@kelpie/server 0.3.1 → 0.4.0

package/migrations/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1786410884983,
       "tag": "0016_misty_mentor",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1786490413323,
+      "tag": "0017_drop_integration_connections",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kelpie/server",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "The Kelpie service as a library: module runtime, core CRM modules, REST API, MCP surface, and the shared migration pipeline.",
   "keywords": [
     "kelpie",
@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@kelpie/schemas": "^0.3.1",
+    "@kelpie/schemas": "^0.4.0",
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32",

package/src/lib/ids.ts

@@ -36,7 +36,6 @@ export const idPrefixes = {
   agentRegistration: 'ag',
   agentRun: 'run',
   importJob: 'imp',
-  integrationConnection: 'int',
   /** Never returns over the wire either: identified by `(workspace_id, module_id)` instead. */
   moduleSetting: 'mset',
   /**

package/src/modules/core.ts

@@ -13,7 +13,6 @@ import { createFormsModule } from './forms/index.ts'
 import { createHandbookModule } from './handbook/index.ts'
 import { createHiringModule } from './hiring/index.ts'
 import { createImportExportModule } from './import-export/index.ts'
-import * as integrations from './integrations/schema.ts'
 import { createNotesModule } from './notes/index.ts'
 import { createOpportunitiesModule } from './opportunities/index.ts'
 import { createPartnershipsModule } from './partnerships/index.ts'
@@ -40,21 +39,6 @@ import { createWorkspaceModule } from './workspace/index.ts'
  */
 export const coreMigrationsDirectory = fileURLToPath(new URL('../../migrations', import.meta.url))
 
-interface CoreModuleDefinition {
-  readonly id: string
-  readonly requires?: readonly string[]
-  readonly tables: Readonly<Record<string, unknown>>
-}
-
-const definitions: readonly CoreModuleDefinition[] = [
-  { id: 'integrations', requires: ['workspace'], tables: integrations },
-]
-
-/**
- * Modules with behaviour are written out; the rest contribute only tables so far
- * and are generated from the table above. As each grows routes and services it
- * moves out of `definitions` into its own module file, like `auth` has.
- */
 export const coreModules: readonly KelpieModule[] = [
   createAuthModule(coreMigrationsDirectory),
   createWorkspaceModule(coreMigrationsDirectory),
@@ -81,13 +65,4 @@ export const coreModules: readonly KelpieModule[] = [
   createImportExportModule(coreMigrationsDirectory),
   createAgentTasksModule(coreMigrationsDirectory),
   createWebhooksModule(coreMigrationsDirectory),
-  ...definitions.map((definition): KelpieModule => ({
-    id: definition.id,
-    ...(definition.requires === undefined ? {} : { requires: definition.requires }),
-    register(context) {
-      context.schema(definition.tables, coreMigrationsDirectory)
-
-      return Promise.resolve()
-    },
-  })),
 ]

package/src/modules/reseal.ts

@@ -4,7 +4,6 @@ import type { Database } from '../lib/database.ts'
 import { SecretDecryptionError } from '../lib/secrets.ts'
 import type { SecretCipher } from '../lib/secrets.ts'
 import { agentRegistrations } from './agent-tasks/schema.ts'
-import { integrationConnections } from './integrations/schema.ts'
 import { webhooks } from './webhooks/schema.ts'
 
 /**
@@ -37,18 +36,20 @@ interface SealedColumn {
 }
 
 /**
- * Every column holding a value sealed by `lib/secrets.ts`.
+ * Every column in core's schema holding a value sealed by `lib/secrets.ts`.
  *
- * All three that exist are here, including the two nothing writes yet. Covering
- * a column before its first write is the cheap half of this: the expensive half
- * is noticing, a year later, that a rotation reported success while stranding a
- * customer's stored OAuth credential with no way back. `resealTest` asserts this
- * list against the schema, so a fourth `_encrypted` column fails a test the day
- * it is added rather than at the next rotation.
+ * All three that exist are here, including `agent_registrations`, which nothing
+ * writes yet. Covering a column before its first write is the cheap half of
+ * this: the expensive half is noticing, a year later, that a rotation reported
+ * success while stranding a customer's stored credential with no way back. The
+ * test asserts this list against the schema, so a fourth `_encrypted` column
+ * fails the day it is added rather than at the next rotation.
  *
  * There is no registry for modules to declare these through, on purpose. One
  * caller does not need an extension point, and a sealed column that nothing
- * re-seals is a bug whichever way it was registered.
+ * re-seals is a bug whichever way it was registered. A module outside core
+ * seals under the same key through `createSecretCipher` and brings its own pass
+ * over its own tables, which this one cannot see.
  */
 const SEALED_COLUMNS: readonly SealedColumn[] = [
   {
@@ -79,19 +80,6 @@ const SEALED_COLUMNS: readonly SealedColumn[] = [
         .where(eq(agentRegistrations.id, id))
     },
   },
-  {
-    label: 'integration_connections.secrets_encrypted',
-    read: async (db) =>
-      db
-        .select({ id: integrationConnections.id, sealed: integrationConnections.secretsEncrypted })
-        .from(integrationConnections),
-    write: async (db, id, sealed) => {
-      await db
-        .update(integrationConnections)
-        .set({ secretsEncrypted: sealed })
-        .where(eq(integrationConnections.id, id))
-    },
-  },
 ]
 
 /** The columns this pass covers. Exported for the test that checks none is missing. */

package/src/schema/index.ts

@@ -27,5 +27,4 @@ export * from '../modules/forms/schema.ts'
 export * from '../modules/import-export/schema.ts'
 export * from '../modules/agent-tasks/schema.ts'
 export * from '../modules/webhooks/schema.ts'
-export * from '../modules/integrations/schema.ts'
 export * from '../modules/rate-limit/schema.ts'

package/src/modules/integrations/schema.ts

@@ -1,31 +0,0 @@
-import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core'
-
-import { createdAt, moment, primaryId, updatedAt } from '../../lib/columns.ts'
-import { users } from '../auth/schema.ts'
-import { workspaces } from '../workspace/schema.ts'
-
-/**
- * Core owns the connection lifecycle; the provider itself ships as a module and
- * declares `provider_id`. Module-owned provider tables reference this row.
- *
- * `user_id` is set for personal connections such as a Gmail mailbox, null for
- * workspace-wide ones.
- */
-export const integrationConnections = pgTable(
-  'integration_connections',
-  {
-    id: primaryId(),
-    workspaceId: text('workspace_id')
-      .notNull()
-      .references(() => workspaces.id, { onDelete: 'cascade' }),
-    providerId: text('provider_id').notNull(),
-    userId: text('user_id').references(() => users.id, { onDelete: 'cascade' }),
-    status: text('status').notNull(),
-    config: jsonb('config').notNull().default({}),
-    secretsEncrypted: text('secrets_encrypted'),
-    lastSyncAt: moment('last_sync_at'),
-    createdAt: createdAt(),
-    updatedAt: updatedAt(),
-  },
-  (table) => [index('integration_connections_workspace_idx').on(table.workspaceId)],
-)