@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/store/postgres/store.js

@@ -32,7 +32,7 @@
  *    head).
  * 2. A transaction that touches several sessions locks them in ascending id
  *    order, with `lockSessions` (`./locking.ts`), before writing any of them.
- * 3. A sandbox resource's row (`sandboxResource(id, { lock: true })`, which orders its
+ * 3. An Environment's row (`environment(id, { lock: true })`, which orders its
  *    lifecycle stream) is locked after every session row the transaction locks, never
  *    before one.
  *
@@ -50,15 +50,15 @@
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
-import { and, count, eq, getTableColumns, gte, gt, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
-import { appendEvent, appendSandboxEvent } from "../../record/index.js";
+import { and, count, desc, eq, getTableColumns, gte, gt, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
+import { appendEnvironmentEvent, appendEvent } from "../../record/index.js";
 import { OwnershipLostError, PrincipalRoleConflict } from "../ownership.js";
 import { followControlSignals, pruneSignals, writeSignal } from "./control.js";
 import { database, driverError } from "./db.js";
 import { expectedSchemaVersion, readSchemaVersion } from "./migrate.js";
 import { createPostgresRecordReader } from "./record.js";
-import { postgresRecordWriter, postgresSandboxRecordWriter } from "./record-writer.js";
-import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, sandboxEvents, sandboxResources, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, sandboxSignals, wakes, } from "./schema.js";
+import { postgresEnvironmentRecordWriter, postgresRecordWriter } from "./record-writer.js";
+import { artifacts, artifactVersions, artifactContent, definitionFiles, definitionFileUses, commands, definitions, effects, links, modelBudgets, modelUsage, principals, sandboxes, environmentEvents, environments, environmentManifests, sessionEvents, sessionLogHeads, sessions, toJson, toolCrossings, signingKeys, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, sandboxSignals, wakes, } from "./schema.js";
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
@@ -240,14 +240,25 @@ function ownership(row) {
         ownerExpiresAt: row.ownerExpiresAt?.toISOString() ?? null,
     };
 }
-function sandboxResourceOf(row) {
+function environmentOf(row) {
     return {
         id: row.id,
         kind: row.kind,
-        spec: row.spec,
         labels: row.labels,
+        recipe: row.recipe,
+        applied: row.applied,
+        version: row.version,
+        appliedVersion: row.appliedVersion,
+        ...(row.ownerUserId !== null ? { ownerUserId: row.ownerUserId } : {}),
+        lastUsedAt: new Date(row.lastUsedAt).toISOString(),
         createdAt: row.createdAt,
         updatedAt: row.updatedAt,
+        ...(row.diskOp ? { diskOp: row.diskOp } : {}),
+        ...(row.diskSeed ? { diskSeed: row.diskSeed } : {}),
+        ...(row.manifestName !== null ? { manifestName: row.manifestName } : {}),
+        ...(row.manifestVersion !== null ? { manifestVersion: row.manifestVersion } : {}),
+        ...(row.manifestHash !== null ? { manifestHash: row.manifestHash } : {}),
+        ...(row.forkedFrom ? { forkedFrom: row.forkedFrom } : {}),
         ...(row.k8sName !== null && row.desired !== null && row.observed !== null
             ? {
                 pod: {
@@ -260,16 +271,26 @@ function sandboxResourceOf(row) {
                     ...(row.joinTokenHash !== null ? { joinTokenHash: row.joinTokenHash } : {}),
                     rev: row.rev,
                     ...(row.lastActiveAt ? { lastActiveAt: row.lastActiveAt.toISOString() } : {}),
-                    ...(row.expiresAt ? { expiresAt: row.expiresAt.toISOString() } : {}),
                     ...(row.startedAt ? { startedAt: row.startedAt.toISOString() } : {}),
                     ...(row.reason !== null ? { reason: row.reason } : {}),
                     ...(row.retiring !== null ? { retiring: row.retiring } : {}),
