or3-provider-sqlite 0.0.1 → 0.0.3

package/README.md

@@ -5,7 +5,8 @@ SQLite sync and workspace store provider for OR3 Chat. Provides a lightweight, s
 ## What it provides
 
 - **AuthWorkspaceStore** (`sqlite`) — user identity mapping, workspace CRUD, role resolution
-- **SyncGatewayAdapter** (`sqlite`) — push/pull sync with LWW conflict resolution, cursor tracking, GC
+- **SyncGatewayAdapter** (`sqlite`) — push/pull sync, consistent materialized snapshot pages, LWW conflict resolution, and cursor tracking
+- **ConnectStore** (`sqlite`) — durable, atomic device enrollment and connected-computer records for OR3 Connect
 
 ## Install
 
@@ -39,6 +40,15 @@ OR3_SQLITE_PRAGMA_JOURNAL_MODE=WAL
 OR3_SQLITE_PRAGMA_SYNCHRONOUS=NORMAL
 ```
 
+OR3 Connect uses this same database by default:
+
+```bash
+OR3_CONNECT_ENABLED=true
+OR3_CONNECT_PROVIDER=sqlite
+```
+
+No Convex deployment or second database is required.
+
 ## How it works
 
 ### Registration
@@ -48,16 +58,20 @@ On server startup, the Nitro plugin:
 1. Initializes the SQLite database (creates file if needed)
 2. Runs schema migrations automatically
 3. Registers `AuthWorkspaceStore` with ID `sqlite`
-4. Registers `SyncGatewayAdapter` with ID `sqlite`
+4. Registers `SyncGatewayAdapter` when SQLite sync is selected
+5. Registers `ConnectStore` when SQLite Connect persistence is selected
 
 Registration is skipped when `auth.enabled` is `false` (local-only mode).
 
 ### Schema
 
-Two migrations create all tables:
+Ordered migrations create and evolve all tables:
 
 - **001_init**: `users`, `auth_accounts`, `workspaces`, `workspace_members`
 - **002_sync_tables**: `server_version_counter`, `change_log`, `device_cursors`, `tombstones`, plus materialized entity tables (`s_threads`, `s_messages`, etc.)
+- **003–005**: workspace-scoped sync keys, invitations, and admin stores
+- **006_sync_snapshots**: winning operation IDs plus immutable snapshot headers/items
+- **009_or3_connect**: single-use device authorizations and connected computers
 
 All tables use snake_case aligned with the sync wire format.
 
@@ -65,8 +79,9 @@ All tables use snake_case aligned with the sync wire format.
 
 - **Push**: validates ops → checks `op_id` idempotency → allocates contiguous `server_version` block → applies LWW to materialized tables → writes change_log → upserts tombstones for deletes
 - **Pull**: returns ordered changes for `server_version > cursor` with limit/pagination and optional table filtering
+- **Snapshot**: captures canonical live rows and current tombstones with one `highWatermark` under `BEGIN IMMEDIATE`, then serves immutable, keyset-paginated pages ordered by `(tableName, pk, kind)`
 - **Cursor**: forward-only per-device cursor tracking
-- **GC**: tombstone and change_log cleanup respects min device cursor + retention window
+- **Retention safety**: tombstone and `change_log` GC is enabled only under the explicit `snapshot-v1` capability and deletes old revisions acknowledged by every registered device
 
 LWW conflict resolution: incoming wins when `clock` is higher, or when clocks are equal and `hlc` is lexicographically greater.
