@sealkeeper/schema 0.4.1 → 0.4.3

package/dist/db/client.d.ts

@@ -252,6 +252,57 @@ export declare function createDb(url: string, options?: DbOptions): import("driz
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            dirtySince: import("drizzle-orm/pg-core").PgColumn<{
+                name: "dirty_since";
+                tableName: "agents";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            dirtyGen: import("drizzle-orm/pg-core").PgColumn<{
+                name: "dirty_gen";
+                tableName: "agents";
+                dataType: "number";
+                columnType: "PgBigInt53";
+                data: number;
+                driverParam: string | number;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            recomputeAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "recompute_at";
+                tableName: "agents";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
         };
         dialect: 'pg';
     }>;
@@ -504,6 +555,57 @@ export declare function createDb(url: string, options?: DbOptions): import("driz
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            assigneeAgentId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "assignee_agent_id";
+                tableName: "tasks";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            pairSettledAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "pair_settled_at";
+                tableName: "tasks";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            overPairCap: import("drizzle-orm/pg-core").PgColumn<{
+                name: "over_pair_cap";
+                tableName: "tasks";
+                dataType: "boolean";
+                columnType: "PgBoolean";
+                data: boolean;
+                driverParam: boolean;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             taskType: import("drizzle-orm/pg-core").PgColumn<{
                 name: "task_type";
                 tableName: "tasks";
@@ -1814,6 +1916,81 @@ export declare function createDb(url: string, options?: DbOptions): import("driz
         };
         dialect: 'pg';
     }>;
+    agentMilestones: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "agent_milestones";
+        schema: undefined;
+        columns: {
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "agent_milestones";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "updated_at";
+                tableName: "agent_milestones";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            agentId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "agent_id";
+                tableName: "agent_milestones";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            milestone: import("drizzle-orm/pg-core").PgColumn<{
+                name: "milestone";
+                tableName: "agent_milestones";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: 'pg';
+    }>;
     deletedOperators: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "deleted_operators";
         schema: undefined;

package/dist/db/client.js

@@ -1,5 +1,6 @@
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
+import { agentMilestones } from './agent-milestones.js';
 import { agentRenames } from './agent-renames.js';
 import { agents } from './agents.js';
 import { credentials } from './credentials.js';
@@ -27,6 +28,7 @@ const schema = {
     quotaCounters,
     feedItems,
     agentRenames,
+    agentMilestones,
     deletedOperators,
 };
 export function createDb(url, options = {}) {

package/dist/db/feed-items.js

@@ -13,4 +13,9 @@ export const feedItems = pgTable('feed_items', {
     agentId: text('agent_id').references(() => agents.id),
     payload: jsonb('payload').notNull(),
     ...timestamps,
-}, (t) => [index('feed_items_created_at_idx').on(t.createdAt)]);
+}, (t) => [
+    index('feed_items_created_at_idx').on(t.createdAt),
+    // Milestones are written once per agent, and deleting an agent removes
+    // its items. Both look up by agent and kind.
+    index('feed_items_agent_id_kind_idx').on(t.agentId, t.kind),
+]);

package/dist/db/index.d.ts

@@ -1,3 +1,4 @@
+import type { agentMilestones } from './agent-milestones.js';
 import type { agentRenames } from './agent-renames.js';
 import type { credentials } from './credentials.js';
 import type { deletedOperators } from './deleted-operators.js';
@@ -10,8 +11,9 @@ import type { scores } from './scores.js';
 import type { standing } from './standing.js';
 import type { taskOutcomes } from './task-outcomes.js';
 import type { tasks } from './tasks.js';
-export { and, asc, desc, eq, gt, inArray, isNotNull, isNull, lt, lte, max, ne, notInArray, or, sql, } from 'drizzle-orm';
+export { and, asc, desc, eq, gt, inArray, isNotNull, isNull, lt, lte, max, ne, notInArray, or, type SQL, sql, } from 'drizzle-orm';
 export { DrizzleQueryError } from 'drizzle-orm/errors';
+export { agentMilestones } from './agent-milestones.js';
 export { agentRenames } from './agent-renames.js';
 export type { Agent, NewAgent } from './agents.js';
 export { agents } from './agents.js';
@@ -52,5 +54,7 @@ export type AgentRename = typeof agentRenames.$inferSelect;
 export type NewAgentRename = typeof agentRenames.$inferInsert;
 export type FeedItem = typeof feedItems.$inferSelect;
 export type NewFeedItem = typeof feedItems.$inferInsert;
+export type AgentMilestone = typeof agentMilestones.$inferSelect;
+export type NewAgentMilestone = typeof agentMilestones.$inferInsert;
 export type DeletedOperator = typeof deletedOperators.$inferSelect;
 export type NewDeletedOperator = typeof deletedOperators.$inferInsert;

