@kelpie/server 0.3.0 → 0.4.0

package/migrations/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1786410884983,
       "tag": "0016_misty_mentor",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1786490413323,
+      "tag": "0017_drop_integration_connections",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kelpie/server",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The Kelpie service as a library: module runtime, core CRM modules, REST API, MCP surface, and the shared migration pipeline.",
   "keywords": [
     "kelpie",
@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@kelpie/schemas": "^0.3.0",
+    "@kelpie/schemas": "^0.4.0",
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32",

package/src/lib/ids.ts

@@ -36,7 +36,6 @@ export const idPrefixes = {
   agentRegistration: 'ag',
   agentRun: 'run',
   importJob: 'imp',
-  integrationConnection: 'int',
   /** Never returns over the wire either: identified by `(workspace_id, module_id)` instead. */
   moduleSetting: 'mset',
   /**

package/src/modules/core.ts

@@ -13,7 +13,6 @@ import { createFormsModule } from './forms/index.ts'
 import { createHandbookModule } from './handbook/index.ts'
 import { createHiringModule } from './hiring/index.ts'
 import { createImportExportModule } from './import-export/index.ts'
-import * as integrations from './integrations/schema.ts'
 import { createNotesModule } from './notes/index.ts'
 import { createOpportunitiesModule } from './opportunities/index.ts'
 import { createPartnershipsModule } from './partnerships/index.ts'
@@ -40,21 +39,6 @@ import { createWorkspaceModule } from './workspace/index.ts'
  */
 export const coreMigrationsDirectory = fileURLToPath(new URL('../../migrations', import.meta.url))
 
-interface CoreModuleDefinition {
-  readonly id: string
-  readonly requires?: readonly string[]
-  readonly tables: Readonly<Record<string, unknown>>
-}
-
-const definitions: readonly CoreModuleDefinition[] = [
-  { id: 'integrations', requires: ['workspace'], tables: integrations },
-]
-
-/**
- * Modules with behaviour are written out; the rest contribute only tables so far
- * and are generated from the table above. As each grows routes and services it
- * moves out of `definitions` into its own module file, like `auth` has.
- */
 export const coreModules: readonly KelpieModule[] = [
   createAuthModule(coreMigrationsDirectory),
   createWorkspaceModule(coreMigrationsDirectory),
@@ -81,13 +65,4 @@ export const coreModules: readonly KelpieModule[] = [
   createImportExportModule(coreMigrationsDirectory),
   createAgentTasksModule(coreMigrationsDirectory),
   createWebhooksModule(coreMigrationsDirectory),
-  ...definitions.map((definition): KelpieModule => ({
-    id: definition.id,
-    ...(definition.requires === undefined ? {} : { requires: definition.requires }),
-    register(context) {
-      context.schema(definition.tables, coreMigrationsDirectory)
-
-      return Promise.resolve()
-    },
-  })),
 ]

package/src/modules/import-export/drafts.ts

@@ -120,8 +120,21 @@ function enumeration(
   return canonicalEnum(values, mapped[column]) ?? undefined
 }
 
-/** Drops the keys whose value is undefined, so a draft holds only what it sets. */
-function present<T extends object>(draft: T): T {
+/**
+ * Drops the keys whose value is undefined, so a draft holds only what it sets.
+ *
+ * The parameter is not `T`. Under `exactOptionalPropertyTypes` an optional key
+ * declared `name?: string` may be absent but may not be present holding
+ * `undefined`, and every literal below spells out all of its keys and lets the
+ * extractors return `undefined` for the columns the row did not carry. So the
+ * input is `T` with every key required and `undefined` allowed, and the return
+ * is `T`, where the absences this function creates are the only ones. Requiring
+ * the keys is the useful half: a field left out of a literal is a compile error
+ * rather than a column that silently never imports.
+ */
+type Supplied<T> = { [K in keyof T]-?: T[K] | undefined }
+
+function present<T extends object>(draft: Supplied<T>): T {
   return Object.fromEntries(Object.entries(draft).filter(([, value]) => value !== undefined)) as T
 }
 

package/src/modules/reseal.ts

@@ -4,7 +4,6 @@ import type { Database } from '../lib/database.ts'
 import { SecretDecryptionError } from '../lib/secrets.ts'
 import type { SecretCipher } from '../lib/secrets.ts'
 import { agentRegistrations } from './agent-tasks/schema.ts'
-import { integrationConnections } from './integrations/schema.ts'
 import { webhooks } from './webhooks/schema.ts'
 
