@sanoma-ai/workflows 0.11.12 → 0.11.14

package/dist/db/company.js

@@ -0,0 +1,118 @@
+import { sql } from "drizzle-orm";
+import { bigserial, boolean, check, index, integer, jsonb, pgTable, primaryKey, text, timestamp, } from "drizzle-orm/pg-core";
+// The runtime's tables in a company's database, beside DBOS's: what `prepareDatabase` makes and
+// every store reads. Column names are the property names in snake_case (`casing` in `db.ts` and
+// in `drizzle/company.config.ts`). A change here is a new migration: `pnpm --filter
+// @sanoma-ai/workflows generate` writes it under `drizzle/company/`, and CI refuses a schema
+// whose migration was not generated.
+const when = () => timestamp({ withTimezone: true });
+/** The credentials set from the app, each sealed under its namespace and name. */
+export const credentials = pgTable("sanoma_credentials", {
+    namespace: text().notNull(),
+    name: text().notNull(),
+    value: text().notNull(),
+    version: text().notNull(),
+    setBy: text().notNull(),
+    setAt: when()
+        .notNull()
+        .defaultNow()
+        .$onUpdate(() => sql `now()`),
+}, (t) => [primaryKey({ columns: [t.namespace, t.name] })]);
+/**
+ * The Postgres ledger's records. `n` is the write order, `id` the record's, which the first write
+ * of takes, and `seq` the record's place in its run: a run reads in `seq` order, then write order.
+ */
+export const ledger = pgTable("sanoma_ledger", {
+    n: bigserial({ mode: "number" }).primaryKey(),
+    id: text().notNull().unique(),
+    runId: text().notNull(),
+    seq: integer().notNull(),
+    record: jsonb().$type().notNull(),
+}, (t) => [index("sanoma_ledger_run_seq").on(t.runId, t.seq, t.n)]);
+/** The collections' records (`collection.ts`): one row per collection and key, the record as JSON. */
+export const data = pgTable("sanoma_data", {
+    collection: text().notNull(),
+    key: text().notNull(),
+    record: jsonb().$type().notNull(),
+    updatedAt: when().notNull().defaultNow(),
+    updatedBy: text().notNull(),
+}, (t) => [primaryKey({ columns: [t.collection, t.key] })]);
+/**
+ * The instance's side of its wakeup: one row, made with the table (`0001_wakeup_row.sql`). `at`
+ * is the deadline last registered, `stopped_at` when the worker last stopped itself (the
+ * schedules backfill from it), `last_error` why the last registration failed.
+ */
+export const wakeup = pgTable("sanoma_wakeup", {
+    id: integer().primaryKey(),
+    at: when(),
+    stoppedAt: when(),
+    lastError: text(),
+}, (t) => [check("sanoma_wakeup_one_row", sql `${t.id} = 1`)]);
+/** The operator agent's chats (`chats.ts`): who each is for, its engine and its draft. */
+export const chats = pgTable("sanoma_chats", {
+    id: text().primaryKey(),
+    person: text().notNull(),
+    engine: text().notNull(),
+    draftId: text(),
+    title: text().notNull(),
+    createdAt: when().notNull().defaultNow(),
+}, (t) => [index("sanoma_chats_person").on(t.person, t.createdAt)]);
+/** Each chat's messages, the AI SDK's UI messages as JSON, in `seq` order. */
+export const chatMessages = pgTable("sanoma_chat_messages", {
+    chatId: text()
+        .notNull()
+        .references(() => chats.id, { onDelete: "cascade" }),
+    id: text().notNull(),
+    seq: integer().notNull(),
+    message: jsonb().$type().notNull(),
+}, (t) => [primaryKey({ columns: [t.chatId, t.id] })]);
+/** The api tokens (`tokens.ts`): each one's SHA-256, never the token, whom it acts for, its groups, and when it was revoked. */
+export const apiTokens = pgTable("sanoma_api_tokens", {
+    id: text().primaryKey(),
+    hash: text().notNull().unique(),
+    subject: text().notNull(),
+    groups: jsonb().$type().notNull(),
+    createdAt: when().notNull().defaultNow(),
+    revokedAt: when(),
+});
+/** The nonces of sealed invite requests spent (`spendInviteRequest`), each until it expires. */
+export const inviteRequests = pgTable("sanoma_invite_requests", {
+    nonce: text().primaryKey(),
+    expiresAt: when().notNull(),
+});
+/** The connected accounts (`connection.ts`): metadata only, never an authentication value. */
+export const connections = pgTable("sanoma_connections", {
+    id: text().primaryKey(),
+    vendor: text().notNull(),
+    method: text().notNull(),
+    owner: text(),
+    rule: text(),
+    account: text().notNull(),
+    scopes: jsonb().$type().notNull(),
+    revision: text().notNull(),
+    definition: text().notNull(),
+    credential: text(),
+    location: jsonb().$type(),
+    status: text().$type().notNull().default("connected"),
+    updatedBy: text().notNull(),
+    updatedAt: when()
+        .notNull()
+        .defaultNow()
+        .$onUpdate(() => sql `now()`),
+});
+/** Each connection's last health check. */
+export const connectionHealth = pgTable("sanoma_connection_health", {
+    connectionId: text().primaryKey(),
+    revision: text().notNull(),
+    health: text().$type().notNull(),
+    credentialVersion: text(),
+    externallyRenewed: boolean().notNull(),
+    checkedAt: when().notNull().defaultNow(),
+});
+/** The receipts of a connection's setup, one per revision. */
+export const connectionSetups = pgTable("sanoma_connection_setups", {
+    connectionId: text().notNull(),
+    revision: text().notNull(),
+    credentialVersion: text().notNull(),
+}, (t) => [primaryKey({ columns: [t.connectionId, t.revision] })]);
+//# sourceMappingURL=company.js.map

