@kubun/store-connector 0.12.1 → 0.14.0

package/lib/api.d.ts

@@ -19,18 +19,17 @@ export type PendingAuthRecord = {
     codeVerifier: string;
     provider: string;
     ownerDID: string;
+    /** The owner's DID in a form that can be encrypted to. See the table type. */
+    ownerWrappableDID?: string | null;
+    /** A recovery recipient's DID in a form that can be encrypted to. See the table type. */
+    controllerWrappableDID?: string | null;
     createdAt: number;
 };
 export type ConnectorStoreAPI = {
-    getCredential(providerName: string, ownerDID: string): Promise<string | null>;
-    setCredential(providerName: string, ownerDID: string, credential: string): Promise<void>;
-    deleteCredential(providerName: string, ownerDID: string): Promise<void>;
     getSyncState(connectorName: string, ownerDID: string): Promise<SyncState | null>;
     setSyncState(connectorName: string, ownerDID: string, state: SyncState): Promise<void>;
     deleteSyncState(connectorName: string, ownerDID: string): Promise<void>;
     listSyncStatesForConnector(connectorName: string): Promise<Array<SyncStateEntry>>;
-    claimSync(connectorName: string, ownerDID: string, leaseMs: number): Promise<boolean>;
-    renewSync(connectorName: string, ownerDID: string, leaseMs: number): Promise<void>;
     createPendingAuth(record: PendingAuthRecord): Promise<void>;
     consumePendingAuth(state: string): Promise<PendingAuthRecord | null>;
     deleteExpiredPendingAuth(cutoffMs: number): Promise<void>;

