@pikku/kysely 0.13.24 → 0.13.28

package/bin/pikku-kysely-pure.ts

@@ -1,59 +0,0 @@
-#!/usr/bin/env node
-
-import { mkdir, readFile, writeFile } from 'fs/promises'
-import { dirname } from 'path'
-import { fileURLToPath } from 'url'
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = dirname(__filename)
-
-const main = async (output: string, input?: string) => {
-  let execDirectory = process.cwd()
-  let inputPath = `${__dirname}/../node_modules/kysely-codegen/dist/db.d.ts`
-  if (input) {
-    inputPath = `${execDirectory}/${input}`
-  }
-
-  let kysely: string
-  try {
-    kysely = await readFile(inputPath, 'utf8')
-  } catch {
-    console.error(`Could not read file ${input}`)
-    process.exit(1)
-  }
-
-  kysely = kysely
-    .replace('import type { ColumnType } from "kysely";', '')
-    .replace(
-      new RegExp('^export\\s+type\\s+Generated<[^>]+>.*?;\\s*$', 'ms'),
-      ''
-    )
-    .replace(/Generated<(.*)>/g, '$1')
-    .replace(
-      /export type Numeric =.*;/,
-      'export type Numeric = string | number'
-    )
-    .replace(/export type Timestamp =.*;/, 'export type Timestamp = Date')
-    .replace(
-      /export type ArrayType<T> = ArrayTypeImpl<T> extends \(infer U\)\[\]\s*\?\s*U\[\]\s*:\s*ArrayTypeImpl<T>;\s*export type ArrayTypeImpl<T> = T extends ColumnType<infer S, infer I, infer U>\s*\?\s*ColumnType<S\[\], I\[\], U\[\]>\s*:\s*T\[\];/gs,
-      ''
-    )
-    .replace(/ArrayType<([^>]+)>/g, '$1[]')
-
-  console.log('Writing kysely-pure.gen.ts')
-
-  const outputPath = `${execDirectory}/${output}`
-  const outputDirectory = dirname(outputPath)
-  await mkdir(outputDirectory, { recursive: true })
-  await writeFile(outputPath, kysely, 'utf-8')
-  console.log(outputPath)
-}
-
-if (process.argv.length !== 4) {
-  console.error('Expected the following usage:')
-  console.error('node kysely-pure.js <output> <input>')
-  process.exit(1)
-}
-
-const [, , output, input] = process.argv
-main(output!, input)

package/dist/src/kysely-lock-vault.d.ts

@@ -1,34 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { LockRecord, LockVault } from '@pikku/core/classification';
-import type { KyselyPikkuDB } from './kysely-tables.js';
-/**
- * Lock records kept in the application's own database.
- *
- * This is what makes a sealed column survive a restart. `createMemoryLockVault`
- * is fine for a test, but its salts die with the process and a sealed row whose
- * salt is gone is not recoverable by anyone — so a real deployment stores them
- * next to the rows they protect, in the same backup and the same restore.
- *
- * The table holds no plaintext key material, only salts and verifiers, which is
- * why it is readable while the store is locked.
- */
-export declare class KyselyLockVault implements LockVault {
-    private readonly db;
-    constructor(db: Kysely<KyselyPikkuDB>);
-    read(): Promise<LockRecord[]>;
-    /**
-     * Replace the whole record set.
-     *
-     * Whole-set rather than per-row because the callers that write are
-     * initialization and rotation, and both produce a complete keyring: applying
-     * one as a partial update would leave records from the previous key behind,
-     * and a stale salt is indistinguishable from a current one.
-     */
-    write(records: LockRecord[]): Promise<void>;
-    /**
-     * Asked through introspection rather than by matching the driver's error
-     * text, so the answer does not depend on which engine phrased the failure or
-     * on the language it phrased it in.
-     */
-    private tableExists;
-}

