@pikku/core 0.12.24 → 0.12.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.24",
+  "version": "0.12.25",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",

package/src/data-classification.ts

@@ -0,0 +1,15 @@
+export type Private<T> = T & { readonly __pii__: 'private' }
+export type Secret<T> = T & { readonly __pii__: 'secret' }
+
+export type Classification = 'public' | 'private' | 'secret'
+export type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null
+
+export interface ColumnClassification {
+  classification: Classification
+  anonymize_strategy: AnonymizeStrategy
+}
+
+export type ClassificationManifest = {
+  version: 1
+  tables: Record<string, Record<string, ColumnClassification>>
+}

package/src/index.ts

@@ -177,3 +177,12 @@ export {
   type ScheduledTaskSummary,
 } from './services/scheduler-service.js'
 export { SchedulerService } from './services/scheduler-service.js'
+
+export type {
+  Private,
+  Secret,
+  Classification,
+  AnonymizeStrategy,
+  ColumnClassification,
+  ClassificationManifest,
+} from './data-classification.js'

package/src/services/gopass-secrets.ts

@@ -6,10 +6,6 @@ import type { SecretService } from './secret-service.js'
  * Requires gopass to be installed and configured on the system.
  */
 export class GopassSecretService implements SecretService {
-  /**
-   * Creates an instance of GopassSecretService.
-   * @param prefix - Optional prefix for all secret keys (e.g., 'pikku/' will look up 'pikku/mykey' for key 'mykey')
-   */
   constructor(private prefix: string = '') {}
 
   private getFullKey(key: string): string {
@@ -19,39 +15,22 @@ export class GopassSecretService implements SecretService {
     return this.prefix ? `${this.prefix}${key}` : key
   }
 
-  /**
-   * Retrieves a secret by key and parses it as JSON.
-   * @param key - The key of the secret to retrieve.
-   * @returns A promise that resolves to the parsed secret value.
-   * @throws {Error} If the secret is not found or gopass fails.
-   */
-  public async getSecretJSON<R>(key: string): Promise<R> {
-    const value = await this.getSecret(key)
-    return JSON.parse(value)
-  }
-
-  /**
-   * Retrieves a secret by key as a string.
-   * @param key - The key of the secret to retrieve.
-   * @returns A promise that resolves to the secret value.
-   * @throws {Error} If the secret is not found or gopass fails.
-   */
-  public async getSecret(key: string): Promise<string> {
+  public async getSecret<T = string>(key: string): Promise<T> {
     const fullKey = this.getFullKey(key)
     try {
-      return execFileSync('gopass', ['show', '-o', fullKey], {
+      const raw = execFileSync('gopass', ['show', '-o', fullKey], {
         encoding: 'utf8',
       }).trim()
+      try {
+        return JSON.parse(raw) as T
+      } catch {
+        return raw as unknown as T
+      }
     } catch (error: any) {
       throw new Error(`Secret Not Found: ${key}`, { cause: error })
     }
   }
 
-  /**
-   * Checks if a secret exists without throwing.
-   * @param key - The key of the secret to check.
-   * @returns A promise that resolves to true if the secret exists.
-   */
   public async hasSecret(key: string): Promise<boolean> {
     const fullKey = this.getFullKey(key)
     try {
@@ -62,19 +41,13 @@ export class GopassSecretService implements SecretService {
     }
   }
 
-  /**
-   * Stores a JSON value as a secret in gopass.
-   * @param key - The key to store the secret under.
-   * @param value - The JSON value to store.
-   * @returns A promise that resolves when the secret is stored.
-   */
-  public async setSecretJSON(key: string, value: unknown): Promise<void> {
+  public async setSecret(key: string, value: unknown): Promise<void> {
     const fullKey = this.getFullKey(key)
-    const jsonValue = JSON.stringify(value)
+    const encoded = typeof value === 'string' ? value : JSON.stringify(value)
     try {
       execFileSync('gopass', ['insert', '-f', fullKey], {
         encoding: 'utf8',
-        input: jsonValue,
+        input: encoded,
         stdio: ['pipe', 'pipe', 'pipe'],
       })
     } catch (error: any) {
@@ -82,11 +55,6 @@ export class GopassSecretService implements SecretService {
     }
   }
 
