feat(dgw): record provisioner tasks in gateway.db

crates/provisioner-task-libsql/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "provisioner-task-libsql"
+version = "0.0.0"
+edition = "2024"
+authors = ["Devolutions Inc. <infos@devolutions.net>"]
+publish = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = "1"
+async-trait = "0.1"
+libsql = { version = "0.9", default-features = false, features = ["core"] }
+provisioner-task.path = "../provisioner-task"
+serde_json = "1"
+time = { version = "0.3", default-features = false }
+tokio = { version = "1.52", features = ["sync"] }
+tracing = "0.1"
+uuid = "1.23"
+
+[dev-dependencies]
+gateway-db.path = "../gateway-db"
+tempfile = "3.24"
+tokio = { version = "1.52", features = ["macros", "rt-multi-thread"] }
+uuid = { version = "1.23", features = ["v4"] }

crates/provisioner-task-libsql/INTENT.md

@@ -0,0 +1,21 @@
+# Background
+This crate stores provisioner Task records in `gateway.db`, implementing `ProvisionerTaskStore` from `provisioner-task`.
+The states and transitions of a Task are defined in `../provisioner-task/INTENT.md`.
+
+# Invariants
+
+## Tables and migrations
+The tables of this crate are named with the `provisioner_task_` prefix; the prefix is the compatibility boundary.
+This crate alone creates and migrates its tables, and its migrations are append-only.
+Its schema version is the `schema_version` row of `provisioner_task_metadata`, never the file's `PRAGMA user_version`.
+This crate may depend on `gateway-db`, never the other way around.
+
+## Records
+For a given kind and target, at most one record can be unfinished.
+
+A record past its deadline is failed.
+
+Each change of state is atomic: a record is never seen half moved from one state to another.
+
+## Secrets
+Records never hold secrets: parameters and payloads are stored as given, in clear.

crates/provisioner-task-libsql/migrations/01_provisioner_task.sql

@@ -0,0 +1,26 @@
+CREATE TABLE provisioner_task_records (
+    id TEXT PRIMARY KEY,
+    kind TEXT NOT NULL,
+    target TEXT NOT NULL,
+    params TEXT NOT NULL,
+    state TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    attempts INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    started_at INTEGER,
+    finished_at INTEGER,
+    deadline_at INTEGER NOT NULL,
+    job_token TEXT NOT NULL,
+    CHECK (state IN ('queued', 'running', 'succeeded', 'failed')),
+    CHECK ((state IN ('succeeded', 'failed')) = (finished_at IS NOT NULL)),
+    CHECK (json_valid(params) AND json_valid(payload)),
+    CHECK (attempts >= 0)
+);
+
+CREATE UNIQUE INDEX provisioner_task_records_unfinished ON provisioner_task_records (kind, target)
+    WHERE state IN ('queued', 'running');
+
+CREATE TABLE provisioner_task_metadata (
+    key TEXT PRIMARY KEY,
+    value BLOB NOT NULL
+);