@pikku/kysely 0.13.22 → 0.13.24

package/CHANGELOG.md

@@ -1,3 +1,30 @@
+## 0.13.24
+
+### Patch Changes
+
+- f10162a: `send()` now reports the delivery id it wrote, not only the broker's job id.
+
+  `KyselyWebhookService.send()` returned `{ jobId }` straight from `queueService.add()`, and callers handed that to `getDelivery()`. That only worked because every queue in the test suite echoed the requested `jobId` back. A broker is free to assign its own identity — the JetStream queue returns a stream sequence — so on those the read-back looked up an id that was never written and 404'd.
+
+  `SendWebhookResult` gains an optional `deliveryId`, which store-backed implementations always populate.
+
+- Updated dependencies [f10162a]
+  - @pikku/core@0.12.104
+
+## 0.13.23
+
+### Patch Changes
+
+- 80eb5c0: Encrypt classified columns from the generated manifest.
+
+  `ClassificationPlugin` reads the per-column classification manifest and decrypts `wrapped` and `sealed` columns transparently on the way out. Writes are not transparent — Kysely's `transformQuery` is synchronous and WebCrypto is not — so plaintext heading for a classified column **throws** instead, and values are produced by `ClassificationCrypto.encryptColumn()`. A forgotten call site is a loud error rather than a silent plaintext row. The stored envelope is self-describing (`pikku1.<keyId>.<version>.<wrappedDek>.<ciphertext>`), so a row records which key opens it without a schema change to every table.
+
+  `keyId` now flows from the hand-authored `db/annotations.ts` through `pikku db migrate` into `classification.gen.ts`. It is emitted only for `wrapped` and `sealed` columns: naming a key on a plain column would claim a protection it does not have, and a hashed column has no key at all — the hash is the lookup key.
+
+- Updated dependencies [80eb5c0]
+- Updated dependencies [2252016]
+  - @pikku/core@0.12.98
+
 ## 0.13.22
 
 ### Patch Changes

package/dist/src/classification-crypto.d.ts

@@ -0,0 +1,72 @@
+import { DEFAULT_KEY_ID } from '@pikku/core/classification';
+import type { WrappedValue } from '@pikku/core/classification';
+/**
+ * The key a column is protected by when its classification names none. A
+ * deployment that never scopes its keys stores this id in every row and still
+ * gets the scoping seam for free.
+ *
+ * Re-exported from core rather than declared again: the same constant decides
+ * which record `initialize` mints and which one a stored envelope names, and
+ * two copies of it would only ever be found to disagree by a row that could
+ * not be opened.
+ */
+export { DEFAULT_KEY_ID };
+/** The parts of a stored envelope, as they came off the column. */
+export interface ColumnEnvelope {
+    keyId: string;
+    keyVersion: number;
+    wrappedDek: string;
+    ciphertext: string;
+}
+/**
+ * A KEK for one `keyId`, plus the version it was derived at.
+ *
+ * The version is the resolver's to report rather than the caller's to ask for:
+ * on a write it stamps the row, and on a read the row already carries the
+ * version the value was written under.
+ */
+export interface ResolvedKEK {
+    kek: CryptoKey;
+    keyVersion: number;
+}
+/**
+ * Maps a `keyId` — and, when reading, the version the row was written under —
+ * to the KEK that opens it.
+ *
+ * This is the seam the whole design turns on. An unlock gate, a per-tenant
+ * lookup or a KMS call all replace this one function without reshaping anything
+ * that calls it.
+ */
+export type KEKResolver = (keyId: string, keyVersion?: number) => Promise<ResolvedKEK>;
+/**
+ * Read a stored envelope, or null when the value is not one.
+ *
+ * Every part is base64url except the version, so `.` cannot occur inside a part
+ * and a fixed split is unambiguous — a `keyId` may contain dots.
+ */
+export declare const parseColumnEnvelope: (value: unknown) => ColumnEnvelope | null;
+export declare const isColumnEnvelope: (value: unknown) => boolean;
+export interface ClassificationCryptoOptions {
+    resolveKEK: KEKResolver;
+}
+/**
+ * Envelope encryption for a single classified column.
+ *
+ * Unlike `KyselySecretService`, which owns its table and can afford a column
+ * per envelope part, a classified column is one column in someone else's table.
+ * So the envelope is self-describing: the `keyId` and `keyVersion` travel in
+ * the value, which is what lets a row record the key that protects it without
+ * a schema change to every table that has a secret in it.
+ */
+export declare class ClassificationCrypto {
+    private readonly resolveKEK;
+    constructor(options: ClassificationCryptoOptions);
+    encryptColumn(keyId: string, value: unknown): Promise<WrappedValue>;
+    decryptColumn<T = unknown>(value: unknown): Promise<T>;
+    /**
+     * Move a value to another key by re-wrapping its DEK. The ciphertext is
+     * untouched, so the cost is a constant per row rather than proportional to
+     * the value — the property that makes rescoping and rotation affordable.
+     */
+    rewrapColumn(value: unknown, newKeyId: string): Promise<WrappedValue>;
+}