-  /**
-   * Deletes a secret from gopass.
-   * @param key - The key of the secret to delete.
-   * @returns A promise that resolves when the secret is deleted.
-   */
   public async deleteSecret(key: string): Promise<void> {
     const fullKey = this.getFullKey(key)
     try {

package/src/services/local-secrets.test.ts

@@ -6,9 +6,9 @@ import { LocalVariablesService } from './local-variables.js'
 describe('LocalSecretService', () => {
   test('should get secret from local storage', async () => {
     const service = new LocalSecretService()
-    await service.setSecretJSON('MY_KEY', { token: 'abc' })
+    await service.setSecret('MY_KEY', { token: 'abc' })
     const result = await service.getSecret('MY_KEY')
-    assert.strictEqual(result, '{"token":"abc"}')
+    assert.deepStrictEqual(result, { token: 'abc' })
   })
 
   test('should get secret from environment variables', async () => {
@@ -28,22 +28,22 @@ describe('LocalSecretService', () => {
 
   test('should get JSON secret from local storage', async () => {
     const service = new LocalSecretService()
-    await service.setSecretJSON('JSON_KEY', { data: 42 })
-    const result = await service.getSecretJSON('JSON_KEY')
+    await service.setSecret('JSON_KEY', { data: 42 })
+    const result = await service.getSecret('JSON_KEY')
     assert.deepStrictEqual(result, { data: 42 })
   })
 
   test('should get JSON secret from environment variables', async () => {
     const vars = new LocalVariablesService({ CONFIG: '{"port":3000}' })
     const service = new LocalSecretService(vars)
-    const result = await service.getSecretJSON('CONFIG')
+    const result = await service.getSecret('CONFIG')
     assert.deepStrictEqual(result, { port: 3000 })
   })
 
   test('should throw when JSON secret not found', async () => {
     const vars = new LocalVariablesService({})
     const service = new LocalSecretService(vars)
-    await assert.rejects(() => service.getSecretJSON('MISSING'), {
+    await assert.rejects(() => service.getSecret('MISSING'), {
       message: 'Requested secret not found',
     })
   })
@@ -51,15 +51,15 @@ describe('LocalSecretService', () => {
   test('should prefer local storage over env variables', async () => {
     const vars = new LocalVariablesService({ KEY: 'env-value' })
     const service = new LocalSecretService(vars)
-    await service.setSecretJSON('KEY', 'local-value')
+    await service.setSecret('KEY', 'local-value')
     const result = await service.getSecret('KEY')
-    assert.strictEqual(result, '"local-value"')
+    assert.strictEqual(result, 'local-value')
   })
 
   test('should check hasSecret in local storage', async () => {
     const vars = new LocalVariablesService({})
     const service = new LocalSecretService(vars)
-    await service.setSecretJSON('EXISTS', 'yes')
+    await service.setSecret('EXISTS', 'yes')
     assert.strictEqual(await service.hasSecret('EXISTS'), true)
     assert.strictEqual(await service.hasSecret('NOPE'), false)
   })
@@ -72,7 +72,7 @@ describe('LocalSecretService', () => {
 
   test('should delete secret from local storage', async () => {
     const service = new LocalSecretService()
-    await service.setSecretJSON('DEL_KEY', 'value')
+    await service.setSecret('DEL_KEY', 'value')
     assert.strictEqual(await service.hasSecret('DEL_KEY'), true)
     await service.deleteSecret('DEL_KEY')
     assert.strictEqual(await service.hasSecret('DEL_KEY'), false)

package/src/services/local-secrets.ts

@@ -9,81 +9,38 @@ import type { VariablesService } from './variables-service.js'
 export class LocalSecretService implements SecretService {
   private localSecrets: Map<string, string> = new Map()
 
-  // TODO: Drop this fallback once secrets and variables expose aligned typed/raw access paths again.
-  private parseSecret<R>(raw: string): R {
+  private parseSecret<T>(raw: string): T {
     try {
-      return JSON.parse(raw) as R
+      return JSON.parse(raw) as T
     } catch {
-      return raw as unknown as R
+      return raw as unknown as T
     }
   }
 
