@sdods/db 0.9.0 → 0.11.1

package/dist/ingest/finalize.d.ts

@@ -1,4 +1,4 @@
-import type { RunTotals } from '@sdods/contracts/types';
+import type { GateResult, RunTotals } from '@sdods/contracts/types';
 import type { SdodsDb } from '../create-db.js';
 export interface LocatorCounter {
     fails: number;
@@ -25,4 +25,21 @@ export declare function finalizeRun(input: FinalizeInput): Promise<{
     totals: RunTotals;
     status: string;
 }>;
+/** The gate verdict the CLI wrote into a run directory (`gates.json`), when there is one. */
+export declare function readGateVerdict(runDir: string): GateResult | undefined;
+/** `value` when it has the shape of a gate verdict. */
+export declare function gateResultOf(value: unknown): GateResult | undefined;
+/**
+ * Records a process gate verdict on the run row: under `totals_json.gates`, and — when a gate failed
+ * — as the run's status, exit code and error. A run whose scenarios all passed and whose gates did
+ * not is a failed run; leaving it `passed` is exactly the claim the gate exists to stop. Used by
+ * ingest (CLI runs, merged shards) and by the server's run manager, so both record it the same way.
+ * Returns the run's status afterwards.
+ */
+export declare function recordGateVerdict(adb: SdodsDb, input: {
+    runId: string;
+    gates: GateResult;
+    cancelled?: boolean;
+    exitCode?: number | null;
+}): Promise<string | undefined>;
 //# sourceMappingURL=finalize.d.ts.map

package/dist/ingest/finalize.js

@@ -1,3 +1,6 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runFiles } from '@sdods/contracts/names';
 import { enc, nowIso, readBool, readJson, readTs } from '../col.js';
 import { bumpLocatorStats, recomputeFlakyStats } from '../repos/improvement.js';
 import { emptyTotals } from './types.js';
@@ -129,4 +132,68 @@ export async function finalizeRun(input) {
     void readBool;
     return { totals, status };
 }
+/** The gate verdict the CLI wrote into a run directory (`gates.json`), when there is one. */
+export function readGateVerdict(runDir) {
+    const file = join(runDir, runFiles.gates);
+    if (!existsSync(file))
+        return undefined;
+    try {
+        return gateResultOf(JSON.parse(readFileSync(file, 'utf8')));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `value` when it has the shape of a gate verdict. */
+export function gateResultOf(value) {
+    const v = value;
+    return v && typeof v === 'object' && typeof v.process === 'string' && Array.isArray(v.rows)
+        ? v
+        : undefined;
+}
+const GATE_ERROR_PREFIX = 'GATE_FAILED:';
+/**
+ * Records a process gate verdict on the run row: under `totals_json.gates`, and — when a gate failed
+ * — as the run's status, exit code and error. A run whose scenarios all passed and whose gates did
+ * not is a failed run; leaving it `passed` is exactly the claim the gate exists to stop. Used by
+ * ingest (CLI runs, merged shards) and by the server's run manager, so both record it the same way.
+ * Returns the run's status afterwards.
+ */
+export async function recordGateVerdict(adb, input) {
+    const { db } = adb;
+    const { runId, gates } = input;
+    const row = await db
+        .selectFrom('runs')
+        .select(['status', 'totals_json', 'exit_code', 'error_text'])
+        .where('id', '=', runId)
+        .executeTakeFirst();
+    if (!row)
+        return undefined;
+    const prev = readJson(row.totals_json) ?? {};
+    const cancelled = input.cancelled || row.status === 'cancelled';
+    const failed = gates.rows.filter((r) => !r.passed);
+    const breached = !gates.passed && !cancelled;
+    const status = breached ? 'failed' : row.status;
+    const staleGateError = !breached && row.error_text?.startsWith(GATE_ERROR_PREFIX);
+    await db
+        .updateTable('runs')
+        .set({
+        totals_json: enc.json({ ...prev, gates }),
+        status,
+        ...(breached
+            ? {
+                exit_code: input.exitCode || row.exit_code || 1,
+                error_text: `${GATE_ERROR_PREFIX} process "${gates.process}" did not meet ${failed
+                    .map((r) => `${r.gate} (${r.actual}, needs ${r.threshold})`)
+                    .join('; ')}`,
+            }
+            : staleGateError
+                ? { error_text: null }
+                : {}),
+        updated_at: nowIso(),
+    })
+        .where('id', '=', runId)
+        .execute();
+    return status;
+}
 //# sourceMappingURL=finalize.js.map

