@kelpie/server 0.3.1 → 0.4.1

package/migrations/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1786410884983,
       "tag": "0016_misty_mentor",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1786490413323,
+      "tag": "0017_drop_integration_connections",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kelpie/server",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "The Kelpie service as a library: module runtime, core CRM modules, REST API, MCP surface, and the shared migration pipeline.",
   "keywords": [
     "kelpie",
@@ -52,16 +52,18 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@kelpie/schemas": "^0.3.1",
+    "@kelpie/schemas": "^0.4.1",
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32",
+    "nodemailer": "^9.0.5",
     "postgres": "^3.4.9",
     "ulid": "^3.0.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
+    "@types/nodemailer": "^8.0.1",
     "drizzle-kit": "^0.31.10",
     "vite": "^8.2.0",
     "vitest": "^4.1.10"

package/src/lib/config.ts

@@ -69,31 +69,41 @@ const environmentSchema = z.object({
   LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']),
   KELPIE_MODULE_CONFIG_PATH: z.string().min(1).optional(),
   WEB_BUNDLE_DIR: z.string().min(1).optional(),
-  ...emailConfigSchema.shape,
   ...rateLimitConfigSchema.shape,
 })
 
 /**
  * Parses an environment into a validated config.
  *
+ * `emailConfigSchema` is a discriminated union, so it is parsed separately
+ * from the rest: a union has no flat `.shape` to spread into `environmentSchema`,
+ * only its own `EMAIL_PROVIDER`-keyed branches. Problems from both parses are
+ * combined into one error, preserving the "every missing variable at once" rule.
+ *
  * @param environment Raw variables, normally `process.env`.
  * @throws ConfigurationError listing every invalid or missing variable.
  */
 export function loadConfig(environment: Environment): KelpieConfig {
-  const result = environmentSchema.safeParse(environment)
+  const environmentResult = environmentSchema.safeParse(environment)
+  const emailResult = emailConfigSchema.safeParse(environment)
+
+  if (!environmentResult.success || !emailResult.success) {
+    const problems = [
+      ...(environmentResult.success ? [] : environmentResult.error.issues.map(describeValidationIssue)),
+      ...(emailResult.success ? [] : emailResult.error.issues.map(describeValidationIssue)),
+    ]
 
-  if (!result.success) {
-    throw new ConfigurationError(result.error.issues.map(describeValidationIssue))
+    throw new ConfigurationError(problems)
   }
 
   return {
-    runtimeMode: result.data.NODE_ENV,
-    port: result.data.PORT,
-    databaseUrl: result.data.DATABASE_URL,
-    logLevel: result.data.LOG_LEVEL,
-    email: { EMAIL_PROVIDER: result.data.EMAIL_PROVIDER, EMAIL_FROM: result.data.EMAIL_FROM },
-    moduleConfigPath: result.data.KELPIE_MODULE_CONFIG_PATH,
-    webBundleDirectory: result.data.WEB_BUNDLE_DIR,
-    rateLimit: rateLimitConfigFrom(result.data),
+    runtimeMode: environmentResult.data.NODE_ENV,
+    port: environmentResult.data.PORT,
+    databaseUrl: environmentResult.data.DATABASE_URL,
+    logLevel: environmentResult.data.LOG_LEVEL,
+    email: emailResult.data,
+    moduleConfigPath: environmentResult.data.KELPIE_MODULE_CONFIG_PATH,
+    webBundleDirectory: environmentResult.data.WEB_BUNDLE_DIR,
+    rateLimit: rateLimitConfigFrom(environmentResult.data),
   }
 }

package/src/lib/email.ts

@@ -1,5 +1,7 @@
+import nodemailer from 'nodemailer'
 import { z } from 'zod'
 
+import { describeThrown } from './errors.ts'
 import type { Logger } from './logger.ts'
 
 /**
@@ -7,9 +9,15 @@ import type { Logger } from './logger.ts'
  * and account-change notifications, nothing else. Kelpie never sends outreach
  * email.
  *
- * Roadmap decision 4: the provider is configured, never hardcoded. Core ships the
- * port and the `log` provider. Real providers ship as modules, so the open-source
- * assembly has no vendor account baked into it.
+ * Roadmap decision 4: the provider is configured, never hardcoded. Core ships
+ * the port and two providers, `log` and `smtp`. Both need no vendor account a
+ * deployment doesn't already have, which is what keeps them in core rather than
+ * a module, per `modules.md`'s split test. A provider that does need one
+ * (Resend, Postmark, Mailtrap, SendGrid) is a commercial integration under that
+ * same test and belongs in a module: it supplies its own `EmailSender` from its
+ * own config, and an assembly's entry point wires it into `services.email` in
+ * place of `createEmailSender`, the same way `kelpie-cloud/src/server.ts` wires
+ * this one today.
  */
 
 export interface EmailMessage {
@@ -22,12 +30,28 @@ export interface EmailSender {
   send(message: EmailMessage): Promise<void>
 }
 