package/lib/api.js

@@ -20,27 +20,6 @@ function rowToSyncState(row) {
 // --- Factory function ---
 export function createConnectorStore(db, _adapter) {
     return {
-        // --- Credential operations ---
-        async getCredential (providerName, ownerDID) {
-            const row = await db.selectFrom('kubun_connector_credentials').select('credential').where('provider_name', '=', providerName).where('owner_did', '=', ownerDID).executeTakeFirst();
-            if (row == null) return null;
-            return row.credential;
-        },
-        async setCredential (providerName, ownerDID, credential) {
-            await db.insertInto('kubun_connector_credentials').values({
-                provider_name: providerName,
-                owner_did: ownerDID,
-                credential
-            }).onConflict((oc)=>oc.columns([
-                    'provider_name',
-                    'owner_did'
-                ]).doUpdateSet({
-                    credential
-                })).execute();
-        },
-        async deleteCredential (providerName, ownerDID) {
-            await db.deleteFrom('kubun_connector_credentials').where('provider_name', '=', providerName).where('owner_did', '=', ownerDID).execute();
-        },
         // --- Sync state operations ---
         async getSyncState (connectorName, ownerDID) {
             const row = await db.selectFrom('kubun_connector_sync_state').selectAll().where('connector_name', '=', connectorName).where('owner_did', '=', ownerDID).executeTakeFirst();
@@ -48,10 +27,9 @@ export function createConnectorStore(db, _adapter) {
             return rowToSyncState(row);
         },
         async setSyncState (connectorName, ownerDID, state) {
-            // Progress write only: the lease column is owned by claimSync/renewSync,
-            // never by a plain set. A fresh INSERT carries no lease (null); on
-            // conflict the lease is deliberately excluded so a live lease held by the
-            // sync worker survives progress updates.
+            // The `lease_expires_at` column is dead (the lease moved to the workflow
+            // engine); a fresh INSERT sets it null and a conflicting update leaves it
+            // untouched.
             await db.insertInto('kubun_connector_sync_state').values({
                 connector_name: connectorName,
                 owner_did: ownerDID,
@@ -72,45 +50,6 @@ export function createConnectorStore(db, _adapter) {
                     error: state.error ?? null
                 })).execute();
         },
-        async claimSync (connectorName, ownerDID, leaseMs) {
-            const now = Date.now();
-            const leaseExpiresAt = now + leaseMs;
-            // Single atomic upsert. INSERT wins when no row exists. On conflict the
-            // DO UPDATE only fires when its WHERE holds: the existing lease is not
-            // 'syncing', is unset, or has expired. The guard columns are
-            // table-qualified because a bare 'status'/'lease_expires_at' is ambiguous
-            // on Postgres (both the target row and the excluded row are in scope).
-            // A live lease fails the WHERE, so no row is returned.
-            const result = await db.insertInto('kubun_connector_sync_state').values({
-                connector_name: connectorName,
-                owner_did: ownerDID,
-                checkpoint: null,
-                last_synced_at: new Date(now).toISOString(),
-                entity_count: 0,
-                status: 'syncing',
-                error: null,
-                lease_expires_at: leaseExpiresAt
-            }).onConflict((oc)=>oc.columns([
-                    'connector_name',
-                    'owner_did'
-                ]).doUpdateSet({
-                    status: 'syncing',
-                    lease_expires_at: leaseExpiresAt
-                }).where((eb)=>eb.or([
-                        eb('kubun_connector_sync_state.status', '!=', 'syncing'),
-                        eb('kubun_connector_sync_state.lease_expires_at', 'is', null),
-                        eb('kubun_connector_sync_state.lease_expires_at', '<', now)
-                    ]))).returningAll().executeTakeFirst();
-            return result != null;
-        },
-        async renewSync (connectorName, ownerDID, leaseMs) {
-            const now = Date.now();
-            // Extend the lease only while the row is still actively syncing. A plain
-            // UPDATE (no excluded row in scope) needs no table-qualified columns.
-            await db.updateTable('kubun_connector_sync_state').set({
-                lease_expires_at: now + leaseMs
-            }).where('connector_name', '=', connectorName).where('owner_did', '=', ownerDID).where('status', '=', 'syncing').execute();
-        },
         async deleteSyncState (connectorName, ownerDID) {
             await db.deleteFrom('kubun_connector_sync_state').where('connector_name', '=', connectorName).where('owner_did', '=', ownerDID).execute();
         },
@@ -129,6 +68,8 @@ export function createConnectorStore(db, _adapter) {
                 code_verifier: record.codeVerifier,
                 provider: record.provider,
                 owner_did: record.ownerDID,
+                owner_wrappable_did: record.ownerWrappableDID ?? null,
+                controller_wrappable_did: record.controllerWrappableDID ?? null,
                 created_at: record.createdAt
             }).execute();
         },
@@ -142,6 +83,8 @@ export function createConnectorStore(db, _adapter) {
                 codeVerifier: row.code_verifier,
                 provider: row.provider,
                 ownerDID: row.owner_did,
+                ownerWrappableDID: row.owner_wrappable_did,
+                controllerWrappableDID: row.controller_wrappable_did,
                 createdAt: row.created_at
             };
         },

package/lib/index.d.ts

@@ -5,4 +5,4 @@ export { createConnectorStore } from './api.js';
 export { connectorStoreDefinition } from './definition.js';
 export declare const CONNECTOR_STORE: "connector";
 export declare function getConnectorStore(provider: StoreProvider): Promise<ConnectorStoreAPI>;
-export type { ConnectorCredential, ConnectorCredentialTable, ConnectorSyncState, ConnectorSyncStateTable, ConnectorTables, } from './tables.js';
+export type { ConnectorSyncState, ConnectorSyncStateTable, ConnectorTables, } from './tables.js';

