@celilo/cli 2.1.0 → 2.2.1

package/src/hooks/hook-store-proxy.test.ts

@@ -0,0 +1,109 @@
+/**
+ * Tests for the child-side hook store view (hook-store-proxy).
+ *
+ * The load-bearing behavior is the transaction buffer: the hook's callback
+ * runs against a buffering view, and NOTHING crosses the transport until the
+ * callback resolves. A hook that writes then throws must send no frame at all
+ * — that is what makes D4's discard real rather than a promise the broker
+ * keeps. These tests watch the transport, which stands in for the socket.
+ */
+
+import { describe, expect, it } from 'bun:test';
+import { type StoreTransport, buildStoreView } from './hook-store-proxy';
+
+/** Record every transport call; answer `get` from a scripted map. */
+function fakeTransport(scripted: Record<string, string> = {}) {
+  const calls: Array<{ store: string; method: string; args: unknown[] }> = [];
+  const transport: StoreTransport = (store, method, args) => {
+    calls.push({ store, method, args });
+    if (method === 'get') {
+      return Promise.resolve(scripted[args[0] as string]);
+    }
+    return Promise.resolve(null);
+  };
+  return { calls, transport };
+}
+
+describe('hook store view (child side)', () => {
+  it('keeps the map surface readable alongside the accessor methods', () => {
+    const { transport } = fakeTransport({ bot_token: 'v' });
+    const view = buildStoreView('secrets', { bot_token: 'v' }, transport);
+
+    expect(view.bot_token).toBe('v');
+    expect(view.get('bot_token')).resolves.toBe('v');
+  });
+
+  it('forwards set/get/delete to the transport with the store name', async () => {
+    const { calls, transport } = fakeTransport();
+    const view = buildStoreView('config', {}, transport);
+
+    await view.set('public_ip', '203.0.113.7');
+    await view.delete('public_ip');
+
+    expect(calls).toEqual([
+      { store: 'config', method: 'set', args: ['public_ip', '203.0.113.7'] },
+      { store: 'config', method: 'delete', args: ['public_ip'] },
+    ]);
+  });
+
+  it('transaction sends one frame with the buffered ops after fn resolves', async () => {
+    const { calls, transport } = fakeTransport();
+    const view = buildStoreView('secrets', {}, transport);
+
+    await view.transaction((s) => {
+      s.set('bot_token', 'a');
+      s.set('api_key', 'b');
+      s.delete('old_key');
+    });
+
+    expect(calls).toEqual([
+      {
+        store: 'secrets',
+        method: 'transaction',
+        args: [
+          [
+            { op: 'set', name: 'bot_token', value: 'a' },
+            { op: 'set', name: 'api_key', value: 'b' },
+            { op: 'delete', name: 'old_key' },
+          ],
+        ],
+      },
+    ]);
+  });
+
+  it('a throwing fn sends NOTHING — the discard is on the wire', async () => {
+    const { calls, transport } = fakeTransport();
+    const view = buildStoreView('secrets', {}, transport);
+
+    await expect(
+      view.transaction(async (s) => {
+        s.set('bot_token', 'doomed');
+        throw new Error('hook failed midway');
+      }),
+    ).rejects.toThrow('hook failed midway');
+
+    expect(calls).toEqual([]);
+  });
+
+  it('get inside a transaction reads committed state, not the buffer', async () => {
+    const { transport } = fakeTransport({ bot_token: 'committed' });
+    const view = buildStoreView('secrets', {}, transport);
+
+    let seenInside: string | undefined;
+    await view.transaction(async (s) => {
+      s.set('bot_token', 'buffered');
+      seenInside = await s.get('bot_token');
+    });
+    expect(seenInside).toBe('committed');
+  });
+
+  it('a nested transaction rejects instead of reordering writes', async () => {
+    const { calls, transport } = fakeTransport();
+    const view = buildStoreView('secrets', {}, transport);
+
+    await expect(view.transaction((s) => s.transaction(() => Promise.resolve()))).rejects.toThrow(
+      /nested|transaction/i,
+    );
+    expect(calls).toEqual([]);
+  });
+});

