@vendoai/store 0.1.0

package/dist/connections-store.d.ts

@@ -0,0 +1,25 @@
+import type { Principal } from "@vendoai/core";
+import type { VendoDb } from "./db.js";
+/** Structural stand-in for `vendo/server`'s `IntegrationCatalogEntry`. */
+export interface IntegrationCatalogEntry {
+    id: string;
+    name: string;
+}
+export interface DurableConnectionsStore {
+    list(): Promise<Array<IntegrationCatalogEntry & {
+        connected: boolean;
+    }>>;
+    connect(id: string): Promise<void>;
+    disconnect(id: string): Promise<void>;
+    connectedToolkits(): Promise<string[]>;
+    /** Record the Composio connected-account id once the OAuth flow lands. */
+    setConnectedAccount(toolkit: string, connectedAccountId: string): Promise<void>;
+    /** Webhook routing: which principal owns this connected account? */
+    findByConnectedAccount(connectedAccountId: string): Promise<{
+        toolkit: string;
+        principal: Principal;
+    } | undefined>;
+}
+export declare function createDrizzleConnectionsStore(handle: VendoDb, scope: Principal, catalog: IntegrationCatalogEntry[], opts?: {
+    now?: () => string;
+}): DurableConnectionsStore;

package/dist/connections-store.js

@@ -0,0 +1,102 @@
+/**
+ * DrizzleConnectionsStore — durable implementation of the STRUCTURAL shape of
+ * `vendo/server`'s `ConnectionsStore` (packages/vendo-server/src/connections.ts):
+ * which toolkits are connected, i.e. what the agent ingests. Duck-typed
+ * locally (not imported) to avoid a server -> store -> server dependency cycle.
+ * Both the upstream interface and this durable port are fully async — every
+ * operation here is a DB round-trip, and the upstream in-memory store matches
+ * that shape (even though it never actually awaits) so the two are drop-in
+ * compatible: `vendo/server`'s handler wires this in whenever durable
+ * storage is configured, the in-memory one otherwise.
+ *
+ * Two additions beyond the upstream shape (webhook + integrations flow):
+ *  - `setConnectedAccount` records the Composio connected-account id once the
+ *    OAuth flow lands.
+ *  - `findByConnectedAccount` is a CROSS-PRINCIPAL lookup (unlike every other
+ *    method here, which is scoped to the store's own Principal) — webhook
+ *    routing needs to answer "which principal owns this connected account?"
+ *    before it has a scope to work with.
+ */
+import { and, eq } from "drizzle-orm";
+import { connections } from "./schema.js";
+const CONNECTED = "connected";
+const DISCONNECTED = "disconnected";
+export function createDrizzleConnectionsStore(handle, scope, catalog, opts = {}) {
+    const db = handle.db;
+    const now = opts.now ?? (() => new Date().toISOString());
+    const validIds = new Set(catalog.map((c) => c.id));
+    async function connectedSet() {
+        const rows = await db
+            .select({ toolkit: connections.toolkit })
+            .from(connections)
+            .where(and(eq(connections.tenantId, scope.tenantId), eq(connections.subject, scope.subject), eq(connections.status, CONNECTED)));
+        return new Set(rows.map((r) => r.toolkit));
+    }
+    return {
+        async list() {
+            const connected = await connectedSet();
+            return catalog.map((c) => ({ ...c, connected: connected.has(c.id) }));
+        },
+        async connect(id) {
+            if (!validIds.has(id))
+                return;
+            await db
+                .insert(connections)
+                .values({
+                toolkit: id,
+                tenantId: scope.tenantId,
+                subject: scope.subject,
+                connectedAccountId: null,
+                status: CONNECTED,
+                createdAt: now(),
+            })
+                .onConflictDoUpdate({
+                target: [connections.tenantId, connections.subject, connections.toolkit],
+                set: { status: CONNECTED },
+            });
+        },
+        async disconnect(id) {
+            await db
+                .update(connections)
+                .set({ status: DISCONNECTED })
+                .where(and(eq(connections.tenantId, scope.tenantId), eq(connections.subject, scope.subject), eq(connections.toolkit, id)));
+        },
+        async connectedToolkits() {
+            const connected = await connectedSet();
+            return catalog.filter((c) => connected.has(c.id)).map((c) => c.id);
+        },
+        async setConnectedAccount(toolkit, connectedAccountId) {
+            if (!validIds.has(toolkit))
+                return;
+            await db
+                .insert(connections)
+                .values({
+                toolkit,
+                tenantId: scope.tenantId,
+                subject: scope.subject,
+                connectedAccountId,
+                status: CONNECTED,
+                createdAt: now(),
+            })
+                .onConflictDoUpdate({
+                target: [connections.tenantId, connections.subject, connections.toolkit],
+                set: { connectedAccountId, status: CONNECTED },
+            });
+        },
+        async findByConnectedAccount(connectedAccountId) {
+            // Status-filtered: disconnect() flips the row to DISCONNECTED without
+            // clearing connectedAccountId (so reconnecting can leave routing
+            // history intact) — a redelivered/live webhook for a disconnected
+            // account must NOT resolve a principal, or a revoked toolkit would
+            // keep firing automations after the user disconnected it.
+            const rows = await db
+                .select()
+                .from(connections)
+                .where(and(eq(connections.connectedAccountId, connectedAccountId), eq(connections.status, CONNECTED)));
+            const row = rows[0];
+            if (!row)
+                return undefined;
+            return { toolkit: row.toolkit, principal: { tenantId: row.tenantId, subject: row.subject } };
+        },
+    };
+}