package/dist/src/kysely-lock-vault.js

@@ -1,77 +0,0 @@
-import { unsafeAsWrapped } from '@pikku/core/classification';
-/**
- * Lock records kept in the application's own database.
- *
- * This is what makes a sealed column survive a restart. `createMemoryLockVault`
- * is fine for a test, but its salts die with the process and a sealed row whose
- * salt is gone is not recoverable by anyone — so a real deployment stores them
- * next to the rows they protect, in the same backup and the same restore.
- *
- * The table holds no plaintext key material, only salts and verifiers, which is
- * why it is readable while the store is locked.
- */
-export class KyselyLockVault {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    async read() {
-        try {
-            const rows = await this.db
-                .selectFrom('dataLocks')
-                .select(['keyId', 'keyVersion', 'salt', 'verifier'])
-                .execute();
-            return rows.map((row) => ({
-                keyId: row.keyId,
-                // SQLite hands back whatever it stored and postgres can widen an
-                // integer to a string over the wire, while `keyVersion` is compared
-                // and stamped as a number.
-                keyVersion: Number(row.keyVersion),
-                salt: row.salt,
-                verifier: unsafeAsWrapped(row.verifier),
-            }));
-        }
-        catch (cause) {
-            if (await this.tableExists()) {
-                throw cause;
-            }
-            // No table yet is a legitimate first run — the migration has not been
-            // applied, nobody has chosen a passphrase, and the server should come up
-            // and offer to initialize rather than refuse to start.
-            return [];
-        }
-    }
-    /**
-     * Replace the whole record set.
-     *
-     * Whole-set rather than per-row because the callers that write are
-     * initialization and rotation, and both produce a complete keyring: applying
-     * one as a partial update would leave records from the previous key behind,
-     * and a stale salt is indistinguishable from a current one.
-     */
-    async write(records) {
-        await this.db.transaction().execute(async (trx) => {
-            await trx.deleteFrom('dataLocks').execute();
-            if (records.length) {
-                await trx
-                    .insertInto('dataLocks')
-                    .values(records.map((record) => ({
-                    keyId: record.keyId,
-                    keyVersion: record.keyVersion,
-                    salt: record.salt,
-                    verifier: record.verifier,
-                })))
-                    .execute();
-            }
-        });
-    }
-    /**
-     * Asked through introspection rather than by matching the driver's error
-     * text, so the answer does not depend on which engine phrased the failure or
-     * on the language it phrased it in.
-     */
-    async tableExists() {
-        const tables = await this.db.introspection.getTables();
-        return tables.some((table) => table.name === 'data_locks');
-    }
-}

package/dist/src/schema/data-lock.schema.d.ts

@@ -1,15 +0,0 @@
-import type { PikkuSchema } from './pikku-schema.types.js';
-/**
- * Where the passphrase's salts and verifiers live.
- *
- * Deliberately the one table in a classified deployment that holds nothing
- * encrypted. It has to be readable before anything has been unlocked — a store
- * that needed its own key to find out how to open itself could never be opened
- * — and that costs nothing, because a salt and a verifier reveal no key
- * material.
- *
- * Losing this table is losing the data: every sealed row is opened by a KEK
- * derived from the salt kept here, so a deployment that ships without the
- * migration silently turns its own rows into noise the first time it restarts.
- */
-export declare const dataLockSchema: PikkuSchema;

package/dist/src/schema/data-lock.schema.js

@@ -1,27 +0,0 @@
-import { sql } from 'kysely';
-/**
- * Where the passphrase's salts and verifiers live.
- *
- * Deliberately the one table in a classified deployment that holds nothing
- * encrypted. It has to be readable before anything has been unlocked — a store
- * that needed its own key to find out how to open itself could never be opened
- * — and that costs nothing, because a salt and a verifier reveal no key
- * material.
- *
- * Losing this table is losing the data: every sealed row is opened by a KEK
- * derived from the salt kept here, so a deployment that ships without the
- * migration silently turns its own rows into noise the first time it restarts.
- */
-export const dataLockSchema = {
-    name: 'data-lock',
-    ownedBy: ['dataLock'],
-    statements: [
-        (db) => db.schema
-            .createTable('dataLocks')
-            .addColumn('keyId', 'varchar(255)', (col) => col.primaryKey())
-            .addColumn('keyVersion', 'integer', (col) => col.notNull())
-            .addColumn('salt', 'varchar(64)', (col) => col.notNull())
-            .addColumn('verifier', 'text', (col) => col.notNull())
-            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-    ],
-};

