@sealkeeper/schema 0.4.6 → 0.4.8

package/dist/db/index.d.ts

@@ -1,76 +0,0 @@
-import type { agentMilestones } from './agent-milestones.js';
-import type { agentRenames } from './agent-renames.js';
-import type { credentials } from './credentials.js';
-import type { deletedOperators } from './deleted-operators.js';
-import type { events } from './events.js';
-import type { feedItems } from './feed-items.js';
-import type { operatorIdentities } from './operator-identities.js';
-import type { operatorLevelGrants } from './operator-level-grants.js';
-import type { operatorSlugs } from './operator-slugs.js';
-import type { operators } from './operators.js';
-import type { quotaCounters } from './quota-counters.js';
-import type { ratings } from './ratings.js';
-import type { scores } from './scores.js';
-import type { standing } from './standing.js';
-import type { taskClaimFailures } from './task-claim-failures.js';
-import type { taskOutcomes } from './task-outcomes.js';
-import type { tasks } from './tasks.js';
-export { and, asc, desc, eq, gt, inArray, isNotNull, isNull, lt, lte, max, ne, notInArray, or, type SQL, sql, } from 'drizzle-orm';
-export { DrizzleQueryError } from 'drizzle-orm/errors';
-export { agentMilestones } from './agent-milestones.js';
-export { agentRenames } from './agent-renames.js';
-export type { Agent, NewAgent } from './agents.js';
-export { agents } from './agents.js';
-export { createDb, type Db, type DbOptions, type Tx } from './client.js';
-export { credentials } from './credentials.js';
-export { deletedOperators } from './deleted-operators.js';
-export { events } from './events.js';
-export { feedItems } from './feed-items.js';
-export { migrationsFolder, runMigrations } from './migrator.js';
-export { operatorIdentities } from './operator-identities.js';
-export { operatorLevelGrants } from './operator-level-grants.js';
-export { operatorSlugs } from './operator-slugs.js';
-export { operators } from './operators.js';
-export { quotaCounters } from './quota-counters.js';
-export { ratings } from './ratings.js';
-export { scores } from './scores.js';
-export { type StoredCounts, type StoredLevelInputs, standing, } from './standing.js';
-export { taskClaimFailures } from './task-claim-failures.js';
-export { taskOutcomes } from './task-outcomes.js';
-export { tasks } from './tasks.js';
-export { timestamps } from './timestamps.js';
-export { pgArgs } from './url.js';
-export type Operator = typeof operators.$inferSelect;
-export type NewOperator = typeof operators.$inferInsert;
-export type Event = typeof events.$inferSelect;
-export type NewEvent = typeof events.$inferInsert;
-export type Task = typeof tasks.$inferSelect;
-export type NewTask = typeof tasks.$inferInsert;
-export type TaskOutcome = typeof taskOutcomes.$inferSelect;
-export type NewTaskOutcome = typeof taskOutcomes.$inferInsert;
-export type TaskClaimFailure = typeof taskClaimFailures.$inferSelect;
-export type NewTaskClaimFailure = typeof taskClaimFailures.$inferInsert;
-export type Rating = typeof ratings.$inferSelect;
-export type NewRating = typeof ratings.$inferInsert;
-export type Credential = typeof credentials.$inferSelect;
-export type NewCredential = typeof credentials.$inferInsert;
-export type Score = typeof scores.$inferSelect;
-export type NewScore = typeof scores.$inferInsert;
-export type StandingRow = typeof standing.$inferSelect;
-export type NewStandingRow = typeof standing.$inferInsert;
-export type QuotaCounter = typeof quotaCounters.$inferSelect;
-export type NewQuotaCounter = typeof quotaCounters.$inferInsert;
-export type AgentRename = typeof agentRenames.$inferSelect;
-export type NewAgentRename = typeof agentRenames.$inferInsert;
-export type FeedItem = typeof feedItems.$inferSelect;
-export type NewFeedItem = typeof feedItems.$inferInsert;
-export type AgentMilestone = typeof agentMilestones.$inferSelect;
-export type NewAgentMilestone = typeof agentMilestones.$inferInsert;
-export type OperatorSlugRow = typeof operatorSlugs.$inferSelect;
-export type NewOperatorSlugRow = typeof operatorSlugs.$inferInsert;
-export type DeletedOperator = typeof deletedOperators.$inferSelect;
-export type NewDeletedOperator = typeof deletedOperators.$inferInsert;
-export type OperatorLevelGrant = typeof operatorLevelGrants.$inferSelect;
-export type NewOperatorLevelGrant = typeof operatorLevelGrants.$inferInsert;
-export type OperatorIdentity = typeof operatorIdentities.$inferSelect;
-export type NewOperatorIdentity = typeof operatorIdentities.$inferInsert;