package/dist/db.d.ts

@@ -0,0 +1,28 @@
+import { drizzle as drizzlePglite } from "drizzle-orm/pglite";
+import { drizzle as drizzlePg } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+export interface VendoDatabaseConfig {
+    connectionString?: string;
+    pglite?: {
+        dataDir: string;
+    };
+}
+export type VendoDb = {
+    kind: "pglite";
+    db: ReturnType<typeof drizzlePglite>;
+    cacheKey: string;
+} | {
+    kind: "pg";
+    db: ReturnType<typeof drizzlePg>;
+    cacheKey: string;
+};
+/**
+ * pg.Pool re-emits idle-client errors (backend restart, dropped connection)
+ * on itself; with no 'error' listener Node escalates that to an uncaught
+ * exception and kills the host process. The pool already discards the dead
+ * client — log and keep serving.
+ */
+export declare function createPgPool(connectionString: string): Pool;
+export declare function createVendoDatabase(config?: VendoDatabaseConfig): Promise<VendoDb>;
+/** Idempotent, race-safe (advisory lock on real PG), memoized per handle. */
+export declare function migrateVendoDatabase(handle: VendoDb): Promise<void>;

package/dist/db.js

@@ -0,0 +1,105 @@
+import { PGlite } from "@electric-sql/pglite";
+import { drizzle as drizzlePglite } from "drizzle-orm/pglite";
+import { migrate as migratePglite } from "drizzle-orm/pglite/migrator";
+import { drizzle as drizzlePg } from "drizzle-orm/node-postgres";
+import { migrate as migratePg } from "drizzle-orm/node-postgres/migrator";
+import { sql } from "drizzle-orm";
+import { Client, Pool } from "pg";
+import { fileURLToPath } from "node:url";
+import fs from "node:fs";
+import path from "node:path";
+const SERVERLESS_ENVS = ["VERCEL", "CF_PAGES", "AWS_LAMBDA_FUNCTION_NAME"];
+const MIGRATIONS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "migrations");
+const ADVISORY_LOCK_KEY = 7461001;
+const registry = (globalThis["__vendoStoreRegistry"] ??= {
+    instances: new Map(),
+    migrated: new Map(),
+});
+/**
+ * pg.Pool re-emits idle-client errors (backend restart, dropped connection)
+ * on itself; with no 'error' listener Node escalates that to an uncaught
+ * exception and kills the host process. The pool already discards the dead
+ * client — log and keep serving.
+ */
+export function createPgPool(connectionString) {
+    const pool = new Pool({ connectionString });
+    pool.on("error", (err) => console.error("[vendo] postgres pool: idle connection error (recovering)", err));
+    return pool;
+}
+export function createVendoDatabase(config = {}) {
+    // Precedence: explicit connectionString > explicit pglite > env DATABASE_URL
+    // > default PGlite — an explicitly passed `pglite` config must not lose to
+    // an ambient DATABASE_URL env var.
+    // `||` (not `??`): a set-but-empty DATABASE_URL means "no connection string",
+    // and must not become a shared "" cache key across different PGlite dirs.
+    const conn = config.connectionString || (config.pglite ? undefined : process.env["DATABASE_URL"] || undefined);
+    const dataDir = config.pglite?.dataDir ?? process.env["VENDO_DATA_DIR"] ?? ".vendo/data";
+    const cacheKey = conn ?? `pglite:${dataDir}`;
+    const existing = registry.instances.get(cacheKey);
+    if (existing)
+        return existing;
+    const created = (async () => {
+        if (conn)
+            return { kind: "pg", db: drizzlePg(createPgPool(conn)), cacheKey };
+        const onServerless = SERVERLESS_ENVS.find((e) => process.env[e]);
+        if (onServerless) {