package/dist/db/company.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.js","sourceRoot":"","sources":["../../src/db/company.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,SAAS,EACT,OAAO,EACP,KAAK,EACL,KAAK,EACL,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,EACJ,SAAS,GACV,MAAM,qBAAqB,CAAC;AAK7B,gGAAgG;AAChG,gGAAgG;AAChG,oFAAoF;AACpF,6FAA6F;AAC7F,qCAAqC;AAErC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAErD,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,oBAAoB,EACpB;IACE,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACzB,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,KAAK,EAAE,IAAI,EAAE;SACV,OAAO,EAAE;SACT,UAAU,EAAE;SACZ,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAA,OAAO,CAAC;CAC/B,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CACxD,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAC3B,eAAe,EACf;IACE,CAAC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE;IAC7C,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,GAAG,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE;IACxB,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAgB,CAAC,OAAO,EAAE;CAChD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,aAAa,EACb;IACE,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,GAAG,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAA2B,CAAC,OAAO,EAAE;IAC1D,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACxC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;CAC5B,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CACxD,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAC3B,eAAe,EACf;IACE,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE;IAC1B,EAAE,EAAE,IAAI,EAAE;IACV,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;CAClB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAC1D,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAC1B,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACvB,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,OAAO,EAAE,IAAI,EAAE;IACf,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACzC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAChE,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,sBAAsB,EACtB;IACE,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACpB,GAAG,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE;IACxB,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,EAAa,CAAC,OAAO,EAAE;CAC9C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACnD,CAAC;AAEF,gIAAgI;AAChI,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,EAAE;IACpD,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACvB,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC/B,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACxC,SAAS,EAAE,IAAI,EAAE;CAClB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,wBAAwB,EAAE;IAC9D,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IAC1B,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,EAAE;IACvD,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACvB,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,KAAK,EAAE,IAAI,EAAE;IACb,IAAI,EAAE,IAAI,EAAE;IACZ,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACzB,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IAC3C,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,UAAU,EAAE,IAAI,EAAE;IAClB,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,EAAkB;IACzC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAoB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IACvE,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,SAAS,EAAE,IAAI,EAAE;SACd,OAAO,EAAE;SACT,UAAU,EAAE;SACZ,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAA,OAAO,CAAC;CAC/B,CAAC,CAAC;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,0BAA0B,EAAE;IAClE,YAAY,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACjC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAA6B,CAAC,OAAO,EAAE;IAC3D,iBAAiB,EAAE,IAAI,EAAE;IACzB,iBAAiB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE;IACtC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACzC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CACrC,0BAA0B,EAC1B;IACE,YAAY,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,iBAAiB,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;CACpC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAC/D,CAAC"}

