@sanoma-ai/workflows 0.11.12 → 0.11.14

package/src/run-status.ts

@@ -1,5 +1,7 @@
 import type { WorkflowStatusString } from "@dbos-inc/dbos-sdk";
+import { and, eq } from "drizzle-orm";
 import type { Db } from "./db.ts";
+import { workflowStatus } from "./db/dbos.ts";
 
 /** Metadata only: never read a run's inputs, outputs, error or authentication data. */
 export type RunObservation = {
@@ -24,15 +26,14 @@ export const inspectRun =
   (database: () => Promise<Db>, appName: string): InspectRun =>
   async (runId) => {
     const db = await database();
-    const { rows } = await db.query<{ name: string; status: string }>(
-      "SELECT name,status FROM dbos.workflow_status WHERE workflow_uuid=$1 AND application_name=$2",
-      [runId, appName],
-    );
-    const row = rows[0];
+    const [row] = await db
+      .select({ name: workflowStatus.name, status: workflowStatus.status })
+      .from(workflowStatus)
+      .where(and(eq(workflowStatus.workflowUuid, runId), eq(workflowStatus.applicationName, appName)));
     if (!row) return { runId, status: "missing" };
     return {
       runId,
-      workflow: row.name,
+      ...(row.name !== null && { workflow: row.name }),
       status: Object.hasOwn(statuses, row.status) ? statuses[row.status as WorkflowStatusString] : "active",
     };
   };

package/src/schedules.ts

@@ -2,7 +2,9 @@ import { DBOS, type ScheduledWorkflowFn, type WorkflowSchedule } from "@dbos-inc
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import type { ResolvedConfig } from "./config.ts";
-import { type Db, WAKEUP_TABLE } from "./db.ts";
+import { eq } from "drizzle-orm";
+import type { Db } from "./db.ts";
+import { wakeup } from "./db/company.ts";
 import type { Principal, WorkflowDefinition } from "./define.ts";
 import { readPeople, admit } from "./resources.ts";
 import type { WorkerState } from "./run.ts";
@@ -77,7 +79,9 @@ export async function applyScheduled(
   await Promise.all([...before.keys()].filter((name) => !names.has(name)).map((name) => DBOS.deleteSchedule(name)));
   const unfired = declared.filter((d) => before.get(d.schedule.scheduleName)?.lastFiredAt === null);
   if (!unfired.length) return;
-  const stoppedAt = await lastStopped(await db());
+  // When the instance's worker last stopped itself, from the wakeup row; never, and nothing was missed.
+  const [row] = await (await db()).select({ stoppedAt: wakeup.stoppedAt }).from(wakeup).where(eq(wakeup.id, 1));
+  const stoppedAt = row?.stoppedAt;
   if (!stoppedAt) return;
   for (const { schedule, since } of unfired) {
     const from = stoppedAt > since ? stoppedAt : since;
@@ -104,12 +108,6 @@ function sinceOf(schedule: WorkflowSchedule | undefined): Date | undefined {
   return at && !Number.isNaN(at.getTime()) ? at : undefined;
 }
 
-/** When the instance's worker last stopped, from the wakeup's row; undefined while it never has. */
-async function lastStopped(db: Db): Promise<Date | undefined> {
-  const { rows } = await db.query<{ stopped_at: Date | null }>(`SELECT stopped_at FROM ${WAKEUP_TABLE} WHERE id = 1`);
-  return rows[0]?.stopped_at ?? undefined;
-}
-
 /** Who starts a scheduled run, as `scheduledStarter` admitted them, or why they were not. */
 export interface ScheduledStarter {
   startedBy: Principal;

package/src/schema.ts

@@ -22,20 +22,23 @@ import { CHANGE_MERGE, DATA_VENDOR, EFFECTS, groupNamesOf, type PeopleResource,
 /** Cedar's bindings: its builds (`/nodejs`, `/web`) export the same functions. */
 export type CedarWasm = typeof import("@cedar-policy/cedar-wasm/nodejs");
 let wasm: CedarWasm | undefined;
+/** How Cedar is loaded on first use: its Node build, unless `useCedarWasm` gave another. */
+let load = () => createRequire(import.meta.url)("@cedar-policy/cedar-wasm/nodejs") as CedarWasm;
 
