@bod.ee/db 0.7.0

package/src/server/Transport.ts

@@ -0,0 +1,479 @@
+import type { Server, ServerWebSocket } from 'bun';
+import type { BodDB } from './BodDB.ts';
+import type { RulesEngine } from './RulesEngine.ts';
+import type { ClientMessage } from '../shared/protocol.ts';
+import { Errors } from '../shared/errors.ts';
+import { normalizePath, pathKey } from '../shared/pathUtils.ts';
+
+interface WsData {
+  auth: Record<string, unknown> | null;
+  valueSubs: Map<string, () => void>;
+  childSubs: Map<string, () => void>;
+  streamSubs: Map<string, () => void>;
+}
+
+export class TransportOptions {
+  port: number = 4400;
+  auth?: (token: string) => Record<string, unknown> | null | Promise<Record<string, unknown> | null>;
+  /** Map URL paths to local file paths, e.g. { '/admin': './admin/ui.html' } */
+  staticRoutes?: Record<string, string>;
+}
+
+export class Transport {
+  readonly options: TransportOptions;
+  private server: Server | null = null;
+  private _clients = new Set<ServerWebSocket<WsData>>();
+  get clientCount(): number { return this._clients.size; }
+
+  constructor(
+    private db: BodDB,
+    private rules: RulesEngine | null,
+    options?: Partial<TransportOptions>,
+  ) {
+    this.options = { ...new TransportOptions(), ...options };
+  }
+
+  start(): Server {
+    const self = this;
+    const extractAuth = async (req: Request): Promise<Record<string, unknown> | null> => {
+      const header = req.headers.get('authorization');
+      if (!header?.startsWith('Bearer ')) return null;
+      const token = header.slice(7);
+      if (self.options.auth) return await self.options.auth(token);
+      return { token };
+    };
+    this.server = Bun.serve({
+      port: this.options.port,
+      fetch(req, server) {
+        const url = new URL(req.url);
+
+        // WebSocket upgrade (only if client actually requests it)
+        if (req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+          if (server.upgrade(req, { data: { auth: null, valueSubs: new Map(), childSubs: new Map(), streamSubs: new Map() } as WsData })) {
+            return;
+          }
+        }
+
+        // REST: GET /path → get
+        if (req.method === 'GET' && url.pathname.startsWith('/db/')) {
+          return (async () => {
+            const path = normalizePath(url.pathname.slice(4));
+            const auth = await extractAuth(req);
+            if (self.rules && !self.rules.check('read', path, auth)) {
+              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+            }
+            const data = self.db.get(path);
+            return Response.json({ ok: true, data });
+          })();
+        }
+
+        // REST: PUT /path → set
+        if (req.method === 'PUT' && url.pathname.startsWith('/db/')) {
+          return (async () => {
+            const path = normalizePath(url.pathname.slice(4));
+            const auth = await extractAuth(req);
+            if (self.rules && !self.rules.check('write', path, auth)) {
+              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+            }
+            const body = await req.json();
+            self.db.set(path, body);
+            return Response.json({ ok: true });
+          })();
+        }
+
+        // REST: DELETE /path → delete
+        if (req.method === 'DELETE' && url.pathname.startsWith('/db/')) {
+          return (async () => {
+            const path = normalizePath(url.pathname.slice(4));
+            const auth = await extractAuth(req);
+            if (self.rules && !self.rules.check('write', path, auth)) {
+              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+            }
+            self.db.delete(path);
+            return Response.json({ ok: true });
+          })();
+        }
+
+        // SSE: GET /sse/path?event=value|child
+        if (req.method === 'GET' && url.pathname.startsWith('/sse/')) {
+          return (async () => {
+            const path = normalizePath(url.pathname.slice(5));
+            const event = url.searchParams.get('event') || 'value';
+            const auth = await extractAuth(req);
+
+            if (self.rules && !self.rules.check('read', path, auth)) {
+              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+            }
+
+          let cleanup: (() => void) | null = null;
+          const stream = new ReadableStream({
+            start(controller) {
+              const encoder = new TextEncoder();
+              // Initial SSE comment to establish the stream
+              controller.enqueue(encoder.encode(': ok\n\n'));
+              const send = (data: string) => {
+                try { controller.enqueue(encoder.encode(`data: ${data}\n\n`)); } catch {}
+              };
+
+              if (event === 'child') {
+                cleanup = self.db.onChild(path, (e) => {
+                  send(JSON.stringify({ type: 'child', path, key: e.key, data: e.val(), event: e.type }));
+                });
+              } else {
+                cleanup = self.db.on(path, (snap) => {
+                  send(JSON.stringify({ type: 'value', path: snap.path, data: snap.val() }));
+                });
+              }
+            },
+            cancel() {
+              cleanup?.();
+            },
+          });
+
+            return new Response(stream, {
+              headers: {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                'Connection': 'keep-alive',
