@sanoma-ai/workflows 0.11.12 → 0.11.13

package/drizzle/wakeup/meta/0000_snapshot.json

@@ -0,0 +1,200 @@
+{
+  "id": "8ab4b417-ea98-494f-a151-5ac42f186eb5",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.sanoma_wakeup_accounts": {
+      "name": "sanoma_wakeup_accounts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "sanoma_wakeup_accounts_tokenHash_unique": {
+          "name": "sanoma_wakeup_accounts_tokenHash_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "token_hash"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sanoma_wakeup_instances": {
+      "name": "sanoma_wakeup_instances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "at": {
+          "name": "at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "called_at": {
+          "name": "called_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "next_attempt_at": {
+          "name": "next_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "sanoma_wakeup_instances_at": {
+          "name": "sanoma_wakeup_instances_at",
+          "columns": [
+            {
+              "expression": "at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"sanoma_wakeup_instances\".\"at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sanoma_wakeup_instances_account": {
+          "name": "sanoma_wakeup_instances_account",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sanoma_wakeup_instances_account_id_sanoma_wakeup_accounts_id_fk": {
+          "name": "sanoma_wakeup_instances_account_id_sanoma_wakeup_accounts_id_fk",
+          "tableFrom": "sanoma_wakeup_instances",
+          "tableTo": "sanoma_wakeup_accounts",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "sanoma_wakeup_instances_tokenHash_unique": {
+          "name": "sanoma_wakeup_instances_tokenHash_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "token_hash"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/drizzle/wakeup/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1793827391027,
+      "tag": "0000_tables",
+      "breakpoints": true
+    }
+  ]
+}

package/oxlint.json

@@ -103,7 +103,8 @@
                   "@sanoma-ai/workflows/cloud-identity",
                   "@sanoma-ai/workflows/identity-service",
                   "@sanoma-ai/workflows/kms-secrets",
-                  "@sanoma-ai/workflows/wakeup-service"
+                  "@sanoma-ai/workflows/wakeup-service",
+                  "@sanoma-ai/workflows/db"
                 ],
                 "message": "A workflow must call vendors through ctx, so the policy sees every call: import the connector itself, `@sanoma-ai/connector-<vendor>`."
               }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanoma-ai/workflows",
-  "version": "0.11.12",
+  "version": "0.11.13",
   "description": "Business processes as TypeScript functions, run durably on DBOS",
   "keywords": [
     "approvals",
@@ -22,6 +22,8 @@
     "dist",
     "src",
     "!src/AGENTS.md",
+    "drizzle",
+    "!drizzle/*.config.ts",
     "oxlint.json",
     "README.md",
     "LICENSE",
@@ -86,6 +88,10 @@
       "types": "./dist/kms-secrets.d.ts",
       "default": "./dist/kms-secrets.js"
     },
+    "./db": {
+      "types": "./dist/db/index.d.ts",
+      "default": "./dist/db/index.js"
+    },
     "./identity-service": {
       "types": "./dist/identity-service.d.ts",
       "default": "./dist/identity-service.js"
@@ -106,6 +112,7 @@
     "@google-cloud/kms": "^6.3.0",
     "ai": "7.0.153",
     "crc-32": "^1.2.2",
+    "drizzle-orm": "0.45.4",
     "google-auth-library": "^11.3.2",
     "oxc-parser": "^0.153.0",
     "oxfmt": "^0.72.0",
@@ -115,6 +122,7 @@
   },
   "devDependencies": {
     "@types/pg": "^8.23.1",
+    "drizzle-kit": "0.31.11",
     "msw": "^3.0.3",
     "srvx": "^0.11.22",
     "zod": "^4.6.5"
@@ -129,6 +137,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "clean": "rm -rf dist",
-    "watch": "tsc -p tsconfig.build.json --watch --preserveWatchOutput"
+    "watch": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
+    "generate": "drizzle-kit generate --config drizzle/company.config.ts && drizzle-kit generate --config drizzle/wakeup.config.ts"
   }
 }