 /**
- * `@cedar-policy/cedar-wasm`'s Node build, loaded (synchronously, once) on first use, so a process
- * that never decides with Cedar never loads it; or the build `useCedarWasm` gave.
+ * Cedar's bindings, loaded (synchronously, once) on first use, so a process that never decides
+ * with Cedar never loads it: `@cedar-policy/cedar-wasm`'s Node build, or what `useCedarWasm`'s loader gives.
  */
-export const cedarWasm = (): CedarWasm =>
-  (wasm ??= createRequire(import.meta.url)("@cedar-policy/cedar-wasm/nodejs") as CedarWasm);
+export const cedarWasm = (): CedarWasm => (wasm ??= load());
 
 /**
- * From now on, Cedar is `bindings`: its web build, initialised, where the Node build cannot load
- * (the Cloudflare host's Worker, which bundles the runtime).
+ * From now on, Cedar is what `loader` gives on first use: its web build, initialised, where the
+ * Node build cannot load (workerd, which bundles the runtime), and instantiated only once a
+ * request decides with it.
  */
-export function useCedarWasm(bindings: CedarWasm): void {
-  wasm = bindings;
+export function useCedarWasm(loader: () => CedarWasm): void {
+  wasm = undefined;
+  load = loader;
 }
 
 /** The schema as Cedar's JSON format has it. */

package/src/shared.ts

@@ -142,24 +142,13 @@ export const domainsText = (domains: Readonly<Record<string, string>>): string =
     .join(",");
 
 /**
- * Where a hosted container answers, with its instance token (`SANOMA_WAKEUP_TOKEN`), the bundle
- * of its public sites that a host's Worker serves: the Cloudflare host downloads it at a deploy.
+ * Where a hosted worker's port answers, with its instance token (`SANOMA_WAKEUP_TOKEN`) and
+ * `?revision=<commit>`, the app bundle (`AppBundle` in `@sanoma-ai/app`) a host's Worker script runs
+ * at that revision, built in a checkout of its own: the Cloudflare host asks for it at a deploy.
  */
-export const SITES_BUNDLE_PATH = "/__sanoma/sites-bundle";
-/** The header every answer of that route carries: a runtime without the route answers without it. */
-export const SITES_BUNDLE_HEADER = "x-sanoma-sites-bundle";
-
-/** What that route answers: what a host's Worker runs a company's public sites from (`buildWorker` in `@sanoma-ai/app/build`). */
-export interface SitesBundle {
-  /** The sites it serves, by key: public, with a domain and no login. */
-  sites: string[];
-  /** The main module, among `modules`. */
-  mainModule: string;
-  /** The Worker's modules, by name relative to the main module, each base64. */
-  modules: { name: string; type: "esm" | "wasm" | "text" | "data"; content: string }[];
-  /** The Worker's static assets, by path from `/`, each base64: the client build and the prerendered pages. */
-  assets: { path: string; content: string }[];
-}
+export const APP_BUNDLE_PATH = "/__sanoma/app-bundle";
+/** The header every answer of that route carries, so a host tells them from its own errors. */
+export const APP_BUNDLE_HEADER = "x-sanoma-app-bundle";
 
 /** Where a host with a `hostname` serves the app (`HostSpec`'s `hostname`): `https://<hostname>`. */
 export const hostnameUrl = (hostname: string): string => `https://${hostname}`;

package/src/storage-provisioning.ts

@@ -1,5 +1,8 @@
 import { createHash } from "node:crypto";
-import { Client, escapeIdentifier } from "pg";
+import { eq, sql } from "drizzle-orm";
+import { Client } from "pg";
+import { databaseOn, type Db, pgCode } from "./db.ts";
+import { kmsDeployment, kmsSecrets } from "./db/kms.ts";
 import { KMS_SECRETS_SQL } from "./kms-secrets.ts";
 import { generateSecret, type Secrets } from "./secret.ts";
 
