@intx/db 0.2.2 → 0.4.0

package/dist/schema/tenants.js

@@ -1,14 +1,24 @@
-import { foreignKey, jsonb, pgTable, text, timestamp, unique, } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+import { foreignKey, jsonb, pgTable, text, timestamp, unique, uniqueIndex, } from "drizzle-orm/pg-core";
 export const tenant = pgTable("tenant", {
     id: text("id").primaryKey(),
     name: text("name").notNull(),
     slug: text("slug").notNull().unique(),
-    domain: text("domain").notNull().unique(),
+    // Unique on `lower(domain)`, not the raw column: an inbound mail `From` is
+    // lowercased when parsed, so a sender address must map to exactly one
+    // tenant. A case-sensitive unique would let case-variant domains coexist and
+    // let a case-variant registration shadow another tenant's senders. The
+    // creation boundary lowercases the domain; this index enforces it for every
+    // write path.
+    domain: text("domain").notNull(),
     parentId: text("parent_id"),
     config: jsonb("config"),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
-}, (t) => [foreignKey({ columns: [t.parentId], foreignColumns: [t.id] })]);
+}, (t) => [
+    foreignKey({ columns: [t.parentId], foreignColumns: [t.id] }),
+    uniqueIndex("tenant_domain_lower_idx").on(sql `lower(${t.domain})`),
+]);
 export const federationTrust = pgTable("federation_trust", {
     id: text("id").primaryKey(),
     tenantId: text("tenant_id")

package/dist/schema/wallets.d.ts

@@ -196,8 +196,8 @@ export declare const transaction: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_id";
+        runId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "run_id";
             tableName: "transaction";
             dataType: "string";
             columnType: "PgText";
@@ -320,7 +320,7 @@ export declare const transaction: import("drizzle-orm/pg-core").PgTableWithColum
             tableName: "transaction";
             dataType: "string";
             columnType: "PgText";
-            data: "failed" | "pending" | "completed";
+            data: "failed" | "completed" | "pending";
             driverParam: string;
             notNull: true;
             hasDefault: true;

package/dist/schema/wallets.js

@@ -1,6 +1,6 @@
 import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { agent } from "./agents.js";
 import { tenant } from "./tenants.js";
+import { workflowRun } from "./workflow-run.js";
 export const wallet = pgTable("wallet", {
     id: text("id").primaryKey(),
     tenantId: text("tenant_id")
@@ -21,7 +21,9 @@ export const transaction = pgTable("transaction", {
     walletId: text("wallet_id")
         .notNull()
         .references(() => wallet.id, { onDelete: "cascade" }),
-    agentId: text("agent_id").references(() => agent.id, {
+    // The run this ledger entry is attributed to. Nullable with set-null on
+    // delete: ledger history must survive deletion of the run it references.
+    runId: text("run_id").references(() => workflowRun.id, {
         onDelete: "set null",
     }),
     direction: text("direction", {

