or3-provider-sqlite 0.0.4 → 0.0.6

package/dist/runtime/server/auth/sqlite-auth-workspace-store.js

@@ -1,7 +1,7 @@
-import { getRawDb, getSqliteDb } from "../db/kysely.js";
-import { randomUUID } from "node:crypto";
+import { getRawDb, getSqliteDb, isD1Driver } from "../db/kysely.js";
+import { d1All, d1Batch, d1Run } from "../db/d1.js";
 function uid() {
-  return randomUUID();
+  return globalThis.crypto.randomUUID();
 }
 function nowEpoch() {
   return Math.floor(Date.now() / 1e3);
@@ -16,6 +16,9 @@ export class SqliteAuthWorkspaceStore {
   onInviteProvisionStep(_step) {
   }
   async getOrCreateUser(input) {
+    if (isD1Driver()) {
+      return this.getOrCreateUserInD1(input);
+    }
     this.db;
     const raw = getRawDb();
     const userId = raw.transaction(() => {
@@ -116,25 +119,46 @@ export class SqliteAuthWorkspaceStore {
     const memberId = uid();
     const now = nowEpoch();
     const name = "My Workspace";
-    await db.transaction().execute(async (tx) => {
-      await tx.insertInto("workspaces").values({
-        id: workspaceId,
-        name,
-        description: null,
-        owner_user_id: userId,
-        created_at: now,
-        deleted: 0,
-        deleted_at: null
-      }).execute();
-      await tx.insertInto("workspace_members").values({
-        id: memberId,
-        workspace_id: workspaceId,
-        user_id: userId,
-        role: "owner",
-        created_at: now
-      }).execute();
-      await tx.updateTable("users").set({ active_workspace_id: workspaceId }).where("id", "=", userId).execute();
-    });
+    if (isD1Driver()) {
+      await d1Batch([
+        {
+          sql: `INSERT INTO workspaces (
+                        id, name, description, owner_user_id, created_at, deleted, deleted_at
+                    ) VALUES (?, ?, NULL, ?, ?, 0, NULL)`,
+          parameters: [workspaceId, name, userId, now]
+        },
+        {
+          sql: `INSERT INTO workspace_members (
+                        id, workspace_id, user_id, role, created_at
+                    ) VALUES (?, ?, ?, 'owner', ?)`,
+          parameters: [memberId, workspaceId, userId, now]
+        },
+        {
+          sql: "UPDATE users SET active_workspace_id = ? WHERE id = ?",
+          parameters: [workspaceId, userId]
+        }
+      ]);
+    } else {
+      await db.transaction().execute(async (tx) => {
+        await tx.insertInto("workspaces").values({
+          id: workspaceId,
+          name,
+          description: null,
+          owner_user_id: userId,
+          created_at: now,
+          deleted: 0,
+          deleted_at: null
+        }).execute();
+        await tx.insertInto("workspace_members").values({
+          id: memberId,
+          workspace_id: workspaceId,
+          user_id: userId,
+          role: "owner",
+          created_at: now
+        }).execute();
+        await tx.updateTable("users").set({ active_workspace_id: workspaceId }).where("id", "=", userId).execute();
+      });
+    }
     return { workspaceId, workspaceName: name, created: true };
   }
   async getWorkspaceRole(input) {
@@ -168,24 +192,47 @@ export class SqliteAuthWorkspaceStore {
     const workspaceId = uid();
     const memberId = uid();
     const now = nowEpoch();
-    await db.transaction().execute(async (tx) => {
-      await tx.insertInto("workspaces").values({
-        id: workspaceId,
-        name: input.name,
-        description: input.description ?? null,
-        owner_user_id: input.userId,
-        created_at: now,
-        deleted: 0,
-        deleted_at: null
-      }).execute();
-      await tx.insertInto("workspace_members").values({
-        id: memberId,
-        workspace_id: workspaceId,
-        user_id: input.userId,
-        role: "owner",
-        created_at: now
-      }).execute();
-    });
+    if (isD1Driver()) {
+      await d1Batch([
+        {
+          sql: `INSERT INTO workspaces (
+                        id, name, description, owner_user_id, created_at, deleted, deleted_at
+                    ) VALUES (?, ?, ?, ?, ?, 0, NULL)`,
+          parameters: [
+            workspaceId,
+            input.name,
+            input.description ?? null,
+            input.userId,
+            now
+          ]
+        },
+        {
+          sql: `INSERT INTO workspace_members (
+                        id, workspace_id, user_id, role, created_at
+                    ) VALUES (?, ?, ?, 'owner', ?)`,
+          parameters: [memberId, workspaceId, input.userId, now]
+        }
+      ]);
+    } else {