package/src/bundled.ts

@@ -12,8 +12,8 @@ export interface RootSnapshot {
   appName: string;
   /** `ResolvedConfig.version`: a hash of the workflows' source, which a bundle's code is not, so a run it queues is its worker's. */
   version: string;
-  /** `ResolvedConfig.changeCode`, for the same reason. */
-  changeCode: string;
+  /** `ResolvedConfig.builtInCodes`, for the same reason. */
+  builtInCodes: Readonly<Record<string, string>>;
   /** `readPolicyFiles`: each `.cedar` file under `policies/` (and an app's), by path from the root. */
   policies: { file: string; text: string }[];
   /** `readPeople`: the people, agents and groups the data files declare, with their problems. */

package/src/chats.ts

@@ -1,6 +1,7 @@
 import type { UIMessage } from "ai";
-import type { Pool } from "pg";
-import { CHAT_MESSAGES_TABLE as MESSAGES, CHATS_TABLE as CHATS } from "./db.ts";
+import { asc, desc, eq, sql } from "drizzle-orm";
+import type { Db } from "./db.ts";
+import { chatMessages, chats } from "./db/company.ts";
 import { SanomaError } from "./errors.ts";
 
 // The operator agent's chats, in the config's database beside the runtime's other tables: one row
@@ -44,70 +45,68 @@ export interface Chats {
   list(person: string): Promise<Chat[]>;
 }
 
-/** A row of the chats' table. */
-interface ChatRow {
-  id: string;
-  person: string;
-  engine: string;
-  draft_id: string | null;
-  title: string;
-  created_at: Date;
-}
-
-const COLUMNS = "id, person, engine, draft_id, title, created_at";
-
-const chatOf = ({ draft_id, created_at, ...row }: ChatRow): Chat => ({
+const chatOf = ({ draftId, createdAt, ...row }: typeof chats.$inferSelect): Chat => ({
   ...row,
-  ...(draft_id === null ? {} : { draftId: draft_id }),
-  createdAt: created_at.getTime(),
+  ...(draftId === null ? {} : { draftId }),
+  createdAt: createdAt.getTime(),
 });
 
-/** The chats' store on the pool `db` gives, the config's database once it is prepared. */
-export function chatStore(db: () => Promise<Pool>): Chats {
+/** The chats' store on the database `db` gives, the config's database once it is prepared. */
+export function chatStore(db: () => Promise<Db>): Chats {
   return {
     async open({ id, person, engine, title }) {
-      const { rows } = await (
+      const opened = await (
         await db()
-      ).query(
-        `INSERT INTO ${CHATS} (id, person, engine, title) VALUES ($1, $2, $3, $4) ON CONFLICT (id) DO NOTHING RETURNING id`,
-        [id, person, engine, title],
-      );
-      if (!rows.length) throw new SanomaError("invalid_input", `Chat ${id} exists already; open it with another id`);
+      )
+        .insert(chats)
+        .values({ id, person, engine, title })
+        .onConflictDoNothing()
+        .returning({ id: chats.id });
+      if (!opened.length) throw new SanomaError("invalid_input", `Chat ${id} exists already; open it with another id`);
     },
     async attach(id, draftId) {
-      await (await db()).query(`UPDATE ${CHATS} SET draft_id = $2 WHERE id = $1`, [id, draftId]);
+      await (await db()).update(chats).set({ draftId }).where(eq(chats.id, id));
     },
     async upsert(id, messages) {
       if (!messages.length) return;
       if (messages.some((m) => !m.id)) throw new SanomaError("invalid_input", "A chat message needs an id");
       // A new message's place is after the chat's last, in the order given.
+      const last = sql`(SELECT coalesce(max(${chatMessages.seq}), 0) FROM ${chatMessages} WHERE ${eq(chatMessages.chatId, id)})`;
       await (
         await db()
-      ).query(
-        `INSERT INTO ${MESSAGES} (chat_id, id, seq, message) ` +
-          `SELECT $1, m.value->>'id', last.seq + m.n, m.value ` +
-          `FROM jsonb_array_elements($2::jsonb) WITH ORDINALITY AS m (value, n), ` +
-          `(SELECT coalesce(max(seq), 0) AS seq FROM ${MESSAGES} WHERE chat_id = $1) AS last ` +
-          "ON CONFLICT (chat_id, id) DO UPDATE SET message = EXCLUDED.message",
-        [id, JSON.stringify(messages)],
-      );
+      )
+        .insert(chatMessages)
+        .values(
+          messages.map((message, n) => ({ chatId: id, id: message.id, seq: sql<number>`${last} + ${n + 1}`, message })),
+        )
+        .onConflictDoUpdate({
+          target: [chatMessages.chatId, chatMessages.id],
+          set: { message: sql`excluded.message` },
+        });
     },
     async load(id) {
-      const { rows } = await (
+      const rows = await (
         await db()
-      ).query<{ message: UIMessage }>(`SELECT message FROM ${MESSAGES} WHERE chat_id = $1 ORDER BY seq, id`, [id]);
+      )
+        .select({ message: chatMessages.message })
+        .from(chatMessages)
+        .where(eq(chatMessages.chatId, id))
+        .orderBy(asc(chatMessages.seq), asc(chatMessages.id));
       return rows.map((row) => row.message);
     },
     async get(id) {
-      const { rows } = await (await db()).query<ChatRow>(`SELECT ${COLUMNS} FROM ${CHATS} WHERE id = $1`, [id]);
-      return rows[0] && chatOf(rows[0]);
+      const [row] = await (await db()).select().from(chats).where(eq(chats.id, id));
+      return row && chatOf(row);
     },
     async list(person) {
-      const { rows } = await (
+      const rows = await (
         await db()
-      ).query<ChatRow>(`SELECT ${COLUMNS} FROM ${CHATS} WHERE person = $1 ORDER BY created_at DESC, id LIMIT 50`, [
-        person,
-      ]);
+      )
+        .select()
+        .from(chats)
+        .where(eq(chats.person, person))
+        .orderBy(desc(chats.createdAt), asc(chats.id))
+        .limit(50);
       return rows.map(chatOf);
     },
   };