package/dist/tsconfig.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["../src/classification-crypto.ts","../src/classification-plugin.ts","../src/coercion-plugin.ts","../src/create-audited-kysely.ts","../src/index.ts","../src/kysely-agent-run-scores.ts","../src/kysely-agent-run-service.ts","../src/kysely-agent-run-state-service.ts","../src/kysely-agent-storage-service.ts","../src/kysely-audit-service.ts","../src/kysely-channel-store.ts","../src/kysely-credential-service.ts","../src/kysely-deployment-service.ts","../src/kysely-eventhub-store.ts","../src/kysely-json.ts","../src/kysely-scope-service.ts","../src/kysely-secret-service.ts","../src/kysely-session-store.ts","../src/kysely-tables.ts","../src/kysely-virtual-user-run-store.ts","../src/kysely-virtual-user-schedule-store.ts","../src/kysely-webhook-service.ts","../src/kysely-workflow-mirror.ts","../src/kysely-workflow-run-service.ts","../src/kysely-workflow-service.ts","../src/serialize-plugin.ts","../src/schema/agent.schema.ts","../src/schema/audit.schema.ts","../src/schema/channel.schema.ts","../src/schema/credential.schema.ts","../src/schema/deployment.schema.ts","../src/schema/index.ts","../src/schema/pikku-schema.types.ts","../src/schema/scope.schema.ts","../src/schema/secret.schema.ts","../src/schema/session.schema.ts","../src/schema/virtual-user-schedule.schema.ts","../src/schema/virtual-user.schema.ts","../src/schema/webhook.schema.ts","../src/schema/workflow.schema.ts","../bin/pikku-kysely-pure.ts"],"version":"6.0.3"}

package/src/classification-crypto.test.ts

@@ -1,143 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import { deriveKEK, generateKEKSalt } from '@pikku/core/crypto-utils'
-import {
-  ClassificationCrypto,
-  DEFAULT_KEY_ID,
-  isColumnEnvelope,
-  parseColumnEnvelope,
-  type KEKResolver,
-} from './classification-crypto.js'
-
-const passphrase = 'a-passphrase-long-enough-to-be-real-key-material'
-
-/**
- * A resolver that derives a KEK per keyId and remembers it.
- *
- * Caching is the part under test as much as the derivation: `resolveKEK` is
- * called per operation, and a resolver that re-derived every time would pay
- * key stretching on every row.
- */
-const testResolver = (): KEKResolver => {
-  const keks = new Map<string, Promise<CryptoKey>>()
-  return async (keyId) => {
-    let kek = keks.get(keyId)
-    if (!kek) {
-      kek = deriveKEK(passphrase, generateKEKSalt())
-      keks.set(keyId, kek)
-    }
-    return { kek: await kek, keyVersion: 1 }
-  }
-}
-
-const staticCrypto = async () =>
-  new ClassificationCrypto({ resolveKEK: testResolver() })
-
-describe('column envelope', () => {
-  test('round-trips a value through the default key', async () => {
-    const crypto = await staticCrypto()
-    const envelope = await crypto.encryptColumn(DEFAULT_KEY_ID, 'hunter2')
-    assert.equal(await crypto.decryptColumn(envelope), 'hunter2')
-  })
-
-  test('the stored envelope names the key that protects it', async () => {
-    const crypto = await staticCrypto()
-    const envelope = await crypto.encryptColumn('credentials', 'shh')
-    const parsed = parseColumnEnvelope(envelope)
-    assert.equal(parsed?.keyId, 'credentials')
-    assert.equal(parsed?.keyVersion, 1)
-  })
-
-  test('a value is not stored in the clear', async () => {
-    const crypto = await staticCrypto()
-    const envelope = await crypto.encryptColumn(DEFAULT_KEY_ID, 'hunter2')