+      await db.transaction().execute(async (tx) => {
+        await tx.insertInto("workspaces").values({
+          id: workspaceId,
+          name: input.name,
+          description: input.description ?? null,
+          owner_user_id: input.userId,
+          created_at: now,
+          deleted: 0,
+          deleted_at: null
+        }).execute();
+        await tx.insertInto("workspace_members").values({
+          id: memberId,
+          workspace_id: workspaceId,
+          user_id: input.userId,
+          role: "owner",
+          created_at: now
+        }).execute();
+      });
+    }
     return { workspaceId };
   }
   async updateWorkspace(input) {
@@ -206,6 +253,31 @@ export class SqliteAuthWorkspaceStore {
       throw new Error("Forbidden: only owner can remove workspace");
     }
     const now = nowEpoch();
+    if (isD1Driver()) {
+      await d1Batch([
+        {
+          sql: "UPDATE workspaces SET deleted = 1, deleted_at = ? WHERE id = ?",
+          parameters: [now, input.workspaceId]
+        },
+        {
+          sql: `UPDATE users
+                        SET active_workspace_id = (
+                            SELECT workspace_members.workspace_id
+                            FROM workspace_members
+                            INNER JOIN workspaces
+                                ON workspaces.id = workspace_members.workspace_id
+                            WHERE workspace_members.user_id = users.id
+                              AND workspaces.deleted = 0
+                              AND workspaces.id <> ?
+                            ORDER BY workspace_members.created_at ASC
+                            LIMIT 1
+                        )
+                        WHERE active_workspace_id = ?`,
+          parameters: [input.workspaceId, input.workspaceId]
+        }
+      ]);
+      return;
+    }
     await db.transaction().execute(async (tx) => {
       await tx.updateTable("workspaces").set({ deleted: 1, deleted_at: now }).where("id", "=", input.workspaceId).execute();
       const affectedUsers = await tx.selectFrom("users").select("id").where("active_workspace_id", "=", input.workspaceId).execute();
@@ -285,6 +357,9 @@ export class SqliteAuthWorkspaceStore {
     void input.revokedByUserId;
   }
   async validateInvite(input) {
+    if (isD1Driver()) {
+      return this.validateInviteInD1(input);
+    }
     this.db;
     const raw = getRawDb();
     const now = nowEpoch();
@@ -306,6 +381,9 @@ export class SqliteAuthWorkspaceStore {
     return { ok: true, role: invite.role };
   }
   async acceptInviteAndProvisionUser(input) {
+    if (isD1Driver()) {
+      return this.acceptInviteAndProvisionUserInD1(input);
+    }
     this.db;
     const raw = getRawDb();
     const now = nowEpoch();
@@ -389,6 +467,9 @@ export class SqliteAuthWorkspaceStore {
     }).immediate();
   }
   async consumeInvite(input) {
+    if (isD1Driver()) {
+      return this.consumeInviteInD1(input);
+    }
     this.db;
     const raw = getRawDb();
     const now = nowEpoch();
@@ -454,6 +535,253 @@ export class SqliteAuthWorkspaceStore {
       return { ok: true, role: invite.role };
     }).immediate();
   }
+  async getOrCreateUserInD1(input) {
+    const candidateUserId = uid();
+    const now = nowEpoch();
+    const results = await d1Batch([
+      {
+        sql: `INSERT OR IGNORE INTO users (
+                    id, email, display_name, active_workspace_id, created_at
+                ) VALUES (?, ?, ?, NULL, ?)`,
+        parameters: [
+          candidateUserId,
+          input.email ?? null,
+          input.displayName ?? null,
+          now
+        ]
+      },
+      {
+        sql: `INSERT OR IGNORE INTO auth_accounts (
+                    id, user_id, provider, provider_user_id, created_at
+                ) VALUES (?, ?, ?, ?, ?)`,
+        parameters: [
+          uid(),
+          candidateUserId,
+          input.provider,
+          input.providerUserId,
+          now
+        ]
+      },
+      {
+        sql: `SELECT user_id
+                    FROM auth_accounts
+                    WHERE provider = ? AND provider_user_id = ?`,
+        parameters: [input.provider, input.providerUserId]
+      }
+    ]);
+    const winner = (results[2]?.results ?? [])[0];
+    if (!winner?.user_id) {
+      throw new Error("Failed to resolve auth account after get-or-create attempt");
+    }
+    if (winner.user_id !== candidateUserId) {
+      await d1Run(
+        `DELETE FROM users
+                 WHERE id = ?