 
@@ -100,6 +115,7 @@ bun run build       # build for distribution
 
 - Works with multiple auth providers (`basic-auth`, `clerk`, or custom)
 - Replaces `or3-provider-convex` for sync + workspace store functionality
+- Provides OR3 Connect persistence without Convex
 - Does NOT provide storage — pair with `or3-provider-fs` for file storage
 
 ### Known differences vs Convex

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-sqlite",
   "configKey": "or3-provider-sqlite",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/server/admin/adapters/sync-sqlite.js

@@ -1,14 +1,6 @@
 import { createError } from "h3";
-import { createSqliteSyncGatewayAdapter } from "../../sync/sqlite-sync-gateway-adapter.js";
+import { SYNC_HISTORY_GC_POLICY } from "../../sync/history-gc-policy.js";
 const SQLITE_PROVIDER_ID = "sqlite";
-const DEFAULT_RETENTION_SECONDS = 30 * 24 * 3600;
-function resolveRetentionSeconds(payload) {
-  const days = typeof payload?.retentionDays === "number" ? payload.retentionDays : null;
-  const seconds = typeof payload?.retentionSeconds === "number" ? payload.retentionSeconds : null;
-  if (seconds && Number.isFinite(seconds) && seconds > 0) return Math.floor(seconds);
-  if (days && Number.isFinite(days) && days > 0) return Math.floor(days * 24 * 3600);
-  return DEFAULT_RETENTION_SECONDS;
-}
 export const sqliteSyncAdminAdapter = {
   id: SQLITE_PROVIDER_ID,
   kind: "sync",
@@ -26,6 +18,10 @@ export const sqliteSyncAdminAdapter = {
         message: "SQLite is configured with :memory:. Data will not persist across restarts."
       });
     }
+    warnings.push({
+      level: "warning",
+      message: SYNC_HISTORY_GC_POLICY.reason
+    });
     return {
       details: {
         dbPath: dbPath ?? ":memory:",
@@ -33,39 +29,21 @@ export const sqliteSyncAdminAdapter = {
         synchronous: process.env.OR3_SQLITE_PRAGMA_SYNCHRONOUS ?? "NORMAL"
       },
       warnings,
-      actions: [
-        {
-          id: "sync.gc-change-log",
-          label: "Run Sync Change Log GC",
-          description: "Purge old change_log entries after retention and device cursor checks.",
-          danger: true
-        },
-        {
-          id: "sync.gc-tombstones",
-          label: "Run Sync Tombstone GC",
-          description: "Purge old tombstones after retention and device cursor checks.",
-          danger: true
-        }
-      ]
+      actions: []
     };
   },
-  async runAction(event, actionId, payload, ctx) {
+  async runAction(_event, actionId, _payload, ctx) {
     if (!ctx.session.workspace?.id) {
       throw createError({
         statusCode: 400,
         statusMessage: "Workspace not resolved"
       });
     }
-    const adapter = createSqliteSyncGatewayAdapter();
-    const retentionSeconds = resolveRetentionSeconds(payload);
-    const scope = { workspaceId: ctx.session.workspace.id };
-    if (actionId === "sync.gc-change-log") {
-      await adapter.gcChangeLog?.(event, { scope, retentionSeconds });
-      return { ok: true, action: actionId, retentionSeconds };
-    }
-    if (actionId === "sync.gc-tombstones") {
-      await adapter.gcTombstones?.(event, { scope, retentionSeconds });
-      return { ok: true, action: actionId, retentionSeconds };
+    if (actionId === "sync.gc-change-log" || actionId === "sync.gc-tombstones") {
+      throw createError({
+        statusCode: 503,
+        statusMessage: SYNC_HISTORY_GC_POLICY.reason
+      });
     }
     throw createError({ statusCode: 400, statusMessage: "Unknown action" });
   }

package/dist/runtime/server/admin/stores/sqlite-store.js

@@ -79,25 +79,80 @@ class SqliteWorkspaceAccessStore {
         ).execute();
       }
     }
+    const existingMembership = await this.db.selectFrom("workspace_members").select("role").where("workspace_id", "=", input.workspaceId).where("user_id", "=", userId).executeTakeFirst();
+    if (existingMembership) {
+      await this.setMemberRole({
+        workspaceId: input.workspaceId,
+        userId,
+        role: input.role
+      });
+      return;
+    }