package/dist/src/classification-crypto.js

@@ -0,0 +1,104 @@
+import { envelopeDecrypt, envelopeEncrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
+import { DEFAULT_KEY_ID } from '@pikku/core/classification';
+/**
+ * The key a column is protected by when its classification names none. A
+ * deployment that never scopes its keys stores this id in every row and still
+ * gets the scoping seam for free.
+ *
+ * Re-exported from core rather than declared again: the same constant decides
+ * which record `initialize` mints and which one a stored envelope names, and
+ * two copies of it would only ever be found to disagree by a row that could
+ * not be opened.
+ */
+export { DEFAULT_KEY_ID };
+const ENVELOPE_PREFIX = 'pikku1';
+const encodePart = (value) => Buffer.from(value, 'utf8').toString('base64url');
+const decodePart = (value) => Buffer.from(value, 'base64url').toString('utf8');
+const serializeEnvelope = (envelope) => [
+    ENVELOPE_PREFIX,
+    encodePart(envelope.keyId),
+    String(envelope.keyVersion),
+    envelope.wrappedDek,
+    envelope.ciphertext,
+].join('.');
+/**
+ * Read a stored envelope, or null when the value is not one.
+ *
+ * Every part is base64url except the version, so `.` cannot occur inside a part
+ * and a fixed split is unambiguous — a `keyId` may contain dots.
+ */
+export const parseColumnEnvelope = (value) => {
+    if (typeof value !== 'string')
+        return null;
+    const parts = value.split('.');
+    if (parts.length !== 5 || parts[0] !== ENVELOPE_PREFIX)
+        return null;
+    const [, encodedKeyId, rawVersion, wrappedDek, ciphertext] = parts;
+    const keyVersion = Number(rawVersion);
+    if (!Number.isInteger(keyVersion) || !wrappedDek || !ciphertext)
+        return null;
+    try {
+        return {
+            keyId: decodePart(encodedKeyId),
+            keyVersion,
+            wrappedDek,
+            ciphertext,
+        };
+    }
+    catch {
+        return null;
+    }
+};
+export const isColumnEnvelope = (value) => parseColumnEnvelope(value) !== null;
+/**
+ * Envelope encryption for a single classified column.
+ *
+ * Unlike `KyselySecretService`, which owns its table and can afford a column
+ * per envelope part, a classified column is one column in someone else's table.
+ * So the envelope is self-describing: the `keyId` and `keyVersion` travel in
+ * the value, which is what lets a row record the key that protects it without
+ * a schema change to every table that has a secret in it.
+ */
+export class ClassificationCrypto {
+    resolveKEK;
+    constructor(options) {
+        this.resolveKEK = options.resolveKEK;
+    }
+    async encryptColumn(keyId, value) {
+        const { kek, keyVersion } = await this.resolveKEK(keyId);
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(kek, value);
+        return serializeEnvelope({
+            keyId,
+            keyVersion,
+            wrappedDek: wrappedDEK,
+            ciphertext,
+        });
+    }
+    async decryptColumn(value) {
+        const envelope = parseColumnEnvelope(value);
+        if (!envelope) {
+            throw new Error('Value is not a pikku column envelope');
+        }
+        const { kek } = await this.resolveKEK(envelope.keyId, envelope.keyVersion);
+        return envelopeDecrypt(kek, envelope.ciphertext, envelope.wrappedDek);
+    }
+    /**
+     * Move a value to another key by re-wrapping its DEK. The ciphertext is
+     * untouched, so the cost is a constant per row rather than proportional to
+     * the value — the property that makes rescoping and rotation affordable.
+     */
+    async rewrapColumn(value, newKeyId) {
+        const envelope = parseColumnEnvelope(value);
+        if (!envelope) {
+            throw new Error('Value is not a pikku column envelope');
+        }
+        const { kek: oldKEK } = await this.resolveKEK(envelope.keyId, envelope.keyVersion);
+        const { kek: newKEK, keyVersion } = await this.resolveKEK(newKeyId);
+        return serializeEnvelope({
+            keyId: newKeyId,
+            keyVersion,
+            wrappedDek: await envelopeRewrap(oldKEK, newKEK, envelope.wrappedDek),
+            ciphertext: envelope.ciphertext,
+        });
+    }
+}