-export const emailConfigSchema = z.object({
-  EMAIL_PROVIDER: z.enum(['log']),
+const logEmailConfigSchema = z.object({
+  EMAIL_PROVIDER: z.literal('log'),
   EMAIL_FROM: z.string().min(1),
 })
 
+const smtpEmailConfigSchema = z.object({
+  EMAIL_PROVIDER: z.literal('smtp'),
+  EMAIL_FROM: z.string().min(1),
+  SMTP_HOST: z.string().min(1),
+  SMTP_PORT: z.coerce.number().int().positive().max(65535),
+  SMTP_SECURE: z.enum(['true', 'false']).transform((value) => value === 'true'),
+  SMTP_USER: z.string().min(1),
+  SMTP_PASSWORD: z.string().min(1),
+})
+
+export const emailConfigSchema = z.discriminatedUnion('EMAIL_PROVIDER', [
+  logEmailConfigSchema,
+  smtpEmailConfigSchema,
+])
+
 export type EmailConfig = z.infer<typeof emailConfigSchema>
+export type SmtpEmailConfig = z.infer<typeof smtpEmailConfigSchema>
 
 /**
  * Writes the message to the log instead of sending it. For self-hosted
@@ -51,15 +75,59 @@ export function createLogEmailSender(logger: Logger, from: string): EmailSender
   }
 }
 
+/**
+ * What `createSmtpEmailSender` sends a message through. A real deployment gets
+ * one backed by `nodemailer`; a test injects one that records calls, so the
+ * sender is verifiable without a container running a real SMTP conversation.
+ */
+export interface SmtpTransport {
+  sendMail(message: { from: string; to: string; subject: string; text: string }): Promise<unknown>
+}
+
+function createNodemailerTransport(config: SmtpEmailConfig): SmtpTransport {
+  return nodemailer.createTransport({
+    host: config.SMTP_HOST,
+    port: config.SMTP_PORT,
+    secure: config.SMTP_SECURE,
+    auth: { user: config.SMTP_USER, pass: config.SMTP_PASSWORD },
+  })
+}
+
+/** Sends over SMTP. `transport` defaults to a real connection built from `config`. */
+export function createSmtpEmailSender(
+  config: SmtpEmailConfig,
+  logger: Logger,
+  transport: SmtpTransport = createNodemailerTransport(config),
+): EmailSender {
+  return {
+    async send(message) {
+      try {
+        await transport.sendMail({
+          from: config.EMAIL_FROM,
+          to: message.to,
+          subject: message.subject,
+          text: message.body,
+        })
+      } catch (cause) {
+        const reason = describeThrown(cause)
+        logger.error('smtp send failed', { to: message.to, reason })
+        throw new Error(`Failed to send email to ${message.to} over SMTP: ${reason}`, { cause })
+      }
+    },
+  }
+}
+
 /**
  * Builds the configured sender.
  *
- * @throws Never. An unknown provider cannot reach here: the config schema is an
- *   enum, so boot rejects it first.
+ * @throws Never. An unknown provider cannot reach here: the config schema is a
+ *   discriminated union, so boot rejects it first.
  */
 export function createEmailSender(config: EmailConfig, logger: Logger): EmailSender {
   switch (config.EMAIL_PROVIDER) {
     case 'log':
       return createLogEmailSender(logger, config.EMAIL_FROM)
+    case 'smtp':
+      return createSmtpEmailSender(config, logger)
   }
 }

package/src/lib/ids.ts

@@ -36,7 +36,6 @@ export const idPrefixes = {
   agentRegistration: 'ag',
   agentRun: 'run',
   importJob: 'imp',
-  integrationConnection: 'int',
   /** Never returns over the wire either: identified by `(workspace_id, module_id)` instead. */
   moduleSetting: 'mset',
   /**

package/src/modules/core.ts

@@ -13,7 +13,6 @@ import { createFormsModule } from './forms/index.ts'
 import { createHandbookModule } from './handbook/index.ts'
 import { createHiringModule } from './hiring/index.ts'
 import { createImportExportModule } from './import-export/index.ts'
-import * as integrations from './integrations/schema.ts'
 import { createNotesModule } from './notes/index.ts'
 import { createOpportunitiesModule } from './opportunities/index.ts'
 import { createPartnershipsModule } from './partnerships/index.ts'
@@ -40,21 +39,6 @@ import { createWorkspaceModule } from './workspace/index.ts'
  */
 export const coreMigrationsDirectory = fileURLToPath(new URL('../../migrations', import.meta.url))
 