+                   AND NOT EXISTS (
+                       SELECT 1 FROM auth_accounts WHERE user_id = ?
+                   )`,
+        candidateUserId,
+        candidateUserId
+      );
+    }
+    return { userId: winner.user_id };
+  }
+  async validateInviteInD1(input) {
+    const now = nowEpoch();
+    const [invite] = await d1All(
+      `SELECT role, status, email, expires_at
+             FROM auth_invites
+             WHERE workspace_id = ? AND token_hash = ?
+             LIMIT 1`,
+      input.workspaceId,
+      input.tokenHash
+    );
+    if (!invite) return { ok: false, reason: "not_found" };
+    if (invite.email !== normalizeEmail(input.email)) {
+      return { ok: false, reason: "email_mismatch" };
+    }
+    if (invite.status === "accepted") return { ok: false, reason: "already_used" };
+    if (invite.status === "revoked") return { ok: false, reason: "revoked" };
+    if (invite.status === "expired" || invite.expires_at <= now) {
+      return { ok: false, reason: "expired" };
+    }
+    return { ok: true, role: invite.role };
+  }
+  async acceptInviteAndProvisionUserInD1(input) {
+    const now = nowEpoch();
+    const normalizedEmail = normalizeEmail(input.email);
+    const validation = await this.validateInviteInD1({
+      workspaceId: input.workspaceId,
+      email: normalizedEmail,
+      tokenHash: input.tokenHash
+    });
+    if (!validation.ok) return validation;
+    this.onInviteProvisionStep("invite_validated");
+    const [existingAccount] = await d1All(
+      `SELECT user_id FROM auth_accounts
+             WHERE provider = ? AND provider_user_id = ?
+             LIMIT 1`,
+      input.provider,
+      input.providerUserId
+    );
+    const { userId } = await this.getOrCreateUserInD1({
+      provider: input.provider,
+      providerUserId: input.providerUserId,
+      email: normalizedEmail,
+      displayName: input.displayName
+    });
+    const createdUser = !existingAccount;
+    this.onInviteProvisionStep("user_created");
+    const results = await d1Batch([
+      {
+        sql: `UPDATE auth_invites
+                    SET status = 'accepted', accepted_at = ?, accepted_user_id = ?, updated_at = ?
+                    WHERE workspace_id = ?
+                      AND token_hash = ?
+                      AND email = ?
+                      AND status = 'pending'
+                      AND expires_at > ?`,
+        parameters: [
+          now,
+          userId,
+          now,
+          input.workspaceId,
+          input.tokenHash,
+          normalizedEmail,
+          now
+        ]
+      },
+      {
+        sql: `INSERT INTO workspace_members (
+                    id, workspace_id, user_id, role, created_at
+                )
+                SELECT ?, ?, ?, role, ?
+                FROM auth_invites
+                WHERE workspace_id = ?
+                  AND token_hash = ?
+                  AND status = 'accepted'
+                  AND accepted_user_id = ?
+                ON CONFLICT(workspace_id, user_id) DO UPDATE SET role = excluded.role`,
+        parameters: [
+          uid(),
+          input.workspaceId,
+          userId,
+          now,
+          input.workspaceId,
+          input.tokenHash,
+          userId
+        ]
+      },
+      {
+        sql: `UPDATE users SET active_workspace_id = ?
+                    WHERE id = ?
