@pikku/kysely 0.12.11 → 0.12.13

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 0.12.13
+
+### Patch Changes
+
+- 909eb25: Add audit logging support for function invocations and database queries.
+
+  Introduces `AuditService` and `createAuditedKysely` — configurable audit capture with best-effort and transactional durability modes. Audit logs capture session metadata (user, org), RPC call details, and Kysely query operations (type, tables, changes). Audit context is scoped per-invocation so nested RPC calls are correctly attributed.
+
+- Updated dependencies [909eb25]
+  - @pikku/core@0.12.26
+
+## 0.12.12
+
+### Patch Changes
+
+- 55ba75a: Update the OSS runtime dependency set for newer Node support by bumping `uWebSockets.js` to `v20.68.0` and `better-sqlite3` to `v12.10.0`.
+- Updated dependencies [c02275f]
+- Updated dependencies [0bd0433]
+  - @pikku/core@0.12.24
+
 ## 0.12.11
 
 ### Patch Changes

package/dist/src/create-audited-kysely.d.ts

@@ -0,0 +1,10 @@
+import type { AuditLog } from '@pikku/core';
+import type { Kysely } from 'kysely';
+export interface CreateAuditedKyselyOptions {
+    audit: AuditLog;
+    auditReads?: boolean;
+    eventType?: string;
+    transactionId?: string | null;
+    queryIdPrefix?: string;
+}
+export declare function createAuditedKysely<DB>(db: Kysely<DB>, options: CreateAuditedKyselyOptions): Kysely<DB>;

package/dist/src/create-audited-kysely.js

@@ -0,0 +1,167 @@
+const QUERY_KIND_BY_NODE = {
+    SelectQueryNode: 'select',
+    InsertQueryNode: 'insert',
+    UpdateQueryNode: 'update',
+    DeleteQueryNode: 'delete',
+};
+function getIdentifierName(node) {
+    if (!node || typeof node !== 'object')
+        return undefined;
+    const candidate = node;
+    return (candidate.name ??
+        candidate.column?.name ??
+        candidate.identifier?.name ??
+        candidate.table?.identifier?.name);
+}
+function collectTableNames(node, out) {
+    if (!node || typeof node !== 'object')
+        return;
+    const candidate = node;
+    if (candidate.kind === 'TableNode' &&
+        typeof candidate.table?.identifier?.name === 'string') {
+        out.add(candidate.table.identifier.name);
+    }
+    for (const value of Object.values(node)) {
+        if (Array.isArray(value)) {
+            for (const item of value)
+                collectTableNames(item, out);
+            continue;
+        }
+        collectTableNames(value, out);
+    }
+}
+function extractValue(node) {
+    if (!node || typeof node !== 'object')
+        return node;
+    const candidate = node;
+    switch (candidate.kind) {
+        case 'ValueNode':
+            return candidate.value;
+        case 'PrimitiveValueListNode':
+        case 'ValueListNode':
+            return (candidate.values ?? []).map(extractValue);
+        case 'DefaultInsertValueNode':
+            return '[default]';
+        case 'ColumnNode':
+        case 'ReferenceNode':
+            return `[${candidate.kind}]`;
+        case 'RawNode':
+            return '[raw]';
+        case 'SelectQueryNode':
+            return '[subquery]';
+        case 'ParensNode':
+            return extractValue(candidate.node);
+        case 'BinaryOperationNode':
+            return {
+                left: extractValue(candidate.left),
+                right: extractValue(candidate.right),
+            };
+        default:
+            return `[${candidate.kind ?? 'expression'}]`;
+    }
+}
+function extractInsertChanges(node) {
