@fadhilp/stateql 0.10.1 → 0.11.1

package/dist/src/store.d.ts

@@ -19,6 +19,7 @@ export interface ConnectionRecord {
     source: string;
     secret_env: string | null;
     credential_ref: string | null;
+    password_ref: string | null;
     read_only: number;
     version: number;
     created_at: string;
@@ -28,6 +29,7 @@ export interface ProfileRecord {
     target: string | null;
     secret_env: string | null;
     credential_ref: string | null;
+    password_ref: string | null;
     read_only: number;
     created_at: string;
     updated_at: string;
@@ -126,9 +128,11 @@ export declare class StateStore {
     private closed;
     constructor(home: string, now: () => Date, maxStateBytes?: number);
     close(): void;
-    nextId(prefix: string): string;
+    randomId(prefix: string): string;
+    private insertWithRandomId;
     ensureSession(name?: string): SessionRecord;
     bootstrapSession(name: string, actorId: string, ensureLegacyMembership: boolean): SessionRecord;
+    bootstrapWorkspace(name: string, actorId: string): SessionRecord;
     createSession(name: string): SessionRecord;
     isSessionMember(sessionId: string, actorId: string): boolean;
     linkActor(sessionId: string, requestingActorId: string, actorId: string): "linked" | "already_linked" | "actor_conflict" | "denied";
@@ -144,6 +148,7 @@ export declare class StateStore {
         target?: string;
         secretEnv?: string;
         credentialRef?: string;
+        passwordRef?: string;
         readOnly: boolean;
     }): ProfileRecord;
     updateProfile(input: {
@@ -151,6 +156,7 @@ export declare class StateStore {
         target: string | null;
         secretEnv: string | null;
         credentialRef: string | null;
+        passwordRef: string | null;
         readOnly: boolean;
     }): ProfileRecord | undefined;
     getProfile(name: string): ProfileRecord | undefined;
@@ -165,6 +171,7 @@ export declare class StateStore {
         source: string;
         secretEnv?: string;
         credentialRef?: string;
+        passwordRef?: string;
         readOnly: boolean;
     }): ConnectionRecord | undefined;
     private allocateConnectionAlias;

package/dist/src/store.js

@@ -53,14 +53,22 @@ export class StateStore {
         this.closed = true;
         this.db.close();
     }
-    nextId(prefix) {
-        this.db
-            .prepare("INSERT OR IGNORE INTO counters(prefix, value) VALUES (?, 0)")
-            .run(prefix);
-        const row = this.db
-            .prepare("UPDATE counters SET value = value + 1 WHERE prefix = ? RETURNING value")
-            .get(prefix);
-        return `${prefix}_${row.value}`;
+    randomId(prefix) {
+        return `${prefix}_${randomBase32Id()}`;
+    }
+    insertWithRandomId(prefix, table, insert) {
+        for (let attempt = 0; attempt < 64; attempt++) {
+            const id = this.randomId(prefix);
+            try {
+                insert(id);
+                return id;
+            }
+            catch (error) {
+                if (!isIdCollision(error, table))
+                    throw error;
+            }
+        }
+        throw new Error(`Could not allocate a unique ${prefix} ID.`);
     }
     ensureSession(name = "default") {
         const existing = this.getSessionByName(name);
@@ -87,12 +95,13 @@ export class StateStore {
                 .get(name);
             const created = !row;
             if (!row) {
-                const id = this.nextId("s");
-                this.db
-                    .prepare(`INSERT INTO sessions
-              (id, name, status, created_at, updated_at)
-             VALUES (?, ?, 'active', ?, ?)`)
-                    .run(id, name, timestamp, timestamp);
+                const id = this.insertWithRandomId("s", "sessions", (candidate) => {
+                    this.db
+                        .prepare(`INSERT INTO sessions