package/dist/src/classification-plugin.d.ts

@@ -0,0 +1,28 @@
+import type { KyselyPlugin } from 'kysely';
+import type { ClassificationManifest } from '@pikku/core/classification';
+import { type ClassificationCrypto } from './classification-crypto.js';
+export interface CreateClassificationPluginOptions {
+    manifest: ClassificationManifest;
+    crypto: ClassificationCrypto;
+}
+/**
+ * Make a column's at-rest form a property of the column rather than of the
+ * developer's memory.
+ *
+ * Reads are transparent: a `wrapped` column comes back decrypted, so
+ * application code never sees an envelope. `hashed` and `plain` columns are
+ * untouched, which is what keeps the rest of the schema queryable.
+ *
+ * Writes are *guarded* rather than transformed, and the reason is Kysely's
+ * shape, not a preference: `transformQuery` is synchronous and WebCrypto is
+ * not, so a plugin cannot encrypt on the way in. Encrypting at the call site
+ * and letting a forgotten call slip through silently is the failure this
+ * design exists to prevent, so the guard refuses any plaintext heading for a
+ * `wrapped` or `sealed` column. Values are produced with
+ * `ClassificationCrypto.encryptColumn`.
+ *
+ * A `sealed` column is never decrypted on the way out — the application holds
+ * only the public half by definition, so returning it as stored is correct
+ * rather than a gap.
+ */
+export declare function createClassificationPlugin(options: CreateClassificationPluginOptions): KyselyPlugin;

