@intx/db 0.2.2 → 0.4.0

package/dist/schema/{workflow-deployments.d.ts → principal-keys.d.ts}

@@ -1,11 +1,10 @@
-export type WorkflowDeploymentStatus = "deployed" | "error";
-export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "workflow_deployment";
+export declare const principalKey: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "principal_key";
     schema: undefined;
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "workflow_deployment";
+            tableName: "principal_key";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -20,9 +19,9 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        tenantId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tenant_id";
-            tableName: "workflow_deployment";
+        principalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_id";
+            tableName: "principal_key";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -37,9 +36,9 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        definitionAssetId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "definition_asset_id";
-            tableName: "workflow_deployment";
+        publicKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "public_key";
+            tableName: "principal_key";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -54,9 +53,9 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        address: import("drizzle-orm/pg-core").PgColumn<{
-            name: "address";
-            tableName: "workflow_deployment";
+        privateKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "private_key";
+            tableName: "principal_key";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -71,45 +70,43 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        publicKey: import("drizzle-orm/pg-core").PgColumn<{
-            name: "public_key";
-            tableName: "workflow_deployment";
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "principal_key";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "active" | "retired";
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["active", "retired"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        status: import("drizzle-orm/pg-core").PgColumn<{
-            name: "status";
-            tableName: "workflow_deployment";
-            dataType: "string";
-            columnType: "PgText";
-            data: WorkflowDeploymentStatus;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "principal_key";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
             driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            $type: WorkflowDeploymentStatus;
-        }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "workflow_deployment";
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "principal_key";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;

package/dist/schema/principal-keys.js

@@ -0,0 +1,28 @@
+import { sql } from "drizzle-orm";
+import { pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+import { principal } from "./principals.js";
+// A principal's Ed25519 signing key. `public_key` is the hex-encoded 32-byte
+// public point; `private_key` holds the hex-encoded 32-byte seed sealed by the
+// credential cipher (`enc:aead:...` ciphertext), so the seed is never at rest in
+// plaintext under a configured key. The hub custodies the private key: a
+// signature attributes an action to the principal, but is not non-repudiable
+// against the hub operator. See docs/AUTH.md.
+//
+// The `status` axis expresses the one-active-key-per-principal invariant, which
+// the partial unique index below enforces at the database. No path retires a
+// key; every key a principal holds today is "active".
+export const principalKey = pgTable("principal_key", {
+    id: text("id").primaryKey(),
+    principalId: text("principal_id")
+        .notNull()
+        .references(() => principal.id, { onDelete: "cascade" }),
+    publicKey: text("public_key").notNull().unique(),
+    privateKey: text("private_key").notNull(),
+    status: text("status", { enum: ["active", "retired"] }).notNull(),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (t) => [
+    uniqueIndex("principal_key_one_active")
+        .on(t.principalId)
+        .where(sql `${t.status} = 'active'`),
+]);

package/dist/schema/principals.d.ts

@@ -42,14 +42,14 @@ export declare const principal: import("drizzle-orm/pg-core").PgTableWithColumns
             tableName: "principal";
             dataType: "string";
             columnType: "PgText";
-            data: "user" | "agent";
+            data: "user" | "agent" | "workflow";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "agent"];
+            enumValues: ["user", "agent", "workflow"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/schema/principals.js

@@ -6,7 +6,7 @@ export const principal = pgTable("principal", {
     tenantId: text("tenant_id")
         .notNull()
         .references(() => tenant.id, { onDelete: "cascade" }),
-    kind: text("kind", { enum: ["user", "agent"] }).notNull(),
+    kind: text("kind", { enum: ["user", "agent", "workflow"] }).notNull(),
     refId: text("ref_id").notNull(),
     status: text("status", {
         enum: ["active", "suspended", "invited", "deactivated"],
@@ -14,8 +14,10 @@ export const principal = pgTable("principal", {
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
 }, (t) => [unique().on(t.tenantId, t.kind, t.refId)]);
-// The refId on a user principal points to the auth user table.
-// We don't add a FK constraint because refId also points to agent.id
-// when kind='agent', and Postgres can't do conditional FKs.
-// The application layer enforces referential integrity.
+// refId is polymorphic on kind: the auth user for kind='user', and either a
+// workflow_run or a workflow_definition for kind='workflow'. A `kind='agent'`
+// principal is a legacy survivor of the fold -- its refId named an
+// `agent_instance` row, a table now dropped, so it dangles and is inert.
+// Postgres can't express a conditional FK across those targets, so there is no
+// FK constraint here and the application layer enforces referential integrity.
 export { user };