+                      AND EXISTS (
+                          SELECT 1 FROM workspace_members
+                          WHERE workspace_id = ? AND user_id = ?
+                      )`,
+        parameters: [input.workspaceId, userId, input.workspaceId, userId]
+      }
+    ]);
+    if ((results[0]?.meta?.changes ?? 0) !== 1) {
+      return this.inviteProvisionFailureInD1(input.workspaceId, normalizedEmail, input.tokenHash);
+    }
+    this.onInviteProvisionStep("membership_created");
+    this.onInviteProvisionStep("invite_consumed");
+    return { ok: true, userId, role: validation.role, createdUser };
+  }
+  async consumeInviteInD1(input) {
+    const now = nowEpoch();
+    const normalized = normalizeEmail(input.email);
+    await d1Run(
+      `UPDATE auth_invites SET status = 'expired', updated_at = ?
+             WHERE workspace_id = ?
+               AND status = 'pending'
+               AND expires_at <= ?`,
+      now,
+      input.workspaceId,
+      now
+    );
+    const [invite] = await d1All(
+      `SELECT * FROM auth_invites
+             WHERE workspace_id = ? AND email = ?
+             ORDER BY created_at ASC
+             LIMIT 1`,
+      input.workspaceId,
+      normalized
+    );
+    if (!invite) return { ok: false, reason: "not_found" };
+    if (invite.status === "revoked") return { ok: false, reason: "revoked" };
+    if (invite.status === "accepted") return { ok: false, reason: "already_used" };
+    if (invite.status === "expired" || invite.expires_at <= now) {
+      return { ok: false, reason: "expired" };
+    }
+    if (invite.token_hash !== input.tokenHash) {
+      return { ok: false, reason: "token_mismatch" };
+    }
+    const results = await d1Batch([
+      {
+        sql: `UPDATE auth_invites
+                    SET status = 'accepted', accepted_at = ?, accepted_user_id = ?, updated_at = ?
+                    WHERE id = ? AND status = 'pending' AND token_hash = ?`,
+        parameters: [
+          now,
+          input.acceptedUserId,
+          now,
+          invite.id,
+          input.tokenHash
+        ]
+      },
+      {
+        sql: `INSERT INTO workspace_members (
+                    id, workspace_id, user_id, role, created_at
+                )
+                SELECT ?, ?, ?, role, ?
+                FROM auth_invites
+                WHERE id = ?
+                  AND status = 'accepted'
+                  AND accepted_user_id = ?
+                ON CONFLICT(workspace_id, user_id) DO UPDATE SET role = excluded.role`,
+        parameters: [
+          uid(),
+          input.workspaceId,
+          input.acceptedUserId,
+          now,
+          invite.id,
+          input.acceptedUserId
+        ]
+      },
+      {
+        sql: `UPDATE users SET active_workspace_id = ?
+                    WHERE id = ?
+                      AND EXISTS (
+                          SELECT 1 FROM workspace_members
+                          WHERE workspace_id = ? AND user_id = ?
