@intx/db 0.3.0 → 0.4.0

package/dist/schema/workflow-probe.d.ts

@@ -0,0 +1,358 @@
+import type { WorkflowProbeResultFrame } from "@intx/types/sidecar";
+type WorkflowProbeResult = Omit<WorkflowProbeResultFrame, "type" | "requestId">;
+export type WorkflowProbeStatus = "pending" | "provisioning" | "probing" | "releasing" | "succeeded" | "failed";
+/**
+ * A workflow probe and the temporary provisioned capacity executing it.
+ *
+ * Deployment intent deliberately does not live here. The source and entry are
+ * the probe input; the result is the probe output. The provisioner binding is
+ * retained only so uncertain or abandoned capacity can be destroyed safely.
+ */
+export declare const workflowProbe: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workflow_probe";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        definitionAssetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "definition_asset_id";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        source: import("drizzle-orm/pg-core").PgColumn<{
+            name: "source";
+            tableName: "workflow_probe";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                kind: "registry";
+                registry: string;
+            } | {
+                kind: "asset";
+                assetId: string;
+                package: {
+                    format: "tarball";
+                } | {
+                    format: "source";
+                    commitSha: string;
+                    packageName?: string;
+                };
+            };
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                kind: "registry";
+                registry: string;
+            } | {
+                kind: "asset";
+                assetId: string;
+                package: {
+                    format: "tarball";
+                } | {
+                    format: "source";
+                    commitSha: string;
+                    packageName?: string;
+                };
+            };
+        }>;
+        entry: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entry";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pin: import("drizzle-orm/pg-core").PgColumn<{
+            name: "pin";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: WorkflowProbeStatus;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: WorkflowProbeStatus;
+        }>;
+        provisionerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provisioner_id";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provisionerApiVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provisioner_api_version";
+            tableName: "workflow_probe";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: 1;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: 1;
+        }>;
+        provisionerBindingFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provisioner_binding_fingerprint";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sidecarId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sidecar_id";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        generation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "generation";
+            tableName: "workflow_probe";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        externalRef: import("drizzle-orm/pg-core").PgColumn<{
+            name: "external_ref";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        result: import("drizzle-orm/pg-core").PgColumn<{
+            name: "result";
+            tableName: "workflow_probe";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: WorkflowProbeResult;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: WorkflowProbeResult;
+        }>;
+        failureCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failure_code";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        failureMessage: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failure_message";
+            tableName: "workflow_probe";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workflow_probe";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "workflow_probe";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export {};

package/dist/schema/workflow-probe.js

@@ -0,0 +1,51 @@
+import { sql } from "drizzle-orm";
+import { check, index, integer, jsonb, pgTable, text, timestamp, } from "drizzle-orm/pg-core";
+import { asset } from "./assets.js";
+import { sidecar } from "./sidecar.js";
+import { tenant } from "./tenants.js";
+/**
+ * A workflow probe and the temporary provisioned capacity executing it.
+ *
+ * Deployment intent deliberately does not live here. The source and entry are
+ * the probe input; the result is the probe output. The provisioner binding is
+ * retained only so uncertain or abandoned capacity can be destroyed safely.
+ */
+export const workflowProbe = pgTable("workflow_probe", {
+    id: text("id").primaryKey(),
+    tenantId: text("tenant_id")
+        .notNull()
+        .references(() => tenant.id, { onDelete: "restrict" }),
+    definitionAssetId: text("definition_asset_id")
+        .notNull()
+        .references(() => asset.id, { onDelete: "restrict" }),
+    source: jsonb("source").$type().notNull(),
+    entry: text("entry").notNull(),
+    pin: text("pin"),
+    status: text("status")
+        .$type()
+        .notNull()
+        .default("pending"),
+    provisionerId: text("provisioner_id").notNull(),
+    provisionerApiVersion: integer("provisioner_api_version")
+        .$type()
+        .notNull(),
+    provisionerBindingFingerprint: text("provisioner_binding_fingerprint").notNull(),
+    sidecarId: text("sidecar_id").references(() => sidecar.id, {
+        onDelete: "restrict",
+    }),
+    generation: integer("generation").notNull().default(0),
+    externalRef: text("external_ref"),
+    result: jsonb("result").$type(),
+    failureCode: text("failure_code"),
+    failureMessage: text("failure_message"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (t) => [
+    index("workflow_probe_active_idx")
+        .on(t.createdAt)
+        .where(sql `${t.status} in ('pending', 'provisioning', 'probing', 'releasing')`),
+    index("workflow_probe_sidecar_idx").on(t.sidecarId),
+    check("workflow_probe_status_check", sql `${t.status} in ('pending', 'provisioning', 'probing', 'releasing', 'succeeded', 'failed')`),
+    check("workflow_probe_succeeded_result_check", sql `${t.status} <> 'succeeded' or ${t.result} is not null`),
+    check("workflow_probe_generation_check", sql `${t.generation} >= 0`),
+]);

