or3-provider-sqlite 0.0.2 → 0.0.4

package/dist/runtime/server/db/migrations/014_connect_retention_activation.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Adds bounded retention and unclaimed-activation lifecycle indexes. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/014_connect_retention_activation.js

@@ -0,0 +1,44 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const columns = await sql`
+        PRAGMA table_info(connect_environments)
+    `.execute(db);
+  const names = new Set(columns.rows.map((column) => column.name));
+  if (!names.has("activation_deadline_at")) {
+    await sql`
+            ALTER TABLE connect_environments
+            ADD COLUMN activation_deadline_at INTEGER
+        `.execute(db);
+  }
+  if (!names.has("activation_claimed_at")) {
+    await sql`
+            ALTER TABLE connect_environments
+            ADD COLUMN activation_claimed_at INTEGER
+        `.execute(db);
+  }
+  if (!names.has("relay_authenticator")) {
+    await sql`
+            ALTER TABLE connect_environments
+            ADD COLUMN relay_authenticator TEXT
+        `.execute(db);
+  }
+  await sql`
+        CREATE INDEX IF NOT EXISTS connect_authorizations_status_updated
+        ON connect_device_authorizations(status, updated_at, id)
+    `.execute(db);
+  await sql`
+        CREATE INDEX IF NOT EXISTS connect_environments_status_updated
+        ON connect_environments(status, updated_at, id)
+    `.execute(db);
+  await sql`
+        CREATE INDEX IF NOT EXISTS connect_environments_activation_due
+        ON connect_environments(
+            status, activation_claimed_at, activation_deadline_at, id
+        )
+    `.execute(db);
+}
+export async function down(db) {
+  await sql`DROP INDEX IF EXISTS connect_environments_activation_due`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_environments_status_updated`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_updated`.execute(db);
+}

package/dist/runtime/server/db/migrations/015_rate_limits.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Durable deployment-wide fixed-window request budgets. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/015_rate_limits.js

@@ -0,0 +1,18 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE TABLE IF NOT EXISTS rate_limits (
+            key TEXT PRIMARY KEY,
+            count INTEGER NOT NULL,
+            window_started_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await sql`
+        CREATE INDEX IF NOT EXISTS rate_limits_expiry
+        ON rate_limits(expires_at)
+    `.execute(db);
+}
+export async function down(db) {
+  await sql`DROP TABLE IF EXISTS rate_limits`.execute(db);
+}

package/dist/runtime/server/db/schema.d.ts

@@ -131,6 +131,60 @@ export interface UploadIntentsTable {
     consumed_at: number | null;
     cancelled_at: number | null;
 }
+export interface ConnectDeviceAuthorizationsTable {
+    id: string;
+    device_code_hash: string;
+    user_code_hash: string;
+    status: 'pending' | 'provisioning' | 'approved' | 'delivering' | 'denied' | 'consumed' | 'expired';
+    host_json: string;
+    approved_user_id: string | null;
+    approved_workspace_id: string | null;
+    environment_id: string | null;
+    credential_ciphertext: string | null;
+    credential_delivery_started_at: number | null;
+    credential_redeliver_until: number | null;
+    expires_at: number;
+    created_at: number;
+    updated_at: number;
+}
+export interface ConnectEnvironmentsTable {
+    id: string;
+    user_id: string;
+    workspace_id: string;
+    name: string;
+    platform: string;
+    architecture: string;
+    host_id: string | null;
+    signing_public_key: string | null;
+    noise_public_key: string | null;
+    authorization_id: string | null;
+    hostname: string;
+    tunnel_id: string;
+    dns_record_id: string;
+    control_token_hash: string;
+    access_credential_ciphertext: string;
+    tunnel_secret_ciphertext: string | null;
+    status: 'provisioning' | 'active' | 'revoking' | 'revoked' | 'error';
+    lifecycle_attempts: number;
+    lifecycle_next_attempt_at: number;
+    lifecycle_claim_token: string | null;
+    lifecycle_claimed_until: number | null;
+    provisioning_deadline_at: number | null;
+    activation_deadline_at: number | null;
+    activation_claimed_at: number | null;
+    relay_authenticator: string | null;
+    lifecycle_error: string | null;
+    last_seen_at: number | null;
+    created_at: number;
+    updated_at: number;
+    revoked_at: number | null;
+}
+export interface RateLimitsTable {
+    key: string;
+    count: number;
+    window_started_at: number;
+    expires_at: number;
+}
 export interface AdminUsersTable {
     user_id: string;
     created_at: number;
@@ -156,6 +210,9 @@ export interface Or3SqliteDb {
     sync_snapshots: SyncSnapshotsTable;
     sync_snapshot_items: SyncSnapshotItemsTable;
     upload_intents: UploadIntentsTable;
+    connect_device_authorizations: ConnectDeviceAuthorizationsTable;
+    connect_environments: ConnectEnvironmentsTable;
+    rate_limits: RateLimitsTable;
     s_threads: SyncedEntityTable;
     s_messages: SyncedEntityTable;
     s_projects: SyncedEntityTable;

