@pikku/kysely 0.12.11 → 0.12.13

package/src/create-audited-kysely.ts

@@ -0,0 +1,254 @@
+import type { AuditLog } from '@pikku/core'
+import type {
+  Kysely,
+  KyselyPlugin,
+  PluginTransformQueryArgs,
+  PluginTransformResultArgs,
+  QueryResult,
+  RootOperationNode,
+  UnknownRow,
+} from 'kysely'
+
+export interface CreateAuditedKyselyOptions {
+  audit: AuditLog
+  auditReads?: boolean
+  eventType?: string
+  transactionId?: string | null
+  queryIdPrefix?: string
+}
+
+type AuditedQuery = {
+  queryKind: 'select' | 'insert' | 'update' | 'delete'
+  queryId: string
+  tables: string[]
+  changedColumns?: string[]
+  changes?: unknown
+}
+
+const QUERY_KIND_BY_NODE: Record<
+  string,
+  AuditedQuery['queryKind'] | undefined
+> = {
+  SelectQueryNode: 'select',
+  InsertQueryNode: 'insert',
+  UpdateQueryNode: 'update',
+  DeleteQueryNode: 'delete',
+}
+
+function getIdentifierName(node: unknown): string | undefined {
+  if (!node || typeof node !== 'object') return undefined
+  const candidate = node as {
+    name?: string
+    column?: { name?: string }
+    identifier?: { name?: string }
+    table?: { identifier?: { name?: string } }
+  }
+  return (
+    candidate.name ??
+    candidate.column?.name ??
+    candidate.identifier?.name ??
+    candidate.table?.identifier?.name
+  )
+}
+
+function collectTableNames(node: unknown, out: Set<string>): void {
+  if (!node || typeof node !== 'object') return
+
+  const candidate = node as {
+    kind?: string
+    table?: { identifier?: { name?: string } }
+  }
+
+  if (
+    candidate.kind === 'TableNode' &&
+    typeof candidate.table?.identifier?.name === 'string'
+  ) {
+    out.add(candidate.table.identifier.name)
+  }
+
+  for (const value of Object.values(node as Record<string, unknown>)) {
+    if (Array.isArray(value)) {
+      for (const item of value) collectTableNames(item, out)
+      continue
+    }
+    collectTableNames(value, out)
+  }
+}
+
+function extractValue(node: unknown): unknown {
+  if (!node || typeof node !== 'object') return node
+
+  const candidate = node as {
+    kind?: string
+    value?: unknown
+    values?: unknown[]
+    left?: unknown
+    right?: unknown
+  }
+
+  switch (candidate.kind) {
+    case 'ValueNode':
+      return candidate.value
+    case 'PrimitiveValueListNode':
+    case 'ValueListNode':
+      return (candidate.values ?? []).map(extractValue)
+    case 'DefaultInsertValueNode':
+      return '[default]'
+    case 'ColumnNode':
+    case 'ReferenceNode':
+      return `[${candidate.kind}]`
+    case 'RawNode':
+      return '[raw]'
+    case 'SelectQueryNode':
+      return '[subquery]'
+    case 'ParensNode':
+      return extractValue((candidate as { node?: unknown }).node)
+    case 'BinaryOperationNode':
+      return {
+        left: extractValue(candidate.left),
+        right: extractValue(candidate.right),
+      }
+    default:
+      return `[${candidate.kind ?? 'expression'}]`
+  }
+}
+
+function extractInsertChanges(node: any): {
+  changedColumns?: string[]
+  changes?: unknown
+} {
+  const columns = Array.isArray(node.columns)
+    ? node.columns
+        .map((column: unknown) => getIdentifierName(column))
+        .filter(Boolean)
+    : []
+  const values = Array.isArray(node.values?.values) ? node.values.values : []
+  if (columns.length === 0 || values.length === 0) {
+    return {
+      changedColumns: columns.length > 0 ? columns : undefined,