package/dist/ingest/index.js

@@ -5,7 +5,7 @@ import { readJson } from '../col.js';
 import { ensureProject, getProjectBySlug } from '../repos/projects.js';
 import { deleteRunChildren, upsertRun } from '../repos/runs.js';
 import { IngestSession } from './cucumber-ingest.js';
-import { finalizeRun } from './finalize.js';
+import { finalizeRun, gateResultOf, readGateVerdict, recordGateVerdict, } from './finalize.js';
 import { fileSha256, parseNdjson } from './parse-ndjson.js';
 import { ingestRunnerJson } from './runner-json-ingest.js';
 export * from './types.js';
@@ -165,7 +165,7 @@ export async function ingestRun(adb, opts) {
             runFinishedAt = r.finishedAt;
         filesIngested.push(key);
     }
-    const { totals, status } = await finalizeRun({
+    const finalized = await finalizeRun({
         adb,
         runId: opts.runId,
         projectId: project.id,
@@ -175,11 +175,31 @@ export async function ingestRun(adb, opts) {
         ingestedFiles: filesIngested,
         exitCode: manifest?.exitCode ?? null,
     });
+    const { totals } = finalized;
+    let { status } = finalized;
+    // The same verdict a server-started run gets: CLI runs and merged shards look alike in the DB.
+    // A re-ingest with nothing to judge keeps the verdict already recorded, rather than resetting the
+    // run to the status its scenarios alone would give it.
+    const gates = opts.gates === null
+        ? undefined
+        : typeof opts.gates === 'object'
+            ? opts.gates
+            : (readGateVerdict(runDir) ??
+                (typeof opts.gates === 'function' ? opts.gates(totals) : undefined) ??
+                gateResultOf(prevTotals.gates));
+    if (gates)
+        status =
+            (await recordGateVerdict(adb, {
+                runId: opts.runId,
+                gates,
+                exitCode: manifest?.exitCode ?? null,
+            })) ?? status;
     return {
         runId: opts.runId,
         projectSlug,
         totals,
         status,
+        gates,
         scenarios: counts.scenarios,
         attempts: counts.attempts,
         steps: counts.steps,

package/dist/ingest/types.d.ts

@@ -1,4 +1,4 @@
-import type { RunManifest, RunTotals, SuiteStatus } from '@sdods/contracts/types';
+import type { GateResult, RunManifest, RunTotals, SuiteStatus } from '@sdods/contracts/types';
 import type { SdodsDb } from '../create-db.js';
 export type { RunManifest, RunTotals, SuiteStatus };
 export interface IngestRunOptions {
@@ -14,12 +14,22 @@ export interface IngestRunOptions {
     /** git/ci/trigger overrides when there is no manifest */
     trigger?: string;
     env?: string;
+    /**
+     * The process gate verdict to record on the run. The `gates.json` the CLI wrote into the run
+     * directory (`sdods run --process`, `sdods report merge --process`) wins; without one, a function
+     * here judges the gates over the totals ingest computed (the database cannot evaluate them
+     * itself: the judge lives in core, which depends on this package); failing that, the verdict
+     * already recorded on the run is kept. A `GateResult` records that verdict; `null` records none.
+     */
+    gates?: GateResult | null | ((totals: RunTotals) => GateResult | undefined);
 }
 export interface IngestResult {
     runId: string;
     projectSlug: string;
     totals: RunTotals;
     status: string;
+    /** The process gate verdict recorded on the run, when there was one. */
+    gates?: GateResult;
     scenarios: number;
     attempts: number;
     steps: number;

package/dist/migrations/0009_user_profile.d.ts

@@ -0,0 +1,9 @@
+import type { Kysely } from 'kysely';
+import type { Col } from '../col.js';
+/**
+ * Self-service profile: a free-text display name next to the immutable username. Nullable, so
+ * existing users keep showing their username until they set one.
+ */
+export declare function up(db: Kysely<any>, c: Col): Promise<void>;
+export declare function down(db: Kysely<any>, _c: Col): Promise<void>;
+//# sourceMappingURL=0009_user_profile.d.ts.map

package/dist/migrations/0009_user_profile.js

@@ -0,0 +1,11 @@
+/**
+ * Self-service profile: a free-text display name next to the immutable username. Nullable, so
+ * existing users keep showing their username until they set one.
+ */
+export async function up(db, c) {
+    await db.schema.alterTable('users').addColumn('display_name', c.text).execute();
+}
+export async function down(db, _c) {
+    await db.schema.alterTable('users').dropColumn('display_name').execute();
+}
+//# sourceMappingURL=0009_user_profile.js.map