-    assert.ok(!envelope.includes('hunter2'))
-  })
-
-  test('every value gets its own DEK', async () => {
-    const crypto = await staticCrypto()
-    const a = parseColumnEnvelope(
-      await crypto.encryptColumn(DEFAULT_KEY_ID, 'same')
-    )
-    const b = parseColumnEnvelope(
-      await crypto.encryptColumn(DEFAULT_KEY_ID, 'same')
-    )
-    assert.notEqual(a?.wrappedDek, b?.wrappedDek)
-    assert.notEqual(a?.ciphertext, b?.ciphertext)
-  })
-
-  test('round-trips non-string values', async () => {
-    const crypto = await staticCrypto()
-    const value = { card: '4242', meta: [1, 2, 3] }
-    const envelope = await crypto.encryptColumn(DEFAULT_KEY_ID, value)
-    assert.deepEqual(await crypto.decryptColumn(envelope), value)
-  })
-
-  test('plaintext is not mistaken for an envelope', () => {
-    assert.equal(isColumnEnvelope('hunter2'), false)
-    assert.equal(isColumnEnvelope(''), false)
-    assert.equal(parseColumnEnvelope('hunter2'), null)
-  })
-
-  test('a keyId containing the separator survives the round trip', async () => {
-    const crypto = await staticCrypto()
-    const envelope = await crypto.encryptColumn('tenant.42', 'x')
-    assert.equal(parseColumnEnvelope(envelope)?.keyId, 'tenant.42')
-    assert.equal(await crypto.decryptColumn(envelope), 'x')
-  })
-})
-
-describe('KEK scoping', () => {
-  test('different keyIds derive different KEKs from one passphrase', async () => {
-    const resolve = testResolver()
-    const a = await resolve(DEFAULT_KEY_ID)
-    const b = await resolve('credentials')
-    assert.notEqual(a.kek, b.kek)
-  })
-
-  test('a value written under one keyId does not open under another', async () => {
-    const crypto = await staticCrypto()
-    const envelope = await crypto.encryptColumn('credentials', 'shh')
-    const forged = envelope.replace(
-      /^(pikku1\.)[^.]+/,
-      `$1${Buffer.from('notes').toString('base64url')}`
-    )
-    await assert.rejects(() => crypto.decryptColumn(forged))
-  })
-
-  test('the same keyId resolves to the same KEK, so derivation is paid once', async () => {
-    const resolve = testResolver()
-    assert.equal(
-      (await resolve(DEFAULT_KEY_ID)).kek,
-      (await resolve(DEFAULT_KEY_ID)).kek
-    )
-  })
-
-  test('rewrapping moves a value to a new key without touching the ciphertext', async () => {
-    const crypto = await staticCrypto()
-    const envelope = await crypto.encryptColumn(DEFAULT_KEY_ID, 'portable')
-    const before = parseColumnEnvelope(envelope)
-
-    const rewrapped = await crypto.rewrapColumn(envelope, 'credentials')
-    const after = parseColumnEnvelope(rewrapped)
-
-    assert.equal(after?.keyId, 'credentials')
-    assert.equal(
-      after?.ciphertext,
-      before?.ciphertext,
-      'rewrap must re-wrap the DEK, not re-encrypt the value'
-    )
-    assert.notEqual(after?.wrappedDek, before?.wrappedDek)
-    assert.equal(await crypto.decryptColumn(rewrapped), 'portable')
-  })
-
-  test('a resolver may hand back a KEK it derived any way it likes', async () => {
-    const kek = await deriveKEK(passphrase, generateKEKSalt())
-    const crypto = new ClassificationCrypto({
-      resolveKEK: async () => ({ kek, keyVersion: 7 }),
-    })
-    const envelope = await crypto.encryptColumn('anything', 'v')
-    assert.equal(parseColumnEnvelope(envelope)?.keyVersion, 7)
-    assert.equal(await crypto.decryptColumn(envelope), 'v')
-  })
-})