+    }
+  }
+
+  const rows = values.map((row: any) => {
+    const rowValues = Array.isArray(row?.values)
+      ? row.values.map(extractValue)
+      : []
+    return Object.fromEntries(
+      columns.map((column, index) => [column, rowValues[index]])
+    )
+  })
+
+  return {
+    changedColumns: columns,
+    changes: rows.length === 1 ? rows[0] : rows,
+  }
+}
+
+function extractUpdateChanges(node: any): {
+  changedColumns?: string[]
+  changes?: unknown
+} {
+  const updates = Array.isArray(node.updates) ? node.updates : []
+  const entries = updates
+    .map((update: any) => {
+      const column = getIdentifierName(update.column)
+      if (!column) return null
+      return [column, extractValue(update.value)] as const
+    })
+    .filter(Boolean) as Array<readonly [string, unknown]>
+
+  if (entries.length === 0) {
+    return {}
+  }
+
+  return {
+    changedColumns: entries.map(([column]) => column),
+    changes: Object.fromEntries(entries),
+  }
+}
+
+function extractChangeSet(
+  node: RootOperationNode,
+  queryKind: AuditedQuery['queryKind']
+) {
+  if (queryKind === 'insert') {
+    return extractInsertChanges(node as any)
+  }
+  if (queryKind === 'update') {
+    return extractUpdateChanges(node as any)
+  }
+  return {}
+}
+
+class AuditedKyselyPlugin implements KyselyPlugin {
+  private readonly pending = new Map<unknown, AuditedQuery>()
+  private queryCounter = 0
+
+  constructor(private readonly options: CreateAuditedKyselyOptions) {}
+
+  transformQuery(args: PluginTransformQueryArgs): RootOperationNode {
+    const queryKind =
+      QUERY_KIND_BY_NODE[(args.node as { kind?: string }).kind ?? '']
+    if (!queryKind) {
+      return args.node
+    }
+
+    if (queryKind === 'select' && this.options.auditReads === false) {
+      return args.node
+    }
+
+    const tables = new Set<string>()
+    collectTableNames(args.node, tables)
+    const queryId = `${this.options.queryIdPrefix ?? 'q'}-${++this.queryCounter}`
+    this.pending.set(args.queryId, {
+      queryKind,
+      queryId,
+      tables: [...tables].sort(),
+      ...extractChangeSet(args.node, queryKind),
+    })
+    return args.node
+  }
+
+  async transformResult(
+    args: PluginTransformResultArgs
+  ): Promise<QueryResult<UnknownRow>> {
+    const pending = this.pending.get(args.queryId)
+    if (!pending) {
+      return args.result
+    }
+
+    this.pending.delete(args.queryId)
+    const rawResult = args.result as QueryResult<UnknownRow> & {
+      numAffectedRows?: bigint
+      numUpdatedOrDeletedRows?: bigint
+    }
+    const rowCount =
+      rawResult.rows.length > 0
+        ? rawResult.rows.length
+        : Number(
+            rawResult.numUpdatedOrDeletedRows ?? rawResult.numAffectedRows ?? 0n
+          )
+
+    await this.options.audit.write({
+      type: this.options.eventType ?? 'db.query',
+      source: 'auto',
+      transactionId: this.options.transactionId ?? null,
+      queryId: pending.queryId,
+      metadata: {
+        queryKind: pending.queryKind,
+        tables: pending.tables,
+        changedColumns: pending.changedColumns,
+        changes: pending.changes,
+        rowCount,
+      },
+    })
+    return rawResult
+  }
+}
+
+export function createAuditedKysely<DB>(
+  db: Kysely<DB>,
+  options: CreateAuditedKyselyOptions
+): Kysely<DB> {
+  return db.withPlugin(new AuditedKyselyPlugin(options))
+}