     await this.db.insertInto("workspace_members").values({
       id: randomUUID(),
       workspace_id: input.workspaceId,
       user_id: userId,
       role: input.role,
       created_at: now
-    }).onConflict(
-      (oc) => oc.columns(["workspace_id", "user_id"]).doUpdateSet({ role: input.role })
-    ).execute();
+    }).execute();
   }
   async setMemberRole(input) {
-    const result = await this.db.updateTable("workspace_members").set({ role: input.role }).where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).executeTakeFirst();
-    const updated = Number(result.numUpdatedRows ?? 0);
-    if (updated === 0) {
-      throw new Error("Workspace member not found");
-    }
+    await this.db.transaction().execute(async (tx) => {
+      const member = await tx.selectFrom("workspace_members").select("role").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).executeTakeFirst();
+      if (!member) {
+        throw new Error("Workspace member not found");
+      }
+      if (member.role === "owner" && input.role !== "owner") {
+        const owners = await tx.selectFrom("workspace_members").select("user_id").where("workspace_id", "=", input.workspaceId).where("role", "=", "owner").execute();
+        if (owners.length <= 1) {
+          throw new Error(
+            "Cannot demote the last workspace owner. Transfer ownership first."
+          );
+        }
+        const workspace = await tx.selectFrom("workspaces").select("owner_user_id").where("id", "=", input.workspaceId).executeTakeFirst();
+        if (workspace?.owner_user_id === input.userId) {
+          const replacement = owners.find(
+            (owner) => owner.user_id !== input.userId
+          );
+          if (!replacement) {
+            throw new Error(
+              "Cannot demote the last workspace owner. Transfer ownership first."
+            );
+          }
+          await tx.updateTable("workspaces").set({ owner_user_id: replacement.user_id }).where("id", "=", input.workspaceId).execute();
+        }
+      }
+      await tx.updateTable("workspace_members").set({ role: input.role }).where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).execute();
+    });
   }
   async removeMember(input) {
-    await this.db.deleteFrom("workspace_members").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).execute();
+    await this.db.transaction().execute(async (tx) => {
+      const member = await tx.selectFrom("workspace_members").select("role").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).executeTakeFirst();
+      if (!member) {
+        throw new Error("Workspace member not found");
+      }
+      if (member.role === "owner") {
+        const owners = await tx.selectFrom("workspace_members").select("user_id").where("workspace_id", "=", input.workspaceId).where("role", "=", "owner").execute();
+        if (owners.length <= 1) {
+          throw new Error(
+            "Cannot remove the last workspace owner. Transfer ownership first."
+          );
+        }
+        const workspace = await tx.selectFrom("workspaces").select("owner_user_id").where("id", "=", input.workspaceId).executeTakeFirst();
+        if (workspace?.owner_user_id === input.userId) {
+          const replacement = owners.find(
+            (owner) => owner.user_id !== input.userId
+          );
+          if (!replacement) {
+            throw new Error(
+              "Cannot remove the last workspace owner. Transfer ownership first."
+            );
+          }
+          await tx.updateTable("workspaces").set({ owner_user_id: replacement.user_id }).where("id", "=", input.workspaceId).execute();
+        }
+      }
+      await tx.deleteFrom("workspace_members").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).execute();
+    });
   }
   async listWorkspaces(input) {
     const includeDeleted = input.includeDeleted === true;

package/dist/runtime/server/auth/sqlite-auth-workspace-store.d.ts

@@ -4,10 +4,11 @@
  * Maps provider identity -> internal user and manages workspace CRUD.
  * Uses Kysely for all queries. No Convex or Clerk SDK imports.