                     ...(row.volumeId !== null ? { volumeId: row.volumeId } : {}),
+                    ...(row.imageDigest !== null ? { imageDigest: row.imageDigest } : {}),
                 },
             }
             : {}),
     };
 }
+function environmentManifestOf(row) {
+    return {
+        name: row.name,
+        version: row.version,
+        body: row.body,
+        hash: row.hash,
+        savedBy: row.savedBy,
+        createdAt: row.createdAt,
+    };
+}
 /** A pod patch as column values: ISO times become dates, `null` clears. */
 function podColumns(patch) {
     const date = (value) => value === undefined ? undefined : value === null ? null : new Date(value);
@@ -283,11 +304,11 @@ function podColumns(patch) {
         joinTokenHash: patch.joinTokenHash,
         rev: patch.rev,
         lastActiveAt: date(patch.lastActiveAt),
-        expiresAt: date(patch.expiresAt),
         startedAt: date(patch.startedAt),
         reason: patch.reason,
         retiring: patch.retiring,
         volumeId: patch.volumeId,
+        imageDigest: patch.imageDigest,
     };
     return Object.fromEntries(Object.entries(columns).filter(([, value]) => value !== undefined));
 }
@@ -389,7 +410,7 @@ class PostgresTx {
         const [row] = await this.sessions().where(eq(sessions.id, id)).for("update");
         return row && storedSession(row);
     }
-    async event(sessionId, turnId, type, payload) {
+    async event(sessionId, turnId, type, payload, writer) {
         this.check();
         const db = this.db;
         // The session row lock orders the session's events; the log head allocates under it.
@@ -408,6 +429,7 @@ class PostgresTx {
             time: this.now(),
             type,
             payload,
+            ...(writer ? { writer } : {}),
         });
         this.events.push(event);
         this.generations.push(generation);
@@ -612,88 +634,151 @@ class PostgresTx {
         this.check();
         return this.bodies(sandboxes);
     }
-    // --- sandbox resources ---------------------------------------------------
-    async sandboxResource(id, options = {}) {
+    // --- Environments ----------------------------------------------------------
+    async environment(id, options = {}) {
         this.check();
-        const query = this.db.select().from(sandboxResources).where(eq(sandboxResources.id, id));
+        const query = this.db.select().from(environments).where(eq(environments.id, id));
         const [row] = options.lock ? await query.for("update") : await query;
-        return row && sandboxResourceOf(row);
+        return row && environmentOf(row);
     }
-    async createSandboxResource(row, limit) {
+    async createEnvironment(row, limit) {
         this.check();
         // Every create takes this lock, so two never both see room for one more.
-        await this.db.execute(sql `SELECT pg_advisory_xact_lock(hashtext('nylorun.sandbox_resources'))`);
+        await this.db.execute(sql `SELECT pg_advisory_xact_lock(hashtext('nylorun.environments'))`);
         const [found] = await this.db
-            .select({ id: sandboxResources.id })
-            .from(sandboxResources)
-            .where(eq(sandboxResources.id, row.id));
+            .select({ id: environments.id })
+            .from(environments)
+            .where(eq(environments.id, row.id));
         if (found)
             return "exists";
-        const [counted] = await this.db.select({ n: count() }).from(sandboxResources);
+        const [counted] = await this.db.select({ n: count() }).from(environments);
         if ((counted?.n ?? 0) >= limit)
             return "limit";
-        const { pod, ...resource } = row;
-        await this.db.insert(sandboxResources).values({ ...resource, ...(pod ? podColumns(pod) : {}) });
+        const { pod, ownerUserId, diskOp, diskSeed, manifestName, manifestVersion, manifestHash, forkedFrom, ...environment } = row;
+        await this.db.insert(environments).values({
+            ...environment,
+            ownerUserId: ownerUserId ?? null,
+            diskOp: diskOp ?? null,