@@ -47,7 +50,8 @@ const fail = (code: StorageProvisioningError["code"]): never => {
 };
 const digest = (value: string) => createHash("sha256").update(value).digest("hex");
 const ROLE_PREFIX = "sanoma_runtime_";
-const BINDING_SQL = `CREATE TABLE IF NOT EXISTS sanoma_kms.deployment (
+/** Installs the deployment binding table beside `KMS_SECRETS_SQL`; an administrator creates it, the runtime never does. */
+export const BINDING_SQL = `CREATE TABLE IF NOT EXISTS sanoma_kms.deployment (
   singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
   company text NOT NULL, environment text NOT NULL, runtime_role text NOT NULL,
   credential_hash text NOT NULL
@@ -128,7 +132,7 @@ async function credentials(input: PrepareSecretStore, secrets: Secrets) {
   };
 }
 
-async function connected<T>(url: string, run: (db: Client) => Promise<T>): Promise<T> {
+async function connected<T>(url: string, run: (db: Db) => Promise<T>): Promise<T> {
   const db = new Client({
     connectionString: url,
     connectionTimeoutMillis: 10_000,
@@ -140,7 +144,7 @@ async function connected<T>(url: string, run: (db: Client) => Promise<T>): Promi
   });
   try {
     await db.connect();
-    return await run(db);
+    return await run(databaseOn(db));
   } finally {
     await db.end().catch(() => {});
   }
@@ -152,72 +156,65 @@ export const prepareSecretStore: PrepareStorage = async (input, secrets) => {
     const prepared = await credentials(input, secrets);
     const { company, environment } = input;
     const hash = digest(prepared.password),
-      role = escapeIdentifier(prepared.role);
-    await connected(prepared.admin, async (db) => {
-      await db.query("BEGIN");
-      try {
-        await db.query("SELECT pg_advisory_xact_lock(hashtext('sanoma.prepareSecretStore'))");
-        await db.query(KMS_SECRETS_SQL);
-        await db.query(BINDING_SQL);
-        const existing = (
-          await db.query<{ company: string; environment: string; runtime_role: string; credential_hash: string }>(
-            "SELECT company,environment,runtime_role,credential_hash FROM sanoma_kms.deployment WHERE singleton=true FOR UPDATE",
-          )
-        ).rows[0];
+      role = sql.identifier(prepared.role);
+    await connected(prepared.admin, (db) =>
+      db.transaction(async (tx) => {
+        await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('sanoma.prepareSecretStore'))`);
+        await tx.execute(sql.raw(KMS_SECRETS_SQL));
+        await tx.execute(sql.raw(BINDING_SQL));
+        const [existing] = await tx.select().from(kmsDeployment).where(eq(kmsDeployment.singleton, true)).for("update");
         if (existing) {
           if (
             existing.company !== company ||
             existing.environment !== environment ||
-            existing.runtime_role !== prepared.role ||
-            existing.credential_hash !== hash
+            existing.runtimeRole !== prepared.role ||
+            existing.credentialHash !== hash
           )
             fail("conflict");
         } else {
           if (
-            (await db.query("SELECT 1 FROM pg_roles WHERE rolname=$1", [prepared.role])).rowCount ||
-            (await db.query("SELECT 1 FROM sanoma_kms.secrets LIMIT 1")).rowCount
+            (await tx.execute(sql`SELECT 1 FROM pg_roles WHERE rolname = ${prepared.role}`)).rowCount ||
+            (
+              await tx
+                .select({ one: sql`1` })
+                .from(kmsSecrets)
+                .limit(1)
+            ).length
           )
             fail("conflict");
-          await db.query("SET LOCAL password_encryption = 'scram-sha-256'");
-          await db.query(CREATE_RUNTIME_SQL);
-          await db.query("SELECT pg_temp.sanoma_create_runtime($1, $2)", [prepared.role, prepared.password]);
-          await db.query(
-            "INSERT INTO sanoma_kms.deployment(company,environment,runtime_role,credential_hash) VALUES($1,$2,$3,$4)",
-            [company, environment, prepared.role, hash],
-          );
+          await tx.execute(sql`SET LOCAL password_encryption = 'scram-sha-256'`);
+          await tx.execute(sql.raw(CREATE_RUNTIME_SQL));
+          await tx.execute(sql`SELECT pg_temp.sanoma_create_runtime(${prepared.role}, ${prepared.password})`);