package/dist/schema/{agents.d.ts → workflow-definitions.d.ts}

@@ -1,10 +1,10 @@
-export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "agent";
+export declare const workflowDefinition: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workflow_definition";
     schema: undefined;
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -21,7 +21,7 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         tenantId: import("drizzle-orm/pg-core").PgColumn<{
             name: "tenant_id";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -38,12 +38,12 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         creatorPrincipalId: import("drizzle-orm/pg-core").PgColumn<{
             name: "creator_principal_id";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -53,14 +53,14 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "agent";
+        assetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "asset_id";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -70,9 +70,9 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        description: import("drizzle-orm/pg-core").PgColumn<{
-            name: "description";
-            tableName: "agent";
+        wireHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "wire_hash";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -87,14 +87,14 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        systemPrompt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "system_prompt";
-            tableName: "agent";
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -104,77 +104,26 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        contextConfig: import("drizzle-orm/pg-core").PgColumn<{
-            name: "context_config";
-            tableName: "agent";
-            dataType: "json";
-            columnType: "PgJsonb";
-            data: unknown;
-            driverParam: unknown;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        initialState: import("drizzle-orm/pg-core").PgColumn<{
-            name: "initial_state";
-            tableName: "agent";
-            dataType: "json";
-            columnType: "PgJsonb";
-            data: unknown;
-            driverParam: unknown;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        modelConfig: import("drizzle-orm/pg-core").PgColumn<{
-            name: "model_config";
-            tableName: "agent";
-            dataType: "json";
-            columnType: "PgJsonb";
-            data: unknown;
-            driverParam: unknown;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        capabilities: import("drizzle-orm/pg-core").PgColumn<{
-            name: "capabilities";
-            tableName: "agent";
-            dataType: "json";
-            columnType: "PgJsonb";
-            data: unknown;
-            driverParam: unknown;
+        description: import("drizzle-orm/pg-core").PgColumn<{
+            name: "description";
+            tableName: "workflow_definition";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        credentialRequirements: import("drizzle-orm/pg-core").PgColumn<{
-            name: "credential_requirements";
-            tableName: "agent";
+        grantRequirements: import("drizzle-orm/pg-core").PgColumn<{
+            name: "grant_requirements";
+            tableName: "workflow_definition";
             dataType: "json";
             columnType: "PgJsonb";
             data: unknown;
@@ -191,7 +140,7 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         modelRequirements: import("drizzle-orm/pg-core").PgColumn<{
             name: "model_requirements";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "json";
             columnType: "PgJsonb";
             data: unknown;
@@ -206,26 +155,9 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        toolPackages: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tool_packages";
-            tableName: "agent";
-            dataType: "json";
-            columnType: "PgJsonb";
-            data: unknown;
-            driverParam: unknown;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        grantRequirements: import("drizzle-orm/pg-core").PgColumn<{
-            name: "grant_requirements";
-            tableName: "agent";
+        credentialBindings: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_bindings";
+            tableName: "workflow_definition";
             dataType: "json";
             columnType: "PgJsonb";
             data: unknown;
@@ -242,7 +174,7 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         currentVersion: import("drizzle-orm/pg-core").PgColumn<{
             name: "current_version";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -259,7 +191,7 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         status: import("drizzle-orm/pg-core").PgColumn<{
             name: "status";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "string";
             columnType: "PgText";
             data: "deployed" | "stopped";
@@ -276,7 +208,7 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;
@@ -293,7 +225,7 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {}>;
         updatedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "updated_at";
-            tableName: "agent";
+            tableName: "workflow_definition";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;
@@ -311,13 +243,13 @@ export declare const agent: import("drizzle-orm/pg-core").PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-export declare const agentVersion: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "agent_version";
+export declare const workflowDefinitionVersion: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workflow_definition_version";
     schema: undefined;
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "agent_version";
+            tableName: "workflow_definition_version";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -332,9 +264,9 @@ export declare const agentVersion: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_id";
-            tableName: "agent_version";
+        definitionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "definition_id";
+            tableName: "workflow_definition_version";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -351,7 +283,7 @@ export declare const agentVersion: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {}>;
         version: import("drizzle-orm/pg-core").PgColumn<{
             name: "version";
-            tableName: "agent_version";
+            tableName: "workflow_definition_version";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -368,7 +300,7 @@ export declare const agentVersion: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {}>;
         status: import("drizzle-orm/pg-core").PgColumn<{
             name: "status";
-            tableName: "agent_version";
+            tableName: "workflow_definition_version";
             dataType: "string";
             columnType: "PgText";
             data: "active" | "inactive" | "failed";
@@ -383,9 +315,43 @@ export declare const agentVersion: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        approvedWireHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "approved_wire_hash";
+            tableName: "workflow_definition_version";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        grantSnapshot: import("drizzle-orm/pg-core").PgColumn<{
+            name: "grant_snapshot";
+            tableName: "workflow_definition_version";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
-            tableName: "agent_version";
+            tableName: "workflow_definition_version";
             dataType: "date";
             columnType: "PgTimestamp";
             data: Date;