package/dist/db/dbos.d.ts

@@ -0,0 +1,111 @@
+export declare const dbos: import("drizzle-orm/pg-core").PgSchema<"dbos">;
+/** Each run's status row. */
+export declare const workflowStatus: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workflow_status";
+    schema: "dbos";
+    columns: {
+        workflowUuid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workflowUuid";
+            tableName: "workflow_status";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "workflow_status";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "workflow_status";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        applicationName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "applicationName";
+            tableName: "workflow_status";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        applicationVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "applicationVersion";
+            tableName: "workflow_status";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        queueName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "queueName";
+            tableName: "workflow_status";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;

package/dist/db/dbos.js

@@ -0,0 +1,15 @@
+import { pgSchema, text } from "drizzle-orm/pg-core";
+// What the runtime reads of DBOS's own tables (dbos-sdk 5.2.11), in its schema `dbos`: the
+// columns named here only. DBOS makes and migrates these tables (`DBOS.migrate`); no migration is
+// generated from this model, and the runtime's one write to them is `stampVersion` (`db.ts`).
+export const dbos = pgSchema("dbos");
+/** Each run's status row. */
+export const workflowStatus = dbos.table("workflow_status", {
+    workflowUuid: text().primaryKey(),
+    status: text().notNull(),
+    name: text(),
+    applicationName: text(),
+    applicationVersion: text(),
+    queueName: text(),
+});
+//# sourceMappingURL=dbos.js.map

package/dist/db/dbos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dbos.js","sourceRoot":"","sources":["../../src/db/dbos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErD,2FAA2F;AAC3F,kGAAkG;AAClG,8FAA8F;AAE9F,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;AAErC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;IAC1D,YAAY,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACjC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,IAAI,EAAE;IACZ,eAAe,EAAE,IAAI,EAAE;IACvB,kBAAkB,EAAE,IAAI,EAAE;IAC1B,SAAS,EAAE,IAAI,EAAE;CAClB,CAAC,CAAC"}

package/dist/db/identity.d.ts

@@ -0,0 +1,367 @@
+export declare const identity: import("drizzle-orm/pg-core").PgSchema<"sanoma_identity">;
+/** Each enrolled deployment and the service account it may act as. */
+export declare const identityDeployments: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "deployments";
+    schema: "sanoma_identity";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "deployments";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        company: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company";
+            tableName: "deployments";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        environment: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environment";
+            tableName: "deployments";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        serviceAccount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "serviceAccount";
+            tableName: "deployments";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        enabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "enabled";
+            tableName: "deployments";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+/** Each deployment credential's hash, never the credential, with its generation and validity. */
+export declare const identityCredentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "credentials";
+    schema: "sanoma_identity";
+    columns: {
+        hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hash";
+            tableName: "credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deployment: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deployment";
+            tableName: "credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        generation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "generation";
+            tableName: "credentials";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        validFrom: import("drizzle-orm/pg-core").PgColumn<{
+            name: "validFrom";
+            tableName: "credentials";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        validUntil: import("drizzle-orm/pg-core").PgColumn<{
+            name: "validUntil";
+            tableName: "credentials";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revoked: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked";
+            tableName: "credentials";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+/** Each issuance decision, without token values. */
+export declare const identityAuditEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "audit_events";
+    schema: "sanoma_identity";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "audit_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        recordedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "recordedAt";
+            tableName: "audit_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        result: import("drizzle-orm/pg-core").PgColumn<{
+            name: "result";
+            tableName: "audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: "denied" | "issued" | "unavailable";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "denied" | "issued" | "unavailable";
+        }>;
+        deployment: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deployment";
+            tableName: "audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        company: import("drizzle-orm/pg-core").PgColumn<{
+            name: "company";
+            tableName: "audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        environment: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environment";
+            tableName: "audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        serviceAccount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "serviceAccount";
+            tableName: "audit_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        generation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "generation";
+            tableName: "audit_events";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expiresAt";
+            tableName: "audit_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;