package/src/classification-crypto.ts

@@ -1,163 +0,0 @@
-import {
-  envelopeDecrypt,
-  envelopeEncrypt,
-  envelopeRewrap,
-} from '@pikku/core/crypto-utils'
-import { DEFAULT_KEY_ID } from '@pikku/core/classification'
-import type { WrappedValue } from '@pikku/core/classification'
-
-/**
- * The key a column is protected by when its classification names none. A
- * deployment that never scopes its keys stores this id in every row and still
- * gets the scoping seam for free.
- *
- * Re-exported from core rather than declared again: the same constant decides
- * which record `initialize` mints and which one a stored envelope names, and
- * two copies of it would only ever be found to disagree by a row that could
- * not be opened.
- */
-export { DEFAULT_KEY_ID }
-
-const ENVELOPE_PREFIX = 'pikku1'
-
-/** The parts of a stored envelope, as they came off the column. */
-export interface ColumnEnvelope {
-  keyId: string
-  keyVersion: number
-  wrappedDek: string
-  ciphertext: string
-}
-
-/**
- * A KEK for one `keyId`, plus the version it was derived at.
- *
- * The version is the resolver's to report rather than the caller's to ask for:
- * on a write it stamps the row, and on a read the row already carries the
- * version the value was written under.
- */
-export interface ResolvedKEK {
-  kek: CryptoKey
-  keyVersion: number
-}
-
-/**
- * Maps a `keyId` — and, when reading, the version the row was written under —
- * to the KEK that opens it.
- *
- * This is the seam the whole design turns on. An unlock gate, a per-tenant
- * lookup or a KMS call all replace this one function without reshaping anything
- * that calls it.
- */
-export type KEKResolver = (
-  keyId: string,
-  keyVersion?: number
-) => Promise<ResolvedKEK>
-
-const encodePart = (value: string): string =>
-  Buffer.from(value, 'utf8').toString('base64url')
-
-const decodePart = (value: string): string =>
-  Buffer.from(value, 'base64url').toString('utf8')
-
-const serializeEnvelope = (envelope: ColumnEnvelope): WrappedValue =>
-  [
-    ENVELOPE_PREFIX,
-    encodePart(envelope.keyId),
-    String(envelope.keyVersion),
-    envelope.wrappedDek,
-    envelope.ciphertext,
-  ].join('.') as WrappedValue
-
-/**
- * Read a stored envelope, or null when the value is not one.
- *
- * Every part is base64url except the version, so `.` cannot occur inside a part
- * and a fixed split is unambiguous — a `keyId` may contain dots.
- */
-export const parseColumnEnvelope = (value: unknown): ColumnEnvelope | null => {
-  if (typeof value !== 'string') return null
-  const parts = value.split('.')
-  if (parts.length !== 5 || parts[0] !== ENVELOPE_PREFIX) return null
-
-  const [, encodedKeyId, rawVersion, wrappedDek, ciphertext] = parts
-  const keyVersion = Number(rawVersion)
-  if (!Number.isInteger(keyVersion) || !wrappedDek || !ciphertext) return null
-
-  try {
-    return {
-      keyId: decodePart(encodedKeyId!),
-      keyVersion,
-      wrappedDek,
-      ciphertext,
-    }
-  } catch {
-    return null
-  }
-}
-
-export const isColumnEnvelope = (value: unknown): boolean =>
-  parseColumnEnvelope(value) !== null
-
-export interface ClassificationCryptoOptions {
-  resolveKEK: KEKResolver
-}
-
-/**
- * Envelope encryption for a single classified column.
- *
- * Unlike `KyselySecretService`, which owns its table and can afford a column
- * per envelope part, a classified column is one column in someone else's table.
- * So the envelope is self-describing: the `keyId` and `keyVersion` travel in
- * the value, which is what lets a row record the key that protects it without
- * a schema change to every table that has a secret in it.
- */
-export class ClassificationCrypto {
-  private readonly resolveKEK: KEKResolver
-
-  constructor(options: ClassificationCryptoOptions) {
-    this.resolveKEK = options.resolveKEK
-  }
-
-  async encryptColumn(keyId: string, value: unknown): Promise<WrappedValue> {
-    const { kek, keyVersion } = await this.resolveKEK(keyId)
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(kek, value)
-    return serializeEnvelope({
-      keyId,
-      keyVersion,
-      wrappedDek: wrappedDEK,
-      ciphertext,
-    })
-  }
-
-  async decryptColumn<T = unknown>(value: unknown): Promise<T> {
-    const envelope = parseColumnEnvelope(value)
-    if (!envelope) {
-      throw new Error('Value is not a pikku column envelope')
-    }
-    const { kek } = await this.resolveKEK(envelope.keyId, envelope.keyVersion)
-    return envelopeDecrypt<T>(kek, envelope.ciphertext, envelope.wrappedDek)
-  }
-
-  /**
-   * Move a value to another key by re-wrapping its DEK. The ciphertext is
-   * untouched, so the cost is a constant per row rather than proportional to
-   * the value — the property that makes rescoping and rotation affordable.
-   */
-  async rewrapColumn(value: unknown, newKeyId: string): Promise<WrappedValue> {
-    const envelope = parseColumnEnvelope(value)
-    if (!envelope) {
-      throw new Error('Value is not a pikku column envelope')
-    }
-    const { kek: oldKEK } = await this.resolveKEK(
-      envelope.keyId,
-      envelope.keyVersion
-    )
-    const { kek: newKEK, keyVersion } = await this.resolveKEK(newKeyId)
-    return serializeEnvelope({
-      keyId: newKeyId,
-      keyVersion,
-      wrappedDek: await envelopeRewrap(oldKEK, newKEK, envelope.wrappedDek),
-      ciphertext: envelope.ciphertext,
-    })
-  }
-}