+              },
+            });
+          })();
+        }
+
+        // Static routes
+        if (self.options.staticRoutes) {
+          const filePath = self.options.staticRoutes[url.pathname];
+          if (filePath) return new Response(Bun.file(filePath));
+        }
+
+        return new Response('Not Found', { status: 404 });
+      },
+      websocket: {
+        open(ws: ServerWebSocket<WsData>) { self._clients.add(ws); },
+        close(ws: ServerWebSocket<WsData>) {
+          self._clients.delete(ws);
+          // Cleanup all subscriptions
+          for (const off of ws.data.valueSubs.values()) off();
+          for (const off of ws.data.childSubs.values()) off();
+          for (const off of ws.data.streamSubs.values()) off();
+          ws.data.valueSubs.clear();
+          ws.data.childSubs.clear();
+          ws.data.streamSubs.clear();
+        },
+        async message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
+          let msg: ClientMessage;
+          try {
+            msg = JSON.parse(typeof raw === 'string' ? raw : raw.toString());
+          } catch {
+            ws.send(JSON.stringify({ id: '?', ok: false, error: 'Invalid JSON', code: Errors.INTERNAL }));
+            return;
+          }
+
+          const { id } = msg;
+          const reply = (data: unknown) => ws.send(JSON.stringify({ id, ok: true, data }));
+          const error = (err: string, code: string) => ws.send(JSON.stringify({ id, ok: false, error: err, code }));
+
+          try {
+            switch (msg.op) {
+              case 'auth': {
+                if (!self.options.auth) {
+                  ws.data.auth = { token: msg.token };
+                } else {
+                  const result = await self.options.auth(msg.token);
+                  if (!result) return error('Authentication failed', Errors.AUTH_REQUIRED);
+                  ws.data.auth = result;
+                }
+                return reply(null);
+              }
+
+              case 'get': {
+                if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                if (msg.shallow) return reply(self.db.getShallow(msg.path || undefined));
+                return reply(self.db.get(msg.path));
+              }
+
+              case 'set': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth, self.db.get(msg.path), msg.value)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.set(msg.path, msg.value, msg.ttl ? { ttl: msg.ttl } : undefined);
+                return reply(null);
+              }
+
+              case 'update': {
+                for (const path of Object.keys(msg.updates)) {
+                  if (self.rules && !self.rules.check('write', path, ws.data.auth)) {
+                    return error(`Permission denied for ${path}`, Errors.PERMISSION_DENIED);
+                  }
+                }
+                self.db.update(msg.updates);
+                return reply(null);
+              }
+
+              case 'delete': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.delete(msg.path);
+                return reply(null);
+              }
+
+              case 'query': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                let q = self.db.query(msg.path);
+                if (msg.filters) for (const f of msg.filters) q = q.where(f.field, f.op, f.value);
+                if (msg.order) q = q.order(msg.order.field, msg.order.dir);
+                if (msg.limit) q = q.limit(msg.limit);
+                if (msg.offset) q = q.offset(msg.offset);
+                return reply(q.get());
+              }
+
+              case 'sub': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                const subKey = `${msg.event}:${msg.path}`;
+                if (msg.event === 'value') {
+                  if (ws.data.valueSubs.has(subKey)) return reply(null); // already subscribed
+                  const off = self.db.on(msg.path, (snap) => {
+                    ws.send(JSON.stringify({ type: 'value', path: snap.path, data: snap.val() }));
+                  });
+                  ws.data.valueSubs.set(subKey, off);
+                } else if (msg.event === 'child') {
+                  if (ws.data.childSubs.has(subKey)) return reply(null);
+                  const subPath = msg.path;
+                  const off = self.db.onChild(subPath, (event) => {
+                    ws.send(JSON.stringify({ type: 'child', path: subPath, key: event.key, data: event.val(), event: event.type }));
+                  });
+                  ws.data.childSubs.set(subKey, off);
+                }
+                return reply(null);
+              }
+
+              case 'unsub': {
+                const unsubKey = `${msg.event}:${msg.path}`;
+                if (msg.event === 'value') {
+                  ws.data.valueSubs.get(unsubKey)?.();
+                  ws.data.valueSubs.delete(unsubKey);
+                } else if (msg.event === 'child') {
+                  ws.data.childSubs.get(unsubKey)?.();
+                  ws.data.childSubs.delete(unsubKey);
+                }
+                return reply(null);
+              }
+
+              case 'batch': {
+                const results: unknown[] = [];
+                self.db.transaction((tx) => {
+                  for (const batchOp of msg.operations) {
+                    switch (batchOp.op) {
+                      case 'set':