+          await tx
+            .insert(kmsDeployment)
+            .values({ company, environment, runtimeRole: prepared.role, credentialHash: hash });
         }
         // Never silently repair/adopt an unexpectedly privileged role on a retry.
         const authority = (
-          await db.query<{ safe: boolean }>(
-            `SELECT (
+          await tx.execute<{ safe: boolean }>(sql`SELECT (
           NOT r.rolsuper AND NOT r.rolcreatedb AND NOT r.rolcreaterole AND NOT r.rolreplication AND NOT r.rolbypassrls
           AND r.rolcanlogin AND NOT r.rolinherit
           AND NOT EXISTS(SELECT 1 FROM pg_auth_members WHERE member=r.oid)
           AND NOT EXISTS(SELECT 1 FROM pg_database WHERE datdba=r.oid)
           AND NOT EXISTS(SELECT 1 FROM pg_namespace WHERE nspname='sanoma_kms' AND nspowner=r.oid)
-        ) AS safe FROM pg_roles r WHERE rolname=$1`,
-            [prepared.role],
-          )
+        ) AS safe FROM pg_roles r WHERE rolname = ${prepared.role}`)
         ).rows[0];
         if (!authority?.safe) fail("denied");
-        const database = (await db.query<{ name: string }>("SELECT current_database() AS name")).rows[0]!.name;
-        await db.query(`REVOKE ALL ON DATABASE ${escapeIdentifier(database)} FROM PUBLIC`);
-        await db.query(`GRANT CONNECT, CREATE, TEMPORARY ON DATABASE ${escapeIdentifier(database)} TO ${role}`);
-        await db.query("REVOKE ALL ON SCHEMA public FROM PUBLIC");
-        await db.query(`GRANT USAGE, CREATE ON SCHEMA public TO ${role}`);
-        await db.query(`GRANT USAGE ON SCHEMA sanoma_kms TO ${role}`);
-        await db.query(`GRANT SELECT, INSERT, UPDATE, DELETE ON sanoma_kms.secrets TO ${role}`);
-        await db.query("COMMIT");
-      } catch (error) {
-        await db.query("ROLLBACK").catch(() => {});
-        throw error;
-      }
-    });
+        const database = sql.identifier(
+          (await tx.execute<{ name: string }>(sql`SELECT current_database() AS name`)).rows[0]!.name,
+        );
+        await tx.execute(sql`REVOKE ALL ON DATABASE ${database} FROM PUBLIC`);
+        await tx.execute(sql`GRANT CONNECT, CREATE, TEMPORARY ON DATABASE ${database} TO ${role}`);
+        await tx.execute(sql`REVOKE ALL ON SCHEMA public FROM PUBLIC`);
+        await tx.execute(sql`GRANT USAGE, CREATE ON SCHEMA public TO ${role}`);
+        await tx.execute(sql`GRANT USAGE ON SCHEMA sanoma_kms TO ${role}`);
+        await tx.execute(sql`GRANT SELECT, INSERT, UPDATE, DELETE ON sanoma_kms.secrets TO ${role}`);
+      }),
+    );
     // A committed schema is not enough: the stored login must work with the promised authority.
     await connected(prepared.runtime, async (db) => {
-      const { rows } = await db.query<{ safe: boolean }>(
-        `SELECT (
-        current_user=$1 AND has_schema_privilege(current_user,'sanoma_kms','USAGE')
+      const { rows } = await db.execute<{ safe: boolean }>(sql`SELECT (
+        current_user = ${prepared.role} AND has_schema_privilege(current_user,'sanoma_kms','USAGE')
         AND NOT has_schema_privilege(current_user,'sanoma_kms','CREATE')
         AND has_table_privilege(current_user,'sanoma_kms.secrets','SELECT')
         AND has_table_privilege(current_user,'sanoma_kms.secrets','INSERT')
@@ -225,16 +222,14 @@ export const prepareSecretStore: PrepareStorage = async (input, secrets) => {
         AND has_table_privilege(current_user,'sanoma_kms.secrets','DELETE')
         AND NOT has_table_privilege(current_user,'sanoma_kms.secrets','TRUNCATE,TRIGGER,REFERENCES')
         AND NOT has_table_privilege(current_user,'sanoma_kms.deployment','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES')
-      ) AS safe`,
-        [prepared.role],
-      );
+      ) AS safe`);
       if (!rows[0]?.safe) fail("denied");
     });
     return prepared.receipt;
   } catch (error) {
     const known = storageProvisioningCode(error);
     if (known) throw new StorageProvisioningError(known);
-    const code = (error as { code?: string } | null)?.code;
+    const code = pgCode(error);
     throw new StorageProvisioningError(
       code === "42501" ? "denied" : code === "23505" || code === "42710" ? "conflict" : "unavailable",
     );