-  /**
-   * Creates an instance of LocalSecretService.
-   */
   constructor(
     private variables: VariablesService = new LocalVariablesService()
   ) {}
 
-  /**
-   * Retrieves a secret by key.
-   * Checks local storage first, then falls back to environment variables.
-   * @param key - The key of the secret to retrieve.
-   * @returns A promise that resolves to the secret value.
-   * @throws {Error} If the secret is not found.
-   */
-  public async getSecretJSON<R>(key: string): Promise<R> {
-    // Check local storage first
+  public async getSecret<T = string>(key: string): Promise<T> {
     const localValue = this.localSecrets.get(key)
     if (localValue) {
-      return this.parseSecret(localValue)
+      return this.parseSecret<T>(localValue)
     }
 
-    // Fall back to environment variables
     const value = await this.variables.get(key)
     if (value) {
-      return this.parseSecret(value)
+      return this.parseSecret<T>(value)
     }
     throw new Error('Requested secret not found')
   }
 
-  /**
-   * Retrieves a secret by key.
-   * Checks local storage first, then falls back to environment variables.
-   * @param key - The key of the secret to retrieve.
-   * @returns A promise that resolves to the secret value.
-   * @throws {Error} If the secret is not found.
-   */
-  public async getSecret(key: string): Promise<string> {
-    // Check local storage first
-    const localValue = this.localSecrets.get(key)
-    if (localValue) {
-      return localValue
-    }
-
-    // Fall back to environment variables
-    const value = await this.variables.get(key)
-    if (value) {
-      return value
-    }
-    throw new Error('Requested secret not found')
-  }
-
-  /**
-   * Stores a JSON value as a secret in local storage.
-   * @param key - The key to store the secret under.
-   * @param value - The JSON value to store.
-   * @returns A promise that resolves when the secret is stored.
-   */
-  public async setSecretJSON(key: string, value: unknown): Promise<void> {
-    this.localSecrets.set(key, JSON.stringify(value))
+  public async setSecret(key: string, value: unknown): Promise<void> {
+    this.localSecrets.set(
+      key,
+      typeof value === 'string' ? value : JSON.stringify(value)
+    )
   }
 
-  /**
-   * Checks if a secret exists without throwing.
-   * @param key - The key of the secret to check.
-   * @returns A promise that resolves to true if the secret exists.
-   */
   public async hasSecret(key: string): Promise<boolean> {
     if (this.localSecrets.has(key)) {
       return true
@@ -92,11 +49,6 @@ export class LocalSecretService implements SecretService {
     return value !== undefined && value !== null && value !== ''
   }
 
-  /**
-   * Deletes a secret from local storage.
-   * @param key - The key of the secret to delete.
-   * @returns A promise that resolves when the secret is deleted.
-   */
   public async deleteSecret(key: string): Promise<void> {
     this.localSecrets.delete(key)
   }

package/src/services/local-variables.test.ts

@@ -39,19 +39,19 @@ describe('LocalVariablesService', () => {
 
   test('should get JSON variable', () => {
     const service = new LocalVariablesService({ DATA: '{"key":"val"}' })
-    const result = service.getJSON('DATA')
+    const result = service.get('DATA')
     assert.deepStrictEqual(result, { key: 'val' })
   })
 
   test('should return undefined for missing JSON variable', () => {
     const service = new LocalVariablesService({})
-    assert.strictEqual(service.getJSON('MISSING'), undefined)
+    assert.strictEqual(service.get('MISSING'), undefined)
   })
 
   test('should set JSON variable', () => {
     const service = new LocalVariablesService({})
-    service.setJSON('DATA', { key: 'val' })
-    assert.strictEqual(service.get('DATA'), '{"key":"val"}')
+    service.set('DATA', { key: 'val' })
+    assert.deepStrictEqual(service.get('DATA'), { key: 'val' })
   })
 
   test('should handle has with undefined value', () => {

package/src/services/local-variables.ts

@@ -5,28 +5,23 @@ export class LocalVariablesService implements VariablesService {
     private variables: Record<string, string | undefined> = process.env
   ) {}
 
-  public getAll():
-    | Promise<Record<string, string | undefined>>
-    | Record<string, string | undefined> {
+  public getAll(): Record<string, string | undefined> {
     return this.variables || {}
   }
 