package/src/index.ts

@@ -2,6 +2,7 @@ export { KyselyChannelStore } from './kysely-channel-store.js'
 export { KyselyEventHubStore } from './kysely-eventhub-store.js'
 export { KyselyWorkflowService } from './kysely-workflow-service.js'
 export { KyselyWorkflowRunService } from './kysely-workflow-run-service.js'
+export { KyselyWorkflowMirror } from './kysely-workflow-mirror.js'
 export { KyselyDeploymentService } from './kysely-deployment-service.js'
 export { KyselyAIStorageService } from './kysely-ai-storage-service.js'
 export { KyselyAgentRunService } from './kysely-ai-agent-run-service.js'
@@ -11,6 +12,10 @@ export type { KyselySecretServiceConfig } from './kysely-secret-service.js'
 export { KyselyCredentialService } from './kysely-credential-service.js'
 export type { KyselyCredentialServiceConfig } from './kysely-credential-service.js'
 export { KyselySessionStore } from './kysely-session-store.js'
+export {
+  createAuditedKysely,
+  type CreateAuditedKyselyOptions,
+} from './create-audited-kysely.js'
 
 export type { KyselyPikkuDB } from './kysely-tables.js'
 export type { WorkflowRunService } from '@pikku/core/workflow'

package/src/kysely-ai-agent-run-service.ts

@@ -13,10 +13,11 @@ export class KyselyAgentRunService implements AgentRunService {
 
   async listThreads(options?: {
     agentName?: string
+    resourceId?: string
     limit?: number
     offset?: number
   }): Promise<AIThread[]> {
-    const { agentName, limit = 50, offset = 0 } = options ?? {}
+    const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {}
 
     let query = this.db
       .selectFrom('aiThreads as t')
@@ -41,6 +42,10 @@ export class KyselyAgentRunService implements AgentRunService {
       )
     }
 
+    if (resourceId) {
+      query = query.where('t.resourceId', '=', resourceId)
+    }
+
     const result = await query
       .orderBy('t.updatedAt', 'desc')
       .limit(limit)

package/src/kysely-ai-run-state-service.ts

@@ -123,7 +123,9 @@ export class KyselyAIRunStateService implements AIRunStateService {
         try {
           approvals = JSON.parse(row.pendingApprovals as string)
         } catch {
-          console.warn(`Failed to parse pendingApprovals for run ${row.runId}, treating as empty`)
+          console.warn(
+            `Failed to parse pendingApprovals for run ${row.runId}, treating as empty`
+          )
         }
       }
       const filtered = approvals.filter((a) => a.toolCallId !== toolCallId)
@@ -161,7 +163,9 @@ export class KyselyAIRunStateService implements AIRunStateService {
         try {
           approvals = JSON.parse((row as any).pendingApprovals)
         } catch {
-          console.warn(`Failed to parse pendingApprovals for run ${row.runId}, treating as empty`)
+          console.warn(
+            `Failed to parse pendingApprovals for run ${row.runId}, treating as empty`
+          )
         }
       }
       const approval = approvals.find((a) => a.toolCallId === toolCallId)

package/src/kysely-channel-store.ts

@@ -27,6 +27,7 @@ export class KyselyChannelStore extends ChannelStore {
       )
       .addColumn('opening_data', 'text', (col) => col.notNull().defaultTo('{}'))
       .addColumn('pikku_user_id', 'text')
+      .addColumn('state', 'text')
       .addColumn('last_wire', 'timestamp', (col) =>
         col.defaultTo(sql`CURRENT_TIMESTAMP`).notNull()
       )
@@ -106,5 +107,31 @@ export class KyselyChannelStore extends ChannelStore {
     }
   }
 
+  public async setState(channelId: string, state: unknown): Promise<void> {
+    await this.db
+      .updateTable('channels')
+      .set({ state: JSON.stringify(state ?? null) })
+      .where('channelId', '=', channelId)
+      .execute()
+  }
+
+  public async getState(channelId: string): Promise<unknown | undefined> {
+    const row = await this.db
+      .selectFrom('channels')
+      .select(['state'])
+      .where('channelId', '=', channelId)
+      .executeTakeFirst()
+    if (!row || !row.state) return undefined
+    return parseJson(row.state) ?? undefined
+  }
+
+  public async clearState(channelId: string): Promise<void> {
+    await this.db
+      .updateTable('channels')
+      .set({ state: null })
+      .where('channelId', '=', channelId)
+      .execute()
+  }
+
   public async close(): Promise<void> {}
 }

package/src/kysely-secret-service.ts

@@ -93,7 +93,7 @@ export class KyselySecretService implements SecretService {
     throw new Error(`No KEK available for key_version ${version}`)
   }
 