+                        if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
+                          throw new Error(`Permission denied for ${batchOp.path}`);
+                        }
+                        tx.set(batchOp.path, batchOp.value);
+                        break;
+                      case 'update':
+                        for (const path of Object.keys(batchOp.updates)) {
+                          if (self.rules && !self.rules.check('write', path, ws.data.auth)) {
+                            throw new Error(`Permission denied for ${path}`);
+                          }
+                        }
+                        tx.update(batchOp.updates);
+                        break;
+                      case 'delete':
+                        if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
+                          throw new Error(`Permission denied for ${batchOp.path}`);
+                        }
+                        tx.delete(batchOp.path);
+                        break;
+                      case 'push': {
+                        if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
+                          throw new Error(`Permission denied for ${batchOp.path}`);
+                        }
+                        const key = self.db.push(batchOp.path, batchOp.value);
+                        results.push(key);
+                        break;
+                      }
+                    }
+                  }
+                });
+                return reply(results.length ? results : null);
+              }
+
+              case 'push': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                const key = self.db.push(msg.path, msg.value, msg.idempotencyKey ? { idempotencyKey: msg.idempotencyKey } : undefined);
+                return reply(key);
+              }
+
+              case 'stream-read': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                const events = self.db.stream.read(msg.path, msg.groupId, msg.limit);
+                return reply(events);
+              }
+
+              case 'stream-ack': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.stream.ack(msg.path, msg.groupId, msg.key);
+                return reply(null);
+              }
+
+              case 'stream-sub': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                const streamKey = `${msg.path}:${msg.groupId}`;
+                // Unsub existing if any
+                ws.data.streamSubs.get(streamKey)?.();
+                const unsub = self.db.stream.subscribe(msg.path, msg.groupId, (events) => {
+                  ws.send(JSON.stringify({ type: 'stream', path: msg.path, groupId: msg.groupId, events }));
+                });
+                ws.data.streamSubs.set(streamKey, unsub);
+                return reply(null);
+              }
+
+              case 'stream-unsub': {
+                const streamUnsubKey = `${msg.path}:${msg.groupId}`;
+                ws.data.streamSubs.get(streamUnsubKey)?.();
+                ws.data.streamSubs.delete(streamUnsubKey);
+                return reply(null);
+              }
+
+              // MQ ops
+              case 'mq-push': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                const mqKey = self.db.mq.push(msg.path, msg.value, msg.idempotencyKey ? { idempotencyKey: msg.idempotencyKey } : undefined);
+                return reply(mqKey);
+              }
+              case 'mq-fetch': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.mq.fetch(msg.path, msg.count));
+              }
+              case 'mq-ack': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.mq.ack(msg.path, msg.key);
+                return reply(null);
+              }
+              case 'mq-nack': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.mq.nack(msg.path, msg.key);
+                return reply(null);
+              }
+              case 'mq-peek': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.mq.peek(msg.path, msg.count));
+              }
+              case 'mq-dlq': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.mq.dlq(msg.path));
+              }
+              case 'mq-purge': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.mq.purge(msg.path, { all: msg.all }));
+              }
+
+              // FTS ops
+              case 'fts-search': {
+                if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.search({ text: msg.text, path: msg.path, limit: msg.limit }));
+              }
+              case 'fts-index': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                if (msg.fields) self.db.index(msg.path, msg.fields);
+                else if (msg.content) self.db.index(msg.path, msg.content);
+                return reply(null);
+              }
+
+              // Vector ops
+              case 'vector-search': {
+                if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.vectorSearch({ query: msg.query, path: msg.path, limit: msg.limit, threshold: msg.threshold }));
+              }
+              case 'vector-store': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.vectors!.store(msg.path, msg.embedding);
+                return reply(null);
+              }
+
+              // Stream extended ops
+              case 'stream-snapshot': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.stream.snapshot(msg.path));
+              }
+              case 'stream-materialize': {