package/dist/db/index.js

@@ -1,28 +0,0 @@
-// The query helpers the API needs beyond the relational query API. The API
-// takes them from here so drizzle-orm stays a dependency of this package only.
-export { and, asc, desc, eq, gt, inArray, isNotNull, isNull, lt, lte, max, ne, notInArray, or, sql, } from 'drizzle-orm';
-// What every failed query throws. Its message holds the SQL and every bound
-// param, so the API error log must never print it.
-export { DrizzleQueryError } from 'drizzle-orm/errors';
-export { agentMilestones } from './agent-milestones.js';
-export { agentRenames } from './agent-renames.js';
-export { agents } from './agents.js';
-export { createDb } from './client.js';
-export { credentials } from './credentials.js';
-export { deletedOperators } from './deleted-operators.js';
-export { events } from './events.js';
-export { feedItems } from './feed-items.js';
-export { migrationsFolder, runMigrations } from './migrator.js';
-export { operatorIdentities } from './operator-identities.js';
-export { operatorLevelGrants } from './operator-level-grants.js';
-export { operatorSlugs } from './operator-slugs.js';
-export { operators } from './operators.js';
-export { quotaCounters } from './quota-counters.js';
-export { ratings } from './ratings.js';
-export { scores } from './scores.js';
-export { standing, } from './standing.js';
-export { taskClaimFailures } from './task-claim-failures.js';
-export { taskOutcomes } from './task-outcomes.js';
-export { tasks } from './tasks.js';
-export { timestamps } from './timestamps.js';
-export { pgArgs } from './url.js';

package/dist/db/migrate.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/db/migrate.js

@@ -1,34 +0,0 @@
-// Applies the SQL migrations in packages/schema/drizzle to DATABASE_URL.
-// This is what the vouched-migrate Cloud Run Job runs, so the image needs
-// drizzle-orm only and not drizzle-kit. Local dev keeps `pnpm db:migrate`.
-// @types/node is a devDependency only for this script, migrator.ts and url.ts.
-/// <reference types="node" />
-import { runMigrations } from './migrator.js';
-const url = process.env.DATABASE_URL;
-if (!url) {
-    console.error('DATABASE_URL is not set');
-    process.exit(1);
-}
-try {
-    // A notice is a migration telling the operator of the database something,
-    // such as 0025 listing the operators whose slug got a suffix.
-    await runMigrations(url, {
-        onNotice: (notice) => console.log(JSON.stringify({ msg: 'migration notice', notice })),
-    });
-    console.log(JSON.stringify({ msg: 'migrations applied' }));
-}
-catch (err) {
-    // Log messages and the error code only, never the error object or the URL,
-    // which carry the password. Drizzle wraps connection and auth failures as
-    // a failed query, so the real reason is in err.cause.
-    const msg = err instanceof Error ? err.message : 'unknown error';
-    const cause = err instanceof Error && err.cause instanceof Error ? err.cause : undefined;
-    const code = cause?.code;
-    console.error(JSON.stringify({
-        msg: 'migration failed',
-        error: msg,
-        cause: cause?.message,
-        code,
-    }));
-    process.exit(1);
-}

