@pikku/kysely 0.13.24 → 0.13.27

package/src/create-audited-kysely.ts

@@ -1,254 +0,0 @@
-import type { AuditLog } from '@pikku/core/services'
-import type {
-  Kysely,
-  KyselyPlugin,
-  PluginTransformQueryArgs,
-  PluginTransformResultArgs,
-  QueryResult,
-  RootOperationNode,
-  UnknownRow,
-} from 'kysely'
-
-export interface CreateAuditedKyselyOptions {
-  audit: AuditLog
-  auditReads?: boolean
-  eventType?: string
-  transactionId?: string | null
-  queryIdPrefix?: string
-}
-
-type AuditedQuery = {
-  queryKind: 'select' | 'insert' | 'update' | 'delete'
-  queryId: string
-  tables: string[]
-  changedColumns?: string[]
-  changes?: unknown
-}
-
-const QUERY_KIND_BY_NODE: Record<
-  string,
-  AuditedQuery['queryKind'] | undefined
-> = {
-  SelectQueryNode: 'select',
-  InsertQueryNode: 'insert',
-  UpdateQueryNode: 'update',
-  DeleteQueryNode: 'delete',
-}
-
-function getIdentifierName(node: unknown): string | undefined {
-  if (!node || typeof node !== 'object') return undefined
-  const candidate = node as {
-    name?: string
-    column?: { name?: string }
-    identifier?: { name?: string }
-    table?: { identifier?: { name?: string } }
-  }
-  return (
-    candidate.name ??
-    candidate.column?.name ??
-    candidate.identifier?.name ??
-    candidate.table?.identifier?.name
-  )
-}
-
-function collectTableNames(node: unknown, out: Set<string>): void {
-  if (!node || typeof node !== 'object') return
-
-  const candidate = node as {
-    kind?: string
-    table?: { identifier?: { name?: string } }
-  }
-
-  if (
-    candidate.kind === 'TableNode' &&
-    typeof candidate.table?.identifier?.name === 'string'
-  ) {
-    out.add(candidate.table.identifier.name)
-  }
-
-  for (const value of Object.values(node as Record<string, unknown>)) {
-    if (Array.isArray(value)) {
-      for (const item of value) collectTableNames(item, out)
-      continue
-    }
-    collectTableNames(value, out)
-  }
-}
-
-function extractValue(node: unknown): unknown {
-  if (!node || typeof node !== 'object') return node
-
-  const candidate = node as {
-    kind?: string
-    value?: unknown
-    values?: unknown[]
-    left?: unknown
-    right?: unknown
-  }
-
-  switch (candidate.kind) {
-    case 'ValueNode':
-      return candidate.value
-    case 'PrimitiveValueListNode':
-    case 'ValueListNode':
-      return (candidate.values ?? []).map(extractValue)
-    case 'DefaultInsertValueNode':
-      return '[default]'
-    case 'ColumnNode':
-    case 'ReferenceNode':
-      return `[${candidate.kind}]`
-    case 'RawNode':
-      return '[raw]'
-    case 'SelectQueryNode':
-      return '[subquery]'
-    case 'ParensNode':
-      return extractValue((candidate as { node?: unknown }).node)
-    case 'BinaryOperationNode':
-      return {
-        left: extractValue(candidate.left),
-        right: extractValue(candidate.right),
-      }
-    default:
-      return `[${candidate.kind ?? 'expression'}]`
-  }
-}
-
-function extractInsertChanges(node: any): {
-  changedColumns?: string[]
-  changes?: unknown
-} {
-  const columns = Array.isArray(node.columns)
-    ? node.columns
-        .map((column: unknown) => getIdentifierName(column))
-        .filter(Boolean)
-    : []
-  const values = Array.isArray(node.values?.values) ? node.values.values : []
-  if (columns.length === 0 || values.length === 0) {
-    return {