 /**
@@ -37,18 +36,20 @@ interface SealedColumn {
 }
 
 /**
- * Every column holding a value sealed by `lib/secrets.ts`.
+ * Every column in core's schema holding a value sealed by `lib/secrets.ts`.
  *
- * All three that exist are here, including the two nothing writes yet. Covering
- * a column before its first write is the cheap half of this: the expensive half
- * is noticing, a year later, that a rotation reported success while stranding a
- * customer's stored OAuth credential with no way back. `resealTest` asserts this
- * list against the schema, so a fourth `_encrypted` column fails a test the day
- * it is added rather than at the next rotation.
+ * All three that exist are here, including `agent_registrations`, which nothing
+ * writes yet. Covering a column before its first write is the cheap half of
+ * this: the expensive half is noticing, a year later, that a rotation reported
+ * success while stranding a customer's stored credential with no way back. The
+ * test asserts this list against the schema, so a fourth `_encrypted` column
+ * fails the day it is added rather than at the next rotation.
  *
  * There is no registry for modules to declare these through, on purpose. One
  * caller does not need an extension point, and a sealed column that nothing
- * re-seals is a bug whichever way it was registered.
+ * re-seals is a bug whichever way it was registered. A module outside core
+ * seals under the same key through `createSecretCipher` and brings its own pass
+ * over its own tables, which this one cannot see.
  */
 const SEALED_COLUMNS: readonly SealedColumn[] = [
   {
@@ -79,19 +80,6 @@ const SEALED_COLUMNS: readonly SealedColumn[] = [
         .where(eq(agentRegistrations.id, id))
     },
   },
-  {
-    label: 'integration_connections.secrets_encrypted',
-    read: async (db) =>
-      db
-        .select({ id: integrationConnections.id, sealed: integrationConnections.secretsEncrypted })
-        .from(integrationConnections),
-    write: async (db, id, sealed) => {
-      await db
-        .update(integrationConnections)
-        .set({ secretsEncrypted: sealed })
-        .where(eq(integrationConnections.id, id))
-    },
-  },
 ]
 
 /** The columns this pass covers. Exported for the test that checks none is missing. */

package/src/modules/workspace/repository.ts

@@ -41,10 +41,21 @@ export async function findWorkspace(db: Queryable, id: string): Promise<Workspac
   return found
 }
 
+/**
+ * A PATCH's changes, as they arrive: every key optional, and a key may be
+ * present holding `undefined` because that is what a parsed request body looks
+ * like. `Partial<T>` alone permits only the absence, not the `undefined`.
+ *
+ * Passing `undefined` through is safe rather than merely tolerated. Drizzle's
+ * `mapUpdateSet` filters those entries out before building the `set` clause, so
+ * a field the caller did not send is left alone instead of being written null.
+ */
+type Changes<T> = { [K in keyof T]?: T[K] | undefined }
+
 export async function updateWorkspace(
   db: Queryable,
   id: string,
-  changes: Partial<typeof workspaces.$inferInsert>,
+  changes: Changes<typeof workspaces.$inferInsert>,
 ): Promise<WorkspaceRecord | undefined> {
   const [updated] = await db.update(workspaces).set(changes).where(eq(workspaces.id, id)).returning()
 

package/src/modules/workspace/service.ts

@@ -83,12 +83,22 @@ export interface CreateWorkspaceInput {
   readonly timezone: string
 }
 