package/dist/db/migrator.d.ts

@@ -1,6 +0,0 @@
-export declare const migrationsFolder: string;
-export declare const MIGRATION_LOCK_TIMEOUT_MS = 5000;
-export declare const MIGRATION_STATEMENT_TIMEOUT_MS = 120000;
-export declare function runMigrations(databaseUrl: string, { onNotice }?: {
-    onNotice?: (message: string) => void;
-}): Promise<void>;

package/dist/db/migrator.js

@@ -1,36 +0,0 @@
-// The one drizzle migrator. migrate.ts (the vouched-migrate job) and the API
-// test helper both call runMigrations, so there is a single code path.
-/// <reference types="node" />
-import { fileURLToPath } from 'node:url';
-import { drizzle } from 'drizzle-orm/postgres-js';
-import { migrate } from 'drizzle-orm/postgres-js/migrator';
-import postgres from 'postgres';
-import { pgArgs } from './url.js';
-// Resolves to packages/schema/drizzle from both src/db and dist/db.
-export const migrationsFolder = fileURLToPath(new URL('../../drizzle', import.meta.url));
-// A migration that waits on a lock, such as an ALTER TABLE queued behind the
-// scoring run's transaction, fails after MIGRATION_LOCK_TIMEOUT_MS instead of
-// waiting with no bound and blocking every query queued behind it. One
-// statement may run for MIGRATION_STATEMENT_TIMEOUT_MS (VOU-205).
-export const MIGRATION_LOCK_TIMEOUT_MS = 5_000;
-export const MIGRATION_STATEMENT_TIMEOUT_MS = 120_000;
-// onNotice receives the text of each notice a migration raises, such as
-// the operators 0025 gave a suffixed slug. Silent when left out.
-export async function runMigrations(databaseUrl, { onNotice } = {}) {
-    const [connUrl, options] = pgArgs(databaseUrl);
-    const sql = postgres(connUrl, {
-        ...options,
-        max: 1,
-        connection: {
-            lock_timeout: MIGRATION_LOCK_TIMEOUT_MS,
-            statement_timeout: MIGRATION_STATEMENT_TIMEOUT_MS,
-        },
-        onnotice: (notice) => onNotice?.(notice.message),
-    });
-    try {
-        await migrate(drizzle(sql), { migrationsFolder });
-    }
-    finally {
-        await sql.end();
-    }
-}

package/dist/db/operator-identities.d.ts

@@ -1,211 +0,0 @@
-export declare const operatorIdentities: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "operator_identities";
-    schema: undefined;
-    columns: {
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "operator_identities";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updated_at";
-            tableName: "operator_identities";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgUUID";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        operatorId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "operator_id";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgUUID";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        kind: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kind";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        provider: import("drizzle-orm/pg-core").PgColumn<{
-            name: "provider";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        subject: import("drizzle-orm/pg-core").PgColumn<{
-            name: "subject";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        subjectHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "subject_hash";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        token: import("drizzle-orm/pg-core").PgColumn<{
-            name: "token";
-            tableName: "operator_identities";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        verifiedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "verified_at";
-            tableName: "operator_identities";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        lastCheckedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "last_checked_at";
-            tableName: "operator_identities";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        lapsedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "lapsed_at";
-            tableName: "operator_identities";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;