-      changedColumns: columns.length > 0 ? columns : undefined,
-    }
-  }
-
-  const rows = values.map((row: any) => {
-    const rowValues = Array.isArray(row?.values)
-      ? row.values.map(extractValue)
-      : []
-    return Object.fromEntries(
-      columns.map((column, index) => [column, rowValues[index]])
-    )
-  })
-
-  return {
-    changedColumns: columns,
-    changes: rows.length === 1 ? rows[0] : rows,
-  }
-}
-
-function extractUpdateChanges(node: any): {
-  changedColumns?: string[]
-  changes?: unknown
-} {
-  const updates = Array.isArray(node.updates) ? node.updates : []
-  const entries = updates
-    .map((update: any) => {
-      const column = getIdentifierName(update.column)
-      if (!column) return null
-      return [column, extractValue(update.value)] as const
-    })
-    .filter(Boolean) as Array<readonly [string, unknown]>
-
-  if (entries.length === 0) {
-    return {}
-  }
-
-  return {
-    changedColumns: entries.map(([column]) => column),
-    changes: Object.fromEntries(entries),
-  }
-}
-
-function extractChangeSet(
-  node: RootOperationNode,
-  queryKind: AuditedQuery['queryKind']
-) {
-  if (queryKind === 'insert') {
-    return extractInsertChanges(node as any)
-  }
-  if (queryKind === 'update') {
-    return extractUpdateChanges(node as any)
-  }
-  return {}
-}
-
-class AuditedKyselyPlugin implements KyselyPlugin {
-  private readonly pending = new Map<unknown, AuditedQuery>()
-  private queryCounter = 0
-
-  constructor(private readonly options: CreateAuditedKyselyOptions) {}
-
-  transformQuery(args: PluginTransformQueryArgs): RootOperationNode {
-    const queryKind =
-      QUERY_KIND_BY_NODE[(args.node as { kind?: string }).kind ?? '']
-    if (!queryKind) {
-      return args.node
-    }
-
-    if (queryKind === 'select' && this.options.auditReads === false) {
-      return args.node
-    }
-
-    const tables = new Set<string>()
-    collectTableNames(args.node, tables)
-    const queryId = `${this.options.queryIdPrefix ?? 'q'}-${++this.queryCounter}`
-    this.pending.set(args.queryId, {
-      queryKind,
-      queryId,
-      tables: [...tables].sort(),
-      ...extractChangeSet(args.node, queryKind),
-    })
-    return args.node
-  }
-
-  async transformResult(
-    args: PluginTransformResultArgs
-  ): Promise<QueryResult<UnknownRow>> {
-    const pending = this.pending.get(args.queryId)
-    if (!pending) {
-      return args.result
-    }
-
-    this.pending.delete(args.queryId)
-    const rawResult = args.result as QueryResult<UnknownRow> & {
-      numAffectedRows?: bigint
-      numUpdatedOrDeletedRows?: bigint
-    }
-    const rowCount =
-      rawResult.rows.length > 0
-        ? rawResult.rows.length
-        : Number(
-            rawResult.numUpdatedOrDeletedRows ?? rawResult.numAffectedRows ?? 0n
-          )
-
-    await this.options.audit.write({
-      type: this.options.eventType ?? 'db.query',
-      source: 'auto',
-      transactionId: this.options.transactionId ?? null,
-      queryId: pending.queryId,
-      metadata: {
-        queryKind: pending.queryKind,
-        tables: pending.tables,
-        changedColumns: pending.changedColumns,
-        changes: pending.changes,
-        rowCount,
-      },
-    })
-    return rawResult
-  }
-}
-
-export function createAuditedKysely<DB>(
-  db: Kysely<DB>,
-  options: CreateAuditedKyselyOptions