+                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.stream.materialize(msg.path, msg.keepKey ? { keepKey: msg.keepKey } : undefined));
+              }
+              case 'stream-compact': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                return reply(self.db.stream.compact(msg.path, { maxAge: msg.maxAge, maxCount: msg.maxCount, keepKey: msg.keepKey }));
+              }
+              case 'stream-reset': {
+                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                  return error('Permission denied', Errors.PERMISSION_DENIED);
+                }
+                self.db.stream.reset(msg.path);
+                return reply(null);
+              }
+
+              default:
+                return error('Unknown operation', Errors.INTERNAL);
+            }
+          } catch (e: unknown) {
+            const message = e instanceof Error ? e.message : 'Internal error';
+            return error(message, Errors.INTERNAL);
+          }
+        },
+      },
+    });
+    return this.server;
+  }
+
+  stop() {
+    this.server?.stop(true);
+    this.server = null;
+  }
+
+  get port(): number | null {
+    return this.server?.port ?? null;
+  }
+}

package/src/server/VectorEngine.ts

@@ -0,0 +1,115 @@
+import type { Database } from 'bun:sqlite';
+
+export class VectorEngineOptions {
+  dimensions: number = 384;
+  metric: 'cosine' | 'euclidean' = 'cosine';
+}
+
+export class VectorEngine {
+  readonly options: VectorEngineOptions;
+  private db: Database;
+  private cache = new Map<string, Float32Array>();
+
+  constructor(db: Database, options?: Partial<VectorEngineOptions>) {
+    this.options = { ...new VectorEngineOptions(), ...options };
+    this.db = db;
+    this.init();
+  }
+
+  private init() {
+    this.db.run(`
+      CREATE TABLE IF NOT EXISTS _vectors (
+        path TEXT PRIMARY KEY,
+        embedding BLOB NOT NULL
+      )
+    `);
+  }
+
+  /** Store an embedding for a path */
+  store(path: string, embedding: number[]): void {
+    if (embedding.length !== this.options.dimensions) {
+      throw new Error(`Expected ${this.options.dimensions} dimensions, got ${embedding.length}`);
+    }
+    const buf = new Float32Array(embedding);
+    this.db.run('INSERT OR REPLACE INTO _vectors (path, embedding) VALUES (?, ?)', [path, Buffer.from(buf.buffer)]);
+    this.cache.set(path, buf);
+  }
+
+  /** Remove embedding for a path */
+  remove(path: string): void {
+    this.db.run('DELETE FROM _vectors WHERE path = ?', [path]);
+    this.cache.delete(path);
+  }
+
+  /** Get embedding for a path */
+  get(path: string): number[] | null {
+    const cached = this.cache.get(path);
+    if (cached) return Array.from(cached);
+
+    const row = this.db.prepare('SELECT embedding FROM _vectors WHERE path = ?').get(path) as { embedding: Buffer } | null;
+    if (!row) return null;
+    const arr = new Float32Array(row.embedding.buffer, row.embedding.byteOffset, row.embedding.byteLength / 4);
+    this.cache.set(path, arr);
+    return Array.from(arr);
+  }
+
+  /** Search for similar vectors (brute-force) */
+  search(options: {
+    query: number[];
+    prefix?: string;
+    limit?: number;
+    threshold?: number;
+  }): Array<{ path: string; score: number }> {
+    const { query, prefix, limit = 10, threshold } = options;
+    const queryArr = new Float32Array(query);
+
+    // Load all vectors (filtered by prefix if provided)
+    let sql = 'SELECT path, embedding FROM _vectors';
+    const params: unknown[] = [];
+    if (prefix) {
+      sql += ' WHERE path >= ? AND path < ?';
+      params.push(prefix + '/', prefix + '/\uffff');
+    }
+
+    const rows = this.db.prepare(sql).all(...params) as Array<{ path: string; embedding: Buffer }>;
+    const results: Array<{ path: string; score: number }> = [];
+
+    for (const row of rows) {
+      const emb = new Float32Array(row.embedding.buffer, row.embedding.byteOffset, row.embedding.byteLength / 4);
+      const score = this.options.metric === 'cosine'
+        ? cosineSimilarity(queryArr, emb)
+        : -euclideanDistance(queryArr, emb); // Negate so higher = better
+
+      if (threshold !== undefined && score < threshold) continue;
+      results.push({ path: row.path, score });
+    }
+
+    results.sort((a, b) => b.score - a.score);
+    return results.slice(0, limit);
+  }
+
+  /** Clear the in-memory cache */
+  clearCache(): void {
+    this.cache.clear();
+  }
+}
+
+function cosineSimilarity(a: Float32Array, b: Float32Array): number {
+  let dot = 0, normA = 0, normB = 0;
+  for (let i = 0; i < a.length; i++) {
+    dot += a[i] * b[i];
+    normA += a[i] * a[i];
+    normB += b[i] * b[i];
+  }
+  const denom = Math.sqrt(normA) * Math.sqrt(normB);
+  return denom === 0 ? 0 : dot / denom;
+}
+
+function euclideanDistance(a: Float32Array, b: Float32Array): number {
+  let sum = 0;
+  for (let i = 0; i < a.length; i++) {
+    const d = a[i] - b[i];
+    sum += d * d;
+  }
+  return Math.sqrt(sum);
+}

package/src/shared/errors.ts

@@ -0,0 +1,15 @@
+export class BodError extends Error {
+  constructor(public code: string, message: string) {
+    super(message);
+    this.name = 'BodError';
+  }
+}
+
+export const Errors = {
+  NOT_FOUND: 'NOT_FOUND',
+  PERMISSION_DENIED: 'PERMISSION_DENIED',
+  INVALID_PATH: 'INVALID_PATH',
+  INVALID_VALUE: 'INVALID_VALUE',
+  AUTH_REQUIRED: 'AUTH_REQUIRED',
+  INTERNAL: 'INTERNAL',
+} as const;