-  async getSecret(key: string): Promise<string> {
+  async getSecret<T = string>(key: string): Promise<T> {
     const row = await this.db
       .selectFrom('secrets')
       .select(['ciphertext', 'wrappedDek', 'keyVersion'])
@@ -103,20 +103,11 @@ export class KyselySecretService implements SecretService {
     if (!row) throw new Error('Requested secret not found')
 
     const kek = this.getKEK(row.keyVersion)
-    const result = await envelopeDecrypt<string>(
-      kek,
-      row.ciphertext,
-      row.wrappedDek
-    )
+    const result = await envelopeDecrypt<T>(kek, row.ciphertext, row.wrappedDek)
     await this.logAudit(key, 'read')
     return result
   }
 
-  async getSecretJSON<R = {}>(key: string): Promise<R> {
-    const raw = await this.getSecret(key)
-    return JSON.parse(raw) as R
-  }
-
   async hasSecret(key: string): Promise<boolean> {
     const row = await this.db
       .selectFrom('secrets')
@@ -126,12 +117,8 @@ export class KyselySecretService implements SecretService {
     return !!row
   }
 
-  async setSecretJSON(key: string, value: unknown): Promise<void> {
-    const plaintext = JSON.stringify(value)
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      this.key,
-      plaintext
-    )
+  async setSecret(key: string, value: unknown): Promise<void> {
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value)
     const now = new Date().toISOString()
 
     await this.db

package/src/kysely-services.test.ts

@@ -128,7 +128,7 @@ function registerTests(
         auditReads: true,
       })
       await service.init()
-      await service.setSecretJSON('audit-test', 'value')
+      await service.setSecret('audit-test', 'value')
       await service.getSecret('audit-test')
       await service.deleteSecret('audit-test')
 
@@ -152,7 +152,7 @@ function registerTests(
         auditReads: false,
       })
       await service.init()
-      await service.setSecretJSON('no-read-audit', 'value')
+      await service.setSecret('no-read-audit', 'value')
       await service.getSecret('no-read-audit')
 
       const logs = await getDb()

package/src/kysely-session-store.ts

@@ -42,9 +42,7 @@ export class KyselySessionStore implements SessionStore {
       return undefined
     }
 
-    return (parseJson(row.session) ?? undefined) as
-      | CoreUserSession
-      | undefined
+    return (parseJson(row.session) ?? undefined) as CoreUserSession | undefined
   }
 
   async set(pikkuUserId: string, session: CoreUserSession): Promise<void> {

package/src/kysely-tables.ts

@@ -11,6 +11,8 @@ export interface ChannelsTable {
   createdAt: Generated<Date>
   openingData: string
   pikkuUserId: string | null
+  /** JSON-serialized per-socket channel state, keyed by channelId. */
+  state: string | null
   lastWire: Generated<Date>
 }
 