package/dist/migrations/index.js

@@ -6,6 +6,7 @@ import * as m0005 from './0005_integrations_agents_audit.js';
 import * as m0006 from './0006_schedules.js';
 import * as m0007 from './0007_hierarchy.js';
 import * as m0008 from './0008_runner_naming.js';
+import * as m0009 from './0009_user_profile.js';
 /**
  * Static registry (bundler-friendly, no runtime file discovery). Order matters: Kysely sorts by key.
  */
@@ -18,5 +19,6 @@ export const MIGRATIONS = {
     '0006_schedules': m0006,
     '0007_hierarchy': m0007,
     '0008_runner_naming': m0008,
+    '0009_user_profile': m0009,
 };
 //# sourceMappingURL=index.js.map

package/dist/repos/auth.d.ts

@@ -16,6 +16,7 @@ export declare function getUserByUsername(db: Kysely<Database>, username: string
     id: string;
     username: string;
     email: string | null;
+    displayName: string | null;
     passwordHash: string;
     role: Role;
     active: boolean;
@@ -27,6 +28,7 @@ export declare function getUserById(db: Kysely<Database>, id: string): Promise<{
     id: string;
     username: string;
     email: string | null;
+    displayName: string | null;
     passwordHash: string;
     role: Role;
     active: boolean;
@@ -38,6 +40,7 @@ export declare function listUsers(db: Kysely<Database>): Promise<{
     id: string;
     username: string;
     email: string | null;
+    displayName: string | null;
     passwordHash: string;
     role: Role;
     active: boolean;
@@ -50,6 +53,7 @@ export declare function updateUser(db: Kysely<Database>, driver: Driver, id: str
     role?: Role;
     active?: boolean;
     email?: string | null;
+    displayName?: string | null;
     lastLoginAt?: string;
 }): Promise<void>;
 export declare function countUsers(db: Kysely<Database>): Promise<number>;
@@ -79,8 +83,28 @@ export declare function getSession(db: Kysely<Database>, token: string): Promise
 } | null>;
 export declare function touchSession(db: Kysely<Database>, token: string, ttlMs: number): Promise<void>;
 export declare function deleteSession(db: Kysely<Database>, token: string): Promise<void>;
-/** Sign a user out everywhere, e.g. after their password changes. */
-export declare function deleteSessionsForUser(db: Kysely<Database>, userId: string): Promise<void>;
+/**
+ * Sign a user out everywhere, e.g. after their password changes. `exceptToken` keeps the session
+ * that made the change, so saving a new password does not also sign out the person saving it.
+ * Returns how many sessions were removed.
+ */
+export declare function deleteSessionsForUser(db: Kysely<Database>, userId: string, opts?: {
+    exceptToken?: string;
+}): Promise<number>;
+/**
+ * A user's live sessions, newest activity first. `id` is the stored hash of the cookie token,
+ * never the token itself, so listing sessions cannot be used to take one over.
+ */
+export declare function listSessionsForUser(db: Kysely<Database>, userId: string): Promise<{
+    id: string;
+    ip: string | null;
+    userAgent: string | null;
+    createdAt: string;
+    lastSeenAt: string;
+    expiresAt: string;
+}[]>;
+/** Revoke one of a user's sessions by its listed id. False when it is not theirs or already gone. */
+export declare function deleteSessionById(db: Kysely<Database>, userId: string, id: string): Promise<boolean>;
 export declare function purgeExpiredSessions(db: Kysely<Database>): Promise<void>;
 export declare function createApiToken(db: Kysely<Database>, input: {
     userId: string;