package/dist/src/classification-plugin.js

@@ -0,0 +1,199 @@
+import { DEFAULT_KEY_ID, isColumnEnvelope, } from './classification-crypto.js';
+function snakeToCamel(name) {
+    return name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+}
+/**
+ * Flatten the manifest into a table-qualified lookup plus a bare column-name
+ * fallback, both indexed under snake_case and camelCase so the plugin works on
+ * either side of `CamelCasePlugin` in the array.
+ *
+ * A bare name two tables disagree about is dropped rather than letting the last
+ * one win: on a joined query it could carry either, and guessing wrong means
+ * either handing back ciphertext or refusing a legitimate write. The qualified
+ * map still resolves it whenever the query names its tables.
+ */
+function buildManifest(manifest) {
+    const qualified = new Map();
+    const flat = new Map();
+    const ambiguous = new Set();
+    const assignFlat = (key, column) => {
+        const existing = flat.get(key);
+        if (existing && existing.keyId !== column.keyId) {
+            ambiguous.add(key);
+            return;
+        }
+        flat.set(key, column);
+    };
+    for (const [table, columns] of Object.entries(manifest.tables)) {
+        for (const [name, classification] of Object.entries(columns)) {
+            const form = classification.form;
+            if (form !== 'wrapped' && form !== 'sealed')
+                continue;
+            const column = {
+                form,
+                keyId: classification.keyId ?? DEFAULT_KEY_ID,
+            };
+            const camel = snakeToCamel(name);
+            qualified.set(`${table}.${name}`, column);
+            qualified.set(`${table}.${camel}`, column);
+            assignFlat(name, column);
+            assignFlat(camel, column);
+        }
+    }
+    for (const key of ambiguous)
+        flat.delete(key);
+    return { qualified, flat };
+}
+function collectQueryTables(node, out) {
+    if (!node || typeof node !== 'object')
+        return;
+    const op = node;
+    if (op.kind === 'TableNode') {
+        const name = op.table?.identifier?.name;
+        if (typeof name === 'string' && name.length > 0)
+            out.add(name);
+    }
+    for (const value of Object.values(node)) {
+        if (Array.isArray(value)) {
+            for (const item of value)
+                collectQueryTables(item, out);
+        }
+        else {
+            collectQueryTables(value, out);
+        }
+    }
+}
+function lookupColumn(manifest, tables, column) {
+    let matched;
+    for (const table of tables) {
+        const found = manifest.qualified.get(`${table}.${column}`);
+        if (!found)
+            continue;
+        if (matched && matched.keyId !== found.keyId) {
+            return manifest.flat.get(column);
+        }
+        matched = found;
+    }
+    return matched ?? manifest.flat.get(column);
+}
+/**
+ * The column names an insert or update writes, paired with the values going
+ * into them.
+ *
+ * Only literal values are collected. A raw expression or a sub-select is
+ * something this plugin cannot read and must not guess at, so it is skipped —
+ * the guard's job is to catch a plaintext string a call site forgot to encrypt,
+ * not to prove every write correct.
+ */
+function collectWrittenValues(node) {
+    const written = [];
+    const visit = (current) => {
+        if (!current || typeof current !== 'object')
+            return;
+        const op = current;
+        if (op.kind === 'ColumnUpdateNode') {
+            const name = op.column?.column?.name;
+            if (typeof name === 'string' && op.value?.kind === 'ValueNode') {
+                written.push([name, op.value.value]);
+            }
+        }
+        if (op.kind === 'InsertQueryNode' && Array.isArray(op.columns)) {
+            const names = op.columns.map((c) => c.column?.name);
+            const rows = op.values?.values;
+            if (Array.isArray(rows)) {
+                for (const row of rows) {
+                    const list = row?.values;
+                    if (!Array.isArray(list))
+                        continue;
+                    list.forEach((value, index) => {
+                        const name = names[index];
+                        if (typeof name !== 'string')
+                            return;
+                        const unwrapped = value && typeof value === 'object' && 'kind' in value
+                            ? value.kind ===
+                                'ValueNode'
+                                ? value.value
+                                : undefined
+                            : value;
+                        if (unwrapped !== undefined)
+                            written.push([name, unwrapped]);
+                    });
+                }
+            }
+        }
+        for (const value of Object.values(current)) {
+            if (Array.isArray(value)) {
+                for (const item of value)
+                    visit(item);
+            }
+            else {
+                visit(value);
+            }
+        }
+    };
+    visit(node);
+    return written;
+}
+/**
+ * Make a column's at-rest form a property of the column rather than of the
+ * developer's memory.
+ *
+ * Reads are transparent: a `wrapped` column comes back decrypted, so
+ * application code never sees an envelope. `hashed` and `plain` columns are
+ * untouched, which is what keeps the rest of the schema queryable.
+ *
+ * Writes are *guarded* rather than transformed, and the reason is Kysely's
+ * shape, not a preference: `transformQuery` is synchronous and WebCrypto is
+ * not, so a plugin cannot encrypt on the way in. Encrypting at the call site
+ * and letting a forgotten call slip through silently is the failure this
+ * design exists to prevent, so the guard refuses any plaintext heading for a
+ * `wrapped` or `sealed` column. Values are produced with
+ * `ClassificationCrypto.encryptColumn`.
+ *
+ * A `sealed` column is never decrypted on the way out — the application holds
+ * only the public half by definition, so returning it as stored is correct
+ * rather than a gap.
+ */
+export function createClassificationPlugin(options) {
+    const manifest = buildManifest(options.manifest);
+    const queryTables = new WeakMap();
+    return {
+        transformQuery(args) {
+            const tables = new Set();
+            collectQueryTables(args.node, tables);
+            queryTables.set(args.queryId, [...tables]);
+            for (const [name, value] of collectWrittenValues(args.node)) {
+                if (value === null || value === undefined)
+                    continue;
+                const column = lookupColumn(manifest, [...tables], name);
+                if (!column)
+                    continue;
+                if (!isColumnEnvelope(value)) {
+                    throw new Error(`Refusing to write plaintext into "${name}", which is classified ${column.form}. ` +
+                        `Produce the value with ClassificationCrypto.encryptColumn() before writing it.`);
+                }
+            }
+            return args.node;
+        },
+        async transformResult(args) {
+            const tables = queryTables.get(args.queryId) ?? [];
+            const rows = [];
+            for (const row of args.result.rows) {
+                let next;
+                for (const [name, value] of Object.entries(row)) {
+                    if (value === null || value === undefined)
+                        continue;
+                    const column = lookupColumn(manifest, tables, name);
+                    if (!column || column.form !== 'wrapped')
+                        continue;
+                    if (!isColumnEnvelope(value))
+                        continue;
+                    next ??= { ...row };
+                    next[name] = await options.crypto.decryptColumn(value);
+                }
+                rows.push(next ?? row);
+            }
+            return { ...args.result, rows };
+        },
+    };
+}

