@deepseek-ai/dsh-session-query-sqlite 0.0.1-rc.3 → 0.1.0-rc.2

package/LICENSE

@@ -1,28 +1,21 @@
-BSD 3-Clause License
+MIT License
 
-Copyright (c) 2026, DeepSeek
+Copyright (c) 2026 DeepSeek
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holder nor the names of its
-   contributors may be used to endorse or promote products derived from
-   this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/session-query/session-query-sqlite/README.md
-README.md: 846f79bd8383a8114a6d1329e7dbe931a67d98d0
-README.zh.md: e84e521dd5f392dbcede1e1dd957e4ce0a9bc50f
+README.md: 25257ddbe672d47faf39e1472a1bd882205d8c4e
+README.zh.md: 584e466a5042334e22797a6c2794cce910844d5a

package/README.md

@@ -16,7 +16,7 @@ All three surfaces (`current`, `shadowed`, and `log-only`) are searchable by def
 
 The service requires `ctx.sessions` and observes optional `ctx.sessionPersistence` dynamically. One serialized state machine compares source-qualified lightweight durable snapshot revisions, non-mutatingly inspects only new or changed logs, extracts shared semantic documents, reconciles changes transactionally, and runs the query. Session queries never invoke the persistence backend's crash-repairing `load()`; an owner attaching during inspection cannot mutate its log, and the stable-observation retry makes the result live-preferred. The TEMP live row still records persisted availability, and the durable base refreshes after that live owner detaches. Repeated queries and an unchanged same-store reopen perform no full durable-log inspection; switching stores, or observing new, changed, deleted, or externally load-repaired sources, reconciles on the next stable observation. Source or transaction failure commits nothing, and the next search retries.
 
-`openAt: startup` is the default: service activation imports `node:sqlite`, opens the handle, and fails before publication when the index is invalid. `openAt: first-search` publishes the service as ACTIVE without importing the SQLite module or opening a handle; the first concurrent searches share one readiness promise, and disposal before any search opens nothing. This mode supports compositions that need clean Node 22 startup output by deferring SQLite's experimental warning until the first actual search; it does not suppress a warning at that point. An invalid database likewise fails the first search instead of service activation.
+`openAt: startup` is the default: service activation imports `node:sqlite`, opens the handle, and fails before publication when the index is invalid. `openAt: first-search` publishes the service as ACTIVE without importing the SQLite module or opening a handle; the first concurrent searches share one readiness promise, and disposal before any search opens nothing. This mode supports compositions that need clean Node 22 startup output by deferring SQLite's experimental warning until the first actual search; it does not suppress a warning at that point. An invalid database likewise fails the first search instead of service activation. `openAt: never` turns full-text search off for the deployment: `searchSessions` and `searchEvents` fail with `SESSION_QUERY_SEARCH_DISABLED` before any request normalization, node:sqlite is never imported or opened, and no source observation or reconciliation runs, while every inherited exact read, filter, and trace on `ctx.sessionQuery` keeps working.
 
 Persisted FTS rows live in a dedicated derived database. Connection-local TEMP tables hold live rows, which shadow the durable base for the same session and reveal it when the live owner disappears. Unmounting persistence hides durable rows without discarding the cache; remounting reconciles it. Closing or reopening the database drops every live overlay while retaining persisted rows.
 
@@ -27,7 +27,7 @@ The database is disposable but reset is guarded: every recognized schema version
 | Key | Default | Contract |
 |---|---:|---|
 | `path` | required | Dedicated derived-index SQLite path; `:memory:` is supported. Missing filesystem paths are created owner-only on POSIX filesystems. |
-| `openAt` | `startup` | `startup` opens before service activation completes; `first-search` defers the SQLite module and handle until search. |
+| `openAt` | `startup` | `startup` opens before service activation completes; `first-search` defers the SQLite module and handle until search; `never` disables full-text search (typed `SESSION_QUERY_SEARCH_DISABLED` failures) while inherited reads stay available. |
 | `journalMode` | `wal` | `wal`, `delete`, `truncate`, or `persist`. |
 | `defaultLimit` | `20` | Page size when a request omits `limit`; at most `Number.MAX_SAFE_INTEGER - 1`. |
 | `maxLimit` | `100` | Largest accepted request page size; at most `Number.MAX_SAFE_INTEGER - 1`. |

package/README.zh.md

@@ -16,7 +16,7 @@
 
 该服务需要 `ctx.sessions`，并动态观察可选的 `ctx.sessionPersistence`。一个串行化状态机比较来源限定的轻量持久化快照修订，仅以不修改日志的方式检查新日志或已更改日志，提取共享语义文档，以事务方式对账变更，然后运行查询。会话查询绝不会调用持久化后端会修复崩溃的 `load()`；检查期间接入的活动所有者无法修改其日志，稳定观察重试使结果优先使用实时来源。TEMP 实时行仍会记录持久化可用性，而持久基库会在该活动所有者脱离后刷新。重复查询以及同一存储未发生变化的重新打开操作不会执行完整持久化日志检查；切换存储，或观察到新增、已更改、已删除或经外部 load 修复的来源时，会在下次稳定观察时对账。来源或事务失败不会提交任何内容，下一次搜索会重试。
 