package/src/client.ts

@@ -1,3 +1,4 @@
+import type { Pool } from "pg";
 import {
   connectionDriver,
   connectionTargetSchema,
@@ -13,7 +14,8 @@ import { encodeCredentials, decodeCredentials, verifyAuthentication, Authenticat
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { type DBOSClient, Error as DBOSErrors, type WorkflowStatusString } from "@dbos-inc/dbos-sdk";
-import type { Pool } from "pg";
+import { is } from "drizzle-orm";
+import { TransactionRollbackError } from "drizzle-orm/errors";
 import { z } from "zod";
 import {
   APPROVALS_EVENT,
@@ -30,7 +32,7 @@ import { type Tokens, tokenStore } from "./tokens.ts";
 import { collectionsDriver } from "./collection.ts";
 import { type ResolvedConfig, resolveConfig, type SanomaConfig } from "./config.ts";
 import { configuredSecrets } from "./credentials.ts";
-import { dbosClient, lazyPool, type LazyPool } from "./db.ts";
+import { dbosClient, lazyDb, type LazyDb, spendInviteRequest } from "./db.ts";
 import { type CredentialStatus, credentialsOf } from "./env.ts";
 import { type ApprovalState, Principal, type WorkflowDefinition } from "./define.ts";
 import { APPLY_WORKFLOW, type ApplyInput, type ApplyReport } from "./apply.ts";
@@ -263,6 +265,12 @@ export interface ClientOptions {
    * `origin`) and fetches a draft's new commits into. Without one, `remoteEvent` does nothing.
    */
   source?: Source;
+  /**
+   * The version each run it starts is queued for, so only a worker of that code runs it: the app
+   * bundle's (its snapshot's), which is live beside a worker of another version while a deploy
+   * rolls. Without it a run is queued with none, which DBOS gives the app's latest version.
+   */
+  appVersion?: string;
 }
 