package/dist/runtime/server/plugins/register.d.ts

@@ -1,2 +1,2 @@
-declare const _default: any;
+declare const _default: import("nitropack").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/plugins/register.js

@@ -1,8 +1,11 @@
+import { defineNitroPlugin } from "nitropack/runtime/plugin";
 import { registerAuthWorkspaceStore } from "~~/server/auth/store/registry";
 import { registerProviderAdminAdapter } from "~~/server/admin/providers/registry";
 import { registerAdminStoreProvider } from "~~/server/admin/stores/registry";
 import { registerSyncGatewayAdapter } from "~~/server/sync/gateway/registry";
 import { registerWebhookStore } from "~~/server/utils/webhooks/store/registry";
+import { registerConnectStore } from "~~/server/connect/store/registry";
+import { registerRateLimitProvider } from "~~/server/utils/rate-limit/registry";
 import { createSqliteAuthWorkspaceStore } from "../auth/sqlite-auth-workspace-store.js";
 import { createSqliteSyncGatewayAdapter } from "../sync/sqlite-sync-gateway-adapter.js";
 import { createSqliteWebhookStore } from "../webhooks/sqlite-webhook-store.js";
@@ -12,27 +15,39 @@ import {
   createSqliteWorkspaceSettingsStore
 } from "../admin/stores/sqlite-store.js";
 import { sqliteSyncAdminAdapter } from "../admin/adapters/sync-sqlite.js";
+import { createSqliteConnectStore } from "../connect/sqlite-connect-store.js";
 import { getSqliteDb } from "../db/kysely.js";
 import { runMigrations } from "../db/migrate.js";
+import { sqliteRateLimitProvider } from "../rate-limit/sqlite-provider.js";
 import { useRuntimeConfig } from "#imports";
 const SQLITE_PROVIDER_ID = "sqlite";
 export default defineNitroPlugin(async () => {
   const config = useRuntimeConfig();
   if (!config.auth?.enabled) return;
-  if (!config.sync?.enabled) return;
-  if (config.sync?.provider !== SQLITE_PROVIDER_ID) return;
+  const syncSelected = config.sync?.enabled === true && config.sync?.provider === SQLITE_PROVIDER_ID;
+  const connectSelected = config.connect?.enabled === true && config.connect?.provider === SQLITE_PROVIDER_ID;
+  if (!syncSelected && !connectSelected) return;
   const db = getSqliteDb();
-  await runMigrations(db);
   registerAuthWorkspaceStore({
     id: SQLITE_PROVIDER_ID,
     order: 100,
     create: createSqliteAuthWorkspaceStore
   });
-  registerSyncGatewayAdapter({
-    id: SQLITE_PROVIDER_ID,
-    order: 100,
-    create: createSqliteSyncGatewayAdapter
-  });
+  registerRateLimitProvider(SQLITE_PROVIDER_ID, sqliteRateLimitProvider);
+  if (syncSelected) {
+    registerSyncGatewayAdapter({
+      id: SQLITE_PROVIDER_ID,
+      order: 100,
+      create: createSqliteSyncGatewayAdapter
+    });
+  }
+  if (connectSelected) {
+    registerConnectStore({
+      id: SQLITE_PROVIDER_ID,
+      order: 100,
+      create: createSqliteConnectStore
+    });
+  }
   registerWebhookStore({
     id: SQLITE_PROVIDER_ID,
     order: 100,
@@ -52,4 +67,5 @@ export default defineNitroPlugin(async () => {
     })
   });
   registerProviderAdminAdapter(sqliteSyncAdminAdapter);
+  await runMigrations(db);
 });