-  public get(name: string): Promise<string | undefined> | string | undefined {
-    return this.variables[name]
+  public get<T = string>(name: string): T | undefined {
+    const raw = this.variables[name]
+    if (raw === undefined) return undefined
+    try {
+      return JSON.parse(raw) as T
+    } catch {
+      return raw as unknown as T
+    }
   }
 
-  public getJSON<T = unknown>(name: string): T | undefined {
-    const value = this.variables[name]
-    if (value === undefined) return undefined
-    return JSON.parse(value)
-  }
-
-  public set(name: string, value: string): void {
-    this.variables[name] = value
-  }
-
-  public setJSON(name: string, value: unknown): void {
-    this.variables[name] = JSON.stringify(value)
+  public set(name: string, value: unknown): void {
+    this.variables[name] =
+      typeof value === 'string' ? value : JSON.stringify(value)
   }
 
   public has(name: string): boolean {

package/src/services/scoped-secret-service.test.ts

@@ -3,10 +3,9 @@ import assert from 'node:assert'
 import { ScopedSecretService } from './scoped-secret-service.js'
 
 const createMockSecrets = () => ({
-  getSecret: async (key: string) => `value-of-${key}`,
-  getSecretJSON: async (key: string) => ({ key }),
+  getSecret: async <T>(key: string) => ({ key }) as T,
   hasSecret: async () => true,
-  setSecretJSON: async () => {},
+  setSecret: async () => {},
   deleteSecret: async () => {},
 })
 
@@ -15,7 +14,7 @@ describe('ScopedSecretService', () => {
     const mock = createMockSecrets()
     const scoped = new ScopedSecretService(mock, new Set(['KEY1', 'KEY2']))
     const result = await scoped.getSecret('KEY1')
-    assert.strictEqual(result, 'value-of-KEY1')
+    assert.deepStrictEqual(result, { key: 'KEY1' })
   })
 
   test('should deny access to non-allowed keys', async () => {
@@ -26,17 +25,17 @@ describe('ScopedSecretService', () => {
     })
   })
 
-  test('should allow getSecretJSON for allowed keys', async () => {
+  test('should allow getSecret for allowed keys', async () => {
     const mock = createMockSecrets()
     const scoped = new ScopedSecretService(mock, new Set(['KEY1']))
-    const result = await scoped.getSecretJSON('KEY1')
+    const result = await scoped.getSecret('KEY1')
     assert.deepStrictEqual(result, { key: 'KEY1' })
   })
 
-  test('should deny getSecretJSON for non-allowed keys', async () => {
+  test('should deny getSecret for non-allowed keys', async () => {
     const mock = createMockSecrets()
     const scoped = new ScopedSecretService(mock, new Set(['KEY1']))
-    await assert.rejects(() => scoped.getSecretJSON('FORBIDDEN'), {
+    await assert.rejects(() => scoped.getSecret('FORBIDDEN'), {
       message: 'Access denied to secret key: FORBIDDEN',
     })
   })
@@ -56,11 +55,11 @@ describe('ScopedSecretService', () => {
     })
   })
 
-  test('should always throw on setSecretJSON', async () => {
+  test('should always throw on setSecret', async () => {
     const mock = createMockSecrets()
     const scoped = new ScopedSecretService(mock, new Set(['KEY1']))
-    await assert.rejects(() => scoped.setSecretJSON('KEY1', 'val'), {
-      message: 'setSecretJSON is not allowed in scoped secret service',
+    await assert.rejects(() => scoped.setSecret('KEY1', 'val'), {
+      message: 'setSecret is not allowed in scoped secret service',
     })
   })
 

package/src/services/scoped-secret-service.ts

@@ -16,14 +16,9 @@ export class ScopedSecretService implements SecretService {
     }
   }
 
-  async getSecret(key: string): Promise<string> {
+  async getSecret<T = string>(key: string): Promise<T> {
     this.assertAllowed(key)
-    return this.secrets.getSecret(key)
-  }
-
-  async getSecretJSON<T = {}>(key: string): Promise<T> {
-    this.assertAllowed(key)
-    return this.secrets.getSecretJSON<T>(key)
+    return this.secrets.getSecret<T>(key)
   }
 
   async hasSecret(key: string): Promise<boolean> {
@@ -31,8 +26,8 @@ export class ScopedSecretService implements SecretService {
     return this.secrets.hasSecret(key)
   }
 