package/dist/schema/providers.d.ts

@@ -70,6 +70,23 @@ export declare const provider: import("drizzle-orm/pg-core").PgTableWithColumns<
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        apiBaseUrl: import("drizzle-orm/pg-core").PgColumn<{
+            name: "api_base_url";
+            tableName: "provider";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         authorizationUrl: import("drizzle-orm/pg-core").PgColumn<{
             name: "authorization_url";
             tableName: "provider";

package/dist/schema/providers.js

@@ -7,6 +7,11 @@ export const provider = pgTable("provider", {
         .references(() => tenant.id, { onDelete: "cascade" }),
     name: text("name").notNull(),
     plugin: text("plugin").notNull(),
+    // The API origin a credential from this provider authenticates to (e.g.
+    // https://api.github.com). Optional: OAuth-login-only providers have no
+    // API-call origin. A provider that backs an origin-pinned credential must
+    // have one, enforced loudly at credential-shape time, not by the schema.
+    apiBaseUrl: text("api_base_url"),
     authorizationUrl: text("authorization_url"),
     tokenUrl: text("token_url"),
     userInfoUrl: text("user_info_url"),

package/dist/schema/roles.js

@@ -1,7 +1,7 @@
 import { boolean, pgTable, primaryKey, text, timestamp, } from "drizzle-orm/pg-core";
-import { agent } from "./agents.js";
 import { principal } from "./principals.js";
 import { tenant } from "./tenants.js";
+import { workflowDefinition } from "./workflow-definitions.js";
 export const role = pgTable("role", {
     id: text("id").primaryKey(),
     tenantId: text("tenant_id")
@@ -14,9 +14,13 @@ export const role = pgTable("role", {
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });
 export const agentRole = pgTable("agent_role", {
+    // Retains the agent_id column name, but its values are workflow_definition
+    // ids: every agent was folded to exactly one definition, and role
+    // assignments follow the definition so they survived the agent table's
+    // retirement.
     agentId: text("agent_id")
         .notNull()
-        .references(() => agent.id, { onDelete: "cascade" }),
+        .references(() => workflowDefinition.id, { onDelete: "cascade" }),
     roleId: text("role_id")
         .notNull()
         .references(() => role.id, { onDelete: "cascade" }),

package/dist/schema/session-assets.d.ts

@@ -1,9 +1,8 @@
-export type SessionAssetSource = "direct" | "resolved";
 export declare const sessionAsset: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "session_asset";
     schema: undefined;
     columns: {
-        instanceId: import("drizzle-orm/pg-core").PgColumn<{
+        runId: import("drizzle-orm/pg-core").PgColumn<{
             name: "instance_id";
             tableName: "session_asset";
             dataType: "string";
@@ -20,23 +19,6 @@ export declare const sessionAsset: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        agentAssetId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_asset_id";
-            tableName: "session_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
         mountPath: import("drizzle-orm/pg-core").PgColumn<{
             name: "mount_path";
             tableName: "session_asset";
@@ -88,25 +70,6 @@ export declare const sessionAsset: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        source: import("drizzle-orm/pg-core").PgColumn<{
-            name: "source";
-            tableName: "session_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: SessionAssetSource;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            $type: SessionAssetSource;
-        }>;
         materializedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "materialized_at";
             tableName: "session_asset";