 /** Talks to the runtime from another process (the app, a script), through the shared Postgres. */
@@ -273,7 +281,7 @@ export class SanomaClient {
   /** The config's own ledger store, or a Postgres one made for this client, which `close` then closes. */
   private readonly audit: OwnedLedger;
   /** On the config's database, for the runtime's tables (the credentials, the chats): opened on first use. */
-  private readonly pool: LazyPool;
+  private readonly database: LazyDb;
   /** What a direct call's driver reads secrets from, as a worker's live driver does. */
   private readonly storedSecrets: SecretAccess;
   /** The operator agent's chats: their rows and their transcripts, in the config's database. */
@@ -293,10 +301,10 @@ export class SanomaClient {
     this.drivers = drivers;
     this.options = options;
     this.audit = ownedLedger(config);
-    this.pool = lazyPool(config.databaseUrl, "client");
-    this.storedSecrets = configuredSecrets(config.secrets, () => this.db());
-    this.chats = chatStore(() => this.db());
-    this.tokens = tokenStore(() => this.db());
+    this.database = lazyDb(config.databaseUrl, "client");
+    this.storedSecrets = configuredSecrets(config.secrets, () => this.database.db());
+    this.chats = chatStore(() => this.database.db());
+    this.tokens = tokenStore(() => this.database.db());
   }
 
   /**
@@ -321,7 +329,8 @@ export class SanomaClient {
    * Checks the input against the workflow's schema, then queues a run for the worker. The run
    * gets the input as sent, not as the schema parsed it: the worker parses it once, so a schema
    * with a `.transform` or a default sees the caller's value, and `run.started` records it.
-   * `workflow` is a definition, or the name of one in the config's `workflows`.
+   * `workflow` is a definition, or the name of one in the config's `workflows`. The run is queued
+   * for the client's `appVersion` when it has one.
    */
   async start<S extends z.ZodType>(
     workflow: WorkflowDefinition<any, S> | string,
@@ -363,11 +372,11 @@ export class SanomaClient {
     const args: RunArgs = { input, startedBy, ...(sandbox === undefined ? {} : { sandbox }), ...(hold && { hold }) };
     // Kept on the run's status row too, so a listing tells sandbox runs apart without its input,
     // and says whom an agent's run is for (DBOS keeps the principal's id and groups itself); a
-    // change run's code, so a worker on another version with the same takes it over.
+    // built-in run's code, so a worker on another version with the same takes it over.
     const attributes = {
       sandbox,
       onBehalfOf: startedBy.onBehalfOf,
-      changeCode: workflow.name === CHANGE_WORKFLOW ? this.config.changeCode : undefined,
+      builtInCode: this.config.builtInCodes[workflow.name],
     };
     this.options.onWrite?.();
     // An id DBOS has already returns that run, unless it is another workflow's, which DBOS refuses.
@@ -378,6 +387,7 @@ export class SanomaClient {
           workflowName: workflow.name,
           workflowID: runId,
           applicationName: this.config.appName,
+          ...(this.options.appVersion !== undefined && { appVersion: this.options.appVersion }),
           authenticatedUser: startedBy.id,
           authenticatedRoles: startedBy.groups ?? [],
           ...(Object.values(attributes).some((v) => v !== undefined) && { attributes }),
@@ -525,64 +535,63 @@ export class SanomaClient {
     const { dataStore, collections, ledger } = this.config;
     const connectionMutation = op.id.startsWith("sanoma.connection.");
     const transactionStore = connectionMutation
-      ? this.config.connectionPool
+      ? this.config.connectionStore
       : op.vendor === DATA_VENDOR
         ? dataStore
         : undefined;
-    const conn = !ledger && transactionStore ? await (await transactionStore.db()).connect() : undefined;
-    let broken: Error | undefined;
-    try {
-      await conn?.query("BEGIN");
-      // The metadata or collection driver shares the ledger transaction; neither has an env guard.
-      const fn = conn
-        ? (connectionMutation
-            ? connectionDriver(this.config.connections.onDatabase(conn))
-            : collectionsDriver([collections.get(op.resource)!], { db: async () => conn })
-          ).ops[`${op.resource}.${op.name}`]!
-        : call.fn;
-      const at = Date.now();
-      const record = (outcome: { output: unknown } | { error: ErrorInfo }): LedgerRecord => ({
-        v: 1,
-        app: this.config.appName,
-        id: `${runId}:op.called:0`,
-        runId,
-        seq: 0,
-        at,
-        actor,
-        workflow: CALL_WORKFLOW,
-        type: "op.called",
-        op: op.id,
-        effect: op.effect,
-        input: logged,
-        decision,
-        ...(context.connection && { connection: context.connection }),
-        ...outcome,
-        durationMs: Date.now() - at,
-      });
-      let output: unknown;
+    const at = Date.now();
+    const record = (outcome: { output: unknown } | { error: ErrorInfo }): LedgerRecord => ({
+      v: 1,
+      app: this.config.appName,
+      id: `${runId}:op.called:0`,
+      runId,
+      seq: 0,
+      at,
+      actor,
+      workflow: CALL_WORKFLOW,
+      type: "op.called",
+      op: op.id,
+      effect: op.effect,
+      input: logged,
+      decision,
+      ...(context.connection && { connection: context.connection }),
+      ...outcome,
+      durationMs: Date.now() - at,
+    });
+    /** Runs the call through `fn`; a failure is recorded on the store's own connection, outside any transaction. */
+    const output = async (fn: typeof call.fn): Promise<unknown> => {
       try {
-        output = await outputOf(op, () => fn(parsed, context));
+        return await outputOf(op, () => fn(parsed, context));
       } catch (err) {
-        // Recorded on the store's own connection; the transaction is rolled back below.
         await this.audit.store.append(record({ error: errorInfo(err) }));
         throw err;
       }
-      const done = record({ output: recorded(op, output) });
-      if (!conn) {
-        await this.audit.store.append(done);
-        return output;
-      }
-      if (await insertRecord(conn, done)) {
-        await conn.query("COMMIT");
-        return output;
-      }
-      await conn.query("ROLLBACK");
-      return (await this.recordedCall(runId, op.id, logged, context.connection))!.output;
+    };
+    if (ledger || !transactionStore) {
+      const result = await output(call.fn);
+      await this.audit.store.append(record({ output: recorded(op, result) }));
+      return result;
+    }
+    // The write and its record in one transaction: the metadata or collection driver runs on the
+    // transaction's connection (neither has an env guard), and a record another write of the id
+    // was first with rolls the write back, for the recorded output to stand.
+    const store = await transactionStore.db();
+    try {
+      return await store.transaction(async (tx) => {
+        const fn = (
+          connectionMutation
+            ? connectionDriver(this.config.connections.onDatabase(tx))
+            : collectionsDriver([collections.get(op.resource)!], { db: async () => tx })
+        ).ops[`${op.resource}.${op.name}`]!;
+        const result = await output(fn);
+        if (await insertRecord(tx, record({ output: recorded(op, result) }))) return result;
+        tx.rollback();
+      });
     } catch (err) {
-      await conn?.query("ROLLBACK").catch((e: Error) => (broken = e));
-      throw err;
-    } finally {
-      conn?.release(broken);
+      if (!is(err, TransactionRollbackError)) throw err;
+      const first = await this.recordedCall(runId, op.id, logged, context.connection);
+      if (!first) throw err;
+      return first.output;
     }
   }
 