+    const columns = Array.isArray(node.columns)
+        ? node.columns
+            .map((column) => getIdentifierName(column))
+            .filter(Boolean)
+        : [];
+    const values = Array.isArray(node.values?.values) ? node.values.values : [];
+    if (columns.length === 0 || values.length === 0) {
+        return {
+            changedColumns: columns.length > 0 ? columns : undefined,
+        };
+    }
+    const rows = values.map((row) => {
+        const rowValues = Array.isArray(row?.values)
+            ? row.values.map(extractValue)
+            : [];
+        return Object.fromEntries(columns.map((column, index) => [column, rowValues[index]]));
+    });
+    return {
+        changedColumns: columns,
+        changes: rows.length === 1 ? rows[0] : rows,
+    };
+}
+function extractUpdateChanges(node) {
+    const updates = Array.isArray(node.updates) ? node.updates : [];
+    const entries = updates
+        .map((update) => {
+        const column = getIdentifierName(update.column);
+        if (!column)
+            return null;
+        return [column, extractValue(update.value)];
+    })
+        .filter(Boolean);
+    if (entries.length === 0) {
+        return {};
+    }
+    return {
+        changedColumns: entries.map(([column]) => column),
+        changes: Object.fromEntries(entries),
+    };
+}
+function extractChangeSet(node, queryKind) {
+    if (queryKind === 'insert') {
+        return extractInsertChanges(node);
+    }
+    if (queryKind === 'update') {
+        return extractUpdateChanges(node);
+    }
+    return {};
+}
+class AuditedKyselyPlugin {
+    options;
+    pending = new Map();
+    queryCounter = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    transformQuery(args) {
+        const queryKind = QUERY_KIND_BY_NODE[args.node.kind ?? ''];
+        if (!queryKind) {
+            return args.node;
+        }
+        if (queryKind === 'select' && this.options.auditReads === false) {
+            return args.node;
+        }
+        const tables = new Set();
+        collectTableNames(args.node, tables);
+        const queryId = `${this.options.queryIdPrefix ?? 'q'}-${++this.queryCounter}`;
+        this.pending.set(args.queryId, {
+            queryKind,
+            queryId,
+            tables: [...tables].sort(),
+            ...extractChangeSet(args.node, queryKind),
+        });
+        return args.node;
+    }
+    async transformResult(args) {
+        const pending = this.pending.get(args.queryId);
+        if (!pending) {
+            return args.result;
+        }
+        this.pending.delete(args.queryId);
+        const rawResult = args.result;
+        const rowCount = rawResult.rows.length > 0
+            ? rawResult.rows.length
+            : Number(rawResult.numUpdatedOrDeletedRows ?? rawResult.numAffectedRows ?? 0n);
+        await this.options.audit.write({
+            type: this.options.eventType ?? 'db.query',
+            source: 'auto',
+            transactionId: this.options.transactionId ?? null,
+            queryId: pending.queryId,
+            metadata: {
+                queryKind: pending.queryKind,
+                tables: pending.tables,
+                changedColumns: pending.changedColumns,
+                changes: pending.changes,
+                rowCount,
+            },
+        });
+        return rawResult;
+    }
+}
+export function createAuditedKysely(db, options) {
+    return db.withPlugin(new AuditedKyselyPlugin(options));
+}