+            diskSeed: diskSeed ?? null,
+            manifestName: manifestName ?? null,
+            manifestVersion: manifestVersion ?? null,
+            manifestHash: manifestHash ?? null,
+            forkedFrom: forkedFrom ?? null,
+            ...(pod ? podColumns(pod) : {}),
+        });
         return "created";
     }
-    async updateSandboxSpec(id, spec, updatedAt) {
-        this.check();
-        await this.db.update(sandboxResources).set({ spec, updatedAt }).where(eq(sandboxResources.id, id));
-    }
-    async updateSandboxPod(id, patch, updatedAt) {
+    async updateEnvironment(id, patch, updatedAt) {
         this.check();
+        const columns = Object.fromEntries(Object.entries(patch).filter(([, value]) => value !== undefined));
         await this.db
-            .update(sandboxResources)
-            .set({ ...podColumns(patch), updatedAt })
-            .where(eq(sandboxResources.id, id));
+            .update(environments)
+            .set({ ...columns, updatedAt })
+            .where(eq(environments.id, id));
     }
-    async updateSandboxLabels(id, labels, updatedAt) {
+    async updateEnvironmentPod(id, patch, updatedAt) {
         this.check();
         await this.db
-            .update(sandboxResources)
-            .set({ labels, updatedAt })
-            .where(eq(sandboxResources.id, id));
+            .update(environments)
+            .set({ ...podColumns(patch), updatedAt })
+            .where(eq(environments.id, id));
     }
-    async deleteSandboxResource(id) {
+    async deleteEnvironment(id) {
         this.check();
-        await this.db.delete(sandboxResources).where(eq(sandboxResources.id, id));
+        // Its vault and credentials go with it (ON DELETE CASCADE).
+        await this.db.delete(environments).where(eq(environments.id, id));
     }
-    async listSandboxResources(filter = {}) {
+    async listEnvironments(filter = {}) {
         this.check();
         const labels = filter.labels;
         const rows = await this.db
             .select()
-            .from(sandboxResources)
+            .from(environments)
             .where(labels === undefined || Object.keys(labels).length === 0
             ? undefined
-            : sql `nylorun.doc(${sandboxResources.labels}) @> ${toJson(labels)}::jsonb`)
-            .orderBy(sandboxResources.id);
-        return rows.map(sandboxResourceOf);
+            : sql `nylorun.doc(${environments.labels}) @> ${toJson(labels)}::jsonb`)
+            .orderBy(environments.id);
+        return rows.map(environmentOf);
+    }
+    // --- Environment manifests (D63) -----------------------------------------------
+    async lockEnvironmentManifest(name) {
+        this.check();
+        await this.db.execute(sql `SELECT pg_advisory_xact_lock(hashtext(${`nylorun.environment_manifests:${name}`}))`);
+    }
+    async environmentManifest(name, version) {
+        this.check();
+        const [row] = await this.db
+            .select()
+            .from(environmentManifests)
+            .where(version === undefined
+            ? eq(environmentManifests.name, name)
+            : and(eq(environmentManifests.name, name), eq(environmentManifests.version, version)))
+            .orderBy(desc(environmentManifests.version))
+            .limit(1);
+        return row && environmentManifestOf(row);
+    }
+    async insertEnvironmentManifest(row) {
+        this.check();
+        await this.db.insert(environmentManifests).values(row);
     }
-    async sessionsOnSandbox(sandboxId) {
+    async listEnvironmentManifests() {
+        this.check();
+        const rows = await this.db
+            .selectDistinctOn([environmentManifests.name])
+            .from(environmentManifests)
+            .orderBy(environmentManifests.name, desc(environmentManifests.version));
+        return rows.map(environmentManifestOf);
+    }
+    async environmentManifestVersions(name) {
+        this.check();
+        const rows = await this.db
+            .select()
+            .from(environmentManifests)