package/dist/repos/auth.js

@@ -33,6 +33,7 @@ export async function createUser(db, driver, input) {
         id,
         username: input.username,
         email: input.email ?? null,
+        display_name: null,
         password_hash: input.passwordHash,
         role_id: roles[input.role],
         active: enc.bool(driver, true),
@@ -84,6 +85,7 @@ export async function updateUser(db, driver, id, patch) {
         ...(roles && patch.role ? { role_id: roles[patch.role] } : {}),
         ...(patch.active !== undefined ? { active: enc.bool(driver, patch.active) } : {}),
         ...(patch.email !== undefined ? { email: patch.email } : {}),
+        ...(patch.displayName !== undefined ? { display_name: patch.displayName } : {}),
         ...(patch.lastLoginAt ? { last_login_at: patch.lastLoginAt } : {}),
         updated_at: nowIso(),
     })
@@ -119,6 +121,7 @@ function mapUser(row) {
         id: row.id,
         username: row.username,
         email: row.email,
+        displayName: (row.display_name ?? null),
         passwordHash: row.password_hash,
         role: row.role,
         active: readBool(row.active),
@@ -178,9 +181,47 @@ export async function touchSession(db, token, ttlMs) {
 export async function deleteSession(db, token) {
     await db.deleteFrom('sessions').where('id', '=', hashToken(token)).execute();
 }
-/** Sign a user out everywhere, e.g. after their password changes. */
-export async function deleteSessionsForUser(db, userId) {
-    await db.deleteFrom('sessions').where('user_id', '=', userId).execute();
+/**
+ * Sign a user out everywhere, e.g. after their password changes. `exceptToken` keeps the session
+ * that made the change, so saving a new password does not also sign out the person saving it.
+ * Returns how many sessions were removed.
+ */
+export async function deleteSessionsForUser(db, userId, opts = {}) {
+    let q = db.deleteFrom('sessions').where('user_id', '=', userId);
+    if (opts.exceptToken)
+        q = q.where('id', '!=', hashToken(opts.exceptToken));
+    const res = await q.executeTakeFirst();
+    return Number(res?.numDeletedRows ?? 0);
+}
+/**
+ * A user's live sessions, newest activity first. `id` is the stored hash of the cookie token,
+ * never the token itself, so listing sessions cannot be used to take one over.
+ */
+export async function listSessionsForUser(db, userId) {
+    const rows = await db
+        .selectFrom('sessions')
+        .selectAll()
+        .where('user_id', '=', userId)
+        .where('expires_at', '>', nowIso())
+        .orderBy('last_seen_at', 'desc')
+        .execute();
+    return rows.map((r) => ({
+        id: r.id,
+        ip: r.ip,
+        userAgent: r.user_agent,
+        createdAt: readTs(r.created_at),
+        lastSeenAt: readTs(r.last_seen_at),
+        expiresAt: readTs(r.expires_at),
+    }));
+}
+/** Revoke one of a user's sessions by its listed id. False when it is not theirs or already gone. */
+export async function deleteSessionById(db, userId, id) {
+    const res = await db
+        .deleteFrom('sessions')
+        .where('id', '=', id)
+        .where('user_id', '=', userId)
+        .executeTakeFirst();
+    return Number(res?.numDeletedRows ?? 0) > 0;
 }
 export async function purgeExpiredSessions(db) {
     await db.deleteFrom('sessions').where('expires_at', '<', nowIso()).execute();

package/dist/repos/runs.js

@@ -1,5 +1,6 @@
 import { enc, nowIso, readBool, readJson, readTs } from '../col.js';
 import { newId } from '../ids.js';
+import { gateResultOf } from '../ingest/finalize.js';
 export async function upsertRun(db, _driver, r) {
     const existing = await db
         .selectFrom('runs')
@@ -116,6 +117,7 @@ export function mapRun(row) {
         finishedAt: readTs(row.finished_at) ?? undefined,
         durationMs: row.duration_ms ?? undefined,
         totals,
+        gates: gateResultOf(totalsRaw.gates),
         totalsRaw,
         artifactsDir: row.artifacts_dir ?? undefined,
         exitCode: row.exit_code ?? undefined,

package/dist/schema.d.ts

@@ -337,6 +337,7 @@ export interface UsersTable {
     id: string;
     username: string;
     email: string | null;
+    display_name: string | null;
     password_hash: string;
     role_id: string;
     active: Bool;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdods/db",
-  "version": "0.9.0",
+  "version": "0.11.1",
   "description": "SDODS platform database: one schema on SQLite or Postgres, migrations, result ingest and insights.",
   "license": "Apache-2.0",
   "author": "SDODS <admin@sdods.com>",
@@ -23,19 +23,19 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@sdods/contracts": "0.9.0",
+    "@sdods/contracts": "0.11.1",
     "better-sqlite3": "^13.0.3",
     "kysely": "^0.29.5",
     "pg": "^8.23.0",
-    "zod": "^4.5.4"
+    "zod": "^4.6.5"
   },
   "homepage": "https://sdods.com",
   "bugs": {
-    "url": "https://github.com/siri1410/SDODS/issues"
+    "url": "https://github.com/YarlisAISolutions/SDODS/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/siri1410/SDODS.git",
+    "url": "git+https://github.com/YarlisAISolutions/SDODS.git",
     "directory": "packages/db"
   },
   "keywords": [