package/dist/db/operator-identities.js

@@ -1,49 +0,0 @@
-import { sql } from 'drizzle-orm';
-import { check, index, pgTable, text, timestamp, unique, uniqueIndex, uuid, } from 'drizzle-orm/pg-core';
-import { operators } from './operators.js';
-import { timestamps } from './timestamps.js';
-/*
- * Operator identities (VOU-185). One row per identity an operator links,
- * today only kind 'dns', a domain proven by a TXT record at
- * _sealkeeper.<domain> (apps/api/src/operator-domains.ts). VOU-149 adds
- * kind 'oidc' rows to the same table.
- *
- * subject is the domain, lower case, and subject_hash its SHA-256,
- * base64url, the hash a SEAL carries. token is the value the TXT record
- * must hold. It proves control of the domain and nothing else, but it is
- * never logged. provider is the attester's URL, SealKeeper itself for dns.
- *
- * verified_at is the last check that found the record, null until the
- * first. last_checked_at is the last check of any result. lapsed_at is the
- * first check that missed the record after it was verified, cleared when a
- * check finds it again. The identity counts as verified from verified_at
- * until lapsed_at plus the grace period (OPERATOR_VERIFICATION). An operator
- * adds a domain once, and one domain is verified for one operator at a
- * time.
- */
-export const operatorIdentities = pgTable('operator_identities', {
-    id: uuid('id').primaryKey().defaultRandom(),
-    operatorId: uuid('operator_id')
-        .notNull()
-        .references(() => operators.id),
-    kind: text('kind').notNull(),
-    provider: text('provider').notNull(),
-    subject: text('subject').notNull(),
-    subjectHash: text('subject_hash').notNull(),
-    token: text('token'),
-    verifiedAt: timestamp('verified_at', { withTimezone: true }),
-    lastCheckedAt: timestamp('last_checked_at', { withTimezone: true }),
-    lapsedAt: timestamp('lapsed_at', { withTimezone: true }),
-    ...timestamps,
-}, (t) => [
-    unique('operator_identities_operator_kind_subject_unique').on(t.operatorId, t.kind, t.subject),
-    // One operator at a time holds a verified subject.
-    uniqueIndex('operator_identities_verified_subject_idx')
-        .on(t.kind, t.subject)
-        .where(sql `${t.verifiedAt} is not null`),
-    // The daily recheck's pick, verified rows by their last check.
-    index('operator_identities_recheck_idx')
-        .on(t.lastCheckedAt)
-        .where(sql `${t.verifiedAt} is not null`),
-    check('operator_identities_kind', sql `${t.kind} in ('dns')`),
-]);

package/dist/db/operator-level-grants.d.ts

@@ -1,109 +0,0 @@
-export declare const operatorLevelGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "operator_level_grants";
-    schema: undefined;
-    columns: {
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "operator_level_grants";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updated_at";
-            tableName: "operator_level_grants";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        operatorId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "operator_id";
-            tableName: "operator_level_grants";
-            dataType: "string";
-            columnType: "PgUUID";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_id";
-            tableName: "operator_level_grants";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        level: import("drizzle-orm/pg-core").PgColumn<{
-            name: "level";
-            tableName: "operator_level_grants";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        grantedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "granted_at";
-            tableName: "operator_level_grants";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;

package/dist/db/operator-level-grants.js

@@ -1,30 +0,0 @@
-import { sql } from 'drizzle-orm';
-import { check, index, pgTable, primaryKey, text, timestamp, uuid, } from 'drizzle-orm/pg-core';
-import { timestamps } from './timestamps.js';
-/*
- * The operator silver cap (VOU-182). One row per agent that took one of its
- * operator's slots at a level, today only silver. The scoring run writes a
- * row the first time an agent earns the level, when the operator has fewer
- * than OPERATOR_SILVER_CAP.agents rows with granted_at in the last
- * OPERATOR_SILVER_CAP.days days, and holds the agent at bronze otherwise
- * (apps/api/src/silver-cap.ts). An agent keeps its row through dormancy and
- * version changes.
- *
- * No foreign key to agents or operators. The row outlives the agent, so
- * deleting an agent and registering it again does not free a slot. After
- * the operator deletes its account the rows stay until the scoring run
- * purges them with the deleted_operators hold. granted_at is the run's
- * clock, the one the cap counts on.
- */
-export const operatorLevelGrants = pgTable('operator_level_grants', {
-    operatorId: uuid('operator_id').notNull(),
-    agentId: text('agent_id').notNull(),
-    level: text('level').notNull(),
-    grantedAt: timestamp('granted_at', { withTimezone: true }).notNull(),
-    ...timestamps,
-}, (t) => [
-    primaryKey({ columns: [t.operatorId, t.agentId, t.level] }),
-    // The cap's count, an operator's grants of one level by date.
-    index('operator_level_grants_operator_level_granted_at_idx').on(t.operatorId, t.level, t.grantedAt),
-    check('operator_level_grants_level', sql `${t.level} in ('silver')`),
-]);