package/dist/src/index.d.ts

@@ -2,6 +2,7 @@ export { KyselyChannelStore } from './kysely-channel-store.js';
 export { KyselyEventHubStore } from './kysely-eventhub-store.js';
 export { KyselyWorkflowService } from './kysely-workflow-service.js';
 export { KyselyWorkflowRunService } from './kysely-workflow-run-service.js';
+export { KyselyWorkflowMirror } from './kysely-workflow-mirror.js';
 export { KyselyDeploymentService } from './kysely-deployment-service.js';
 export { KyselyAIStorageService } from './kysely-ai-storage-service.js';
 export { KyselyAgentRunService } from './kysely-ai-agent-run-service.js';
@@ -11,6 +12,7 @@ export type { KyselySecretServiceConfig } from './kysely-secret-service.js';
 export { KyselyCredentialService } from './kysely-credential-service.js';
 export type { KyselyCredentialServiceConfig } from './kysely-credential-service.js';
 export { KyselySessionStore } from './kysely-session-store.js';
+export { createAuditedKysely, type CreateAuditedKyselyOptions, } from './create-audited-kysely.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';
 export type { AgentRunService, AgentRunRow } from '@pikku/core/ai-agent';

package/dist/src/index.js

@@ -2,6 +2,7 @@ export { KyselyChannelStore } from './kysely-channel-store.js';
 export { KyselyEventHubStore } from './kysely-eventhub-store.js';
 export { KyselyWorkflowService } from './kysely-workflow-service.js';
 export { KyselyWorkflowRunService } from './kysely-workflow-run-service.js';
+export { KyselyWorkflowMirror } from './kysely-workflow-mirror.js';
 export { KyselyDeploymentService } from './kysely-deployment-service.js';
 export { KyselyAIStorageService } from './kysely-ai-storage-service.js';
 export { KyselyAgentRunService } from './kysely-ai-agent-run-service.js';
@@ -9,3 +10,4 @@ export { KyselyAIRunStateService } from './kysely-ai-run-state-service.js';
 export { KyselySecretService } from './kysely-secret-service.js';
 export { KyselyCredentialService } from './kysely-credential-service.js';
 export { KyselySessionStore } from './kysely-session-store.js';
+export { createAuditedKysely, } from './create-audited-kysely.js';

package/dist/src/kysely-ai-agent-run-service.d.ts

@@ -6,6 +6,7 @@ export declare class KyselyAgentRunService implements AgentRunService {
     constructor(db: Kysely<KyselyPikkuDB>);
     listThreads(options?: {
         agentName?: string;
+        resourceId?: string;
         limit?: number;
         offset?: number;
     }): Promise<AIThread[]>;

package/dist/src/kysely-ai-agent-run-service.js

@@ -5,7 +5,7 @@ export class KyselyAgentRunService {
         this.db = db;
     }
     async listThreads(options) {
-        const { agentName, limit = 50, offset = 0 } = options ?? {};
+        const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {};
         let query = this.db
             .selectFrom('aiThreads as t')
             .select([
@@ -23,6 +23,9 @@ export class KyselyAgentRunService {
                 .where('agentName', '=', agentName)
                 .distinct());
         }
+        if (resourceId) {
+            query = query.where('t.resourceId', '=', resourceId);
+        }
         const result = await query
             .orderBy('t.updatedAt', 'desc')
             .limit(limit)

package/dist/src/kysely-channel-store.d.ts

@@ -13,5 +13,8 @@ export declare class KyselyChannelStore extends ChannelStore {
     getChannel(channelId: string): Promise<Channel & {
         pikkuUserId?: string;
     }>;
+    setState(channelId: string, state: unknown): Promise<void>;
+    getState(channelId: string): Promise<unknown | undefined>;
+    clearState(channelId: string): Promise<void>;
     close(): Promise<void>;
 }

package/dist/src/kysely-channel-store.js

@@ -20,6 +20,7 @@ export class KyselyChannelStore extends ChannelStore {
             .addColumn('created_at', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('opening_data', 'text', (col) => col.notNull().defaultTo('{}'))
             .addColumn('pikku_user_id', 'text')
+            .addColumn('state', 'text')
             .addColumn('last_wire', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .execute();
         await this.db.schema
@@ -76,5 +77,29 @@ export class KyselyChannelStore extends ChannelStore {
             pikkuUserId: row.pikkuUserId ?? undefined,
         };
     }
+    async setState(channelId, state) {
+        await this.db
+            .updateTable('channels')
+            .set({ state: JSON.stringify(state ?? null) })
+            .where('channelId', '=', channelId)
+            .execute();
+    }
+    async getState(channelId) {
+        const row = await this.db
+            .selectFrom('channels')
+            .select(['state'])
+            .where('channelId', '=', channelId)
+            .executeTakeFirst();
+        if (!row || !row.state)
+            return undefined;
+        return parseJson(row.state) ?? undefined;
+    }
+    async clearState(channelId) {
+        await this.db
+            .updateTable('channels')
+            .set({ state: null })
+            .where('channelId', '=', channelId)
+            .execute();
+    }
     async close() { }
 }

package/dist/src/kysely-secret-service.d.ts

@@ -20,10 +20,9 @@ export declare class KyselySecretService implements SecretService {
     init(): Promise<void>;
     private logAudit;
     private getKEK;
-    getSecret(key: string): Promise<string>;
-    getSecretJSON<R = {}>(key: string): Promise<R>;
+    getSecret<T = string>(key: string): Promise<T>;
     hasSecret(key: string): Promise<boolean>;
-    setSecretJSON(key: string, value: unknown): Promise<void>;
+    setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/kysely-secret-service.js