+            .where(eq(environmentManifests.name, name))
+            .orderBy(desc(environmentManifests.version));
+        return rows.map(environmentManifestOf);
+    }
+    async deleteEnvironmentManifest(name) {
+        this.check();
+        const deleted = await this.db
+            .delete(environmentManifests)
+            .where(eq(environmentManifests.name, name))
+            .returning({ version: environmentManifests.version });
+        return deleted.length;
+    }
+    async environmentsOfManifest(name) {
+        this.check();
+        const rows = await this.db
+            .select({ version: environments.manifestVersion, n: count() })
+            .from(environments)
+            .where(eq(environments.manifestName, name))
+            .groupBy(environments.manifestVersion);
+        return new Map(rows.filter((row) => row.version !== null).map((row) => [row.version, row.n]));
+    }
+    async sessionsOnEnvironment(environmentId) {
         this.check();
         const rows = await this.sessions()
-            .where(eq(sessions.sandboxId, sandboxId))
+            .where(eq(sessions.environmentId, environmentId))
             .orderBy(sessions.id);
         return rows.map((row) => storedSession(row));
     }
-    async sandboxEvent(sandboxId, type, payload) {
+    async environmentEvent(environmentId, type, payload) {
         this.check();
-        return appendSandboxEvent(postgresSandboxRecordWriter(this.db), {
+        return appendEnvironmentEvent(postgresEnvironmentRecordWriter(this.db), {
             tenantId: this.tenantId,
-            sandboxId,
+            environmentId,
             time: this.now(),
             type,
             payload,
         });
     }
-    async sandboxEvents(sandboxId, options = {}) {
+    async environmentEvents(environmentId, options = {}) {
         this.check();
         const rows = await this.db
-            .select({ body: sandboxEvents.body })
-            .from(sandboxEvents)
-            .where(and(eq(sandboxEvents.sandboxId, sandboxId), options.fromSeq === undefined ? undefined : gte(sandboxEvents.seq, options.fromSeq)))
-            .orderBy(sandboxEvents.seq)
+            .select({ body: environmentEvents.body })
+            .from(environmentEvents)
+            .where(and(eq(environmentEvents.environmentId, environmentId), options.fromSeq === undefined ? undefined : gte(environmentEvents.seq, options.fromSeq), options.types === undefined ? undefined : inArray(environmentEvents.type, [...options.types]), options.since === undefined ? undefined : gte(environmentEvents.committedAt, options.since), options.until === undefined ? undefined : lt(environmentEvents.committedAt, options.until)))
+            .orderBy(environmentEvents.seq)
             .limit(options.limit ?? 1000);
         return rows.map((row) => row.body);
     }
@@ -831,21 +916,13 @@ class PostgresTx {
         const [row] = await this.db.select().from(vaults).where(eq(vaults.id, id));
         return row;
     }
-    async vaultsByOwner(ownerUserId) {
-        this.check();
-        return this.db
-            .select()
-            .from(vaults)
-            .where(and(eq(vaults.ownerUserId, ownerUserId), eq(vaults.scope, "user")))
-            .orderBy(vaults.createdAt, vaults.id);
-    }
-    async installationVaults() {
+    async vaultOfEnvironment(environmentId) {
         this.check();
-        return this.db
+        const [row] = await this.db
             .select()
             .from(vaults)
-            .where(eq(vaults.scope, "installation"))
-            .orderBy(vaults.createdAt, vaults.id);
+            .where(eq(vaults.environmentId, environmentId));
+        return row;
     }
     async updateVaultMetadata(id, metadataJson) {
         this.check();
@@ -868,6 +945,14 @@ class PostgresTx {
             .where(eq(vaultCredentials.id, id));
         return row;
     }
+    async credentialByName(vaultId, name) {
+        this.check();
+        const [row] = await this.db
+            .select()
+            .from(vaultCredentials)