package/dist/schema/workflow-run-dispatch.d.ts

@@ -81,6 +81,23 @@ export declare const workflowRunDispatch: import("drizzle-orm/pg-core").PgTableW
         }, {}, {
             $type: "signal" | "mail";
         }>;
+        senderAddress: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sender_address";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         rawMessage: import("drizzle-orm/pg-core").PgColumn<{
             name: "raw_message";
             tableName: "workflow_run_dispatch";

package/dist/schema/workflow-run-dispatch.js

@@ -24,6 +24,7 @@ export const workflowRunDispatch = pgTable("workflow_run_dispatch", {
         .$type()
         .notNull()
         .default("mail"),
+    senderAddress: text("sender_address"),
     rawMessage: bytea("raw_message").notNull(),
     stepGrants: jsonb("step_grants").notNull(),
     status: text("status")
@@ -53,4 +54,10 @@ export const workflowRunDispatch = pgTable("workflow_run_dispatch", {
     check("workflow_run_dispatch_acknowledged_generation_check", sql `${t.acknowledgedGeneration} is null or ${t.acknowledgedGeneration} >= 0`),
     check("workflow_run_dispatch_acknowledged_state_check", sql `${t.status} <> 'acknowledged' or ${t.acknowledgedGeneration} is not null`),
     check("workflow_run_dispatch_pending_schedule_check", sql `${t.status} <> 'pending' or ${t.nextAttemptAt} is not null`),
+    // A deliverable mail dispatch must carry the hub-verified sender that
+    // its inbound frame is stamped with; signals have no sender. Terminal
+    // (settled/failed) mail rows are exempt because they are never
+    // re-dispatched and so never reconstruct a frame -- this is what lets a
+    // migration fail legacy in-flight mail in place rather than delete it.
+    check("workflow_run_dispatch_mail_sender_check", sql `${t.kind} <> 'mail' or ${t.status} in ('settled', 'failed') or ${t.senderAddress} is not null`),
 ]);

package/dist/schema/workflow-run.d.ts

@@ -1,3 +1,11 @@
+export type WorkflowRunCredentialRefs = {
+    credentialIds: string[];
+    bindings: {
+        handle: string;
+        credentialId: string;
+        consumer: string;
+    }[];
+};
 export declare const workflowRun: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "workflow_run";
     schema: undefined;
@@ -189,6 +197,25 @@ export declare const workflowRun: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        credentialRefs: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_refs";
+            tableName: "workflow_run";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: WorkflowRunCredentialRefs;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: WorkflowRunCredentialRefs;
+        }>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "workflow_run";

package/dist/schema/workflow-run.js

@@ -71,6 +71,14 @@ export const workflowRun = pgTable("workflow_run", {
     }),
     kernelId: text("kernel_id"),
     modelPreferences: jsonb("model_preferences"),
+    // The non-secret shape of the credential delivery this deployment resolved
+    // at deploy: the credentialIds it references and the tool binding
+    // descriptors. Set on a deployment anchor run; null for runs that carry no
+    // credential delivery. Secrets are NEVER stored here -- only ids and
+    // descriptors -- so the reconnect resync can re-resolve each id's CURRENT
+    // material from the credential table (dropping a revoked or deleted id,
+    // picking up a rotated secret) and reconcile the reconnecting child.
+    credentialRefs: jsonb("credential_refs").$type(),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     // Nullable: a run has no end time until it reaches a terminal state.
     endedAt: timestamp("ended_at"),