package/dist/src/index.d.ts

@@ -18,6 +18,8 @@ export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { KyselyVirtualUserScheduleStore } from './kysely-virtual-user-schedule-store.js';
 export { SerializePlugin, BaseSerializePlugin, type Serializer, type Deserializer, } from './serialize-plugin.js';
 export { createCoercionPlugin, type ColumnKind, type CoercionMap, type CreateCoercionPluginOptions, } from './coercion-plugin.js';
+export { createClassificationPlugin, type CreateClassificationPluginOptions, } from './classification-plugin.js';
+export { ClassificationCrypto, DEFAULT_KEY_ID, isColumnEnvelope, parseColumnEnvelope, type ClassificationCryptoOptions, type ColumnEnvelope, type KEKResolver, type ResolvedKEK, } from './classification-crypto.js';
 export { agentSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';

package/dist/src/index.js

@@ -18,4 +18,6 @@ export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { KyselyVirtualUserScheduleStore } from './kysely-virtual-user-schedule-store.js';
 export { SerializePlugin, BaseSerializePlugin, } from './serialize-plugin.js';
 export { createCoercionPlugin, } from './coercion-plugin.js';
+export { createClassificationPlugin, } from './classification-plugin.js';
+export { ClassificationCrypto, DEFAULT_KEY_ID, isColumnEnvelope, parseColumnEnvelope, } from './classification-crypto.js';
 export { agentSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, } from './schema/index.js';

package/dist/src/kysely-lock-vault.d.ts

@@ -0,0 +1,34 @@
+import type { Kysely } from 'kysely';
+import type { LockRecord, LockVault } from '@pikku/core/classification';
+import type { KyselyPikkuDB } from './kysely-tables.js';
+/**
+ * Lock records kept in the application's own database.
+ *
+ * This is what makes a sealed column survive a restart. `createMemoryLockVault`
+ * is fine for a test, but its salts die with the process and a sealed row whose
+ * salt is gone is not recoverable by anyone — so a real deployment stores them
+ * next to the rows they protect, in the same backup and the same restore.
+ *
+ * The table holds no plaintext key material, only salts and verifiers, which is
+ * why it is readable while the store is locked.
+ */
+export declare class KyselyLockVault implements LockVault {
+    private readonly db;
+    constructor(db: Kysely<KyselyPikkuDB>);
+    read(): Promise<LockRecord[]>;
+    /**
+     * Replace the whole record set.
+     *
+     * Whole-set rather than per-row because the callers that write are
+     * initialization and rotation, and both produce a complete keyring: applying
+     * one as a partial update would leave records from the previous key behind,
+     * and a stale salt is indistinguishable from a current one.
+     */
+    write(records: LockRecord[]): Promise<void>;
+    /**
+     * Asked through introspection rather than by matching the driver's error
+     * text, so the answer does not depend on which engine phrased the failure or
+     * on the language it phrased it in.
+     */
+    private tableExists;
+}