  */
-import type { AuthWorkspaceStore } from '~~/server/auth/store/types';
+import type { AuthWorkspaceStore, InviteProvisionResult, InviteValidationResult } from '~~/server/auth/store/types';
 import type { WorkspaceRole } from '~~/app/core/hooks/hook-types';
 export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
     private get db();
+    protected onInviteProvisionStep(_step: 'invite_validated' | 'user_created' | 'membership_created' | 'invite_consumed'): void;
     getOrCreateUser(input: {
         provider: string;
         providerUserId: string;
@@ -27,6 +28,7 @@ export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
     getOrCreateDefaultWorkspace(userId: string): Promise<{
         workspaceId: string;
         workspaceName: string;
+        created?: boolean;
     }>;
     getWorkspaceRole(input: {
         userId: string;
@@ -95,6 +97,19 @@ export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
         inviteId: string;
         revokedByUserId: string;
     }): Promise<void>;
+    validateInvite(input: {
+        workspaceId: string;
+        email: string;
+        tokenHash: string;
+    }): Promise<InviteValidationResult>;
+    acceptInviteAndProvisionUser(input: {
+        provider: string;
+        providerUserId: string;
+        email: string;
+        displayName?: string;
+        workspaceId: string;
+        tokenHash: string;
+    }): Promise<InviteProvisionResult>;
     consumeInvite(input: {
         workspaceId: string;
         email: string;

package/dist/runtime/server/auth/sqlite-auth-workspace-store.js

@@ -13,6 +13,8 @@ export class SqliteAuthWorkspaceStore {
   get db() {
     return getSqliteDb();
   }
+  onInviteProvisionStep(_step) {
+  }
   async getOrCreateUser(input) {
     this.db;
     const raw = getRawDb();
@@ -94,7 +96,8 @@ export class SqliteAuthWorkspaceStore {
     if (activeMembership) {
       return {
         workspaceId: activeMembership.id,
-        workspaceName: activeMembership.name
+        workspaceName: activeMembership.name,
+        created: false
       };
     }
     const membership = await db.selectFrom("workspace_members").innerJoin("workspaces", "workspaces.id", "workspace_members.workspace_id").select([
@@ -103,7 +106,11 @@ export class SqliteAuthWorkspaceStore {
     ]).where("workspace_members.user_id", "=", userId).where("workspaces.deleted", "=", 0).orderBy("workspace_members.created_at", "asc").executeTakeFirst();
     if (membership) {
       await db.updateTable("users").set({ active_workspace_id: membership.id }).where("id", "=", userId).execute();
-      return { workspaceId: membership.id, workspaceName: membership.name };
+      return {
+        workspaceId: membership.id,
+        workspaceName: membership.name,
+        created: false
+      };
     }
     const workspaceId = uid();
     const memberId = uid();
@@ -128,7 +135,7 @@ export class SqliteAuthWorkspaceStore {
       }).execute();
       await tx.updateTable("users").set({ active_workspace_id: workspaceId }).where("id", "=", userId).execute();
     });
-    return { workspaceId, workspaceName: name };
+    return { workspaceId, workspaceName: name, created: true };
   }
   async getWorkspaceRole(input) {
     const db = this.db;
@@ -277,6 +284,110 @@ export class SqliteAuthWorkspaceStore {
     }).where("workspace_id", "=", input.workspaceId).where("id", "=", input.inviteId).execute();
     void input.revokedByUserId;
   }
+  async validateInvite(input) {
+    this.db;
+    const raw = getRawDb();
+    const now = nowEpoch();
+    const invite = raw.prepare(
+      `SELECT role, status, email, expires_at
+                 FROM auth_invites
+                 WHERE workspace_id = ? AND token_hash = ?