-  async setSecretJSON(_key: string, _value: unknown): Promise<void> {
-    throw new Error('setSecretJSON is not allowed in scoped secret service')
+  async setSecret(_key: string, _value: unknown): Promise<void> {
+    throw new Error('setSecret is not allowed in scoped secret service')
   }
 
   async deleteSecret(_key: string): Promise<void> {

package/src/services/secret-service.ts

@@ -3,19 +3,12 @@
  */
 export interface SecretService {
   /**
-   * Retrieves a secret by key and parses it as JSON.
-   * @param key - The key of the secret to retrieve.
-   * @returns A promise that resolves to the parsed secret value.
-   * @throws If the secret is not found.
-   */
-  getSecretJSON<Return = {}>(key: string): Promise<Return>
-  /**
-   * Retrieves a secret by key as a string.
+   * Retrieves a secret by key, typed as T (defaults to string).
    * @param key - The key of the secret to retrieve.
    * @returns A promise that resolves to the secret value.
    * @throws If the secret is not found.
    */
-  getSecret(key: string): Promise<string>
+  getSecret<T = string>(key: string): Promise<T>
   /**
    * Checks if a secret exists without throwing.
    * @param key - The key of the secret to check.
@@ -23,12 +16,12 @@ export interface SecretService {
    */
   hasSecret(key: string): Promise<boolean>
   /**
-   * Stores a JSON value as a secret.
+   * Stores a secret value.
    * @param key - The key to store the secret under.
-   * @param value - The JSON value to store.
+   * @param value - The value to store.
    * @returns A promise that resolves when the secret is stored.
    */
-  setSecretJSON(key: string, value: unknown): Promise<void>
+  setSecret(key: string, value: unknown): Promise<void>
   /**
    * Deletes a secret by key.
    * @param key - The key of the secret to delete.

package/src/services/typed-secret-service.test.ts

@@ -3,18 +3,17 @@ import assert from 'node:assert'
 import { TypedSecretService } from './typed-secret-service.js'
 
 const createMockSecrets = (store: Map<string, string> = new Map()) => ({
-  getSecret: async (key: string) => {
+  getSecret: async <T = string>(key: string): Promise<T> => {
     const val = store.get(key)
     if (!val) throw new Error(`Not found: ${key}`)
-    return val
-  },
-  getSecretJSON: async (key: string) => {
-    const val = store.get(key)
-    if (!val) throw new Error(`Not found: ${key}`)
-    return JSON.parse(val)
+    try {
+      return JSON.parse(val) as T
+    } catch {
+      return val as unknown as T
+    }
   },
   hasSecret: async (key: string) => store.has(key),
-  setSecretJSON: async (key: string, value: unknown) => {
+  setSecret: async (key: string, value: unknown) => {
     store.set(key, JSON.stringify(value))
   },
   deleteSecret: async (key: string) => {
@@ -24,42 +23,42 @@ const createMockSecrets = (store: Map<string, string> = new Map()) => ({
 
 describe('TypedSecretService', () => {
   test('should delegate getSecret to underlying service', async () => {
-    const store = new Map([['API_KEY', 'sk-123']])
+    const store = new Map([['API_KEY', '"sk-123"']])
     const service = new TypedSecretService(createMockSecrets(store), {})
     const result = await service.getSecret('API_KEY')
     assert.strictEqual(result, 'sk-123')
   })
 
-  test('should delegate getSecretJSON to underlying service', async () => {
+  test('should delegate getSecret with type to underlying service', async () => {
     const store = new Map([['CONFIG', '{"port":3000}']])
     const service = new TypedSecretService(createMockSecrets(store), {})
-    const result = await service.getSecretJSON('CONFIG')
+    const result = await service.getSecret<{ port: number }>('CONFIG')
     assert.deepStrictEqual(result, { port: 3000 })
   })
 
   test('should delegate hasSecret to underlying service', async () => {
-    const store = new Map([['EXISTS', 'val']])
+    const store = new Map([['EXISTS', '"val"']])
     const service = new TypedSecretService(createMockSecrets(store), {})
     assert.strictEqual(await service.hasSecret('EXISTS'), true)
     assert.strictEqual(await service.hasSecret('MISSING'), false)
   })
 
