@fadhilp/stateql 0.8.0 → 0.8.1

package/README.md

@@ -415,6 +415,7 @@ const stateql = StateQL.forActor({
   home: "./.stql",
   actor: "pi-session-id",
   timeoutMs: 30_000,
+  credentialTimeoutMs: 120_000,
   maxResultBytes: 16 * 1024 * 1024,
   maxStateBytes: 256 * 1024 * 1024,
 });
@@ -506,6 +507,10 @@ const stateql = StateQL.forActor({
 });
 ```
 
+Credential resolution has its own two-minute default deadline
+(`credentialTimeoutMs`) and remains cancellable through `request.signal`.
+The database-operation timeout begins after a credential is resolved.
+
 When no custom resolver is configured, StateQL reads only `secret_env`
 references from `process.env`; `credential_ref` never falls back to the
 environment. A configured resolver is authoritative for both sources: returning

package/dist/src/adapters.d.ts

@@ -9,6 +9,7 @@ export interface WriteResult {
 }
 export interface AdapterContext {
     deadline: number;
+    timeoutMs?: number;
     signal?: AbortSignal;
 }
 export declare class AdapterExecutionError extends Error {

package/dist/src/adapters.js

@@ -32,6 +32,7 @@ export class AdapterWriteError extends Error {
 export function createAdapterContext(timeoutMs, signal) {
     return {
         deadline: Date.now() + timeoutMs,
+        timeoutMs,
         ...(signal ? { signal } : {}),
     };
 }

package/dist/src/stateql.d.ts

@@ -11,6 +11,7 @@ export declare class StateQL {
     private readonly maxResultRows;
     private readonly maxResultBytes;
     private readonly timeoutMs;
+    private readonly credentialTimeoutMs;
     private readonly signal?;
     private readonly commandContexts;
     private readonly credentialResolver?;

package/dist/src/stateql.js

@@ -13,6 +13,7 @@ import { StateStore, } from "./store.js";
 import { compactRows, defaultHome, hash, isSqlParameters, parseJson, redact, } from "./util.js";
 const DEFAULT_SNAPSHOT_HISTORY_LIMIT = 50;
 const MAX_SNAPSHOT_HISTORY_LIMIT = 100;
+const DEFAULT_CREDENTIAL_RESOLUTION_TIMEOUT_MS = 120_000;
 export class StateQL {
     static forActor(options) {
         if (!options.actor.trim()) {
@@ -41,6 +42,7 @@ export class StateQL {
     maxResultRows;
     maxResultBytes;
     timeoutMs;
+    credentialTimeoutMs;
     signal;
     commandContexts = new AsyncLocalStorage();
     credentialResolver;
@@ -60,6 +62,7 @@ export class StateQL {
         this.maxResultRows = positiveInteger(options.maxResultRows ?? 10_000, "maxResultRows");
         this.maxResultBytes = positiveInteger(options.maxResultBytes ?? 16 * 1024 * 1024, "maxResultBytes");
         this.timeoutMs = executionTimeout(options.timeoutMs ?? 30_000);
+        this.credentialTimeoutMs = executionTimeout(options.credentialTimeoutMs ?? DEFAULT_CREDENTIAL_RESOLUTION_TIMEOUT_MS, "credentialTimeoutMs");
         const maxStateBytes = positiveInteger(options.maxStateBytes ?? 256 * 1024 * 1024, "maxStateBytes");
         this.signal = options.signal;
         this.credentialResolver = options.credentialResolver;
@@ -2067,39 +2070,41 @@ export class StateQL {
     }
     async resolveCredential(reference, source, session, operation, access, context, details = {}) {
         const resolver = this.credentialResolver;
+        const credentialContext = createAdapterContext(this.credentialTimeoutMs, context.signal);
+        let value;
         if (!resolver) {
-            if (context.signal?.aborted) {
+            if (credentialContext.signal?.aborted) {
                 throw credentialStateQLError(reference, new CredentialResolutionError("cancelled"));
             }
-            if (context.deadline <= Date.now()) {
+            if (credentialContext.deadline <= Date.now()) {
                 throw credentialStateQLError(reference, new CredentialResolutionError("timeout"));
             }
-            if (source === "secret_env") {
-                const value = env[reference];
-                if (value)
-                    return value;
-            }