+            throw new Error(`[vendo] PGlite (the zero-config store) cannot run on ${onServerless} — filesystems there are ephemeral. ` +
+                `Set DATABASE_URL to a hosted Postgres (Supabase, Neon, …) instead.`);
+        }
+        if (!dataDir.startsWith("memory://")) {
+            try {
+                fs.mkdirSync(dataDir, { recursive: true });
+                fs.accessSync(dataDir, fs.constants.W_OK);
+            }
+            catch (err) {
+                // Fail boot loudly — never fall back to a silent ephemeral store.
+                throw new Error(`[vendo] PGlite data directory "${dataDir}" is not writable — ` +
+                    `fix its permissions or point VENDO_DATA_DIR elsewhere. Cause: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        const client = await PGlite.create(dataDir);
+        return { kind: "pglite", db: drizzlePglite(client), cacheKey };
+    })();
+    created.catch(() => registry.instances.delete(cacheKey)); // failed boots retry
+    registry.instances.set(cacheKey, created);
+    return created;
+}
+/** Idempotent, race-safe (advisory lock on real PG), memoized per handle. */
+export function migrateVendoDatabase(handle) {
+    const memo = registry.migrated.get(handle.cacheKey);
+    if (memo)
+        return memo;
+    const run = (async () => {
+        if (handle.kind === "pglite") {
+            await migratePglite(handle.db, { migrationsFolder: MIGRATIONS_DIR, migrationsSchema: "vendo" });
+            return;
+        }
+        // Advisory locks are SESSION-scoped, and the handle's db wraps a pg.Pool:
+        // lock, migrate, and unlock could each run on a DIFFERENT pooled session,
+        // so the lock would protect nothing (and the unlock could target a session
+        // that never held it, leaking the lock on the one that did). Run the whole
+        // lock → migrate → unlock sequence on ONE dedicated connection instead.
+        // For the pg kind, cacheKey IS the connection string (see createVendoDatabase).
+        const client = new Client({ connectionString: handle.cacheKey });
+        await client.connect();
+        try {
+            const db = drizzlePg(client);
+            await db.execute(sql `select pg_advisory_lock(${ADVISORY_LOCK_KEY})`);
+            try {
+                await migratePg(db, { migrationsFolder: MIGRATIONS_DIR, migrationsSchema: "vendo" });
+            }
+            finally {
+                await db.execute(sql `select pg_advisory_unlock(${ADVISORY_LOCK_KEY})`);
+            }
+        }
+        finally {
+            await client.end();
+        }
+    })().catch((err) => {
+        throw new Error(`[vendo] migration failed — if this is a permissions error, grant the role CREATE on the database ` +
+            `or run migrations out-of-band (autoMigrate: false + migrateVendoDatabase). Cause: ${err instanceof Error ? err.message : String(err)}`);
+    });
+    run.catch(() => registry.migrated.delete(handle.cacheKey));
+    registry.migrated.set(handle.cacheKey, run);
+    return run;
+}

package/dist/decision-store.d.ts

@@ -0,0 +1,8 @@
+import type { Principal } from "@vendoai/core";
+import type { DecisionStore } from "@vendoai/runtime";
+import type { VendoDb } from "./db.js";
+/** `createDrizzleDecisionStore(handle, scope)` — one store per Principal,
+ *  mirroring how `rememberDecisions` is wired per-request. */
+export declare function createDrizzleDecisionStore(handle: VendoDb, scope: Principal, opts?: {
+    now?: () => string;
+}): DecisionStore;