+                (id, name, status, created_at, updated_at)
+               VALUES (?, ?, 'active', ?, ?)`)
+                        .run(candidate, name, timestamp, timestamp);
+                });
                 row = { id, status: "active" };
             }
             else if (row.status !== "active") {
@@ -123,6 +132,56 @@ export class StateStore {
             throw error;
         }
     }
+    bootstrapWorkspace(name, actorId) {
+        const timestamp = this.now().toISOString();
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            let row = this.db
+                .prepare("SELECT id, status FROM sessions WHERE name = ? LIMIT 1")
+                .get(name);
+            const identities = actorId === name ? [actorId] : [name, actorId];
+            for (const identity of identities) {
+                const existing = this.resolveActor(identity);
+                if (existing && existing.id !== row?.id) {
+                    throw new StateQLError("PERMISSION_DENIED", `Actor "${identity}" is already attached to workspace "${existing.name}" and cannot be attached to workspace "${name}".`);
+                }
+            }
+            if (!row) {
+                const id = this.insertWithRandomId("s", "sessions", (candidate) => {
+                    this.db
+                        .prepare(`INSERT INTO sessions
+                (id, name, status, created_at, updated_at)
+               VALUES (?, ?, 'active', ?, ?)`)
+                        .run(candidate, name, timestamp, timestamp);
+                });
+                row = { id, status: "active" };
+            }
+            else if (row.status !== "active") {
+                this.db
+                    .prepare(`UPDATE sessions
+             SET status = 'active', updated_at = ?
+             WHERE id = ?`)
+                    .run(timestamp, row.id);
+            }
+            for (const identity of identities) {
+                if (this.isSessionMember(row.id, identity))
+                    continue;
+                this.db
+                    .prepare(`INSERT INTO session_members(session_id, actor_id, attached_at)
+             VALUES (?, ?, ?)`)
+                    .run(row.id, identity, timestamp);
+            }
+            const session = this.getSessionByName(name);
+            if (!session)
+                throw new Error(`Could not open workspace "${name}".`);
+            this.db.exec("COMMIT");
+            return session;
+        }
+        catch (error) {
+            this.db.exec("ROLLBACK");
+            throw error;
+        }
+    }
     createSession(name) {
         return this.bootstrapSession(name, name, true);
     }
@@ -238,15 +297,15 @@ export class StateStore {
         const timestamp = this.now().toISOString();
         this.db
             .prepare(`INSERT INTO profiles
-          (name, target, secret_env, credential_ref, read_only, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`)
-            .run(input.name, input.target ?? null, input.secretEnv ?? null, input.credentialRef ?? null, input.readOnly ? 1 : 0, timestamp, timestamp);
+          (name, target, secret_env, credential_ref, password_ref, read_only, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(input.name, input.target ?? null, input.secretEnv ?? null, input.credentialRef ?? null, input.passwordRef ?? null, input.readOnly ? 1 : 0, timestamp, timestamp);
         return this.getProfile(input.name);
     }
     updateProfile(input) {
         const result = this.db.prepare(`UPDATE profiles
-       SET target = ?, secret_env = ?, credential_ref = ?, read_only = ?, updated_at = ?
-       WHERE name = ?`).run(input.target, input.secretEnv, input.credentialRef, input.readOnly ? 1 : 0, this.now().toISOString(), input.name);
+       SET target = ?, secret_env = ?, credential_ref = ?, password_ref = ?, read_only = ?, updated_at = ?