@@ -76,10 +76,6 @@ export class KyselySecretService {
         await this.logAudit(key, 'read');
         return result;
     }
-    async getSecretJSON(key) {
-        const raw = await this.getSecret(key);
-        return JSON.parse(raw);
-    }
     async hasSecret(key) {
         const row = await this.db
             .selectFrom('secrets')
@@ -88,9 +84,8 @@ export class KyselySecretService {
             .executeTakeFirst();
         return !!row;
     }
-    async setSecretJSON(key, value) {
-        const plaintext = JSON.stringify(value);
-        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, plaintext);
+    async setSecret(key, value) {
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value);
         const now = new Date().toISOString();
         await this.db
             .insertInto('secrets')

package/dist/src/kysely-tables.d.ts

@@ -6,6 +6,8 @@ export interface ChannelsTable {
     createdAt: Generated<Date>;
     openingData: string;
     pikkuUserId: string | null;
+    /** JSON-serialized per-socket channel state, keyed by channelId. */
+    state: string | null;
     lastWire: Generated<Date>;
 }
 export interface ChannelSubscriptionsTable {

package/dist/src/kysely-workflow-mirror.d.ts

@@ -0,0 +1,60 @@
+import type { SerializedError } from '@pikku/core';
+import type { StepState, WorkflowRunMirror, WorkflowRunWire, WorkflowStatus, WorkflowPlannedStep, WorkflowVersionStatus } from '@pikku/core/workflow';
+import type { Kysely } from 'kysely';
+import type { KyselyPikkuDB } from './kysely-tables.js';
+/**
+ * Kysely-backed `WorkflowRunMirror`.
+ *
+ * Forwards executor writes to the same `workflow_runs` / `workflow_step` /
+ * `workflow_step_history` / `workflow_versions` tables that
+ * `KyselyWorkflowService` uses, so a `KyselyWorkflowRunService` reading
+ * those tables will see runs driven by any executor (Cloudflare Durable
+ * Object, Redis, MongoDB, in-memory) — not just kysely-driven runs.
+ *
+ * Errors thrown here are caught by the executor's `safeMirror` wrapper
+ * and logged, so a mirror outage cannot break a running workflow.
+ */
+export declare class KyselyWorkflowMirror implements WorkflowRunMirror {
+    protected db: Kysely<KyselyPikkuDB>;
+    private initialized;
+    constructor(db: Kysely<KyselyPikkuDB>);
+    /**
+     * Create the underlying tables if they don't exist. Safe to call from
+     * either the mirror or `KyselyWorkflowService.init()` — schema is the
+     * same and uses `ifNotExists`.
+     */
+    init(): Promise<void>;
+    createRun(runId: string, workflowName: string, input: any, inline: boolean, graphHash: string, wire: WorkflowRunWire, options?: {
+        deterministic?: boolean;
+        plannedSteps?: WorkflowPlannedStep[];
+    }): Promise<void>;
+    updateRunStatus(id: string, status: WorkflowStatus, output?: any, error?: SerializedError): Promise<void>;
+    insertStepState(runId: string, step: StepState & {
+        stepName: string;
+        rpcName: string | null;
+        data: any;
+    }): Promise<void>;
+    setStepRunning(stepId: string): Promise<void>;
+    setStepScheduled(stepId: string): Promise<void>;
+    setStepResult(stepId: string, result: any): Promise<void>;
+    setStepChildRunId(stepId: string, childRunId: string): Promise<void>;
+    setStepError(stepId: string, error: SerializedError): Promise<void>;
+    createRetryAttempt(failedStepId: string, newStep: StepState & {
+        stepName: string;
+    }): Promise<void>;
+    setBranchTaken(stepId: string, branchKey: string): Promise<void>;
+    updateRunState(runId: string, name: string, value: unknown): Promise<void>;
+    upsertWorkflowVersion(name: string, graphHash: string, graph: any, source: string, status?: WorkflowVersionStatus): Promise<void>;
+    updateWorkflowVersionStatus(name: string, graphHash: string, status: WorkflowVersionStatus): Promise<void>;
+    private updateStepStatus;
+    private insertHistoryRecord;
+    /**
+     * The executor pattern is: `insertStepState` writes a 'pending' history
+     * row, then later transitions UPDATE that latest row in place rather
+     * than appending a new one — except for retry attempts which append.
+     *
+     * We mirror the same shape so `KyselyWorkflowRunService.getRunHistory`
+     * returns the same sequence the executor would have produced.
+     */
+    private appendOrUpdateLatestHistory;
+}