-): Kysely<DB> {
-  return db.withPlugin(new AuditedKyselyPlugin(options))
-}

package/src/index.ts

@@ -1,81 +0,0 @@
-export { KyselyChannelStore } from './kysely-channel-store.js'
-export { KyselyEventHubStore } from './kysely-eventhub-store.js'
-export { KyselyWorkflowService } from './kysely-workflow-service.js'
-export { KyselyWorkflowRunService } from './kysely-workflow-run-service.js'
-export { KyselyWorkflowMirror } from './kysely-workflow-mirror.js'
-export { KyselyDeploymentService } from './kysely-deployment-service.js'
-export { KyselyAgentStorageService } from './kysely-agent-storage-service.js'
-export { KyselyAgentRunService } from './kysely-agent-run-service.js'
-export { KyselyAgentRunStateService } from './kysely-agent-run-state-service.js'
-export { KyselySecretService } from './kysely-secret-service.js'
-export { KyselyCredentialService } from './kysely-credential-service.js'
-export { KyselySessionStore } from './kysely-session-store.js'
-export { KyselyScopeService } from './kysely-scope-service.js'
-export { KyselyWebhookService } from './kysely-webhook-service.js'
-export {
-  createAuditedKysely,
-  type CreateAuditedKyselyOptions,
-} from './create-audited-kysely.js'
-export { KyselyAuditService } from './kysely-audit-service.js'
-export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js'
-export { KyselyVirtualUserScheduleStore } from './kysely-virtual-user-schedule-store.js'
-
-export {
-  SerializePlugin,
-  BaseSerializePlugin,
-  type Serializer,
-  type Deserializer,
-} from './serialize-plugin.js'
-export {
-  createCoercionPlugin,
-  type ColumnKind,
-  type CoercionMap,
-  type CreateCoercionPluginOptions,
-} from './coercion-plugin.js'
-export {
-  createClassificationPlugin,
-  type CreateClassificationPluginOptions,
-} from './classification-plugin.js'
-export {
-  ClassificationCrypto,
-  DEFAULT_KEY_ID,
-  isColumnEnvelope,
-  parseColumnEnvelope,
-  type ClassificationCryptoOptions,
-  type ColumnEnvelope,
-  type KEKResolver,
-  type ResolvedKEK,
-} from './classification-crypto.js'
-export {
-  agentSchema,
-  auditSchema,
-  channelSchema,
-  credentialSchema,
-  deploymentSchema,
-  scopeSchema,
-  secretSchema,
-  sessionSchema,
-  virtualUserSchema,
-  webhookSchema,
-  workflowSchema,
-  pikkuSchemas,
-  requiredPikkuSchemas,
-  applyPikkuSchemas,
-  compilePikkuSchemas,
-  requirePikkuSchema,
-  resolveRequirements,
-  type PikkuSchema,
-  type RequiredTypes,
-  type UnmetRequirement,
-  type SchemaStatementFactory,
-} from './schema/index.js'
-
-export type { KyselyPikkuDB } from './kysely-tables.js'
-export type { WorkflowRunService } from '@pikku/core/workflow'
-export type { AgentRunService, AgentRunRow } from '@pikku/core/agent'
-export type {
-  VirtualUserRunStore,
-  VirtualUserRunRecord,
-  VirtualUserScheduleStore,
-  VirtualUserScheduleRecord,
-} from '@pikku/core/virtual-user'

package/src/kysely-agent-run-scores.ts

@@ -1,47 +0,0 @@
-import type { Kysely } from 'kysely'
-import type { KyselyPikkuDB } from './kysely-tables.js'
-import type { AgentRunScore } from '@pikku/core/agent-scorer'
-import type { SaveScoreInput } from '@pikku/core/services'
-import { parseJson } from './kysely-json.js'
-
-/**
- * Shared by the two Kysely services that implement `AgentRunStateService` — they
- * differ in how they store approvals, not in how they store grades.