-`openAt: startup` 是默认值：服务激活会导入 `node:sqlite` 并打开句柄；如果索引无效，则会在服务发布前失败。`openAt: first-search` 会将服务以 ACTIVE 状态发布，同时不导入 SQLite 模块也不打开句柄；首批并发搜索共享同一个就绪 promise，在任何搜索前 dispose（资源释放）服务时也不会导入模块或打开句柄。此模式通过把 SQLite 的实验性警告推迟到首次实际搜索，支持需要干净 Node 22 启动输出的组合；它不会抑制届时的警告。无效数据库同样会使首次搜索失败，而不是服务激活失败。
+`openAt: startup` 是默认值：服务激活会导入 `node:sqlite` 并打开句柄；如果索引无效，则会在服务发布前失败。`openAt: first-search` 会将服务以 ACTIVE 状态发布，同时不导入 SQLite 模块也不打开句柄；首批并发搜索共享同一个就绪 promise，在任何搜索前 dispose（资源释放）服务时也不会导入模块或打开句柄。此模式通过把 SQLite 的实验性警告推迟到首次实际搜索，支持需要干净 Node 22 启动输出的组合；它不会抑制届时的警告。无效数据库同样会使首次搜索失败，而不是服务激活失败。`openAt: never` 为该部署关闭全文搜索：`searchSessions` 和 `searchEvents` 在任何请求规范化之前就以 `SESSION_QUERY_SEARCH_DISABLED` 失败，node:sqlite 绝不会被导入或打开，也不运行任何来源观察或对账，而 `ctx.sessionQuery` 上继承的全部精确读取、过滤和跟踪保持可用。
 
 持久化 FTS 行位于专用派生数据库中。连接本地 TEMP 表保存实时行，这些行会遮蔽同一会话的持久化基库，并在实时所有者消失后使其重新可见。卸载持久化会隐藏持久行，但不会丢弃缓存；重新挂载会对账缓存。关闭或重新打开数据库会删除全部实时覆盖层，但保留持久行。
 
@@ -27,7 +27,7 @@
 | 键 | 默认值 | 约定 |
 |---|---:|---|
 | `path` | 必填 | 专用派生索引 SQLite 路径；支持 `:memory:`。在 POSIX 文件系统上，缺失的文件系统路径会以仅所有者可访问的方式创建。 |
-| `openAt` | `startup` | `startup` 会在服务激活完成前打开；`first-search` 把 SQLite 模块与句柄推迟到搜索时再加载和打开。 |
+| `openAt` | `startup` | `startup` 会在服务激活完成前打开；`first-search` 把 SQLite 模块与句柄推迟到搜索时再加载和打开；`never` 关闭全文搜索（以类型化的 `SESSION_QUERY_SEARCH_DISABLED` 失败），继承的读取保持可用。 |
 | `journalMode` | `wal` | `wal`、`delete`、`truncate` 或 `persist`。 |
 | `defaultLimit` | `20` | 请求省略 `limit` 时的分页大小；最多为 `Number.MAX_SAFE_INTEGER - 1`。 |
 | `maxLimit` | `100` | 接受的最大请求分页大小；最多为 `Number.MAX_SAFE_INTEGER - 1`。 |

