@stackbone/cli 0.2.4 → 0.2.6

package/migrations/0022_trigger_subscriptions_mailbox.sql

@@ -0,0 +1,19 @@
+-- 0022_trigger_subscriptions_mailbox.sql — add mailbox column to trigger_subscriptions
+-- The mailbox identifies which mailbox a mailbox-scoped trigger polls. When resolving
+-- a declarative poll, the mailbox is injected into the arg the connector declares via
+-- `mailboxParam` (e.g. Outlook app-only's `user-id`). Nullable for backward compatibility
+-- with existing subscriptions.
+
+ALTER TABLE stackbone_platform.trigger_subscriptions
+ADD COLUMN mailbox text;
+
+-- Last-resort integrity guard against a direct DB insert that skips the register
+-- endpoint's validation. The SOURCE OF TRUTH for "this trigger needs a mailbox" is
+-- the connector definition's `mailboxParam` (enforced by the poll engine + register
+-- endpoint); SQL can't read that, so this constraint hardcodes today's only
+-- mailbox-scoped connector. Adding another one means updating this constraint too.
+ALTER TABLE stackbone_platform.trigger_subscriptions
+ADD CONSTRAINT chk_outlook_app_only_requires_mailbox
+CHECK (
+  (connector != 'outlook-app-only' OR mailbox IS NOT NULL)
+);

package/migrations/0023_runs_waiting_status.sql

@@ -0,0 +1,20 @@
+-- 0023_runs_waiting_status.sql — widen the runs status CHECK for serialized
+-- (FIFO) execution (STA-104).
+--
+-- A serialized workflow trigger enqueued behind an active serial run is mirrored
+-- into `stackbone_platform.runs` as a `waiting` row (started_at NULL — it has not
+-- run yet) so both `stackbone dev` and the Studio runs view can surface the queue
+-- read-only. When the FIFO gate admits the trigger and the next run starts, the
+-- waiting row is cleared. The original CHECK (0001 listed
+-- `running/done/failed/interrupted`) predates this value and would reject the
+-- insert. Widen `runs_status_check` to match `runStatusSchema`.
+--
+-- No trigger change is needed: the existing pg_notify fan-out (0001
+-- notify_run_event) already emits `run.created` on the waiting INSERT and
+-- `run.started` on the started_at NULL→NOT-NULL transition when the run starts,
+-- so open Studio views refresh through the existing SSE channel. Self-host and
+-- cloud both run these migrations, so the behavior is identical.
+ALTER TABLE stackbone_platform.runs DROP CONSTRAINT IF EXISTS runs_status_check;
+ALTER TABLE stackbone_platform.runs
+    ADD CONSTRAINT runs_status_check
+    CHECK (status IN ('running', 'done', 'failed', 'interrupted', 'waiting'));

package/migrations/0024_browser_auth_profiles.sql

@@ -0,0 +1,59 @@
+-- 0024_browser_auth_profiles.sql — persistent, encrypted browser auth profiles
+-- for deep-agent browser tools (STA-99).
+--
+-- A browsing agent gets a fresh browser context per chat session, so it starts
+-- logged out of every site every conversation. This table lets a successful
+-- login be captured once and reused: the browser's serialized Playwright
+-- `storageState` (cookies + per-origin localStorage) is encrypted and stored
+-- keyed by (site origin, identity); every new browser context for that origin
+-- starts with the state injected — already authenticated, no fresh login.
+--
+-- Rides the SAME secrets machinery as `stackbone_platform.secrets`, not a new
+-- crypto path: it lives in the agent's OWN platform database (so scoping is
+-- physical — a different install is a different DB + a different per-agent
+-- `STACKBONE_SECRET_KEY`, and a row is unreachable/undecryptable from any other
+-- install or org) and uses the identical `@stackbone/crypto` libsodium envelope
+-- (`version` / `nonce` / `ciphertext`). Storage state is credential-equivalent
+-- (a leaked cookie is a leaked password), which is exactly why it never sits in
+-- plaintext and never leaves the install's database.
+--
+-- Identity model v1 is agent-owned: one identity per site per install (the
+-- agent's own account). The `identity` column defaults to 'agent' and the
+-- UNIQUE (origin, identity) key future-proofs per-identity profiles without a
+-- rewrite when per-end-user identities arrive.
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.browser_auth_profiles (
+    id          uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    -- The site origin the profile authenticates, canonicalized to
+    -- `<scheme>://<host>[:<port>]` (e.g. `https://tutorbird.com`). The primary
+    -- half of the identity key.
+    origin      text        NOT NULL,
+    -- Which identity on that site this profile is for. v1 is always 'agent'
+    -- (the agent's own account); the column exists so per-end-user identities
+    -- are a non-breaking addition, never a rewrite.
+    identity    text        NOT NULL DEFAULT 'agent',
+    -- Crypto envelope, identical to `stackbone_platform.secrets`. The plaintext
+    -- is the JSON-serialized Playwright storageState; the cipher is the shared
+    -- libsodium `crypto_secretbox` keyed by the per-agent `STACKBONE_SECRET_KEY`.
+    version     text        NOT NULL DEFAULT 'v1' CHECK (version IN ('v1')),
+    nonce       bytea       NOT NULL,
+    ciphertext  bytea       NOT NULL,
+    -- Set when the agent landed unauthenticated despite an injected profile, so
+    -- exactly one re-login runs under the per-identity mutex and refreshes it.
+    stale       boolean     NOT NULL DEFAULT false,
+    created_at  timestamptz NOT NULL DEFAULT now(),
+    updated_at  timestamptz NOT NULL DEFAULT now()
+);
+
+-- One profile per (origin, identity): the login flow upserts on this key so a
+-- re-login rotates the state in place rather than accumulating rows.
+CREATE UNIQUE INDEX IF NOT EXISTS browser_auth_profiles_origin_identity_idx
+    ON stackbone_platform.browser_auth_profiles (origin, identity);
+
+-- The operator list surface orders newest-first.
+CREATE INDEX IF NOT EXISTS browser_auth_profiles_updated_at_idx
+    ON stackbone_platform.browser_auth_profiles (updated_at DESC);
+
+-- Storage state is credential material — keep it out of reach of the read-only
+-- SQL Explorer role exactly like `secrets` (0011).
+REVOKE ALL ON stackbone_platform.browser_auth_profiles FROM stackbone_viewer;

package/migrations/0025_trigger_subscriptions_mapping_graph.sql

@@ -0,0 +1,9 @@
+-- 0025_trigger_subscriptions_mapping_graph.sql — add mapping_graph column to trigger_subscriptions
+-- The visual node editor authors an event→input mapping as a graph and COMPILES it to the
+-- existing JSONata `mapping` string on the client. `mapping_graph` persists that graph opaquely
+-- so the editor can re-open and keep editing; the runtime NEVER reads it (the forwarder still
+-- evaluates only `mapping`). Nullable for backward compatibility and for code-mode detach, where
+-- editing the raw JSONata clears the graph back to null.
+
+ALTER TABLE stackbone_platform.trigger_subscriptions
+ADD COLUMN IF NOT EXISTS mapping_graph jsonb;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackbone/cli",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {
@@ -37,6 +37,7 @@
     "postgres": "^3.4.9",
     "semver": "^7.7.4",
     "tar": "^7.5.13",
+    "unpdf": "^0.12.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6"
   }