package/src/tokens.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import type { Pool } from "pg";
-import { API_TOKENS_TABLE as TABLE } from "./db.ts";
+import { and, eq, isNull, type SQL, sql } from "drizzle-orm";
+import { pgCode, type Db } from "./db.ts";
+import { apiTokens } from "./db/company.ts";
 import type { Principal } from "./define.ts";
 import { generateSecret, tokenHash as hashOf } from "./secret.ts";
 
@@ -48,62 +49,71 @@ export interface Tokens {
   subjectOf(id: string): Promise<string | undefined>;
 }
 
-export function tokenStore(db: () => Promise<Pool>): Tokens {
+const active = (where: SQL | undefined) => and(where, isNull(apiTokens.revokedAt));
+
+export function tokenStore(db: () => Promise<Db>): Tokens {
   return {
     async mint({ id = randomUUID(), subject, groups }) {
       const token = newApiToken();
-      await (
-        await db()
-      ).query(`INSERT INTO ${TABLE} (id, hash, subject, groups) VALUES ($1, $2, $3, $4::jsonb)`, [
-        id,
-        hashOf(token),
-        subject,
-        JSON.stringify(groups),
-      ]);
+      await (await db()).insert(apiTokens).values({ id, hash: hashOf(token), subject, groups: [...groups] });
       return { id, token };
     },
     async register(input) {
       const { id, hash, subject, groups } = registrationOf(input);
       try {
-        const result = await (
+        // A duplicate id changes nothing unless it is this same active registration (the no-op
+        // update makes the row come back).
+        const registered = await (
           await db()
-        ).query(
-          `INSERT INTO ${TABLE} (id, hash, subject, groups) VALUES ($1,$2,$3,$4::jsonb)
-           ON CONFLICT (id) DO UPDATE SET id=EXCLUDED.id
-           WHERE ${TABLE}.hash=EXCLUDED.hash AND ${TABLE}.subject=EXCLUDED.subject
-             AND ${TABLE}.groups @> EXCLUDED.groups AND ${TABLE}.groups <@ EXCLUDED.groups
-             AND ${TABLE}.revoked_at IS NULL
-           RETURNING id`,
-          [id, hash, subject, JSON.stringify(groups)],
-        );
-        return result.rowCount === 1;
+        )
+          .insert(apiTokens)
+          .values({ id, hash, subject, groups })
+          .onConflictDoUpdate({
+            target: apiTokens.id,
+            set: { id },
+            setWhere: and(
+              eq(apiTokens.hash, hash),
+              eq(apiTokens.subject, subject),
+              sql`${apiTokens.groups} @> ${sql.param(groups, apiTokens.groups)} AND ${apiTokens.groups} <@ ${sql.param(groups, apiTokens.groups)}`,
+              isNull(apiTokens.revokedAt),
+            ),
+          })
+          .returning({ id: apiTokens.id });
+        return registered.length === 1;
       } catch (error) {
         // A bearer already registered under another ID cannot acquire a second identity.
-        if ((error as { code?: string }).code === "23505") return false;
+        if (pgCode(error) === "23505") return false;