package/dist/db/identity.js

@@ -0,0 +1,48 @@
+import { sql } from "drizzle-orm";
+import { bigint, boolean, check, pgSchema, text, timestamp, unique, uuid } from "drizzle-orm/pg-core";
+// The cloud identity broker's tables, in the schema `sanoma_identity` an administrator installs
+// with `CLOUD_IDENTITY_SQL` (`cloud-identity.ts`) and `CLOUD_IDENTITY_AUDIT_SQL`
+// (`identity-service.ts`), with their grants: the runtime never makes them, so no migration is
+// generated from this model. `installed-schemas.test.ts` holds the install SQL to it.
+export const identity = pgSchema("sanoma_identity");
+const when = () => timestamp({ withTimezone: true });
+/** Each enrolled deployment and the service account it may act as. */
+export const identityDeployments = identity.table("deployments", {
+    id: text().primaryKey(),
+    company: text().notNull(),
+    environment: text().notNull(),
+    serviceAccount: text().notNull(),
+    enabled: boolean().notNull().default(true),
+});
+/** Each deployment credential's hash, never the credential, with its generation and validity. */
+export const identityCredentials = identity.table("credentials", {
+    hash: text().primaryKey(),
+    deployment: text()
+        .notNull()
+        .references(() => identityDeployments.id),
+    generation: bigint({ mode: "number" }).notNull(),
+    validFrom: when().notNull().defaultNow(),
+    validUntil: when().notNull(),
+    revoked: boolean().notNull().default(false),
+}, (t) => [
+    unique("credentials_deployment_generation").on(t.deployment, t.generation),
+    check("credentials_hash", sql `${t.hash} ~ '^[0-9a-f]{64}$'`),
+    check("credentials_generation", sql `${t.generation} > 0`),
+    check("credentials_validity", sql `${t.validUntil} > ${t.validFrom}`),
+    check("credentials_finite", sql `isfinite(${t.validFrom}) AND isfinite(${t.validUntil})`),
+]);
+/** Each issuance decision, without token values. */
+export const identityAuditEvents = identity.table("audit_events", {
+    id: uuid().primaryKey().defaultRandom(),
+    recordedAt: when()
+        .notNull()
+        .default(sql `clock_timestamp()`),
+    result: text().$type().notNull(),
+    deployment: text(),
+    company: text(),
+    environment: text(),
+    serviceAccount: text(),
+    generation: bigint({ mode: "number" }),
+    expiresAt: when(),
+}, (t) => [check("audit_events_result", sql `${t.result} IN ('issued', 'denied', 'unavailable')`)]);
+//# sourceMappingURL=identity.js.map

package/dist/db/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/db/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEtG,gGAAgG;AAChG,iFAAiF;AACjF,+FAA+F;AAC/F,sFAAsF;AAEtF,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAEpD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAErD,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE;IAC/D,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACvB,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACzB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,cAAc,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAChC,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAC/C,aAAa,EACb;IACE,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE;IACzB,UAAU,EAAE,IAAI,EAAE;SACf,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAChD,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACxC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC5C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,MAAM,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;IAC1E,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,IAAI,qBAAqB,CAAC;IAC5D,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,UAAU,MAAM,CAAC;IACzD,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;IACpE,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAA,YAAY,CAAC,CAAC,SAAS,kBAAkB,CAAC,CAAC,UAAU,GAAG,CAAC;CACzF,CACF,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAC/C,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE;SACf,OAAO,EAAE;SACT,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAuC,CAAC,OAAO,EAAE;IACrE,UAAU,EAAE,IAAI,EAAE;IAClB,OAAO,EAAE,IAAI,EAAE;IACf,WAAW,EAAE,IAAI,EAAE;IACnB,cAAc,EAAE,IAAI,EAAE;IACtB,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtC,SAAS,EAAE,IAAI,EAAE;CAClB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,yCAAyC,CAAC,CAAC,CAC/F,CAAC"}