+                      )`,
+        parameters: [
+          input.workspaceId,
+          input.acceptedUserId,
+          input.workspaceId,
+          input.acceptedUserId
+        ]
+      }
+    ]);
+    if ((results[0]?.meta?.changes ?? 0) !== 1) {
+      const [latest] = await d1All("SELECT status FROM auth_invites WHERE id = ?", invite.id);
+      if (!latest) return { ok: false, reason: "not_found" };
+      if (latest.status === "revoked") return { ok: false, reason: "revoked" };
+      if (latest.status === "accepted") return { ok: false, reason: "already_used" };
+      return { ok: false, reason: "expired" };
+    }
+    return { ok: true, role: invite.role };
+  }
+  async inviteProvisionFailureInD1(workspaceId, email, tokenHash) {
+    const validation = await this.validateInviteInD1({
+      workspaceId,
+      email,
+      tokenHash
+    });
+    return validation.ok ? { ok: false, reason: "already_used" } : validation;
+  }
 }
 export function createSqliteAuthWorkspaceStore() {
   return new SqliteAuthWorkspaceStore();

package/dist/runtime/server/connect/sqlite-connect-store.js

@@ -1,10 +1,10 @@
-import { randomUUID } from "node:crypto";
 import {
   ConnectStoreError
 } from "~~/server/connect/store/types";
 import { getRawDb } from "../db/kysely.js";
 const ENVIRONMENT_COLUMNS = `
-    id, user_id, workspace_id, name, platform, architecture, host_id,
+    id, user_id, workspace_id, name, platform, architecture, driver, runtime,
+    base_path, host_id,
     signing_public_key, noise_public_key, authorization_id, hostname,
     tunnel_id, dns_record_id, control_token_hash, access_credential_ciphertext,
     tunnel_secret_ciphertext, status, lifecycle_attempts,
@@ -40,7 +40,7 @@ class SqliteConnectStore {
                     status, host_json, expires_at, created_at, updated_at
                 ) VALUES (?, ?, ?, 'pending', ?, ?, ?, ?)`
       ).run(
-        randomUUID(),
+        globalThis.crypto.randomUUID(),
         input.deviceCodeHash,
         input.userCodeHash,
         JSON.stringify(input.host),
@@ -188,10 +188,14 @@ class SqliteConnectStore {
       db.prepare(
         `INSERT INTO connect_environments (
                     id, user_id, workspace_id, name, platform, architecture,
+                    driver, runtime, base_path,
                     host_id, signing_public_key, noise_public_key, hostname,
                     tunnel_id, dns_record_id, control_token_hash,
                     access_credential_ciphertext, status, created_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?)`
+                ) VALUES (
+                    ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+                    'active', ?, ?
+                )`
       ).run(
         environment.id,
         input.userId,
@@ -199,6 +203,9 @@ class SqliteConnectStore {
         environment.name,
         environment.platform,
         environment.architecture,
+        environment.driver ?? null,
+        environment.runtime ?? null,
+        environment.base_path ?? null,
         environment.host_id ?? null,
         environment.signing_public_key ?? null,
         environment.noise_public_key ?? null,
@@ -277,6 +284,7 @@ class SqliteConnectStore {
       db.prepare(
         `INSERT INTO connect_environments (
                     id, user_id, workspace_id, name, platform, architecture,
+                    driver, runtime, base_path,
                     host_id, signing_public_key, noise_public_key,
                     authorization_id, hostname, tunnel_id, dns_record_id,
                     control_token_hash, access_credential_ciphertext,
@@ -286,7 +294,7 @@ class SqliteConnectStore {
                     activation_deadline_at, activation_claimed_at,
                     created_at, updated_at
                 ) VALUES (
-                    ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', '', '', ?, ?, ?,
+                    ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', '', '', ?, ?, ?,
                     'provisioning', 0, ?, ?, ?, ?, ?, NULL, ?, ?
                 )`
       ).run(
@@ -296,6 +304,9 @@ class SqliteConnectStore {
         environment.name,
         environment.platform,
         environment.architecture,
+        environment.driver ?? null,
+        environment.runtime ?? null,
+        environment.base_path ?? null,
         environment.host_id ?? null,
         environment.signing_public_key ?? null,
         environment.noise_public_key ?? null,
@@ -835,6 +846,9 @@ function toEnvironmentRecord(row) {
     name: row.name,
     platform: row.platform,
     architecture: row.architecture,
+    driver: row.driver ?? void 0,
+    runtime: row.runtime ?? void 0,
+    base_path: row.base_path ?? void 0,
     host_id: row.host_id ?? void 0,
     signing_public_key: row.signing_public_key ?? void 0,
     noise_public_key: row.noise_public_key ?? void 0,

package/dist/runtime/server/db/d1-dialect.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Small Kysely dialect for a Cloudflare D1 binding.
+ *
+ * D1 exposes an asynchronous prepared-statement API. Keeping this adapter
+ * local avoids pulling a Node-only database driver into a Workers bundle.