package/dist/schema/workflow-definitions.js

@@ -0,0 +1,97 @@
+import { index, jsonb, pgTable, text, timestamp, unique, uniqueIndex, } from "drizzle-orm/pg-core";
+import { asset } from "./assets.js";
+import { principal } from "./principals.js";
+import { tenant } from "./tenants.js";
+// workflow_definition is the first-class definition entity for the workflow
+// model: one row per deployable definition, with a version table alongside it.
+//
+// The definition body (system prompt, context/model config, tool packages) is
+// not stored on this row -- it lives in the `workflow`-kind asset the row
+// points at, and the run reads it back from there. `asset_id` is nullable at
+// the schema level, but a runnable definition points at a materialized asset.
+//
+// Identity is selector-keyed on the wire-projection hash, not one definition
+// per asset: a single asset (e.g. a monorepo package) backs many definitions
+// distinguished by the content hash of their wire projection. `wire_hash` is
+// that content handle; the unique index over `(asset_id, wire_hash)` keys
+// identity so definitions sharing an asset but carrying different wire hashes
+// resolve independently. `wire_hash` is nullable so definitions predating this
+// key carry none; Postgres treats those NULLs as distinct.
+export const workflowDefinition = pgTable("workflow_definition", {
+    id: text("id").primaryKey(),
+    tenantId: text("tenant_id")
+        .notNull()
+        .references(() => tenant.id, { onDelete: "cascade" }),
+    // Nullable to match the weaker of the two definition sources: `asset`'s
+    // creator principal is `onDelete: "set null"`, so a workflow asset whose
+    // creator principal was removed carries no creator onto the definition.
+    creatorPrincipalId: text("creator_principal_id").references(() => principal.id),
+    // The asset holding this definition's body. `restrict`: the definition is
+    // the first-class entity, so deleting the asset must not cascade into
+    // deleting it.
+    assetId: text("asset_id").references(() => asset.id, {
+        onDelete: "restrict",
+    }),
+    // Content hash of this definition's wire projection: the selector that
+    // keys identity within an asset. Nullable so definitions predating the
+    // selector-keyed key carry none.
+    wireHash: text("wire_hash"),
+    name: text("name").notNull(),
+    description: text("description"),
+    // Grant requirements manifest, resolved at launch into materialized grants.
+    // Validated as GrantRequirement[] at parse time.
+    grantRequirements: jsonb("grant_requirements"),
+    // Model requirements manifest: the canonical model names + provider
+    // preferences a definition launched as a single interactive run resolves
+    // against the live tenant catalog into credential-bearing inference
+    // sources, fresh each launch. Non-null marks such a definition and gates
+    // the interactive-launch path; null for a definition deployed as a workflow,
+    // which supplies its sources at deploy time. Validated as ModelRequirements
+    // at parse time.
+    modelRequirements: jsonb("model_requirements"),
+    // Credential bindings manifest: maps a tool package's declared credential
+    // handle (package, handle) to a concrete credential resolved fresh at
+    // launch (by locator + provider + name against the tenant walk-up).
+    // Validated as CredentialBinding[] at parse time. A binding is a request
+    // the launch-time grant gate authorizes; it consents to nothing on its own.
+    credentialBindings: jsonb("credential_bindings"),
+    currentVersion: text("current_version").notNull().default("1"),
+    status: text("status", {
+        enum: ["deployed", "stopped"],
+    })
+        .notNull()
+        .default("deployed"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (t) => [
+    index("workflow_definition_tenant_idx").on(t.tenantId, t.createdAt),
+    uniqueIndex("workflow_definition_asset_wire_hash_idx").on(t.assetId, t.wireHash),
+]);
+export const workflowDefinitionVersion = pgTable("workflow_definition_version", {
+    id: text("id").primaryKey(),
+    definitionId: text("definition_id")
+        .notNull()
+        .references(() => workflowDefinition.id, { onDelete: "cascade" }),
+    version: text("version").notNull(),
+    status: text("status", {
+        enum: ["active", "inactive", "failed"],
+    })
+        .notNull()
+        .default("active"),
+    // Hash of the wire bytes approved for this version, recorded at approval
+    // and read back during re-verify to detect drift. Null before approval is
+    // a legitimate state, so the column takes no NOT NULL constraint.
+    approvedWireHash: text("approved_wire_hash"),
+    // Serializable projection of the deploy-time capability walk, recorded
+    // at approval so a run materializes grants from it instead of re-reading
+    // and re-walking a workflow.json blob. Validated as GrantWalkSnapshot at
+    // parse time. Null before approval is a legitimate state, so the column
+    // takes no NOT NULL constraint.
+    grantSnapshot: jsonb("grant_snapshot"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+}, (t) => [
+    // Unique per definition so rollback-by-version resolves to one row. The
+    // mirror source `agent_version` omits this; the fresh table constrains it.
+    unique("workflow_definition_version_definition_version").on(t.definitionId, t.version),
+    index("workflow_definition_version_definition_idx").on(t.definitionId),
+]);