package/src/kysely-workflow-mirror.test.ts

@@ -0,0 +1,246 @@
+import { describe, test, beforeEach, afterEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { CamelCasePlugin, Kysely, SqliteDialect } from 'kysely'
+import { SerializePlugin } from 'kysely-plugin-serialize'
+import Database from 'better-sqlite3'
+
+import type { KyselyPikkuDB } from './kysely-tables.js'
+import { KyselyWorkflowMirror } from './kysely-workflow-mirror.js'
+import { KyselyWorkflowRunService } from './kysely-workflow-run-service.js'
+
+let db: Kysely<KyselyPikkuDB>
+let mirror: KyselyWorkflowMirror
+let runService: KyselyWorkflowRunService
+
+const RUN_ID = 'run-aaaa'
+const STEP_ID = 'step-bbbb'
+
+beforeEach(async () => {
+  db = new Kysely<KyselyPikkuDB>({
+    dialect: new SqliteDialect({ database: new Database(':memory:') }),
+    plugins: [new CamelCasePlugin(), new SerializePlugin()],
+  })
+  mirror = new KyselyWorkflowMirror(db)
+  await mirror.init()
+  runService = new KyselyWorkflowRunService(db)
+})
+
+afterEach(async () => {
+  await db.destroy()
+})
+
+async function seedRun(opts?: { input?: any; inline?: boolean }) {
+  await mirror.createRun(
+    RUN_ID,
+    'wf',
+    opts?.input ?? { foo: 1 },
+    opts?.inline ?? false,
+    'hash1',
+    { type: 'do', id: RUN_ID } as any
+  )
+}
+
+async function seedStep(stepId = STEP_ID, stepName = 'step1') {
+  await mirror.insertStepState(RUN_ID, {
+    stepId,
+    stepName,
+    rpcName: 'rpc.fn',
+    data: { x: 1 },
+    status: 'pending',
+    attemptCount: 1,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  } as any)
+}
+
+describe('KyselyWorkflowMirror — runs', () => {
+  test('createRun is visible to KyselyWorkflowRunService.getRun', async () => {
+    await seedRun({ input: { hello: 'world' } })
+    const run = await runService.getRun(RUN_ID)
+    assert.ok(run)
+    assert.equal(run.workflow, 'wf')
+    assert.equal(run.status, 'running')
+    assert.deepEqual(run.input, { hello: 'world' })
+    assert.equal(run.graphHash, 'hash1')
+  })
+
+  test('updateRunStatus reflects in getRun', async () => {
+    await seedRun()
+    await mirror.updateRunStatus(RUN_ID, 'completed', { ok: true })
+    const run = await runService.getRun(RUN_ID)
+    assert.equal(run!.status, 'completed')
+    assert.deepEqual(run!.output, { ok: true })
+  })
+
+  test('listRuns surfaces mirrored runs', async () => {
+    await seedRun()
+    const runs = await runService.listRuns()
+    assert.equal(runs.length, 1)
+    assert.equal(runs[0]!.id, RUN_ID)
+  })
+
+  test('getDistinctWorkflowNames returns mirrored workflow names', async () => {
+    await seedRun()
+    const names = await runService.getDistinctWorkflowNames()
+    assert.deepEqual(names, ['wf'])
+  })
+})
+
+describe('KyselyWorkflowMirror — step lifecycle', () => {
+  beforeEach(async () => {
+    await seedRun()
+  })
+
+  test('insertStepState creates step + initial pending history', async () => {
+    await seedStep()
+    const steps = await runService.getRunSteps(RUN_ID)
+    assert.equal(steps.length, 1)
+    assert.equal(steps[0]!.stepName, 'step1')
+    assert.equal(steps[0]!.status, 'pending')
+
+    const history = await runService.getRunHistory(RUN_ID)
+    assert.equal(history.length, 1)
+    assert.equal(history[0]!.status, 'pending')
+  })
+
+  test('running → succeeded updates the in-place history row', async () => {
+    await seedStep()
+    await mirror.setStepRunning(STEP_ID)
+    await mirror.setStepResult(STEP_ID, { value: 42 })
+
+    const steps = await runService.getRunSteps(RUN_ID)
+    assert.equal(steps[0]!.status, 'succeeded')
+    assert.deepEqual(steps[0]!.result, { value: 42 })
+
+    const history = await runService.getRunHistory(RUN_ID)
+    assert.equal(history.length, 1, 'updates collapse onto latest history row')
+    assert.equal(history[0]!.status, 'succeeded')
+    assert.deepEqual(history[0]!.result, { value: 42 })
+  })
+
+  test('setStepError stores serialized error', async () => {
+    await seedStep()
+    await mirror.setStepError(STEP_ID, {
+      message: 'boom',
+      stack: 'stack',
+      code: 'EBOOM',
+    })
+
+    const steps = await runService.getRunSteps(RUN_ID)
