@pikku/kysely 0.13.0 → 0.13.2

package/dist/src/kysely-webhook-service.js

@@ -0,0 +1,150 @@
+import { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, QueueWebhookService, } from '@pikku/core/services';
+import { sql } from 'kysely';
+/**
+ * Durable {@link QueueWebhookService}: still delivers through the
+ * `pikku-outgoing-webhooks` queue, but records a `webhook_delivery` row per
+ * `send()` and one `webhook_delivery_attempt` row per try. Register it as the
+ * `webhookService` singleton; the queue worker persists each attempt through
+ * {@link recordAttempt}, overriding the base's throwing default.
+ */
+export class KyselyWebhookService extends QueueWebhookService {
+    db;
+    initialized = false;
+    constructor(queueService, db) {
+        super(queueService);
+        this.db = db;
+    }
+    async init() {
+        if (this.initialized) {
+            return;
+        }
+        await this.db.schema
+            .createTable('webhook_delivery')
+            .ifNotExists()
+            .addColumn('delivery_id', 'text', (col) => col.primaryKey())
+            .addColumn('organization_id', 'text')
+            .addColumn('url', 'text', (col) => col.notNull())
+            .addColumn('event', 'text')
+            .addColumn('status', 'text', (col) => col.defaultTo('pending').notNull())
+            .addColumn('attempts', 'integer', (col) => col.defaultTo(0).notNull())
+            .addColumn('created_at', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .addColumn('updated_at', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .addColumn('delivered_at', 'timestamp')
+            .execute();
+        await this.db.schema
+            .createTable('webhook_delivery_attempt')
+            .ifNotExists()
+            .addColumn('attempt_id', 'text', (col) => col.primaryKey())
+            .addColumn('delivery_id', 'text', (col) => col.notNull().references('webhook_delivery.delivery_id').onDelete('cascade'))
+            .addColumn('attempt_number', 'integer', (col) => col.notNull())
+            .addColumn('status_code', 'integer')
+            .addColumn('response_body', 'text')
+            .addColumn('error', 'text')
+            .addColumn('created_at', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .execute();
+        await this.createIndexSafe(this.db.schema
+            .createIndex('idx_webhook_delivery_org')
+            .ifNotExists()
+            .on('webhook_delivery')
+            .column('organization_id'));
+        await this.createIndexSafe(this.db.schema
+            .createIndex('idx_webhook_delivery_attempt_delivery')
+            .ifNotExists()
+            .on('webhook_delivery_attempt')
+            .column('delivery_id'));
+        this.initialized = true;
+    }
+    async send(input) {
+        const deliveryId = globalThis.crypto.randomUUID();
+        const { jobData, options } = await this.prepareDelivery(input);
+        await this.db
+            .insertInto('webhookDelivery')
+            .values({
+            deliveryId,
+            organizationId: input.organizationId ?? null,
+            url: input.url,
+            event: input.event ?? null,
+        })
+            .execute();
+        // deliveryId doubles as the queue jobId (idempotency) and rides in the
+        // payload so the worker can record attempts against this row.
+        const jobId = await this.queueService.add(PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, { ...jobData, deliveryId }, { ...options, jobId: deliveryId });
+        return { jobId };
+    }
+    async recordAttempt(deliveryId, { statusCode, responseBody, error, delivered }) {
+        const now = new Date();
+        await this.db.transaction().execute(async (trx) => {
+            const existing = await trx
+                .selectFrom('webhookDeliveryAttempt')
+                .select((eb) => eb.fn.countAll().as('count'))
+                .where('deliveryId', '=', deliveryId)
+                .executeTakeFirst();
+            const attemptNumber = Number(existing?.count ?? 0) + 1;
+            await trx
+                .insertInto('webhookDeliveryAttempt')
+                .values({
+                attemptId: globalThis.crypto.randomUUID(),
+                deliveryId,
+                attemptNumber,
+                statusCode: statusCode ?? null,
+                responseBody: responseBody ?? null,
+                error: error ?? null,
+            })
+                .execute();
+            await trx
+                .updateTable('webhookDelivery')
+                .set({
+                status: delivered ? 'delivered' : 'failed',
+                attempts: attemptNumber,
+                updatedAt: now,
+                ...(delivered ? { deliveredAt: now } : {}),
+            })
+                .where('deliveryId', '=', deliveryId)
+                .execute();
+        });
+    }
+    /** List deliveries, most recent first — for the console webhooks view. */
+    async listDeliveries(opts) {
+        let query = this.db
+            .selectFrom('webhookDelivery')
+            .selectAll()
+            .orderBy('createdAt', 'desc')
+            .limit(opts?.limit ?? 100);
+        if (opts?.organizationId) {
+            query = query.where('organizationId', '=', opts.organizationId);
+        }
+        return query.execute();
+    }
+    /** A single delivery with its full attempt history, or null if unknown. */
+    async getDelivery(deliveryId) {
+        const delivery = await this.db
+            .selectFrom('webhookDelivery')
+            .selectAll()
+            .where('deliveryId', '=', deliveryId)
+            .executeTakeFirst();
+        if (!delivery) {
+            return null;
+        }
+        const attempts = await this.db
+            .selectFrom('webhookDeliveryAttempt')
+            .selectAll()
+            .where('deliveryId', '=', deliveryId)
+            .orderBy('attemptNumber', 'asc')
+            .execute();
+        return { delivery, attempts };
+    }
+    async createIndexSafe(builder) {
+        try {
+            await builder.execute();
+        }
+        catch (e) {
+            if (e?.code === 'ER_DUP_KEYNAME' || e?.errno === 1061)
+                return;
+            if (e?.code === '42P07')
+                return;
+            if (e?.message?.includes('already exists'))
+                return;
+            throw e;
+        }
+    }
+}