package/dist/sender-key-resolver.d.ts

@@ -0,0 +1,91 @@
+import type { DBExecutor } from "./client.js";
+import type { PrincipalKeyStore } from "./principal-key-store.js";
+/**
+ * The durable public key that authenticates a signed mail sender, resolved from
+ * the hub's own storage. `source` records which store the key came from -- a
+ * run sender's key is the sidecar-minted key recorded on the deployment anchor,
+ * a user sender's key is the hub-custodied principal key -- so a consumer can
+ * bucket a resolution without re-parsing the address.
+ */
+export type SenderKeyResolution = {
+    source: "run";
+    publicKey: string;
+} | {
+    source: "user";
+    publicKey: string;
+};
+/**
+ * Resolve the durable public key a signed mail sender must verify against,
+ * unioning the two existing durable-key sources: a run address
+ * (`run_<id>@<domain>`) resolves to the run's `workflow_run.public_key`; any
+ * other address (`<refId>@<domain>`) is treated as a user sender and resolves
+ * to that principal's hub-custodied key.
+ *
+ * Read-only. Returns `null` when the sender has no durable key to resolve -- a
+ * malformed address, an unknown run, a run whose deploy has not been acked yet,
+ * or an address that matches no user principal. A `null` is a legitimate
+ * "unresolvable sender" answer the caller acts on; it is NOT an error.
+ *
+ * Addresses are matched case-insensitively. Inbound `From` addresses are
+ * lowercased when parsed (see `@intx/mime` `extractAddrSpec`), so the address is
+ * normalized here and stored values are compared under `lower(...)`. Tenant
+ * domains are `lower(domain)`-unique (`tenant_domain_lower_idx`), so a
+ * normalized domain matches at most one tenant. A user `refId` is a
+ * case-sensitively-unique betterAuth id that can carry uppercase; lowercasing it
+ * to reconcile with the parser is lossy, so the resolver prefers the exact
+ * (already-lowercase) row and falls back to a case-insensitive match to find a
+ * mixed-case-stored refId. When two principals in one tenant hold case-variant
+ * refIds the case-insensitive match is not unique and no exact row disambiguates
+ * it: the resolver throws rather than silently return one, which would attribute
+ * the sender to the wrong principal.
+ */
+export declare function resolveSenderKey(db: DBExecutor, principalKeyStore: PrincipalKeyStore, address: string): Promise<SenderKeyResolution | null>;
+/**
+ * Resolve the hex-encoded public key to stamp on an outbound mail frame, as a
+ * BEST-EFFORT value that never blocks delivery. Returns the key, or `null` when
+ * the sender has no resolvable key -- OR when resolution FAILS.
+ *
+ * {@link resolveSenderKey} throws on a genuine fault (an ambiguous user address,
+ * or a principal with no active key -- an INTR-164 invariant break). Those
+ * throws must fail loud for {@link auditSenderKeys}, but they must not break
+ * the send path: the frame key is nullable, so a recipient with no co-delivered
+ * key resolves the sender as `unknown`, which its admission policy rejects by
+ * default (a workflow may relax `unknown` to admit).
+ * Coupling delivery to key resolution would let a data-integrity fault strand a
+ * run or drop mail. So a throw here degrades to `null` and is logged at ERROR
+ * with its cause -- a degraded fault, kept distinct from the ordinary
+ * unresolvable-sender `null`, which stays silent.
+ *
+ * The principal key store is real in production (INTR-164 mints every principal
+ * a key), so the throw path is a defensive safety net, not the common case: the
+ * normal outcome is a resolved, populated key.
+ */
+export declare function resolveFrameSenderKey(db: DBExecutor, principalKeyStore: PrincipalKeyStore, address: string): Promise<string | null>;
+/**
+ * The outcome of sweeping every sender that could sign a piece of mail: how many
+ * of each kind were checked, and any whose address did not resolve to a durable
+ * key. An empty `unresolved` is the "no unresolvable signed senders" state a
+ * durable-signature verifier depends on.
+ */
+export type SenderKeyAuditReport = {
+    runsChecked: number;
+    usersChecked: number;
+    unresolved: {
+        address: string;
+        kind: "run" | "user";
+    }[];
+};
+/**
+ * Sweep every mail sender that could sign and confirm each resolves to a durable
+ * public key via {@link resolveSenderKey}. Read-only.
+ *
+ * The senders that can sign are every workflow run that holds a signing key or
+ * is live ("running") and carries a sending address, plus every active user
+ * principal. A never-signed run -- deployed-but-not-yet-acked, or failed or
+ * cancelled before ack (address set, key null) -- is excluded. Any checked
+ * sender that does not resolve is collected in `unresolved`. A keyless user
+ * principal is an INTR-164 invariant break, so `resolveSenderKey` throws and the
+ * sweep fails loudly rather than folding it into `unresolved` -- it is a
+ * different, more serious fault than an unresolvable address.
+ */
+export declare function auditSenderKeys(db: DBExecutor, principalKeyStore: PrincipalKeyStore): Promise<SenderKeyAuditReport>;