- */
-export const saveRunScore = async (
-  db: Kysely<KyselyPikkuDB>,
-  score: SaveScoreInput
-): Promise<void> => {
-  await db
-    .insertInto('agentRunScore')
-    .values({
-      id: crypto.randomUUID(),
-      runId: score.runId,
-      scorerName: score.scorerName,
-      score: score.score,
-      reason: score.reason ?? null,
-      metadata: score.metadata ? JSON.stringify(score.metadata) : null,
-    })
-    .execute()
-}
-
-export const getRunScores = async (
-  db: Kysely<KyselyPikkuDB>,
-  runId: string
-): Promise<AgentRunScore[]> => {
-  const rows = await db
-    .selectFrom('agentRunScore')
-    .selectAll()
-    .where('runId', '=', runId)
-    .orderBy('createdAt', 'asc')
-    .execute()
-
-  return rows.map((row) => ({
-    runId: row.runId,
-    scorerName: row.scorerName,
-    score: Number(row.score),
-    reason: row.reason ?? undefined,
-    metadata: parseJson(row.metadata),
-    createdAt: new Date(row.createdAt),
-  }))
-}

package/src/kysely-agent-run-service.ts

@@ -1,244 +0,0 @@
-import type {
-  AgentThread,
-  AgentMessage,
-  AgentRunRow,
-  AgentRunService,
-} from '@pikku/core/agent'
-import type { Kysely } from 'kysely'
-import { sql } from 'kysely'
-import type { KyselyPikkuDB } from './kysely-tables.js'
-import { parseJson } from './kysely-json.js'
-
-// Owner ids routinely contain `_` (e.g. `user_123`), which LIKE treats as a
-// single-character wildcard — so a raw prefix would match a foreign owner.
-const escapeLikePattern = (value: string) =>
-  value.replace(/[\\%_]/g, (char) => `\\${char}`)
-
-export class KyselyAgentRunService implements AgentRunService {
-  constructor(private db: Kysely<KyselyPikkuDB>) {}
-
-  async listThreads(options?: {
-    agentName?: string
-    resourceId?: string
-    owners?: string[]
-    limit?: number
-    offset?: number
-  }): Promise<AgentThread[]> {
-    const {
-      agentName,
-      resourceId,
-      owners,
-      limit = 50,
-      offset = 0,
-    } = options ?? {}
-
-    // An owners constraint is an authorization boundary, so an empty list must
-    // match nothing rather than degrade to "no filter".
-    if (owners && owners.length === 0) return []
-
-    let query = this.db
-      .selectFrom('agentThreads as t')
-      .select([
-        't.id',
-        't.resourceId',
-        't.title',
-        't.metadata',
-        't.createdAt',
-        't.updatedAt',
-      ])
-
-    if (agentName) {
-      query = query.where(
-        't.id',
-        'in',
-        this.db
-          .selectFrom('agentRun')
-          .select('threadId')
-          .where('agentName', '=', agentName)
-          .distinct()
-      )
-    }
-
-    if (resourceId) {
-      query = query.where('t.resourceId', '=', resourceId)
-    }
-
-    if (owners) {
-      query = query.where((eb) =>
-        eb.or(
-          owners.flatMap((owner) => [
-            eb('t.resourceId', '=', owner),
-            eb(
-              't.resourceId',
-              'like',
-              sql<string>`${`${escapeLikePattern(owner)}:%`} escape '\\'`
-            ),
-          ])
-        )
-      )
-    }
-
-    const result = await query
-      .orderBy('t.updatedAt', 'desc')
-      .limit(limit)
-      .offset(offset)
-      .execute()
-
-    return result.map((row) => this.mapThreadRow(row))
-  }
-
-  async getThread(threadId: string): Promise<AgentThread | null> {
-    const row = await this.db
-      .selectFrom('agentThreads')
-      .select([
-        'id',
-        'resourceId',
-        'title',
-        'metadata',
-        'createdAt',
-        'updatedAt',
-      ])
-      .where('id', '=', threadId)
-      .executeTakeFirst()
-
-    if (!row) return null
-    return this.mapThreadRow(row)
-  }
-
-  async getThreadMessages(threadId: string): Promise<AgentMessage[]> {
-    const [msgResult, tcResult] = await Promise.all([
-      this.db
-        .selectFrom('agentMessage')