package/dist/src/kysely-workflow-service.js

@@ -308,11 +308,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
         if (latestHistory) {
             await this.db
                 .updateTable('workflowStepHistory')
-                .set({
-                status: 'succeeded',
-                result: resultJson,
-                succeededAt: new Date(),
-            })
+                .set({ status: 'succeeded', result: resultJson, succeededAt: new Date() })
                 .where('historyId', '=', latestHistory.historyId)
                 .execute();
         }

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-ai-agent-run-service.ts","../src/kysely-ai-run-state-service.ts","../src/kysely-ai-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}
+{"root":["../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-ai-agent-run-service.ts","../src/kysely-ai-run-state-service.ts","../src/kysely-ai-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-scope-service.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-webhook-service.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -20,7 +20,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.44"
+    "@pikku/core": "^0.12.66"
   },
   "dependencies": {
     "kysely": "^0.29.0"

package/run-tests.sh

@@ -38,16 +38,16 @@ if [ ${#files[@]} -eq 0 ]; then
 fi
 
 # Construct the node command
-node_cmd="node --import tsx --test"
+node_cmd=(node --import tsx --test)
 
 # Append options based on flags
 if [ "$watch_mode" = true ]; then
-  node_cmd="$node_cmd --watch"
+  node_cmd+=(--watch)
 fi
 
 if [ "$coverage_mode" = true ]; then
-  node_cmd="$node_cmd --test-coverage-include=\"src/**/*.{ts,js}\" --test-coverage-exclude=\"**/dist/**\" --experimental-test-coverage --test-reporter=lcov --test-reporter-destination=lcov.info"
+  node_cmd+=(--test-coverage-include="src/**/*.{ts,js}" --test-coverage-exclude="**/dist/**" --experimental-test-coverage --test-reporter=lcov --test-reporter-destination=lcov.info)
 fi
 
 # Execute the node command with the expanded list of files
-$node_cmd "${files[@]}"
+"${node_cmd[@]}" "${files[@]}"

package/src/index.ts

@@ -12,6 +12,8 @@ export type { KyselySecretServiceConfig } from './kysely-secret-service.js'
 export { KyselyCredentialService } from './kysely-credential-service.js'
 export type { KyselyCredentialServiceConfig } from './kysely-credential-service.js'
 export { KyselySessionStore } from './kysely-session-store.js'
+export { KyselyScopeService } from './kysely-scope-service.js'
+export { KyselyWebhookService } from './kysely-webhook-service.js'
 export {
   createAuditedKysely,
   type CreateAuditedKyselyOptions,

package/src/kysely-ai-agent-run-service.ts

@@ -5,19 +5,36 @@ import type {
   AgentRunService,
 } from '@pikku/core/ai-agent'
 import type { Kysely } from 'kysely'
+import { sql } from 'kysely'
 import type { KyselyPikkuDB } from './kysely-tables.js'
 import { parseJson } from './kysely-json.js'
 
+// Owner ids routinely contain `_` (e.g. `user_123`), which LIKE treats as a
+// single-character wildcard — so a raw prefix would match a foreign owner.
+const escapeLikePattern = (value: string) =>
+  value.replace(/[\\%_]/g, (char) => `\\${char}`)
+
 export class KyselyAgentRunService implements AgentRunService {
   constructor(private db: Kysely<KyselyPikkuDB>) {}
 
   async listThreads(options?: {
     agentName?: string
     resourceId?: string
+    owners?: string[]
     limit?: number
     offset?: number
   }): Promise<AIThread[]> {
-    const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {}
+    const {
+      agentName,
+      resourceId,
+      owners,
+      limit = 50,
+      offset = 0,
+    } = options ?? {}
+
+    // An owners constraint is an authorization boundary, so an empty list must
+    // match nothing rather than degrade to "no filter".
+    if (owners && owners.length === 0) return []
 
     let query = this.db
       .selectFrom('aiThreads as t')
@@ -46,6 +63,21 @@ export class KyselyAgentRunService implements AgentRunService {
       query = query.where('t.resourceId', '=', resourceId)
     }
 
+    if (owners) {
+      query = query.where((eb) =>
+        eb.or(
+          owners.flatMap((owner) => [
+            eb('t.resourceId', '=', owner),
+            eb(
+              't.resourceId',
+              'like',
+              sql<string>`${`${escapeLikePattern(owner)}:%`} escape '\\'`
+            ),
+          ])
+        )
+      )
+    }
+
     const result = await query
       .orderBy('t.updatedAt', 'desc')
       .limit(limit)