package/dist/db/index.js

@@ -4,6 +4,7 @@ export { and, asc, desc, eq, gt, inArray, isNotNull, isNull, lt, lte, max, ne, n
 // What every failed query throws. Its message holds the SQL and every bound
 // param, so the API error log must never print it.
 export { DrizzleQueryError } from 'drizzle-orm/errors';
+export { agentMilestones } from './agent-milestones.js';
 export { agentRenames } from './agent-renames.js';
 export { agents } from './agents.js';
 export { createDb } from './client.js';

package/dist/db/tasks.d.ts

@@ -87,6 +87,57 @@ export declare const tasks: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        assigneeAgentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "assignee_agent_id";
+            tableName: "tasks";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pairSettledAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "pair_settled_at";
+            tableName: "tasks";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        overPairCap: import("drizzle-orm/pg-core").PgColumn<{
+            name: "over_pair_cap";
+            tableName: "tasks";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         taskType: import("drizzle-orm/pg-core").PgColumn<{
             name: "task_type";
             tableName: "tasks";

package/dist/db/tasks.js

@@ -1,5 +1,5 @@
 import { sql } from 'drizzle-orm';
-import { index, jsonb, pgTable, text, timestamp, uuid, } from 'drizzle-orm/pg-core';
+import { boolean, index, jsonb, pgTable, text, timestamp, uuid, } from 'drizzle-orm/pg-core';
 import { agents } from './agents.js';
 import { timestamps } from './timestamps.js';
 export const tasks = pgTable('tasks', {
@@ -8,6 +8,21 @@ export const tasks = pgTable('tasks', {
         .notNull()
         .references(() => agents.id),
     claimantAgentId: text('claimant_agent_id').references(() => agents.id),
+    // The one agent an addressed task is for, null for an open task. Only it
+    // can claim the task, and the open pool leaves it out. Set at post and
+    // never changed, except that deleting the assignee agent deletes its
+    // unverified addressed tasks and nulls this on its verified ones, whose
+    // claimant it was (deleteAgents in apps/api/src/account.ts).
+    assigneeAgentId: text('assignee_agent_id').references(() => agents.id),
+    // When a claimed addressed task settled for its operator pair's cap,
+    // verified_at when it verified, expires_at when it expired unverified.
+    // Null for an open task and until it settles. Set once, with
+    // over_pair_cap, by apps/api/src/pair-cap.ts.
+    pairSettledAt: timestamp('pair_settled_at', { withTimezone: true }),
+    // True for a settled addressed task that came past its operator pair's
+    // cap, so it weighs nothing as evidence, success or failure. False for
+    // every other task.
+    overPairCap: boolean('over_pair_cap').notNull().default(false),
     taskType: text('task_type').notNull(),
     spec: jsonb('spec').notNull(),
     verification: jsonb('verification').notNull(),
@@ -36,10 +51,28 @@ export const tasks = pgTable('tasks', {
     index('tasks_poster_agent_id_idx').on(t.posterAgentId),
     // The claim cap per claimant, activity counts, scoring and evidence.
     index('tasks_claimant_agent_id_idx').on(t.claimantAgentId),
-    // GET /v1/tasks?state=open, oldest first.
+    // GET /v1/tasks?state=open and the board, oldest or newest first. The
+    // open pool filters out addressed tasks on top of it.
     index('tasks_open_posted_at_idx')
         .on(t.postedAt, t.id)
         .where(sql `${t.claimedAt} is null and ${t.verifiedAt} is null`),
+    // Open tasks addressed to one agent, oldest first. GET /v1/tasks?assignee=
+    // and the per assignee caps.
+    index('tasks_open_assignee_posted_at_idx')
+        .on(t.assigneeAgentId, t.postedAt, t.id)
+        .where(sql `${t.assigneeAgentId} is not null and ${t.claimedAt} is null and ${t.verifiedAt} is null`),
+    // Addressed tasks by assignee and settle time. The pair cap counts an
+    // assignee's settled tasks over the last days, and a deletion finds the
+    // tasks addressed to it.
+    index('tasks_assignee_settled_at_idx')
+        .on(t.assigneeAgentId, t.pairSettledAt)
+        .where(sql `${t.assigneeAgentId} is not null`),
+    // Claimed addressed tasks not yet settled for the pair cap, by settle
+    // time. The pair cap walks and the scoring run's pass read it. Small,
+    // since a task leaves it once it is decided.
+    index('tasks_addressed_pending_idx')
+        .on(sql `least(${t.verifiedAt}, ${t.expiresAt})`)
+        .where(sql `${t.assigneeAgentId} is not null and ${t.claimedAt} is not null and ${t.pairSettledAt} is null`),
     // GET /v1/tasks?state=claimed, oldest first.
     index('tasks_claimed_posted_at_idx')
         .on(t.postedAt, t.id)

