Repository navigation
Re-vendor Interchange pin 692c3106 → c1b5bb73 (principal signing keys) - #683
Merged
TheGreatAxios merged 5 commits intoSep 7, 2026
Merged
TheGreatAxios merged 5 commits into
TheGreatAxios merged 5 commits into
Conversation
Cover PRINCIPAL_KEY_ENCRYPTION_KEY parsing in the hub config tests (64-hex, parsed exactly like CREDENTIAL_ENCRYPTION_KEY, with no ALLOW_PLAINTEXT_SECRETS fallback substituting a key), and repoint the tolerate-migration test at the migration file's renumbered 0091 name.
…ub-common Copy the per-principal signing-key series into the vendored packages: principal-key-store, principal-store, signer-identity, and the principal-key backfill land in @intx/db; the tenant/invite/run/workflow routes and the grant materializer gain the principalKeyStore seam in @intx/hub-api; @intx/types gains the signer-identity contract and the principalKeyAad domain separator. Upstream's new @intx/hub-common is vendored for the first time (pky_ id prefix, generateId). Upstream's 0089 principal-key migration is renumbered to 0093 behind the four workbench-delta migrations, with the journal entry and a snapshot reconciled to the local columns; upstream 447ebb08's snapshot chain repair (relinked 0087 prevId, credential_refs restored) is applied to 0087/0088. All workbench-delta files are preserved.
Parse PRINCIPAL_KEY_ENCRYPTION_KEY in the hub config (64-hex, parsed exactly like CREDENTIAL_ENCRYPTION_KEY; ALLOW_PLAINTEXT_SECRETS is the only dev/test boot escape), and mint a real principal-key store at boot - the hub refuses to start without the key unless that escape is set. Route principal creation through @intx/db's createPrincipalStore everywhere the hub mints principals: boot's default-tenant owner membership, @corbits/chat's workbench-tenancy member creation (the store is threaded through its authz deps so the key joins the member transaction), and the invite route already covered by the vendored hub-api. Add scripts/backfill-principal-keys.ts, mirroring upstream's bin script, to seal keys onto principals that predate the feature.
Bump the db/hub-api/types ledger rows to c1b5bb73 (origin/main, 2026-09-06), add the first hub-common row, and refresh the why-not-published rationales: npm 0.3.0 predates the per-principal signing-key series and generateId's pky_ prefix. Update the touched packages' VENDORED-FROM delta lines and recompute the kill-date tree hashes; kill dates stay 2026-11-03 (already past change-date +30d). Document PRINCIPAL_KEY_ENCRYPTION_KEY in .env.example.
…1b5bb73-principal
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tracks upstream
faremeter/interchangemain toc1b5bb73(2026-09-06; 10 commits, the per-principal signing-key series). No npm publish covers the series (all@intx/*0.3.0 builds predate it), so this is a source re-pin per the CL-5514/CL-6254 mechanics.Closes CL-7495.
Vendored changes:
vendor/intx/db: principal-key/principal stores,signer-identity.ts,parse-row.ts,backfill-principal-keys.ts,schema/principal-keys.ts; upstream migration0089_tense_selenelands as0093_principal_keys(journal + snapshot surgery; 0087/0088 repaired per upstream447ebb08, local 0089–0092 deltas preserved, new 0093 snapshot reconciled with the four local column deltas). All local-delta files kept (workflow-definition-store, definitions schema, approvals route, workflow-run-deploy-auth, sidecar schema).vendor/intx/hub-api: new optionalprincipalKeyStoreseam (resolvePrincipalKeyStore), run-grant materialization + workflow-run trigger now mint run principals through the principal store; hand-merged with the localworkflowRunAuthenticatorseam.vendor/intx/types:signer-identity.ts, credential-cipher AAD support.vendor/intx/hub-common(npm 0.3.0'sgenerateIdsilently emits broken ids for unknown kinds — vendoring is the only sound supply).Workbench adoption:
PRINCIPAL_KEY_ENCRYPTION_KEY(64-hex) parsed likeCREDENTIAL_ENCRYPTION_KEY; boot-refused unlessALLOW_PLAINTEXT_SECRETSis set.createPrincipalKeyStorewired intocreateAppand the mail-triggered run-grants materializer; principal creation indefault-tenant.tsand@corbits/chattenancy routed throughcreatePrincipalStore(...).create/createIfAbsent.scripts/backfill-principal-keys.tsfor pre-existing databases.c1b5bb73+ new hub-common row; kill-dates recomputed.Verification: worktree gates green — typecheck 0, lint 0, db-gated migration suites 81/81 (
DATABASE_URLset), check:structural incl. check:killdates 0, root tests 925/925,bun install --frozen-lockfile --dry-run0. The only red is the pre-existing@corbits/workflowsmock.module('@intx/db')leak reproducing on clean main (CL-7499) — the pre-push hook was skipped withSKIP_WORKBENCH_HOOKSfor that reason. Critic-reviewed in a fresh context against the upstream clone: verbatim-copy integrity, kept-local integrity, migration-chain coherence, and adoption call sites all verified; no blocking findings.