@khirby/plugin-pokelo 1.0.1 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khirby/plugin-pokelo",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Khirby — Pokelo RAG knowledge base context for AI Compose",
   "main": "src/index.ts",
   "keywords": [

package/src/pokelo-context.service.ts

@@ -1,5 +1,5 @@
 import { Injectable, Logger } from '@nestjs/common';
-import type { PokeloContextServiceLike, PokeloFetchOpts } from '../../../packages/plugin-host/src';
+import type { KnowledgeContextLike, PokeloFetchOpts } from '../../../packages/plugin-host/src';
 import { PokeloSettingsService } from './pokelo-settings.service';
 
 const SNIPPET_LIMIT_TOTAL = 8;
@@ -15,7 +15,7 @@ type McpToolResult = {
 };
 
 @Injectable()
-export class PokeloContextService implements PokeloContextServiceLike {
+export class PokeloContextService implements KnowledgeContextLike {
   private readonly logger = new Logger(PokeloContextService.name);
 
   constructor(private readonly settings: PokeloSettingsService) {}

package/src/pokelo-crypto.ts

@@ -1,60 +1,5 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
-
-const ALGORITHM = 'aes-256-gcm';
-const IV_BYTES = 12;
-const TAG_BYTES = 16;
-
-function getKey(): Buffer {
-  const raw = process.env.POKELO_SECRETS_KEY?.trim();
-  if (!raw) {
-    throw new Error('POKELO_SECRETS_KEY is not set');
-  }
-  let buf: Buffer;
-  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
-    buf = Buffer.from(raw, 'hex');
-  } else {
-    buf = Buffer.from(raw, 'base64');
-  }
-  if (buf.length !== 32) {
-    throw new Error(
-      "POKELO_SECRETS_KEY must be 32 bytes as hex (64 chars) or base64 — generate with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"",
-    );
-  }
-  return buf;
-}
-
-export function isPokeloSecretsKeyConfigured(): boolean {
-  try {
-    getKey();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Encrypts plaintext using AES-256-GCM.
- * Returns a base64 string: iv(12) + ciphertext + tag(16)
- */
-export function encrypt(plaintext: string): string {
-  const key = getKey();
-  const iv = randomBytes(IV_BYTES);
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return Buffer.concat([iv, encrypted, tag]).toString('base64');
-}
-
-/**
- * Decrypts a base64 blob produced by `encrypt`.
- */
-export function decrypt(ciphertext: string): string {
-  const key = getKey();
-  const buf = Buffer.from(ciphertext, 'base64');
-  const iv = buf.subarray(0, IV_BYTES);
-  const tag = buf.subarray(buf.length - TAG_BYTES);
-  const encrypted = buf.subarray(IV_BYTES, buf.length - TAG_BYTES);
-  const decipher = createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(tag);
-  return decipher.update(encrypted) + decipher.final('utf8');
-}
+export {
+  decrypt,
+  encrypt,
+  isInstanceSecretsKeyConfigured as isPokeloSecretsKeyConfigured,
+} from '../../../packages/plugin-host/src/instance-secrets';

package/src/pokelo-settings.service.ts

@@ -99,7 +99,7 @@ export class PokeloSettingsService {
     let encryptedToken: string | undefined = undefined;
     if (dto.token !== undefined && dto.token.trim()) {
       if (!isPokeloSecretsKeyConfigured()) {
-        throw AppException.badRequest('POKELO_SECRETS_KEY is not configured');
+        throw AppException.badRequest('KHIRBY_SECRETS_KEY is not configured');
       }
       encryptedToken = encrypt(dto.token.trim());
     }

package/src/pokelo.module.ts

@@ -1,12 +1,12 @@
 import { Global, Module } from '@nestjs/common';
-import { POKELO_CONTEXT_SERVICE } from '../../../packages/plugin-host/src';
+import { KNOWLEDGE_CONTEXT, POKELO_CONTEXT_SERVICE } from '../../../packages/plugin-host/src';
 import { PokeloSettingsService } from './pokelo-settings.service';
 import { PokeloContextService } from './pokelo-context.service';
 import { PokeloSettingsController } from './pokelo-settings.controller';
 
 /**
- * @Global so AI Compose (sibling plugin module) can @Optional()-inject
- * POKELO_CONTEXT_SERVICE (ADR-0022).
+ * @Global so sibling plugins can @Optional()-inject KNOWLEDGE_CONTEXT (ADR-0047).
+ * POKELO_CONTEXT_SERVICE stays as a second provide until published consumers bump.
  */
 @Global()
 @Module({
@@ -14,8 +14,9 @@ import { PokeloSettingsController } from './pokelo-settings.controller';
   providers: [
     PokeloSettingsService,
     PokeloContextService,
+    { provide: KNOWLEDGE_CONTEXT, useExisting: PokeloContextService },
     { provide: POKELO_CONTEXT_SERVICE, useExisting: PokeloContextService },
   ],
-  exports: [POKELO_CONTEXT_SERVICE],
+  exports: [KNOWLEDGE_CONTEXT, POKELO_CONTEXT_SERVICE],
 })
 export class PokeloModule {}

package/src/pokelo.spec.ts

@@ -7,10 +7,16 @@ describe('pokelo-crypto', () => {
   const HEX_KEY = 'c'.repeat(64);
 
   beforeEach(() => {
+    delete process.env.KHIRBY_SECRETS_KEY;
+    delete process.env.MAIL_SECRETS_KEY;
+    delete process.env.AI_COMPOSE_SECRETS_KEY;
     process.env.POKELO_SECRETS_KEY = HEX_KEY;
   });
 
   afterEach(() => {
+    delete process.env.KHIRBY_SECRETS_KEY;
+    delete process.env.MAIL_SECRETS_KEY;
+    delete process.env.AI_COMPOSE_SECRETS_KEY;
     delete process.env.POKELO_SECRETS_KEY;
   });
 
@@ -26,9 +32,15 @@ describe('pokelo-crypto', () => {
     expect(isPokeloSecretsKeyConfigured()).toBe(false);
   });
 
+  it('isPokeloSecretsKeyConfigured returns true when KHIRBY_SECRETS_KEY is set', () => {
+    delete process.env.POKELO_SECRETS_KEY;
+    process.env.KHIRBY_SECRETS_KEY = HEX_KEY;
+    expect(isPokeloSecretsKeyConfigured()).toBe(true);
+  });
+
   it('throws on missing key at encrypt time', () => {
     delete process.env.POKELO_SECRETS_KEY;
-    expect(() => encrypt('anything')).toThrow('POKELO_SECRETS_KEY is not set');
+    expect(() => encrypt('anything')).toThrow('KHIRBY_SECRETS_KEY is not set');
   });
 });