package/lib/migrations.js

@@ -11,20 +11,18 @@ export function getConnectorMigrations(ctx) {
                 'connector_name',
                 'owner_did'
             ]).execute();
-            // Connector credentials
-            await db.schema.createTable('kubun_connector_credentials').ifNotExists().addColumn('provider_name', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('credential', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('kubun_connector_credentials_pkey', [
-                'provider_name',
-                'owner_did'
-            ]).execute();
             // Pending OAuth authorizations: state + PKCE verifier persisted between the
             // authorize redirect and the callback. State is single-use, consumed on read.
-            await db.schema.createTable('kubun_connector_pending_auth').ifNotExists().addColumn('state', t.text, (col)=>col.notNull().primaryKey()).addColumn('code_verifier', t.text, (col)=>col.notNull()).addColumn('provider', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull())// ms-epoch (Date.now) overflows int32 on Postgres; bigint holds it and
+            await db.schema.createTable('kubun_connector_pending_auth').ifNotExists().addColumn('state', t.text, (col)=>col.notNull().primaryKey()).addColumn('code_verifier', t.text, (col)=>col.notNull()).addColumn('provider', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull())// The wrappable spelling of owner_did, kept beside it rather than
+            // replacing it: owner_did is the join key everywhere and is normalized.
+            .addColumn('owner_wrappable_did', t.text)// The wrappable DID of the user's controller, carried from authorize to
+            // callback so the mint can add the controller recovery wrap.
+            .addColumn('controller_wrappable_did', t.text)// ms-epoch (Date.now) overflows int32 on Postgres; bigint holds it and
             // the adapter's int8 parser reads it back as a JS number.
             .addColumn('created_at', t.bigint, (col)=>col.notNull()).execute();
         },
         async down (db) {
             await db.schema.dropTable('kubun_connector_pending_auth').ifExists().execute();
-            await db.schema.dropTable('kubun_connector_credentials').ifExists().execute();
             await db.schema.dropTable('kubun_connector_sync_state').ifExists().execute();
         }
     };

package/lib/tables.d.ts

@@ -10,22 +10,27 @@ export type ConnectorSyncStateTable = {
     lease_expires_at: number | null;
 };
 export type ConnectorSyncState = Selectable<ConnectorSyncStateTable>;
-export type ConnectorCredentialTable = {
-    provider_name: string;
-    owner_did: string;
-    credential: string;
-};
-export type ConnectorCredential = Selectable<ConnectorCredentialTable>;
 export type ConnectorPendingAuthTable = {
     state: string;
     code_verifier: string;
     provider: string;
     owner_did: string;
+    /**
+     * The owner's DID in a form that can be encrypted to, carried from the
+     * authorize call to the callback that mints the key. Null when the caller did
+     * not supply one, which leaves the credential creatable only if `owner_did`
+     * happens to be wrappable on its own.
+     */
+    owner_wrappable_did: string | null;
+    /**
+     * A recovery recipient's DID in a form that can be encrypted to, carried the
+     * same way as `owner_wrappable_did`. Null when the caller supplied none.
+     */
+    controller_wrappable_did: string | null;
     created_at: number;
 };
 export type ConnectorPendingAuth = Selectable<ConnectorPendingAuthTable>;
 export type ConnectorTables = {
     kubun_connector_sync_state: ConnectorSyncStateTable;
-    kubun_connector_credentials: ConnectorCredentialTable;
     kubun_connector_pending_auth: ConnectorPendingAuthTable;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/store-connector",
-  "version": "0.12.1",
+  "version": "0.14.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -15,14 +15,14 @@
     "LICENSE.md"
   ],
   "dependencies": {
-    "kysely": "^0.29.5",
-    "@kubun/db": "^0.12.1",
-    "@kubun/db-adapter": "^0.13.0"
+    "@kubun/db": "^0.14.0",
+    "@kubun/db-adapter": "^0.14.0",
+    "kysely": "^0.29.5"
   },
   "devDependencies": {
-    "@testcontainers/postgresql": "^12.1.0",
-    "@kubun/db-better-sqlite": "^0.12.1",
-    "@kubun/db-postgres": "^0.12.1"
+    "@kubun/db-better-sqlite": "^0.14.0",
+    "@kubun/db-postgres": "^0.14.0",
+    "@testcontainers/postgresql": "^12.1.0"
   },
   "publishConfig": {
     "access": "public"