-            throw credentialStateQLError(reference, new CredentialResolutionError("unavailable"));
+            if (source === "secret_env")
+                value = env[reference];
         }
-        const request = {
-            reference,
-            source,
-            actorId: this.actorId,
-            session: { id: session.id, name: session.name },
-            operation,
-            access,
-            ...(context.signal ? { signal: context.signal } : {}),
-            ...details,
-        };
-        try {
-            const value = await resolveCredentialBeforeDeadline(resolver, request, context);
-            if (!value)
-                throw new CredentialResolutionError("unavailable");
-            return value;
+        else {
+            const request = {
+                reference,
+                source,
+                actorId: this.actorId,
+                session: { id: session.id, name: session.name },
+                operation,
+                access,
+                ...(context.signal ? { signal: context.signal } : {}),
+                ...details,
+            };
+            try {
+                value = await resolveCredentialBeforeDeadline(resolver, request, credentialContext);
+            }
+            catch (error) {
+                throw credentialStateQLError(reference, error);
+            }
         }
-        catch (error) {
-            throw credentialStateQLError(reference, error);
+        if (!value) {
+            throw credentialStateQLError(reference, new CredentialResolutionError("unavailable"));
         }
+        context.deadline = Date.now() + (context.timeoutMs ?? this.timeoutMs);
+        return value;
     }
     async openAdapter(connection, context, source) {
         try {
@@ -2435,19 +2440,19 @@ function credentialStateQLError(reference, error) {
             case "cancelled":
                 return new StateQLError("OPERATION_CANCELLED", "Credential resolution was cancelled.", { retryable: true });
             case "timeout":
-                return new StateQLError("DEADLINE_EXCEEDED", "Credential resolution exceeded the operation deadline.", { retryable: true });
+                return new StateQLError("DEADLINE_EXCEEDED", "Credential resolution exceeded the credential deadline.", { retryable: true });
         }
     }
     return new StateQLError("CREDENTIAL_RESOLUTION_FAILED", `Credential reference "${reference}" could not be resolved.`, { retryable: true });
 }
 function safeCredentialErrorMessage(error, source) {
     return redact(errorMessage(error).split(source).join("[credential redacted]"))
-        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+(?::[^\s/@]*)?@/giu, "$1***@");
+        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s\/@]+(?::[^\s\/@]*)?@/giu, "$1***@");
 }
-function executionTimeout(value) {
-    const timeout = positiveInteger(value, "timeoutMs");
+function executionTimeout(value, name = "timeoutMs") {
+    const timeout = positiveInteger(value, name);
     if (timeout > 2_147_483_647) {
-        throw new StateQLError("INVALID_COMMAND", "timeoutMs cannot exceed 2147483647 milliseconds.");
+        throw new StateQLError("INVALID_COMMAND", `${name} cannot exceed 2147483647 milliseconds.`);
     }
     return timeout;
 }

package/dist/src/types.d.ts

@@ -213,6 +213,8 @@ export interface StateQLOptions extends ExecutionOptions {
     maxResultBytes?: number;
     maxStateBytes?: number;
     credentialResolver?: CredentialResolver;
+    /** Maximum time allowed for one credential resolution; defaults to two minutes. */
+    credentialTimeoutMs?: number;
     now?: () => Date;
 }
 export type StateQLActorOptions = Omit<StateQLOptions, "session" | "actor"> & {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fadhilp/stateql",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Stateful, agent-oriented database CLI for safe result reuse",
   "repository": {
     "type": "git",