         throw error;
       }
     },
     async revoke({ id }) {
-      await (await db()).query(`UPDATE ${TABLE} SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL`, [id]);
+      await (
+        await db()
+      )
+        .update(apiTokens)
+        .set({ revokedAt: sql`now()` })
+        .where(active(eq(apiTokens.id, id)));
     },
     async resolve(token) {
       if (!token.startsWith(PREFIX)) return undefined;
       // Looked up by its hash: the token itself is never stored, so there is nothing to compare it to.
-      const { rows } = await (
+      const [row] = await (
         await db()
-      ).query<{ id: string; subject: string; groups: string[] }>(
-        `SELECT id, subject, groups FROM ${TABLE} WHERE hash = $1 AND revoked_at IS NULL`,
-        [hashOf(token)],
-      );
-      const row = rows[0];
+      )
+        .select({ id: apiTokens.id, subject: apiTokens.subject, groups: apiTokens.groups })
+        .from(apiTokens)
+        .where(active(eq(apiTokens.hash, hashOf(token))));
       if (!row) return undefined;
       return { principal: { id: `token:${row.id}`, groups: row.groups }, subject: row.subject };
     },
     async subjectOf(id) {
-      const { rows } = await (
+      const [row] = await (
         await db()
-      ).query<{ subject: string }>(`SELECT subject FROM ${TABLE} WHERE id = $1 AND revoked_at IS NULL`, [id]);
-      return rows[0]?.subject;
+      )
+        .select({ subject: apiTokens.subject })
+        .from(apiTokens)
+        .where(active(eq(apiTokens.id, id)));
+      return row?.subject;
     },
   };
 }

package/src/version.ts

@@ -69,14 +69,14 @@ export function computeVersion({
 }
 
 /**
- * A hash of the built-in `change` workflow's own code, which each change run carries (its
- * `changeCode` attribute) so a worker on another version of the app may take it over
- * (`carryChangeRuns` in worker.ts): what `computeVersion` hashes of that one workflow, with
+ * A hash of a built-in workflow's own code (`apply`'s, `change`'s, …), which each of its runs
+ * carries (its `builtInCode` attribute) so a worker on another version of the app may take it
+ * over (`carryBuiltInRuns` in worker.ts): what `computeVersion` hashes of that one workflow, with
  * `RUNTIME_VERSION`, `STEP_LAYOUT` and the installed DBOS version. Never the company's workflows
  * nor `DBOS__APPVERSION`, so a merge that changes only the company's code leaves it as it is.
  */
-export function changeCodeOf(change: WorkflowDefinition<any, any>): string {
-  return sha256([RUNTIME_VERSION, STEP_LAYOUT, installedDbosVersion(), codeOf(change)]);
+export function builtInCodeOf(builtIn: WorkflowDefinition<any, any>): string {
+  return sha256([RUNTIME_VERSION, STEP_LAYOUT, installedDbosVersion(), codeOf(builtIn)]);
 }
 
 const sha256 = (parts: unknown[]) => createHash("sha256").update(JSON.stringify(parts)).digest("hex");