package/lib/index.js

@@ -476,7 +476,11 @@ var SqliteSessionQueryEngine = class extends SessionQueryEngine {
 	static inject = ["sessions"];
 	static Config = z.object({
 		path: z.string().required(),
-		openAt: z.union(["startup", "first-search"]).default("startup"),
+		openAt: z.union([
+			"startup",
+			"first-search",
+			"never"
+		]).default("startup"),
 		journalMode: z.union([
 			"wal",
 			"delete",
@@ -529,6 +533,7 @@ var SqliteSessionQueryEngine = class extends SessionQueryEngine {
 		if (this.config.openAt === "startup") await this._ensureReady(void 0);
 	}
 	async searchSessions(request, exec) {
+		this._assertSearchEnabled();
 		const normalized = normalizeSessionRequest(request, this.config);
 		const signal = exec?.signal;
 		return this._serialized(signal, async () => {
@@ -549,6 +554,7 @@ var SqliteSessionQueryEngine = class extends SessionQueryEngine {
 		});
 	}
 	async searchEvents(request, exec) {
+		this._assertSearchEnabled();
 		const normalized = normalizeEventRequest(request, this.config);
 		const signal = exec?.signal;
 		return this._serialized(signal, async () => {
@@ -577,6 +583,15 @@ var SqliteSessionQueryEngine = class extends SessionQueryEngine {
 		this._closePromise ??= this._close();
 		return this._closePromise;
 	}
+	/**
+	* Refuse full-text calls under `openAt: 'never'` before any request
+	* normalization or SQLite work, so a disabled deployment never imports
+	* node:sqlite, opens the index, or observes sources.
+	*/
+	_assertSearchEnabled() {
+		if (this.config.openAt !== "never") return;
+		throw new SessionQueryError("session search is disabled: this deployment configures the session-query index with openAt \"never\"", "SESSION_QUERY_SEARCH_DISABLED");
+	}
 	async _close() {
 		this._closed = true;
 		await this._tail;
@@ -1066,7 +1081,11 @@ function resolveConfig(config) {
 		persistedInspectConcurrency: config.persistedInspectConcurrency ?? SESSION_QUERY_DEFAULT_PERSISTED_INSPECT_CONCURRENCY
 	};
 	if (typeof resolved.path !== "string" || resolved.path.trim().length === 0) throw invalidConfig("path must not be blank");
-	if (!["startup", "first-search"].includes(resolved.openAt)) throw invalidConfig("openAt is not supported");
+	if (![
+		"startup",
+		"first-search",
+		"never"
+	].includes(resolved.openAt)) throw invalidConfig("openAt is not supported");
 	assertPageLimit("defaultLimit", resolved.defaultLimit);
 	assertPageLimit("maxLimit", resolved.maxLimit);
 	assertPositiveInteger("snippetChars", resolved.snippetChars);

package/lib/types/index.d.ts

@@ -23,8 +23,8 @@ export declare const SESSION_QUERY_SQLITE_DEFAULT_LIMIT = 20;
 export declare const SESSION_QUERY_SQLITE_MAX_LIMIT = 100;
 /** Default maximum snippet length in Unicode code points. */
 export declare const SESSION_QUERY_SQLITE_SNIPPET_CHARS = 240;
-/** SQLite module/handle opening phase. */
-export type OpenAt = 'startup' | 'first-search';
+/** SQLite module/handle opening phase; `never` disables full-text search entirely. */
+export type OpenAt = 'startup' | 'first-search' | 'never';
 /** Combined session-query configuration backed by SQLite full-text search. */
 export interface Config extends SessionQueryConfig {
     /**
@@ -33,7 +33,13 @@ export interface Config extends SessionQueryConfig {
      * POSIX filesystems; existing modes are preserved.
      */
     path: string;
-    /** Open the SQLite module and handle at service activation or the first search. Defaults to `startup`. */
+    /**
+     * Open the SQLite module and handle at service activation or the first
+     * search, or `never` to disable full-text search: the inherited exact
+     * reads, filters, and traces stay available, while `searchSessions` and
+     * `searchEvents` fail with `SESSION_QUERY_SEARCH_DISABLED` and SQLite is
+     * never imported or opened. Defaults to `startup`.
+     */
     openAt?: OpenAt;
     /** SQLite journal mode. Defaults to `wal`. */
     journalMode?: JournalMode;
@@ -81,6 +87,12 @@ export declare class SqliteSessionQueryEngine extends SessionQueryEngine {
     searchEvents(request: SessionEventSearchRequest, exec?: SessionSearchExecContext): Promise<SessionEventSearchPage>;
     /** Close the database after every accepted operation reaches quiescence. */
     close(): Promise<void>;
+    /**
+     * Refuse full-text calls under `openAt: 'never'` before any request
+     * normalization or SQLite work, so a disabled deployment never imports
+     * node:sqlite, opens the index, or observes sources.
+     */
+    private _assertSearchEnabled;
     private _close;
     private _open;
     private _ensureReady;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-session-query-sqlite",
   "description": "Concrete ctx.sessionQuery backend with SQLite FTS5 search",
-  "version": "0.0.1-rc.3",
+  "version": "0.1.0-rc.2",
   "publishConfig": {
     "access": "restricted"
   },
@@ -30,13 +30,13 @@
     "lib/invariant.js",
     "lib/types/**/*.d.ts"
   ],
-  "license": "BSD-3-Clause",
+  "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-session-persistence": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-session": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-session-query": "^0.0.1-rc.3",
-    "@deepseek-ai/cordis": "^4.0.1-rc.1"
+    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session-query": "^0.1.0-rc.2",
+    "@deepseek-ai/cordis": "^4.0.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-session-persistence": {
@@ -44,15 +44,15 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1-rc.1"
+    "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-session": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-session-persistence": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-session-persistence-sqlite": "^0.0.1-rc.3",
-    "@deepseek-ai/dsh-session-query": "^0.0.1-rc.3",
-    "@deepseek-ai/cordis": "^4.0.1-rc.1"
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session-persistence-sqlite": "^0.1.0-rc.2",
+    "@deepseek-ai/dsh-session-query": "^0.1.0-rc.2",
+    "@deepseek-ai/cordis": "^4.0.1"
   }
 }