@@ -675,6 +684,14 @@ export class SanomaClient {
     );
   }
 
+  /**
+   * Spends a sealed invite request's `nonce` (`openInvite`), good until `expiresAt`: true the first
+   * time, false when it was spent already, in this process or another.
+   */
+  async spendInviteRequest(nonce: string, expiresAt: Date): Promise<boolean> {
+    return spendInviteRequest(await this.database.db(), nonce, expiresAt);
+  }
+
   /** When each of `people` last signed in to the staff login, and how, by id (`recordSignIn`); one who never did is left out. */
   lastSignIns(people: readonly string[]): Promise<Record<string, { at: number; method: SignInMethod }>> {
     return lastSignIns(this.audit.store, people);
@@ -1479,10 +1496,10 @@ export class SanomaClient {
       this.config.connections.close(),
       this.config.identityProvisioning.close(),
       this.dbos.destroy(),
-      this.pool.close(),
+      this.database.close(),
       this.audit.close(),
       this.config.dataStore?.close(),
-      this.config.connectionPool.close(),
+      this.config.connectionStore.close(),
     ]);
   }
 
@@ -1506,9 +1523,9 @@ export class SanomaClient {
     });
   }
 
-  /** The pool the runtime's tables are read and written with, on the database once it is prepared. */
-  private db(): Promise<Pool> {
-    return this.pool.db();
+  /** The pool the client reads and writes with, once the database is prepared: what a login runs on (`LoginContext.database`). */
+  pool(): Promise<Pool> {
+    return this.database.pool();
   }
 
   /**