package/dist/schema/session-assets.js

@@ -1,28 +1,45 @@
 import { index, pgTable, primaryKey, text, timestamp, } from "drizzle-orm/pg-core";
-import { agentAsset } from "./agent-assets.js";
-import { agentInstance } from "./instances.js";
+// session_asset rows record per-(instance, materialization) pack
+// acknowledgments. A row exists iff the sidecar acked the pack that
+// materialized that asset for that instance. The launchSession flow
+// inserts each row before the corresponding pack send and rolls it
+// back if that single send fails, so each row reflects an ack the
+// hub actually observed for that attachment.
+//
+// Assets reach an instance through the tool-package resolver: it picks
+// package-registry assets out of the tenant-visible set, and the launch
+// fan-out materializes each into the workspace. The mount path and
+// source commit are recorded so forensic queries can trace every
+// materialization.
+//
+// Caveat on multi-attachment partial-success: when a session attaches
+// N assets and the fan-out succeeds for attachments 1..k-1 and fails
+// on attachment k, only attachment k's row is rolled back. Rows
+// 1..k-1 stay. The session as a whole never reached the running
+// state -- attemptCleanup runs sendAgentUndeploy -- but the per-
+// attachment ack invariant holds for the rows that remain.
+// Forensics queries should treat row count as "packs the sidecar
+// acked during this instance's launch," not "sessions that ran with
+// assets." Pairing with agent_instance.status (or its successor
+// session-lifecycle signal) is necessary to distinguish a row left
+// behind by a partially-successful failed launch from one belonging
+// to a fully-running session.
 export const sessionAsset = pgTable("session_asset", {
-    instanceId: text("instance_id")
-        .notNull()
-        .references(() => agentInstance.id, { onDelete: "cascade" }),
-    // Nullable: resolver-derived materializations have no per-agent
-    // attachment row. Direct attachments carry the agent_asset id.
-    agentAssetId: text("agent_asset_id").references(() => agentAsset.id, {
-        onDelete: "cascade",
-    }),
+    // The endpoint this materialization is for: a legacy agent_instance id or a
+    // folded workflow_run id, from one shared id space. A polymorphic reference
+    // carrying no foreign key (mirroring inference_turn.runId); the launch
+    // layer owns the invariant. NOT NULL -- a materialization always names its
+    // endpoint -- and part of the (instance_id, mount_path) key. A folded run
+    // writes its run id here, which the dropped agent_instance FK would reject.
+    runId: text("instance_id").notNull(),
     mountPath: text("mount_path").notNull(),
     assetPackSha: text("asset_pack_sha").notNull(),
     sourceCommitSha: text("source_commit_sha").notNull(),
-    source: text("source").$type().notNull(),
     materializedAt: timestamp("materialized_at").notNull().defaultNow(),
 }, (t) => [
-    // (instanceId, mountPath) is the natural key: every materialized
-    // asset lands at a distinct mount path inside one instance, so
-    // this pair uniquely identifies a row regardless of whether the
-    // pack came from a direct attachment or a resolver-derived
-    // package-registry pick. Pre-split the PK was (instanceId,
-    // agentAssetId), but that column is now nullable for the
-    // resolved-source rows and Postgres rejects nullable PK columns.
-    primaryKey({ columns: [t.instanceId, t.mountPath] }),
+    // (runId, mountPath) is the natural key: every materialized
+    // asset lands at a distinct mount path inside one run, so this
+    // pair uniquely identifies a row.
+    primaryKey({ columns: [t.runId, t.mountPath] }),
     index("session_asset_pack_sha_idx").on(t.assetPackSha),
 ]);

package/dist/schema/sessions.js

@@ -1,15 +1,20 @@
 import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { agent } from "./agents.js";
 import { principal } from "./principals.js";
 import { tenant } from "./tenants.js";
+import { workflowDefinition } from "./workflow-definitions.js";
 export const agentSession = pgTable("agent_session", {
     id: text("id").primaryKey(),
     tenantId: text("tenant_id")
         .notNull()
         .references(() => tenant.id, { onDelete: "cascade" }),
+    // Retains the agent_id column name, but its values are workflow_definition
+    // ids: a launched session is keyed to the folded definition it runs, so it
+    // survives the agent table's retirement. ON DELETE restrict -- session
+    // history is an audit record, so a definition with live sessions cannot be
+    // dropped out from under them.
     agentId: text("agent_id")
         .notNull()
-        .references(() => agent.id, { onDelete: "cascade" }),
+        .references(() => workflowDefinition.id, { onDelete: "restrict" }),
     principalId: text("principal_id")
         .notNull()
         .references(() => principal.id),