package/dist/src/kysely-lock-vault.js

@@ -0,0 +1,77 @@
+import { unsafeAsWrapped } from '@pikku/core/classification';
+/**
+ * Lock records kept in the application's own database.
+ *
+ * This is what makes a sealed column survive a restart. `createMemoryLockVault`
+ * is fine for a test, but its salts die with the process and a sealed row whose
+ * salt is gone is not recoverable by anyone — so a real deployment stores them
+ * next to the rows they protect, in the same backup and the same restore.
+ *
+ * The table holds no plaintext key material, only salts and verifiers, which is
+ * why it is readable while the store is locked.
+ */
+export class KyselyLockVault {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async read() {
+        try {
+            const rows = await this.db
+                .selectFrom('dataLocks')
+                .select(['keyId', 'keyVersion', 'salt', 'verifier'])
+                .execute();
+            return rows.map((row) => ({
+                keyId: row.keyId,
+                // SQLite hands back whatever it stored and postgres can widen an
+                // integer to a string over the wire, while `keyVersion` is compared
+                // and stamped as a number.
+                keyVersion: Number(row.keyVersion),
+                salt: row.salt,
+                verifier: unsafeAsWrapped(row.verifier),
+            }));
+        }
+        catch (cause) {
+            if (await this.tableExists()) {
+                throw cause;
+            }
+            // No table yet is a legitimate first run — the migration has not been
+            // applied, nobody has chosen a passphrase, and the server should come up
+            // and offer to initialize rather than refuse to start.
+            return [];
+        }
+    }
+    /**
+     * Replace the whole record set.
+     *
+     * Whole-set rather than per-row because the callers that write are
+     * initialization and rotation, and both produce a complete keyring: applying
+     * one as a partial update would leave records from the previous key behind,
+     * and a stale salt is indistinguishable from a current one.
+     */
+    async write(records) {
+        await this.db.transaction().execute(async (trx) => {
+            await trx.deleteFrom('dataLocks').execute();
+            if (records.length) {
+                await trx
+                    .insertInto('dataLocks')
+                    .values(records.map((record) => ({
+                    keyId: record.keyId,
+                    keyVersion: record.keyVersion,
+                    salt: record.salt,
+                    verifier: record.verifier,
+                })))
+                    .execute();
+            }
+        });
+    }
+    /**
+     * Asked through introspection rather than by matching the driver's error
+     * text, so the answer does not depend on which engine phrased the failure or
+     * on the language it phrased it in.
+     */
+    async tableExists() {
+        const tables = await this.db.introspection.getTables();
+        return tables.some((table) => table.name === 'data_locks');
+    }
+}

package/dist/src/kysely-webhook-service.d.ts

@@ -15,7 +15,7 @@ export declare class KyselyWebhookService extends QueueWebhookService {
     private initialized;
     constructor(queueService: QueueService, db: Kysely<KyselyPikkuDB>);
     init(): Promise<void>;
-    send(input: SendWebhookInput): Promise<SendWebhookResult>;
+    send(input: SendWebhookInput): Promise<Required<SendWebhookResult>>;
     recordAttempt(deliveryId: string, { statusCode, responseBody, error, delivered }: WebhookAttemptResult): Promise<void>;
     /** List deliveries, most recent first — for the console webhooks view. */
     listDeliveries(opts?: {

package/dist/src/kysely-webhook-service.js

@@ -37,7 +37,7 @@ export class KyselyWebhookService extends QueueWebhookService {
         // deliveryId doubles as the queue jobId (idempotency) and rides in the
         // payload so the worker can record attempts against this row.
         const jobId = await this.queueService.add(PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, { ...jobData, deliveryId }, { ...options, jobId: deliveryId });
-        return { jobId };
+        return { jobId, deliveryId };
     }
     async recordAttempt(deliveryId, { statusCode, responseBody, error, delivered }) {
         const now = new Date();