+ */
+import { SqliteAdapter, type DatabaseIntrospector, type Dialect, type Driver, type Kysely, type QueryCompiler } from 'kysely';
+export interface D1Result<T = unknown> {
+    success?: boolean;
+    results?: T[];
+    meta?: {
+        changes?: number;
+        last_row_id?: number | string | null;
+    };
+    error?: string;
+}
+export interface D1PreparedStatement {
+    bind(...values: unknown[]): D1PreparedStatement;
+    all<T = unknown>(): Promise<D1Result<T>>;
+    run<T = unknown>(): Promise<D1Result<T>>;
+}
+export interface D1Database {
+    prepare(query: string): D1PreparedStatement;
+    batch?<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+}
+/**
+ * D1 does not expose SQL BEGIN/COMMIT transactions. Callers that require an
+ * atomic write use D1Database.batch(), which is intentionally kept outside
+ * the general-purpose Kysely transaction API.
+ */
+export declare const D1_TRANSACTION_ERROR = "Cloudflare D1 does not support Kysely transactions. Use the D1-specific atomic operation instead.";
+export declare class D1Dialect implements Dialect {
+    private readonly database;
+    constructor(database: D1Database);
+    createAdapter(): SqliteAdapter;
+    createDriver(): Driver;
+    createQueryCompiler(): QueryCompiler;
+    createIntrospector(db: Kysely<unknown>): DatabaseIntrospector;
+}

package/dist/runtime/server/db/d1-dialect.js

@@ -0,0 +1,70 @@
+import {
+  SqliteAdapter,
+  SqliteIntrospector,
+  SqliteQueryCompiler
+} from "kysely";
+export const D1_TRANSACTION_ERROR = "Cloudflare D1 does not support Kysely transactions. Use the D1-specific atomic operation instead.";
+export class D1Dialect {
+  constructor(database) {
+    this.database = database;
+  }
+  createAdapter() {
+    return new SqliteAdapter();
+  }
+  createDriver() {
+    return new D1Driver(this.database);
+  }
+  createQueryCompiler() {
+    return new SqliteQueryCompiler();
+  }
+  createIntrospector(db) {
+    return new SqliteIntrospector(db);
+  }
+}
+class D1Driver {
+  connection;
+  constructor(database) {
+    this.connection = new D1Connection(database);
+  }
+  async init() {
+  }
+  async acquireConnection() {
+    return this.connection;
+  }
+  async beginTransaction() {
+    throw new Error(D1_TRANSACTION_ERROR);
+  }
+  async commitTransaction() {
+    throw new Error(D1_TRANSACTION_ERROR);
+  }
+  async rollbackTransaction() {
+    throw new Error(D1_TRANSACTION_ERROR);
+  }
+  async releaseConnection() {
+  }
+  async destroy() {
+  }
+}
+class D1Connection {
+  constructor(database) {
+    this.database = database;
+  }
+  async executeQuery(compiledQuery) {
+    const statement = this.database.prepare(compiledQuery.sql).bind(...compiledQuery.parameters);
+    const result = await statement.all();
+    if (result.success === false) {
+      throw new Error(result.error ?? "Cloudflare D1 query failed.");
+    }
+    if (result.error) throw new Error(result.error);
+    const changes = result.meta?.changes;
+    const lastRowId = result.meta?.last_row_id;
+    return {
+      rows: result.results ?? [],
+      numAffectedRows: changes === void 0 || changes === null ? void 0 : BigInt(changes),
+      insertId: lastRowId === void 0 || lastRowId === null ? void 0 : BigInt(lastRowId)
+    };
+  }
+  async *streamQuery(compiledQuery) {
+    yield await this.executeQuery(compiledQuery);
+  }
+}

package/dist/runtime/server/db/d1.d.ts

@@ -0,0 +1,13 @@
+/** Native helpers for the D1 operations that need batch-level atomicity. */
+import type { D1Result } from './d1-dialect.js';
+export type D1SqlStatement = {
+    sql: string;
+    parameters?: readonly unknown[];
+};
+export declare function d1All<T = Record<string, unknown>>(sql: string, ...parameters: unknown[]): Promise<T[]>;
+export declare function d1Run(sql: string, ...parameters: unknown[]): Promise<D1Result>;
+/**
+ * D1 runs all statements in a batch sequentially and atomically. It is the
+ * native replacement for the local BEGIN IMMEDIATE paths in this provider.
+ */
+export declare function d1Batch(statements: readonly D1SqlStatement[]): Promise<D1Result[]>;