+                 LIMIT 1`
+    ).get(input.workspaceId, input.tokenHash);
+    if (!invite) return { ok: false, reason: "not_found" };
+    if (invite.email !== normalizeEmail(input.email)) {
+      return { ok: false, reason: "email_mismatch" };
+    }
+    if (invite.status === "accepted") return { ok: false, reason: "already_used" };
+    if (invite.status === "revoked") return { ok: false, reason: "revoked" };
+    if (invite.status === "expired" || invite.expires_at <= now) {
+      return { ok: false, reason: "expired" };
+    }
+    return { ok: true, role: invite.role };
+  }
+  async acceptInviteAndProvisionUser(input) {
+    this.db;
+    const raw = getRawDb();
+    const now = nowEpoch();
+    const normalizedEmail = normalizeEmail(input.email);
+    return raw.transaction(() => {
+      const invite = raw.prepare(
+        `SELECT id, role, status, email, expires_at
+                         FROM auth_invites
+                         WHERE workspace_id = ? AND token_hash = ?
+                         LIMIT 1`
+      ).get(input.workspaceId, input.tokenHash);
+      if (!invite) return { ok: false, reason: "not_found" };
+      if (invite.email !== normalizedEmail) {
+        return { ok: false, reason: "email_mismatch" };
+      }
+      if (invite.status === "accepted") {
+        return { ok: false, reason: "already_used" };
+      }
+      if (invite.status === "revoked") {
+        return { ok: false, reason: "revoked" };
+      }
+      if (invite.status === "expired" || invite.expires_at <= now) {
+        return { ok: false, reason: "expired" };
+      }
+      this.onInviteProvisionStep("invite_validated");
+      const existingAccount = raw.prepare(
+        `SELECT user_id
+                         FROM auth_accounts
+                         WHERE provider = ? AND provider_user_id = ?
+                         LIMIT 1`
+      ).get(input.provider, input.providerUserId);
+      const userId = existingAccount?.user_id ?? uid();
+      const createdUser = !existingAccount;
+      if (createdUser) {
+        raw.prepare(
+          `INSERT INTO users (id, email, display_name, active_workspace_id, created_at)
+                         VALUES (?, ?, ?, NULL, ?)`
+        ).run(userId, normalizedEmail, input.displayName ?? null, now);
+        raw.prepare(
+          `INSERT INTO auth_accounts (id, user_id, provider, provider_user_id, created_at)
+                         VALUES (?, ?, ?, ?, ?)`
+        ).run(uid(), userId, input.provider, input.providerUserId, now);
+      }
+      this.onInviteProvisionStep("user_created");
+      const existingMembership = raw.prepare(
+        `SELECT id FROM workspace_members
+                         WHERE workspace_id = ? AND user_id = ?
+                         LIMIT 1`
+      ).get(input.workspaceId, userId);
+      if (existingMembership) {
+        raw.prepare("UPDATE workspace_members SET role = ? WHERE id = ?").run(
+          invite.role,
+          existingMembership.id
+        );
+      } else {
+        raw.prepare(
+          `INSERT INTO workspace_members (id, workspace_id, user_id, role, created_at)
+                         VALUES (?, ?, ?, ?, ?)`
+        ).run(uid(), input.workspaceId, userId, invite.role, now);
+      }
+      raw.prepare("UPDATE users SET active_workspace_id = ? WHERE id = ?").run(
+        input.workspaceId,
+        userId
+      );
+      this.onInviteProvisionStep("membership_created");
+      const consumed = raw.prepare(
+        `UPDATE auth_invites
+                     SET status = 'accepted', accepted_at = ?, accepted_user_id = ?, updated_at = ?
+                     WHERE id = ? AND status = 'pending'`
+      ).run(now, userId, now, invite.id);
+      if (consumed.changes !== 1) {
+        throw new Error("Invite state changed during atomic acceptance");
+      }
+      this.onInviteProvisionStep("invite_consumed");
+      return {
+        ok: true,
+        userId,
+        role: invite.role,
+        createdUser
+      };
+    }).immediate();
+  }
   async consumeInvite(input) {
     this.db;
     const raw = getRawDb();

package/dist/runtime/server/connect/sqlite-connect-store.d.ts

@@ -0,0 +1,2 @@
+import { type ConnectStore } from '~~/server/connect/store/types';
+export declare function createSqliteConnectStore(): ConnectStore;