package/dist/src/schema/data-lock.schema.d.ts

@@ -0,0 +1,15 @@
+import type { PikkuSchema } from './pikku-schema.types.js';
+/**
+ * Where the passphrase's salts and verifiers live.
+ *
+ * Deliberately the one table in a classified deployment that holds nothing
+ * encrypted. It has to be readable before anything has been unlocked — a store
+ * that needed its own key to find out how to open itself could never be opened
+ * — and that costs nothing, because a salt and a verifier reveal no key
+ * material.
+ *
+ * Losing this table is losing the data: every sealed row is opened by a KEK
+ * derived from the salt kept here, so a deployment that ships without the
+ * migration silently turns its own rows into noise the first time it restarts.
+ */
+export declare const dataLockSchema: PikkuSchema;

package/dist/src/schema/data-lock.schema.js

@@ -0,0 +1,27 @@
+import { sql } from 'kysely';
+/**
+ * Where the passphrase's salts and verifiers live.
+ *
+ * Deliberately the one table in a classified deployment that holds nothing
+ * encrypted. It has to be readable before anything has been unlocked — a store
+ * that needed its own key to find out how to open itself could never be opened
+ * — and that costs nothing, because a salt and a verifier reveal no key
+ * material.
+ *
+ * Losing this table is losing the data: every sealed row is opened by a KEK
+ * derived from the salt kept here, so a deployment that ships without the
+ * migration silently turns its own rows into noise the first time it restarts.
+ */
+export const dataLockSchema = {
+    name: 'data-lock',
+    ownedBy: ['dataLock'],
+    statements: [
+        (db) => db.schema
+            .createTable('dataLocks')
+            .addColumn('keyId', 'varchar(255)', (col) => col.primaryKey())
+            .addColumn('keyVersion', 'integer', (col) => col.notNull())
+            .addColumn('salt', 'varchar(64)', (col) => col.notNull())
+            .addColumn('verifier', 'text', (col) => col.notNull())
+            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
+    ],
+};

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/coercion-plugin.ts","../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-agent-run-scores.ts","../src/kysely-agent-run-service.ts","../src/kysely-agent-run-state-service.ts","../src/kysely-agent-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-scope-service.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-virtual-user-run-store.ts","../src/kysely-virtual-user-schedule-store.ts","../src/kysely-webhook-service.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../src/schema/agent.schema.ts","../src/schema/audit.schema.ts","../src/schema/channel.schema.ts","../src/schema/credential.schema.ts","../src/schema/deployment.schema.ts","../src/schema/index.ts","../src/schema/pikku-schema.types.ts","../src/schema/scope.schema.ts","../src/schema/secret.schema.ts","../src/schema/session.schema.ts","../src/schema/virtual-user-schedule.schema.ts","../src/schema/virtual-user.schema.ts","../src/schema/webhook.schema.ts","../src/schema/workflow.schema.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}
+{"root":["../src/classification-crypto.ts","../src/classification-plugin.ts","../src/coercion-plugin.ts","../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-agent-run-scores.ts","../src/kysely-agent-run-service.ts","../src/kysely-agent-run-state-service.ts","../src/kysely-agent-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-scope-service.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-virtual-user-run-store.ts","../src/kysely-virtual-user-schedule-store.ts","../src/kysely-webhook-service.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../src/schema/agent.schema.ts","../src/schema/audit.schema.ts","../src/schema/channel.schema.ts","../src/schema/credential.schema.ts","../src/schema/deployment.schema.ts","../src/schema/index.ts","../src/schema/pikku-schema.types.ts","../src/schema/scope.schema.ts","../src/schema/secret.schema.ts","../src/schema/session.schema.ts","../src/schema/virtual-user-schedule.schema.ts","../src/schema/virtual-user.schema.ts","../src/schema/webhook.schema.ts","../src/schema/workflow.schema.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}