-  test('should delegate setSecretJSON to underlying service', async () => {
+  test('should delegate setSecret to underlying service', async () => {
     const store = new Map<string, string>()
     const service = new TypedSecretService(createMockSecrets(store), {})
-    await service.setSecretJSON('NEW_KEY', { data: 'val' })
+    await service.setSecret('NEW_KEY', { data: 'val' })
     assert.strictEqual(store.get('NEW_KEY'), '{"data":"val"}')
   })
 
   test('should delegate deleteSecret to underlying service', async () => {
-    const store = new Map([['KEY', 'val']])
+    const store = new Map([['KEY', '"val"']])
     const service = new TypedSecretService(createMockSecrets(store), {})
     await service.deleteSecret('KEY')
     assert.strictEqual(store.has('KEY'), false)
   })
 
   test('should get all status for credentials', async () => {
-    const store = new Map([['STRIPE_KEY', 'sk-123']])
+    const store = new Map([['STRIPE_KEY', '"sk-123"']])
     const meta = {
       STRIPE_KEY: { name: 'stripe', displayName: 'Stripe' },
       GITHUB_TOKEN: {
@@ -80,7 +79,7 @@ describe('TypedSecretService', () => {
   })
 
   test('should get missing credentials', async () => {
-    const store = new Map([['STRIPE_KEY', 'sk-123']])
+    const store = new Map([['STRIPE_KEY', '"sk-123"']])
     const meta = {
       STRIPE_KEY: { name: 'stripe', displayName: 'Stripe' },
       GITHUB_TOKEN: { name: 'github', displayName: 'GitHub' },

package/src/services/typed-secret-service.ts

@@ -22,13 +22,9 @@ export class TypedSecretService<
     private credentialsMeta: Record<string, CredentialMeta>
   ) {}
 
-  async getSecretJSON<K extends keyof TMap & string>(key: K): Promise<TMap[K]>
-  async getSecretJSON<T = unknown>(key: string): Promise<T>
-  async getSecretJSON(key: string): Promise<unknown> {
-    return this.secrets.getSecretJSON(key)
-  }
-
-  async getSecret(key: string): Promise<string> {
+  async getSecret<K extends keyof TMap & string>(key: K): Promise<TMap[K]>
+  async getSecret<T = string>(key: string): Promise<T>
+  async getSecret(key: string): Promise<unknown> {
     return this.secrets.getSecret(key)
   }
 
@@ -36,11 +32,11 @@ export class TypedSecretService<
     return this.secrets.hasSecret(key)
   }
 
-  async setSecretJSON<K extends string>(
+  async setSecret<K extends string>(
     key: K,
     value: K extends keyof TMap ? TMap[K] : unknown
   ): Promise<void> {
-    return this.secrets.setSecretJSON(key, value)
+    return this.secrets.setSecret(key, value)
   }
 
   async deleteSecret(key: string): Promise<void> {

package/src/services/typed-variables-service.test.ts

@@ -36,15 +36,15 @@ describe('TypedVariablesService', () => {
     assert.strictEqual(service.has('DB_URL'), false)
   })
 
-  test('should delegate getJSON to underlying service', () => {
+  test('should delegate get to underlying service', () => {
     const service = createService({ DATA: '{"key":"val"}' })
-    assert.deepStrictEqual(service.getJSON('DATA'), { key: 'val' })
+    assert.deepStrictEqual(service.get('DATA'), { key: 'val' })
   })
 
-  test('should delegate setJSON to underlying service', () => {
+  test('should delegate set to underlying service', () => {
     const service = createService()
-    service.setJSON('DATA', { key: 'val' })
-    assert.strictEqual(service.get('DATA'), '{"key":"val"}')
+    service.set('DATA', { key: 'val' })
+    assert.deepStrictEqual(service.get('DATA'), { key: 'val' })
   })
 
   test('should get all status for configured variables', async () => {