+/**
+ * A partial update, on `api.md`'s rule: an absent field is not being changed,
+ * and `null` clears one.
+ *
+ * Every field spells out `| undefined` because a caller reaches this with the
+ * parsed request body, and Zod produces a key holding `undefined` rather than no
+ * key at all. Under `exactOptionalPropertyTypes` those are different types, and
+ * they are not different behaviour here: `update` spreads this into Drizzle's
+ * `set`, which skips undefined values.
+ */
 export interface UpdateWorkspaceInput {
-  readonly name?: string
-  readonly slug?: string
-  readonly timezone?: string
-  readonly tagline?: string | null
-  readonly oneLiner?: string | null
+  readonly name?: string | undefined
+  readonly slug?: string | undefined
+  readonly timezone?: string | undefined
+  readonly tagline?: string | null | undefined
+  readonly oneLiner?: string | null | undefined
 }
 
 export interface WorkspaceService {

package/src/runtime/registry.ts

@@ -43,22 +43,32 @@ export interface ModuleRouter {
   readonly router: Hono
 }
 
+/**
+ * What `registerModules` needs.
+ *
+ * Every optional field spells out `| undefined`, which is not noise. Under
+ * `exactOptionalPropertyTypes` an omitted key and a key holding `undefined` are
+ * different types, and an assembly building these options has the second:
+ * `readModuleConfigFile` returns `undefined` when no override file is
+ * configured. Without it, core hands a caller a value its own runtime refuses.
+ * None of the four fields tells the two cases apart.
+ */
 export interface ModuleRuntimeOptions {
   readonly modules: readonly KelpieModule[]
   /** Raw variables. Each module validates the slice it needs via `context.config`. */
   readonly environment: Environment
   readonly logger: Logger
   /** Injected so a test can watch what core modules subscribe to. Defaults to a fresh bus. */
-  readonly events?: EventBus
+  readonly events?: EventBus | undefined
   /** Injected so a test can grant or deny before core modules register. */
-  readonly entitlements?: EntitlementRegistry
+  readonly entitlements?: EntitlementRegistry | undefined
   /** The database, transaction scope, and collaborators every module builds on. */
   readonly services: ModuleServices
   /**
    * The deploy-time module override (`lib/moduleConfig.ts`), parsed. A locked
    * module id wins over whatever a workspace's own settings say.
    */
-  readonly moduleConfig?: Readonly<Record<string, boolean>>
+  readonly moduleConfig?: Readonly<Record<string, boolean>> | undefined
   /**
    * Resolves the caller of a REST request, the same way every route already
    * does (`modules/auth/credentials.ts`), so a non-structural module's router
@@ -70,7 +80,7 @@ export interface ModuleRuntimeOptions {
    * every test that does not exercise module toggling wants without having to
    * say so.
    */
-  readonly resolveActor?: (context: Context) => Promise<Actor>
+  readonly resolveActor?: ((context: Context) => Promise<Actor>) | undefined
 }
 
 /** Contributions accumulate here, one mutable set per registration pass. */

package/src/schema/index.ts

@@ -27,5 +27,4 @@ export * from '../modules/forms/schema.ts'
 export * from '../modules/import-export/schema.ts'
 export * from '../modules/agent-tasks/schema.ts'
 export * from '../modules/webhooks/schema.ts'
-export * from '../modules/integrations/schema.ts'
 export * from '../modules/rate-limit/schema.ts'

package/src/modules/integrations/schema.ts

@@ -1,31 +0,0 @@
-import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core'
-
-import { createdAt, moment, primaryId, updatedAt } from '../../lib/columns.ts'
-import { users } from '../auth/schema.ts'
-import { workspaces } from '../workspace/schema.ts'
-
-/**
- * Core owns the connection lifecycle; the provider itself ships as a module and
- * declares `provider_id`. Module-owned provider tables reference this row.
- *
- * `user_id` is set for personal connections such as a Gmail mailbox, null for
- * workspace-wide ones.
- */
-export const integrationConnections = pgTable(
-  'integration_connections',
-  {
-    id: primaryId(),
-    workspaceId: text('workspace_id')
-      .notNull()
-      .references(() => workspaces.id, { onDelete: 'cascade' }),
-    providerId: text('provider_id').notNull(),
-    userId: text('user_id').references(() => users.id, { onDelete: 'cascade' }),
-    status: text('status').notNull(),
-    config: jsonb('config').notNull().default({}),
-    secretsEncrypted: text('secrets_encrypted'),
-    lastSyncAt: moment('last_sync_at'),
-    createdAt: createdAt(),
-    updatedAt: updatedAt(),
-  },
-  (table) => [index('integration_connections_workspace_idx').on(table.workspaceId)],
-)