+       WHERE name = ?`).run(input.target, input.secretEnv, input.credentialRef, input.passwordRef, input.readOnly ? 1 : 0, this.now().toISOString(), input.name);
         return Number(result.changes) === 1 ? this.getProfile(input.name) : undefined;
     }
     getProfile(name) {
@@ -278,14 +337,15 @@ export class StateStore {
                 this.db.exec("COMMIT");
                 return undefined;
             }
-            const id = this.nextId("conn");
             const timestamp = this.now().toISOString();
-            this.db
-                .prepare(`INSERT INTO connections
-            (id, session_id, name, driver, database_name, source, secret_env,
-             credential_ref, read_only, version, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?)`)
-                .run(id, input.sessionId, input.name, input.driver, input.databaseName, input.source, input.secretEnv ?? null, input.credentialRef ?? null, input.readOnly ? 1 : 0, timestamp);
+            const id = this.insertWithRandomId("conn", "connections", (candidate) => {
+                this.db
+                    .prepare(`INSERT INTO connections
+              (id, session_id, name, driver, database_name, source, secret_env,
+               credential_ref, password_ref, read_only, version, created_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?)`)
+                    .run(candidate, input.sessionId, input.name, input.driver, input.databaseName, input.source, input.secretEnv ?? null, input.credentialRef ?? null, input.passwordRef ?? null, input.readOnly ? 1 : 0, timestamp);
+            });
             this.allocateConnectionAlias(id);
             this.db
                 .prepare(`UPDATE sessions
@@ -362,16 +422,17 @@ export class StateStore {
         return `sv_${row.version}`;
     }
     saveResult(input) {
-        const id = this.nextId("q");
         this.db.exec("BEGIN IMMEDIATE");
         try {
-            this.db
-                .prepare(`INSERT INTO results
-            (id, session_id, connection_id, fingerprint, sql, parameters,
-             rows_json, columns_json, row_count, state_version, state_signature,
-             state_confidence, expires_at, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(id, input.sessionId, input.connectionId, input.fingerprint, input.sql, JSON.stringify(toJsonSafe(input.parameters)), JSON.stringify(toJsonSafe(input.rows)), JSON.stringify(input.columns), input.rows.length, input.stateVersion, input.stateSignature, input.stateConfidence, input.expiresAt, this.now().toISOString());
+            const id = this.insertWithRandomId("q", "results", (candidate) => {
+                this.db
+                    .prepare(`INSERT INTO results
+              (id, session_id, connection_id, fingerprint, sql, parameters,
+               rows_json, columns_json, row_count, state_version, state_signature,
+               state_confidence, expires_at, created_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(candidate, input.sessionId, input.connectionId, input.fingerprint, input.sql, JSON.stringify(toJsonSafe(input.parameters)), JSON.stringify(toJsonSafe(input.rows)), JSON.stringify(input.columns), input.rows.length, input.stateVersion, input.stateSignature, input.stateConfidence, input.expiresAt, this.now().toISOString());
+            });
             this.enforceResultQuota(id);
             this.allocateGeneratedAlias(input.sessionId, id);
             const result = this.getResult(id);
@@ -466,14 +527,15 @@ export class StateStore {
         }
     }
     saveOperation(input) {
-        const id = this.nextId("op");
-        this.db
-            .prepare(`INSERT INTO operations
-          (id, session_id, actor_id, connection_id, fingerprint, sql, parameters,
-           statement_type, affected_rows, status, transaction_id, replay_of,
-           idempotency_key, state_version_before, state_version_after, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(id, input.sessionId, input.actorId, input.connectionId, input.fingerprint, input.sql, JSON.stringify(toJsonSafe(input.parameters)), input.statementType, input.affectedRows ?? null, input.status, input.transactionId ?? null, input.replayOf ?? null, input.idempotencyKey ?? null, input.stateVersionBefore, input.stateVersionAfter ?? null, this.now().toISOString());
+        const id = this.insertWithRandomId("op", "operations", (candidate) => {
+            this.db
+                .prepare(`INSERT INTO operations
+            (id, session_id, actor_id, connection_id, fingerprint, sql, parameters,
+             statement_type, affected_rows, status, transaction_id, replay_of,
+             idempotency_key, state_version_before, state_version_after, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(candidate, input.sessionId, input.actorId, input.connectionId, input.fingerprint, input.sql, JSON.stringify(toJsonSafe(input.parameters)), input.statementType, input.affectedRows ?? null, input.status, input.transactionId ?? null, input.replayOf ?? null, input.idempotencyKey ?? null, input.stateVersionBefore, input.stateVersionAfter ?? null, this.now().toISOString());
+        });
         return this.getOperation(id);
     }
     getOperation(id) {
@@ -584,7 +646,6 @@ export class StateStore {
             .run(operationId);
     }
     createTransaction(input) {
-        const id = this.nextId("tx");
         const timestamp = this.now().toISOString();
         this.db.exec("BEGIN IMMEDIATE");
         try {
@@ -604,12 +665,14 @@ export class StateStore {
                 this.db.exec("COMMIT");
                 return undefined;
             }
-            this.db
-                .prepare(`INSERT INTO transactions
-            (id, session_id, owner_actor_id, connection_id, state,
-             isolation_level, start_version, created_at)
-           VALUES (?, ?, ?, ?, 'active', ?, ?, ?)`)
-                .run(id, input.sessionId, input.actorId, input.connectionId, input.isolation, `sv_${eligible.version}`, timestamp);
+            const id = this.insertWithRandomId("tx", "transactions", (candidate) => {
+                this.db
+                    .prepare(`INSERT INTO transactions
+              (id, session_id, owner_actor_id, connection_id, state,
+               isolation_level, start_version, created_at)
+             VALUES (?, ?, ?, ?, 'active', ?, ?, ?)`)
+                    .run(candidate, input.sessionId, input.actorId, input.connectionId, input.isolation, `sv_${eligible.version}`, timestamp);
+            });
             this.db
                 .prepare(`UPDATE sessions
            SET active_transaction_id = ?, updated_at = ?