package/dist/decision-store.js

@@ -0,0 +1,39 @@
+/**
+ * DrizzleDecisionStore — durable port of the runtime `DecisionStore` seam
+ * (packages/vendo-runtime/src/policy/remember.ts): memoised ask-once
+ * approval decisions, keyed by an opaque canonical key and scoped per
+ * Principal. Not a junk drawer — see the `decisions` table doc in schema.ts.
+ */
+import { and, eq } from "drizzle-orm";
+import { decisions } from "./schema.js";
+/** `createDrizzleDecisionStore(handle, scope)` — one store per Principal,
+ *  mirroring how `rememberDecisions` is wired per-request. */
+export function createDrizzleDecisionStore(handle, scope, opts = {}) {
+    const db = handle.db;
+    const now = opts.now ?? (() => new Date().toISOString());
+    return {
+        async get(canonicalKey) {
+            const rows = await db
+                .select()
+                .from(decisions)
+                .where(and(eq(decisions.tenantId, scope.tenantId), eq(decisions.subject, scope.subject), eq(decisions.canonicalKey, canonicalKey)));
+            const row = rows[0];
+            return row ? row.decision : undefined;
+        },
+        async set(canonicalKey, decision) {
+            await db
+                .insert(decisions)
+                .values({
+                tenantId: scope.tenantId,
+                subject: scope.subject,
+                canonicalKey,
+                decision,
+                createdAt: now(),
+            })
+                .onConflictDoUpdate({
+                target: [decisions.tenantId, decisions.subject, decisions.canonicalKey],
+                set: { decision },
+            });
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { and, desc, eq } from "drizzle-orm";
+export { createVendoDatabase, migrateVendoDatabase } from "./db.js";
+export type { VendoDatabaseConfig, VendoDb } from "./db.js";
+export { vendo, automations, automationVersions, automationRuns, decisions, threads, threadMessages, savedVendos, connections, meta, } from "./schema.js";
+export { getMeta, setMeta } from "./meta.js";
+export { DrizzleAutomationStore, toIso } from "./automation-store.js";
+export { createDrizzleDecisionStore } from "./decision-store.js";
+export { createDrizzleThreadStore } from "./thread-store.js";
+export { createDrizzleSavedVendoStore } from "./vendo-registry.js";
+export { createDrizzleConnectionsStore } from "./connections-store.js";
+export type { DurableConnectionsStore, IntegrationCatalogEntry } from "./connections-store.js";

package/dist/index.js

@@ -0,0 +1,15 @@
+// Re-exported so consumers (e.g. vendo/server's vendos.ts) build queries
+// against the SAME drizzle-orm instance this package resolved — a consumer
+// declaring its own `drizzle-orm` dependency can land on a different
+// peer-hashed copy in pnpm's node_modules, which breaks structurally (the
+// `Column`/`SQL` classes carry a private field, so TS sees two incompatible
+// nominal types even though the runtime code is identical).
+export { and, desc, eq } from "drizzle-orm";
+export { createVendoDatabase, migrateVendoDatabase } from "./db.js";
+export { vendo, automations, automationVersions, automationRuns, decisions, threads, threadMessages, savedVendos, connections, meta, } from "./schema.js";
+export { getMeta, setMeta } from "./meta.js";
+export { DrizzleAutomationStore, toIso } from "./automation-store.js";
+export { createDrizzleDecisionStore } from "./decision-store.js";
+export { createDrizzleThreadStore } from "./thread-store.js";
+export { createDrizzleSavedVendoStore } from "./vendo-registry.js";
+export { createDrizzleConnectionsStore } from "./connections-store.js";

package/dist/meta.d.ts

@@ -0,0 +1,5 @@
+import type { VendoDb } from "./db.js";
+/** Read one meta value; `undefined` on a miss. */
+export declare function getMeta(handle: VendoDb, key: string): Promise<unknown>;
+/** Upsert one meta value (last write wins). */
+export declare function setMeta(handle: VendoDb, key: string, value: unknown): Promise<void>;

package/dist/meta.js

@@ -0,0 +1,20 @@
+/**
+ * `meta` helpers — the tiny operational KV over the `vendo.meta` table
+ * (scheduler heartbeat, future flags). NOT for domain data; see the table
+ * doc in schema.ts.
+ */
+import { eq } from "drizzle-orm";
+import { meta } from "./schema.js";
+/** Read one meta value; `undefined` on a miss. */
+export async function getMeta(handle, key) {
+    const rows = await handle.db.select().from(meta).where(eq(meta.key, key));
+    return rows[0]?.value;
+}
+/** Upsert one meta value (last write wins). */
+export async function setMeta(handle, key, value) {
+    const updatedAt = new Date().toISOString();
+    await handle.db
+        .insert(meta)
+        .values({ key, value, updatedAt })
+        .onConflictDoUpdate({ target: meta.key, set: { value, updatedAt } });
+}