package/dist/envelope.d.ts

@@ -14,3 +14,14 @@ export declare function verify(jws: string, publicKey: Uint8Array): Promise<{
     header: JwsHeader;
     payload: unknown;
 }>;
+export declare const Audience: z.ZodString;
+export declare function audienceOf(apiUrl: string): string;
+export declare function withAudience<T extends object>(payload: T, aud: string): T & {
+    aud: string;
+};
+export declare function signRequest(payload: object, privateKey: Uint8Array, kid: string, aud: string): Promise<string>;
+export type AudienceCheck = {
+    result: 'match' | 'missing' | 'wrong';
+    payload: unknown;
+};
+export declare function readAudience(payload: unknown, accepted: readonly string[]): AudienceCheck;

package/dist/envelope.js

@@ -68,3 +68,73 @@ export async function verify(jws, publicKey) {
     const header = parseHeader(parts.header);
     return { header, payload: parseJson(parts.payload, 'payload') };
 }
+// Signed request audience (VOU-111). Every agent-signed request names the
+// API it is meant for with `aud`, a top level key inside the signed payload,
+// so a request captured for one API cannot be replayed to another. SEALs
+// carry `iss` instead and do not use this.
+function isHttpOrigin(v) {
+    try {
+        const url = new URL(v);
+        return ((url.protocol === 'http:' || url.protocol === 'https:') &&
+            url.origin === v);
+    }
+    catch {
+        return false;
+    }
+}
+// An origin with no trailing slash, no path, a lowercase host and no default
+// port, such as https://api.sealkeeper.run.
+export const Audience = z
+    .string()
+    .max(256)
+    .refine(isHttpOrigin, 'aud must be an origin such as https://api.sealkeeper.run');
+// The audience for an API base URL, its origin.
+export function audienceOf(apiUrl) {
+    let url;
+    try {
+        url = new URL(apiUrl);
+    }
+    catch {
+        throw new EnvelopeError('API URL is not a URL');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new EnvelopeError('API URL must be http or https');
+    }
+    if (url.origin === 'null') {
+        throw new EnvelopeError('API URL has no origin');
+    }
+    return url.origin;
+}
+// A copy of the payload with `aud` added. Never mutates the input.
+export function withAudience(payload, aud) {
+    if (!Audience.safeParse(aud).success) {
+        throw new EnvelopeError('aud must be an origin');
+    }
+    if (Array.isArray(payload)) {
+        throw new EnvelopeError('A signed request payload must be an object');
+    }
+    if (Object.hasOwn(payload, 'aud')) {
+        throw new EnvelopeError('Payload already has an aud');
+    }
+    return { ...payload, aud };
+}
+// How every agent-signed request is signed. The payload gains `aud` inside
+// the signed bytes. `sign` stays for SEALs, which carry `iss`.
+export async function signRequest(payload, privateKey, kid, aud) {
+    return sign(withAudience(payload, aud), privateKey, kid);
+}
+// Read `aud` off a verified payload. Call only after `verify`. The compare
+// is exact, the received value is never normalised. A payload that is not a
+// plain object comes back unchanged as missing, so the request schema still
+// rejects it.
+export function readAudience(payload, accepted) {
+    if (typeof payload !== 'object' ||
+        payload === null ||
+        Array.isArray(payload) ||
+        !Object.hasOwn(payload, 'aud')) {
+        return { result: 'missing', payload };
+    }
+    const { aud, ...rest } = payload;
+    const match = typeof aud === 'string' && accepted.includes(aud);
+    return { result: match ? 'match' : 'wrong', payload: rest };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealkeeper/schema",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": false,
   "description": "Zod schemas, event taxonomy and signing helpers for SealKeeper.",
   "license": "Apache-2.0",