@@ -630,7 +693,7 @@ export class StateStore {
     }
     transactionOperations(transactionId) {
         return this.db
-            .prepare("SELECT * FROM operations WHERE transaction_id = ? ORDER BY created_at")
+            .prepare("SELECT * FROM operations WHERE transaction_id = ? ORDER BY created_at, rowid")
             .all(transactionId);
     }
     validatedTransactionOperations(transactionId) {
@@ -804,14 +867,15 @@ export class StateStore {
         }
     }
     savePlan(input) {
-        const id = this.nextId("p");
-        this.db
-            .prepare(`INSERT INTO plans
-          (id, session_id, owner_actor_id, connection_id, sql, parameters,
-           statement_type, state_version, state_signature, destructive,
-           allow_unbounded, allow_destructive, expires_at, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(id, input.sessionId, input.ownerActorId, input.connectionId, input.sql, JSON.stringify(toJsonSafe(input.parameters)), input.statementType, input.stateVersion, input.stateSignature, input.destructive ? 1 : 0, input.allowUnbounded ? 1 : 0, input.allowDestructive ? 1 : 0, input.expiresAt, this.now().toISOString());
+        const id = this.insertWithRandomId("p", "plans", (candidate) => {
+            this.db
+                .prepare(`INSERT INTO plans
+            (id, session_id, owner_actor_id, connection_id, sql, parameters,
+             statement_type, state_version, state_signature, destructive,
+             allow_unbounded, allow_destructive, expires_at, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(candidate, input.sessionId, input.ownerActorId, input.connectionId, input.sql, JSON.stringify(toJsonSafe(input.parameters)), input.statementType, input.stateVersion, input.stateSignature, input.destructive ? 1 : 0, input.allowUnbounded ? 1 : 0, input.allowDestructive ? 1 : 0, input.expiresAt, this.now().toISOString());
+        });
         return this.getPlan(id);
     }
     getPlan(id) {
@@ -876,13 +940,17 @@ export class StateStore {
         }
     }
     addHistory(input) {
-        const id = input.id ?? this.nextId("cmd");
-        this.db
-            .prepare(`INSERT INTO history
-          (id, timestamp, session_id, actor_id, origin, category, internal, command, sql, target, handle,
-           executed, cached, success, error_code)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(id, this.now().toISOString(), input.sessionId, input.actorId, input.origin ?? "legacy", input.category ?? "management", input.internal ? 1 : 0, input.command, boundedHistorySql(input.sql), input.target?.slice(0, 1024) ?? null, input.handle ?? null, input.executed ? 1 : 0, input.cached ? 1 : 0, input.success ? 1 : 0, input.errorCode ?? null);
+        const insert = (id) => {
+            this.db
+                .prepare(`INSERT INTO history
+            (id, timestamp, session_id, actor_id, origin, category, internal, command, sql, target, handle,
+             executed, cached, success, error_code)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(id, this.now().toISOString(), input.sessionId, input.actorId, input.origin ?? "legacy", input.category ?? "management", input.internal ? 1 : 0, input.command, boundedHistorySql(input.sql), input.target?.slice(0, 1024) ?? null, input.handle ?? null, input.executed ? 1 : 0, input.cached ? 1 : 0, input.success ? 1 : 0, input.errorCode ?? null);
+        };
+        const id = input.id ?? this.insertWithRandomId("cmd", "history", insert);
+        if (input.id !== undefined)
+            insert(id);
         this.db
