Skip to content

feat: add sqlite-wasm package - #30

Merged
Mearman merged 8 commits into
mainfrom
feat/sqlite-wasm
Oct 10, 2026
Merged

Mearman merged 8 commits into
mainfrom
feat/sqlite-wasm

Conversation

@Mearman

@Mearman Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member

Adds @exadev/process-graph-sqlite-wasm, the browser driver for the SQLite graph store, stacked on #29. Closes #22 once merged, since this is where the spike's decision is implemented.

The worker entry (./worker, serveGraphStoreInWorker({ name })) runs @sqlite.org/sqlite-wasm on the OPFS opfs-sahpool VFS, gives graph-store-sqlite a drizzle-orm/sqlite-proxy database over it, and serves the store's oRPC router on the worker's own message port. The page entry (connectGraphStore(worker)) is an oRPC client over RPCLink.

Why this combination, from the spike in #22: opfs and opfs-wl need SharedArrayBuffer, so they never install without COOP/COEP headers; SQLocal falls back to a per-tab in-memory database without them; opfs-sahpool works without headers but a pool is exclusive to one worker. So every store operation takes an exclusive Web Lock named after the database, unpauses the pool, opens the file, runs, and closes and pauses it before releasing the lock. The lock spans the whole store operation because a Drizzle transaction is several proxy calls. Changes committed in one tab reach every tab's changes subscribers through a BroadcastChannel.

Tests: the conformance kit runs in Chromium through Vitest's browser mode (test:integration) with no cross-origin isolation, a fresh database per test; two workers on one database (as two tabs) read and write each other's data and hear each other's changes; a database outlives the worker that wrote it. Removing the pauseVfs call makes the two-worker test fail. The worker's dependencies are scanned up front (optimizeDeps.entries), because otherwise Vite discovered them mid-run and reloaded the page under the first test.

A separate commit installs Chromium in the CI test job with the package's pinned Playwright (1.63.0; 1.64.0 is inside the install age gate).

The repo-root lint, typecheck, test, test:integration and test:smoke scripts, knip and syncpack all pass at the top of this stack.

npm name to reserve before the first release: npm-reserve @exadev/process-graph-sqlite-wasm --trust ExaDev/process-graph --workflow ci.yml.

@Mearman
Mearman marked this pull request as ready for review October 10, 2026 16:36
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-10-10T23:34:22.352805Z 9d385ce Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Mearman
Mearman changed the base branch from feat/sqlite-node to main October 10, 2026 19:58
@Mearman Mearman closed this Oct 10, 2026
@Mearman Mearman reopened this Oct 10, 2026
@Mearman Mearman closed this Oct 10, 2026
@Mearman Mearman reopened this Oct 10, 2026
@Mearman Mearman closed this Oct 10, 2026
@Mearman Mearman reopened this Oct 10, 2026
@Mearman Mearman closed this Oct 10, 2026
@Mearman Mearman reopened this Oct 10, 2026
@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 69f3d56088

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman Mearman closed this Oct 10, 2026
@Mearman Mearman reopened this Oct 10, 2026
@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: e1b71fcd64

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 391127172f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

The SQLite graph store in the browser: @sqlite.org/sqlite-wasm in a
dedicated worker on the OPFS opfs-sahpool VFS, reached by Drizzle through
drizzle-orm/sqlite-proxy, served to the page over oRPC's message-port
transport (serveGraphStoreInWorker and connectGraphStore).

Each store operation holds an exclusive Web Lock named after the database
while it unpauses the pool, opens the file, runs and pauses it again, so
tabs take turns on one database with no cross-origin isolation headers.
Committed changes reach every tab's subscribers over a BroadcastChannel.

The conformance kit runs in Chromium through Vitest's browser mode, and
further browser tests run two workers on one database and reopen a
database after its writer has gone. The worker module's dependencies are
scanned up front so Vite never reloads the page under running tests.

Refs #22
The SQLite wasm store's integration tests run in Chromium through Vitest's
browser mode, so the test job installs the browser build the package's
pinned Playwright expects before running them.
@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 02f13cb3b7

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Its tests drive a real browser over OPFS, which Stryker's sandboxed copies cannot start, so a run
could only score the few in-process unit tests as if they were the package's coverage.
@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 9d385cea69

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman
Mearman merged commit dcfcdc9 into main Oct 10, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Browser store: sqlite-proxy in an own worker on opfs-sahpool, serialised by a Web Lock

1 participant