-        .select(['id', 'role', 'content', 'createdAt'])
-        .where('threadId', '=', threadId)
-        .orderBy('createdAt', 'asc')
-        .execute(),
-      this.db
-        .selectFrom('agentToolCall')
-        .select(['id', 'messageId', 'toolName', 'args', 'result'])
-        .where('threadId', '=', threadId)
-        .orderBy('createdAt', 'asc')
-        .execute(),
-    ])
-
-    const tcByMessage = new Map<string, (typeof tcResult)[number][]>()
-    for (const tc of tcResult) {
-      const msgId = tc.messageId
-      if (!tcByMessage.has(msgId)) tcByMessage.set(msgId, [])
-      tcByMessage.get(msgId)!.push(tc)
-    }
-
-    const messages: AgentMessage[] = []
-    for (const row of msgResult) {
-      const msg: AgentMessage = {
-        id: row.id,
-        role: row.role as AgentMessage['role'],
-        content: row.content ?? undefined,
-        createdAt: new Date(row.createdAt as unknown as string),
-      }
-
-      const tcs = tcByMessage.get(msg.id)
-      if (tcs?.length) {
-        msg.toolCalls = tcs.map((tc) => ({
-          id: tc.id,
-          name: tc.toolName,
-          args: parseJson(tc.args) as Record<string, unknown>,
-        }))
-
-        const completed = tcs.filter((tc) => tc.result != null)
-        if (completed.length) {
-          messages.push(msg)
-          messages.push({
-            id: `tool-results-${msg.id}`,
-            role: 'tool',
-            toolResults: completed.map((tc) => ({
-              id: tc.id,
-              name: tc.toolName,
-              result: tc.result!,
-            })),
-            createdAt: msg.createdAt,
-          })
-          continue
-        }
-      }
-
-      messages.push(msg)
-    }
-
-    return messages
-  }
-
-  async getThreadRuns(threadId: string): Promise<AgentRunRow[]> {
-    const result = await this.db
-      .selectFrom('agentRun')
-      .select([
-        'runId',
-        'agentName',
-        'threadId',
-        'resourceId',
-        'status',
-        'errorMessage',
-        'suspendReason',
-        'missingRpcs',
-        'usageInputTokens',
-        'usageOutputTokens',
-        'usageModel',
-        'createdAt',
-        'updatedAt',
-      ])
-      .where('threadId', '=', threadId)
-      .orderBy('createdAt', 'desc')
-      .execute()
-
-    return result.map((row) => this.mapRunRow(row))
-  }
-
-  async deleteThread(threadId: string): Promise<boolean> {
-    const result = await this.db
-      .deleteFrom('agentThreads')
-      .where('id', '=', threadId)
-      .executeTakeFirst()
-
-    return BigInt(result.numDeletedRows) > 0n
-  }
-
-  async getDistinctAgentNames(): Promise<string[]> {
-    const result = await this.db
-      .selectFrom('agentRun')
-      .select('agentName')
-      .distinct()
-      .orderBy('agentName')
-      .execute()
-
-    return result.map((row) => row.agentName)
-  }
-
-  private mapThreadRow(row: any): AgentThread {
-    return {
-      id: row.id as string,
-      resourceId: row.resourceId as string,
-      title: (row.title as string) ?? undefined,
-      metadata: parseJson(row.metadata),
-      createdAt: new Date(row.createdAt as string),
-      updatedAt: new Date(row.updatedAt as string),
-    }
-  }
-
-  private mapRunRow(row: any): AgentRunRow {
-    return {
-      runId: row.runId as string,
-      agentName: row.agentName as string,
-      threadId: row.threadId as string,
-      resourceId: row.resourceId as string,
-      status: row.status as string,
-      errorMessage: (row.errorMessage as string) ?? undefined,
-      suspendReason: (row.suspendReason as string) ?? undefined,
-      missingRpcs: parseJson(row.missingRpcs),
-      usageInputTokens: Number(row.usageInputTokens),
-      usageOutputTokens: Number(row.usageOutputTokens),
-      usageModel: row.usageModel as string,
-      createdAt: new Date(row.createdAt as string),
-      updatedAt: new Date(row.updatedAt as string),
-    }
-  }
-}