package/dist/runtime/server/rate-limit/sqlite-provider.d.ts

@@ -0,0 +1,7 @@
+import type { RateLimitConfig, RateLimitProvider, RateLimitResult, RateLimitStats } from '~~/server/utils/rate-limit/types';
+export declare class SqliteRateLimitProvider implements RateLimitProvider {
+    readonly name = "sqlite";
+    checkAndRecord(key: string, config: RateLimitConfig): Promise<RateLimitResult>;
+    getStats(key: string, config: RateLimitConfig): Promise<RateLimitStats | null>;
+}
+export declare const sqliteRateLimitProvider: SqliteRateLimitProvider;

package/dist/runtime/server/rate-limit/sqlite-provider.js

@@ -0,0 +1,70 @@
+import { getRawDb } from "../db/kysely.js";
+export class SqliteRateLimitProvider {
+  name = "sqlite";
+  async checkAndRecord(key, config) {
+    requireConfig(config);
+    const now = Date.now();
+    const db = getRawDb();
+    return db.transaction(() => {
+      const row = db.prepare(
+        `SELECT count, window_started_at, expires_at
+                     FROM rate_limits WHERE key = ?`
+      ).get(key);
+      if (!row || row.expires_at <= now) {
+        db.prepare(
+          `INSERT INTO rate_limits (
+                        key, count, window_started_at, expires_at
+                     ) VALUES (?, 1, ?, ?)
+                     ON CONFLICT(key) DO UPDATE SET
+                        count = 1,
+                        window_started_at = excluded.window_started_at,
+                        expires_at = excluded.expires_at`
+        ).run(key, now, now + config.windowMs);
+        return {
+          allowed: true,
+          remaining: config.maxRequests - 1
+        };
+      }
+      if (row.count >= config.maxRequests) {
+        return {
+          allowed: false,
+          remaining: 0,
+          retryAfterMs: Math.max(0, row.expires_at - now)
+        };
+      }
+      db.prepare(
+        `UPDATE rate_limits SET count = count + 1 WHERE key = ?`
+      ).run(key);
+      return {
+        allowed: true,
+        remaining: config.maxRequests - row.count - 1
+      };
+    })();
+  }
+  async getStats(key, config) {
+    requireConfig(config);
+    const now = Date.now();
+    const row = getRawDb().prepare(
+      `SELECT count, window_started_at, expires_at
+                 FROM rate_limits WHERE key = ?`
+    ).get(key);
+    if (!row || row.expires_at <= now) {
+      return {
+        limit: config.maxRequests,
+        remaining: config.maxRequests,
+        resetMs: config.windowMs
+      };
+    }
+    return {
+      limit: config.maxRequests,
+      remaining: Math.max(0, config.maxRequests - row.count),
+      resetMs: Math.max(0, row.expires_at - now)
+    };
+  }
+}
+export const sqliteRateLimitProvider = new SqliteRateLimitProvider();
+function requireConfig(config) {
+  if (!Number.isSafeInteger(config.windowMs) || config.windowMs <= 0 || !Number.isSafeInteger(config.maxRequests) || config.maxRequests <= 0) {
+    throw new Error("Invalid SQLite rate-limit configuration");
+  }
+}

package/package.json

@@ -1,9 +1,17 @@
 {
     "name": "or3-provider-sqlite",
-    "version": "0.0.2",
+    "version": "0.0.4",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/Saluana/or3-provider-sqlite.git"
+    },
     "description": "SQLite sync and workspace store provider for OR3 Chat — lightweight self-hosted backend via Kysely.",
     "license": "MIT",
     "type": "module",
+    "engines": {
+        "node": ">=24"
+    },
+    "packageManager": "bun@1.3.14",
     "sideEffects": false,
     "exports": {
         ".": {
@@ -46,7 +54,7 @@
         "@eslint/js": "^9.34.0",
         "@nuxt/module-builder": "^1.0.2",
         "@types/better-sqlite3": "^7.6.13",
-        "@types/node": "^25.2.2",
+        "@types/node": "^24.10.1",
         "@typescript-eslint/eslint-plugin": "^8.41.0",
         "@typescript-eslint/parser": "^8.41.0",
         "eslint": "^9.34.0",