@pikku/kysely 0.12.13 → 0.12.15

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 0.12.15
+
+### Patch Changes
+
+- ea48df2: Include runningAt, succeededAt, and failedAt timestamps in getRunSteps results
+- Updated dependencies [2cf67be]
+  - @pikku/core@0.12.28
+
+## 0.12.14
+
+### Patch Changes
+
+- 4b5c75b: feat(auth-js): wire OIDC config (issuer/tenantId) as variables, expand provider registry
+  - Move `issuer` and `tenantId` out of the secret blob for OIDC providers (auth0, okta, azure-ad, keycloak, cognito, microsoft-entra-id) — they are public config URLs, not secrets. Now registered via `wireVariable` and loaded at runtime via `services.variables.get()`.
+  - Expand provider registry from 13 to 31 providers: reddit, notion, instagram, zoom, figma, tiktok, threads, patreon, dropbox, bitbucket, hubspot, salesforce, atlassian, strava, keycloak, cognito, microsoft-entra-id added.
+  - `serialize-auth-gen` emits `wireVariable({...})` declarations and `services.variables.get()` calls in the generated factory for OIDC providers.
+  - Integration verifier exercises real `/auth/providers` endpoint with `LocalSecretService` + `LocalVariablesService`, including a spy test proving `services.variables.get('AUTH0_ISSUER')` is called at request time.
+
+- Updated dependencies [4b5c75b]
+- Updated dependencies [4b5c75b]
+  - @pikku/core@0.12.27
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/src/kysely-secret-service.d.ts

@@ -24,5 +24,6 @@ export declare class KyselySecretService implements SecretService {
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/kysely-secret-service.js

@@ -110,6 +110,24 @@ export class KyselySecretService {
         await this.db.deleteFrom('secrets').where('key', '=', key).execute();
         await this.logAudit(key, 'delete');
     }
+    async getSecrets(keys) {
+        const rows = await this.db
+            .selectFrom('secrets')
+            .select(['key', 'ciphertext', 'wrappedDek', 'keyVersion'])
+            .where('key', 'in', keys)
+            .execute();
+        const out = {};
+        for (const row of rows) {
+            try {
+                const kek = this.getKEK(row.keyVersion);
+                out[row.key] = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
+            }
+            catch {
+                // skip secrets that fail to decrypt
+            }
+        }
+        return out;
+    }
     async rotateKEK() {
         if (!this.previousKey) {
             throw new Error('No previousKey configured — nothing to rotate from');

package/dist/src/kysely-workflow-run-service.js

@@ -1,3 +1,4 @@
+import { sql } from 'kysely';
 import { parseJson } from './kysely-json.js';
 export class KyselyWorkflowRunService {
     db;
@@ -82,6 +83,9 @@ export class KyselyWorkflowRunService {
             .select(eb.fn.countAll().as('cnt'))
             .whereRef('workflowStepHistory.workflowStepId', '=', 's.workflowStepId')
             .as('attemptCount'))
+            .select(sql `(SELECT MAX(h.running_at) FROM workflow_step_history h WHERE h.workflow_step_id = s.workflow_step_id)`.as('runningAt'))
+            .select(sql `(SELECT MAX(h.succeeded_at) FROM workflow_step_history h WHERE h.workflow_step_id = s.workflow_step_id)`.as('succeededAt'))
+            .select(sql `(SELECT MAX(h.failed_at) FROM workflow_step_history h WHERE h.workflow_step_id = s.workflow_step_id)`.as('failedAt'))
             .where('s.workflowRunId', '=', runId)
             .orderBy('s.createdAt', 'asc')
             .execute();
@@ -99,6 +103,15 @@ export class KyselyWorkflowRunService {
             retryDelay: row.retryDelay ?? undefined,
             createdAt: new Date(row.createdAt),
             updatedAt: new Date(row.updatedAt),
+            runningAt: row.runningAt
+                ? new Date(row.runningAt)
+                : undefined,
+            succeededAt: row.succeededAt
+                ? new Date(row.succeededAt)
+                : undefined,
+            failedAt: row.failedAt
+                ? new Date(row.failedAt)
+                : undefined,
         }));
     }
     async getRunHistory(runId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -20,7 +20,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.26"
+    "@pikku/core": "^0.12.28"
   },
   "dependencies": {
     "kysely": "^0.28.12"
@@ -33,5 +33,8 @@
     "kysely-postgres-js": "^3.0.0",
     "postgres": "^3.4.8",
     "typescript": "^5.9"
+  },
+  "exports": {
+    ".": "./dist/src/index.js"
   }
 }

package/src/kysely-secret-service.ts

@@ -149,6 +149,29 @@ export class KyselySecretService implements SecretService {
     await this.logAudit(key, 'delete')
   }
 
+  async getSecrets(keys: string[]): Promise<Record<string, unknown>> {
+    const rows = await this.db
+      .selectFrom('secrets')
+      .select(['key', 'ciphertext', 'wrappedDek', 'keyVersion'])
+      .where('key', 'in', keys)
+      .execute()
+
+    const out: Record<string, unknown> = {}
+    for (const row of rows) {
+      try {
+        const kek = this.getKEK(row.keyVersion)
+        out[row.key] = await envelopeDecrypt(
+          kek,
+          row.ciphertext,
+          row.wrappedDek
+        )
+      } catch {
+        // skip secrets that fail to decrypt
+      }
+    }
+    return out
+  }
+
   async rotateKEK(): Promise<number> {
     if (!this.previousKey) {
       throw new Error('No previousKey configured — nothing to rotate from')

package/src/kysely-workflow-run-service.ts

@@ -5,6 +5,7 @@ import type {
   WorkflowRunService,
 } from '@pikku/core/workflow'
 import type { Kysely } from 'kysely'
+import { sql } from 'kysely'
 import type { KyselyPikkuDB } from './kysely-tables.js'
 import { parseJson } from './kysely-json.js'
 
@@ -111,6 +112,15 @@ export class KyselyWorkflowRunService implements WorkflowRunService {
           )
           .as('attemptCount')
       )
+      .select(
+        sql<string | null>`(SELECT MAX(h.running_at) FROM workflow_step_history h WHERE h.workflow_step_id = s.workflow_step_id)`.as('runningAt')
+      )
+      .select(
+        sql<string | null>`(SELECT MAX(h.succeeded_at) FROM workflow_step_history h WHERE h.workflow_step_id = s.workflow_step_id)`.as('succeededAt')
+      )
+      .select(
+        sql<string | null>`(SELECT MAX(h.failed_at) FROM workflow_step_history h WHERE h.workflow_step_id = s.workflow_step_id)`.as('failedAt')
+      )
       .where('s.workflowRunId', '=', runId)
       .orderBy('s.createdAt', 'asc')
       .execute()
@@ -129,6 +139,15 @@ export class KyselyWorkflowRunService implements WorkflowRunService {
       retryDelay: row.retryDelay ?? undefined,
       createdAt: new Date(row.createdAt as unknown as string),
       updatedAt: new Date(row.updatedAt as unknown as string),
+      runningAt: row.runningAt
+        ? new Date(row.runningAt as unknown as string)
+        : undefined,
+      succeededAt: row.succeededAt
+        ? new Date(row.succeededAt as unknown as string)
+        : undefined,
+      failedAt: row.failedAt
+        ? new Date(row.failedAt as unknown as string)
+        : undefined,
     }))
   }