             .prepare(`DELETE FROM history
          WHERE rowid IN (
@@ -1120,8 +1188,18 @@ function outcomeJson(outcome) {
     return outcome === undefined ? null : JSON.stringify(toJsonSafe(outcome));
 }
 function randomBase32Alias() {
+    return randomBase32(10);
+}
+function randomBase32Id() {
+    return randomBase32(26);
+}
+function randomBase32(length) {
     const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
-    return [...randomBytes(10)].map((value) => alphabet[value & 31]).join("");
+    return [...randomBytes(length)].map((value) => alphabet[value & 31]).join("");
+}
+function isIdCollision(error, table) {
+    return error instanceof Error &&
+        error.message.includes(`UNIQUE constraint failed: ${table}.id`);
 }
 function boundedHistorySql(sql) {
     if (sql === undefined)

package/dist/src/types.d.ts

@@ -11,7 +11,7 @@ export interface CommandExecutionContext {
 }
 export type CredentialAccess = "read" | "write";
 export type CredentialOperation = "connect" | "query" | "inspect" | "plan" | "exec" | "apply" | "transaction.commit";
-export type CredentialSource = "secret_env" | "credential_ref";
+export type CredentialSource = "secret_env" | "credential_ref" | "password_ref";
 interface CredentialRequestBase {
     reference: string;
     actorId: string;
@@ -39,6 +39,9 @@ export type CredentialRequest = CredentialRequestBase & ({
     source?: "secret_env";
 } | {
     source: "credential_ref";
+} | {
+    source: "password_ref";
+    target: string;
 });
 export type CredentialResolver = (request: CredentialRequest) => string | undefined | Promise<string | undefined>;
 export type StateConfidence = "authoritative" | "transaction_snapshot" | "database_reported" | "local" | "ttl_based" | "unknown";
@@ -271,6 +274,10 @@ export interface StateQLOptions extends ExecutionOptions {
 export type StateQLActorOptions = Omit<StateQLOptions, "session" | "actor"> & {
     actor: string;
 };
+/** Trusted-host options for opening one actor in a named shared workspace. */
+export type StateQLWorkspaceOptions = StateQLActorOptions & {
+    workspace: string;
+};
 export interface QueryOptions extends ExecutionOptions {
     params?: SqlParameters;
     cache?: "auto" | "bypass" | "require";
@@ -300,16 +307,19 @@ export interface ConnectOptions extends ExecutionOptions {
     secretEnv?: string;
     profile?: string;
     credentialRef?: string;
+    passwordRef?: string;
 }
 export interface ProfileOptions {
     readOnly?: boolean;
     secretEnv?: string;
     credentialRef?: string;
+    passwordRef?: string;
 }
 export interface ProfileUpdateOptions {
     target?: string | null;
     secretEnv?: string | null;
     credentialRef?: string | null;
+    passwordRef?: string | null;
     readOnly?: boolean;
 }
 export interface RedisQueryOptions extends ExecutionOptions {
@@ -353,6 +363,7 @@ export interface BatchCommand {
     read_only?: boolean;
     secret_env?: string;
     credential_ref?: string;
+    password_ref?: string | null;
     profile?: string;
     replay?: boolean;
     idempotency_key?: string;
@@ -398,6 +409,7 @@ export interface ProfileData {
     target: string | null;
     secret_env: string | null;
     credential_ref: string | null;
+    password_ref: string | null;
     read_only: boolean;
 }
 export interface ProfilesData {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fadhilp/stateql",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "description": "Stateful, agent-oriented database CLI for safe result reuse",
   "repository": {
     "type": "git",