+    assert.equal(steps[0]!.status, 'failed')
+    assert.equal(steps[0]!.error?.message, 'boom')
+    assert.equal(steps[0]!.error?.code, 'EBOOM')
+  })
+
+  test('createRetryAttempt appends a new history row + clears result/error', async () => {
+    await seedStep()
+    await mirror.setStepError(STEP_ID, { message: 'first try', code: 'X' })
+
+    await mirror.createRetryAttempt(STEP_ID, {
+      stepId: STEP_ID,
+      stepName: 'step1',
+      status: 'pending',
+      attemptCount: 2,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    } as any)
+
+    const steps = await runService.getRunSteps(RUN_ID)
+    assert.equal(steps[0]!.status, 'pending')
+    assert.equal(steps[0]!.error, undefined)
+    assert.equal(steps[0]!.result, undefined)
+
+    const history = await runService.getRunHistory(RUN_ID)
+    // pending (initial — collapsed onto failed) + pending (retry append)
+    assert.equal(history.length, 2)
+    assert.equal(history[0]!.status, 'failed')
+    assert.equal(history[1]!.status, 'pending')
+  })
+
+  test('setStepChildRunId persists', async () => {
+    await seedStep()
+    await mirror.setStepChildRunId(STEP_ID, 'child-run-1')
+    const steps = await runService.getRunSteps(RUN_ID)
+    assert.equal((steps[0] as any).childRunId, 'child-run-1')
+  })
+
+  test('setBranchTaken persists the branch key', async () => {
+    await seedStep()
+    await mirror.setBranchTaken(STEP_ID, 'left')
+    const row = await db
+      .selectFrom('workflowStep')
+      .select('branchTaken')
+      .where('workflowStepId', '=', STEP_ID)
+      .executeTakeFirst()
+    assert.equal(row?.branchTaken, 'left')
+  })
+})
+
+describe('KyselyWorkflowMirror — run state', () => {
+  beforeEach(async () => {
+    await seedRun()
+  })
+
+  test('updateRunState merges values', async () => {
+    await mirror.updateRunState(RUN_ID, 'counter', 1)
+    await mirror.updateRunState(RUN_ID, 'flag', true)
+    const row = await db
+      .selectFrom('workflowRuns')
+      .select('state')
+      .where('workflowRunId', '=', RUN_ID)
+      .executeTakeFirst()
+    const state =
+      typeof row?.state === 'string' ? JSON.parse(row.state) : row?.state
+    assert.deepEqual(state, { counter: 1, flag: true })
+  })
+})
+
+describe('KyselyWorkflowMirror — workflow versions', () => {
+  test('upsertWorkflowVersion is idempotent on (name, hash)', async () => {
+    await mirror.upsertWorkflowVersion('wf', 'h1', { v: 1 }, 'graph')
+    await mirror.upsertWorkflowVersion('wf', 'h1', { v: 2 }, 'graph')
+    const v = await runService.getWorkflowVersion('wf', 'h1')
+    assert.deepEqual(v?.graph, { v: 1 }, 'first write wins (doNothing)')
+  })
+
+  test('updateWorkflowVersionStatus mutates status', async () => {
+    await mirror.upsertWorkflowVersion('wf', 'h1', {}, 'graph', 'active')
+    await mirror.updateWorkflowVersionStatus('wf', 'h1', 'archived')
+    const row = await db
+      .selectFrom('workflowVersions')
+      .select('status')
+      .where('workflowName', '=', 'wf')
+      .where('graphHash', '=', 'h1')
+      .executeTakeFirst()
+    assert.equal(row?.status, 'archived')
+  })
+
+  test('AI-generated workflows surface via getAIGeneratedWorkflows', async () => {
+    await mirror.upsertWorkflowVersion(
+      'ai:agent-x:foo',
+      'h1',
+      { nodes: [] },
+      'dynamic-workflow'
+    )
+    const list = await runService.getAIGeneratedWorkflows('agent-x')
+    assert.equal(list.length, 1)
+    assert.equal(list[0]!.workflowName, 'ai:agent-x:foo')
+  })
+})
+
+describe('KyselyWorkflowMirror — init', () => {
+  test('init is idempotent', async () => {
+    await mirror.init()
+    await mirror.init()
+    // No-op on second call; just shouldn't throw.
+  })
+
+  test('cohabits with KyselyWorkflowService schema (ifNotExists)', async () => {
+    // Same DB, schema already created by mirror.init() in beforeEach.
+    // If KyselyWorkflowService.init() ran on the same DB, both should
+    // succeed because both use ifNotExists. We can't import it without
+    // the singleton-services bootstrap, so simulate by re-calling our
+    // own init — proves the SQL is idempotent.
+    await assert.doesNotReject(mirror.init())
+  })
+})