+            .where(and(eq(vaultCredentials.vaultId, vaultId), eq(vaultCredentials.name, name)));
+        return row;
+    }
     async credentialsForVault(vaultId, filter = {}) {
         this.check();
         return this.db
@@ -976,6 +1061,16 @@ class PostgresTx {
             .returning();
         return inserted;
     }
+    async modelUsageOf(effectKey) {
+        this.check();
+        const [row] = await this.db
+            .select()
+            .from(modelUsage)
+            .where(and(eq(modelUsage.effectKey, effectKey), eq(modelUsage.duplicate, false)))
+            .orderBy(modelUsage.createdAt, modelUsage.id)
+            .limit(1);
+        return row;
+    }
     async modelUsageTotals(query) {
         this.check();
         const [row] = await this.db
@@ -1016,6 +1111,15 @@ class PostgresTx {
             .returning({ key: toolCrossings.key });
         return inserted.length === 1;
     }
+    async restartToolCrossing(row) {
+        this.check();
+        const restarted = await this.db
+            .update(toolCrossings)
+            .set({ startedAt: row.startedAt })
+            .where(and(eq(toolCrossings.key, row.key), eq(toolCrossings.hash, row.hash), isNull(toolCrossings.settledAt)))
+            .returning({ key: toolCrossings.key });
+        return restarted.length === 1;
+    }
     async settleToolCrossing(key, answer, settledAt) {
         this.check();
         await this.db
@@ -1038,6 +1142,12 @@ class PostgresTx {
         const [row] = options.lock ? await query.for("update") : await query;
         return row;
     }
+    async diskArtifact(environmentId, options = {}) {
+        this.check();
+        const query = this.db.select().from(artifacts).where(eq(artifacts.environmentId, environmentId));
+        const [row] = options.lock ? await query.for("update") : await query;
+        return row;
+    }
     async listArtifacts(filter = {}) {
         this.check();
         return this.db
@@ -1088,6 +1198,24 @@ class PostgresTx {
         await this.db.delete(artifacts).where(eq(artifacts.id, id));
         return deleted.map((row) => row.blobKey);
     }
+    async deleteArtifactVersion(artifactId, version) {
+        this.check();
+        const [deleted] = await this.db
+            .delete(artifactVersions)
+            .where(and(eq(artifactVersions.artifactId, artifactId), eq(artifactVersions.version, version)))
+            .returning({ blobKey: artifactVersions.blobKey });
+        if (!deleted)
+            return undefined;
+        const [left] = await this.db
+            .select({ latest: sql `max(${artifactVersions.version})` })
+            .from(artifactVersions)
+            .where(eq(artifactVersions.artifactId, artifactId));
+        await this.db
+            .update(artifacts)
+            .set({ latestVersion: Number(left?.latest ?? 0), updatedAt: new Date().toISOString() })
+            .where(eq(artifacts.id, artifactId));
+        return deleted.blobKey;
+    }
     async lockArtifactQuota() {
         this.check();
         await this.db.execute(sql `SELECT pg_advisory_xact_lock(hashtext('nylorun.artifacts'))`);
@@ -1228,10 +1356,11 @@ class PostgresTx {
                 basinGeneration: sql `${tenant.basinGeneration} + 1`,
             });
         }
-        if (scope === "sandboxes" || scope === "all") {
+        if (scope === "environments" || scope === "all") {
             await db.delete(sandboxes);
-            await db.delete(sandboxResources);
-            await db.delete(sandboxEvents);
+            // Their vaults and credentials go with them (ON DELETE CASCADE).
+            await db.delete(environments);
+            await db.delete(environmentEvents);
             await db.delete(sandboxSignals);
         }
         if (scope === "all") {
@@ -1241,7 +1370,6 @@ class PostgresTx {
             await db.delete(modelUsage);
             await db.delete(modelBudgets);
             await db.delete(artifacts);
-            await db.delete(vaults).where(ne(vaults.scope, "host"));
         }
     }
 }