-interface CoreModuleDefinition {
-  readonly id: string
-  readonly requires?: readonly string[]
-  readonly tables: Readonly<Record<string, unknown>>
-}
-
-const definitions: readonly CoreModuleDefinition[] = [
-  { id: 'integrations', requires: ['workspace'], tables: integrations },
-]
-
-/**
- * Modules with behaviour are written out; the rest contribute only tables so far
- * and are generated from the table above. As each grows routes and services it
- * moves out of `definitions` into its own module file, like `auth` has.
- */
 export const coreModules: readonly KelpieModule[] = [
   createAuthModule(coreMigrationsDirectory),
   createWorkspaceModule(coreMigrationsDirectory),
@@ -81,13 +65,4 @@ export const coreModules: readonly KelpieModule[] = [
   createImportExportModule(coreMigrationsDirectory),
   createAgentTasksModule(coreMigrationsDirectory),
   createWebhooksModule(coreMigrationsDirectory),
-  ...definitions.map((definition): KelpieModule => ({
-    id: definition.id,
-    ...(definition.requires === undefined ? {} : { requires: definition.requires }),
-    register(context) {
-      context.schema(definition.tables, coreMigrationsDirectory)
-
-      return Promise.resolve()
-    },
-  })),
 ]

package/src/modules/reseal.ts

@@ -4,7 +4,6 @@ import type { Database } from '../lib/database.ts'
 import { SecretDecryptionError } from '../lib/secrets.ts'
 import type { SecretCipher } from '../lib/secrets.ts'
 import { agentRegistrations } from './agent-tasks/schema.ts'
-import { integrationConnections } from './integrations/schema.ts'
 import { webhooks } from './webhooks/schema.ts'
 
 /**
@@ -37,18 +36,20 @@ interface SealedColumn {
 }
 
 /**
- * Every column holding a value sealed by `lib/secrets.ts`.
+ * Every column in core's schema holding a value sealed by `lib/secrets.ts`.
  *
- * All three that exist are here, including the two nothing writes yet. Covering
- * a column before its first write is the cheap half of this: the expensive half
- * is noticing, a year later, that a rotation reported success while stranding a
- * customer's stored OAuth credential with no way back. `resealTest` asserts this
- * list against the schema, so a fourth `_encrypted` column fails a test the day
- * it is added rather than at the next rotation.
+ * All three that exist are here, including `agent_registrations`, which nothing
+ * writes yet. Covering a column before its first write is the cheap half of
+ * this: the expensive half is noticing, a year later, that a rotation reported
+ * success while stranding a customer's stored credential with no way back. The
+ * test asserts this list against the schema, so a fourth `_encrypted` column
+ * fails the day it is added rather than at the next rotation.
  *
  * There is no registry for modules to declare these through, on purpose. One
  * caller does not need an extension point, and a sealed column that nothing
- * re-seals is a bug whichever way it was registered.
+ * re-seals is a bug whichever way it was registered. A module outside core
+ * seals under the same key through `createSecretCipher` and brings its own pass
+ * over its own tables, which this one cannot see.
  */
 const SEALED_COLUMNS: readonly SealedColumn[] = [
   {
@@ -79,19 +80,6 @@ const SEALED_COLUMNS: readonly SealedColumn[] = [
         .where(eq(agentRegistrations.id, id))
     },
   },
-  {
-    label: 'integration_connections.secrets_encrypted',
-    read: async (db) =>
-      db
-        .select({ id: integrationConnections.id, sealed: integrationConnections.secretsEncrypted })
-        .from(integrationConnections),
-    write: async (db, id, sealed) => {
-      await db
-        .update(integrationConnections)
-        .set({ secretsEncrypted: sealed })
-        .where(eq(integrationConnections.id, id))
-    },
-  },
 ]
 
 /** The columns this pass covers. Exported for the test that checks none is missing. */

package/src/schema/index.ts

@@ -27,5 +27,4 @@ export * from '../modules/forms/schema.ts'
 export * from '../modules/import-export/schema.ts'
 export * from '../modules/agent-tasks/schema.ts'
 export * from '../modules/webhooks/schema.ts'
-export * from '../modules/integrations/schema.ts'
 export * from '../modules/rate-limit/schema.ts'

package/src/modules/integrations/schema.ts

@@ -1,31 +0,0 @@
-import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core'
-
-import { createdAt, moment, primaryId, updatedAt } from '../../lib/columns.ts'
-import { users } from '../auth/schema.ts'
-import { workspaces } from '../workspace/schema.ts'
-
-/**
- * Core owns the connection lifecycle; the provider itself ships as a module and
- * declares `provider_id`. Module-owned provider tables reference this row.
- *
- * `user_id` is set for personal connections such as a Gmail mailbox, null for
- * workspace-wide ones.
- */
-export const integrationConnections = pgTable(
-  'integration_connections',
-  {
-    id: primaryId(),
-    workspaceId: text('workspace_id')
-      .notNull()
-      .references(() => workspaces.id, { onDelete: 'cascade' }),
-    providerId: text('provider_id').notNull(),
-    userId: text('user_id').references(() => users.id, { onDelete: 'cascade' }),
-    status: text('status').notNull(),
-    config: jsonb('config').notNull().default({}),
-    secretsEncrypted: text('secrets_encrypted'),
-    lastSyncAt: moment('last_sync_at'),
-    createdAt: createdAt(),
-    updatedAt: updatedAt(),
-  },
-  (table) => [index('integration_connections_workspace_idx').on(table.workspaceId)],
-)