package/src/hooks/hook-store-proxy.ts

@@ -0,0 +1,85 @@
+/**
+ * The asking half of the hook-owned-state accessor.
+ *
+ * Lives in the hook's own process (the runner shim builds the context from
+ * this), where every operation must cross the socket as a `store` frame. The
+ * answering half is `hook-store.ts` broker-side.
+ *
+ * The one subtlety is `transaction` (hook-owned-state design D4): the hook's
+ * callback runs entirely child-side against a BUFFERING view, and nothing is
+ * sent until the callback resolves. A hook that writes three names and throws
+ * therefore sends no frame at all — the discard is a property of the wire, not
+ * a promise the broker has to keep. This is the inverse of plain `set`, which
+ * lands when called; the design makes that trade deliberately and puts the
+ * choice at the call site.
+ *
+ * Pure construction (Rule 10.4) — the transport is injected, so the buffering
+ * rules are testable with no socket.
+ */
+
+import type { HookStore } from '@celilo/capabilities';
+import type { BufferedStoreOp } from './hook-protocol';
+
+/** One operation on a store, transported. The injectable boundary. */
+export type StoreTransport = (
+  store: 'secrets' | 'config',
+  method: 'get' | 'set' | 'delete' | 'transaction',
+  args: unknown[],
+) => Promise<unknown>;
+
+/**
+ * The names a transaction's callback must not call through its buffering view.
+ * A nested transaction has no honest meaning — there is nothing to commit the
+ * outer buffer against yet — and silently ignoring it would reorder writes.
+ */
+class NestedTransactionError extends Error {
+  constructor() {
+    super('transaction() cannot be called inside a transaction; apply the writes directly.');
+    this.name = 'NestedTransactionError';
+  }
+}
+
+/**
+ * Build the object the hook sees as `context.secrets` / `context.config`:
+ * the plain record of current values (the map surface older hooks still read),
+ * plus the four accessor methods.
+ *
+ * Methods sit ON the record deliberately during the migration window — a
+ * module declaring a secret or config key named `get`, `set`, `delete` or
+ * `transaction` would shadow one. That collision is rejected at the manifest
+ * layer only after task 3.6 removes the map surface; until then the risk is
+ * carried, not hidden.
+ */
+export function buildStoreView<T extends Record<string, unknown>>(
+  store: 'secrets' | 'config',
+  currentValues: T,
+  transport: StoreTransport,
+): T & HookStore {
+  const call = (method: 'get' | 'set' | 'delete', args: unknown[]) =>
+    transport(store, method, args) as Promise<unknown>;
+
+  const view = {
+    get: (name: string) => call('get', [name]) as Promise<string | undefined>,
+    set: (name: string, value: string) => call('set', [name, value]) as Promise<void>,
+    delete: (name: string) => call('delete', [name]) as Promise<void>,
+    transaction: async (fn: (buffered: HookStore) => void | Promise<void>) => {
+      const ops: BufferedStoreOp[] = [];
+      const buffered: HookStore = {
+        get: view.get,
+        set: (name, value) => {
+          ops.push({ op: 'set', name, value });
+          return Promise.resolve();
+        },
+        delete: (name) => {
+          ops.push({ op: 'delete', name });
+          return Promise.resolve();
+        },
+        transaction: () => Promise.reject(new NestedTransactionError()),
+      };
+      await fn(buffered);
+      await transport(store, 'transaction', [ops]);
+    },
+  };
+
+  return { ...currentValues, ...view } as T & HookStore;
+}

package/src/hooks/hook-store.test.ts

@@ -0,0 +1,168 @@
+/**
+ * Tests for the broker-side hook state stores (hook-owned-state tasks 3.2-3.4).
+ *
+ * The stores are what a jailed hook's `context.secrets` / `context.config`
+ * accessors answer against. Everything here runs against a real temp database
+ * with real encryption, because the interesting failures are storage failures:
+ * a value that will not decrypt back is worse than one that was never written.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type DbClient, closeDb, createDbClient } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { moduleConfigs, modules, secrets } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
+import { createHookStores } from './hook-store';
+
+describe('hook stores', () => {
+  let testDbPath: string;
+  let testDir: string;
+  let db: DbClient;
+
+  const MANIFEST = {
+    secrets: { declares: [{ name: 'bot_token' }, { name: 'api_key' }] },
+    variables: {
+      owns: [
+        { name: 'public_ip', type: 'string', source: 'hook' },
+        { name: 'registered_peers', type: 'string-map', source: 'hook' },
+        { name: 'acme_email', type: 'string', source: 'user' },
+      ],
+    },
+  };
+
+  beforeEach(async () => {
+    testDir = mkdtempSync(join(tmpdir(), 'celilo-hook-store-'));
+    testDbPath = join(testDir, 'test.db');
+    process.env.CELILO_DB_PATH = testDbPath;
+    // Redirect the master key so the test never touches the operator's real one.
+    process.env.CELILO_MASTER_KEY_PATH = join(testDir, 'master.key');
+    await runMigrations(testDbPath);
+
+    db = createDbClient({ path: testDbPath });
+    db.insert(modules)
+      .values({
+        id: 'test-module',
+        name: 'Test Module',
+        version: '1.0.0',
+        manifestData: MANIFEST,
+        sourcePath: '/test/path',
+      })
+      .run();
+  });
+
+  afterEach(() => {
+    closeDb();
+    // The variable pointed at this suite's (now removed) temp database;
+    // leaving it set sends the next var-less reader at a dangling path.
+    // Reset to the scratch path so no later reader reaches the operator's
+    // real celilo.db (celilo#1315).
+    resetTestDbPath();
+    rmSync(testDir, { recursive: true, force: true });
+    delete process.env.CELILO_MASTER_KEY_PATH;
+  });
+
+  it('round-trips a secret through encrypt and decrypt', async () => {
+    const { secrets: store } = await createHookStores(db, 'test-module');
+
+    await store.set('bot_token', 's3cret-value');
+    expect(await store.get('bot_token')).toBe('s3cret-value');
+  });
+
+  it('round-trips a hook-owned config value as plaintext', async () => {
+    const { config } = await createHookStores(db, 'test-module');
+
+    await config.set('public_ip', '203.0.113.7');
+    expect(await config.get('public_ip')).toBe('203.0.113.7');
+
+    // Plaintext: the row lands in module_configs, never in the secrets table.
+    const rows = db.select().from(moduleConfigs).all();
+    expect(rows.some((r) => r.key === 'public_ip' && r.valueJson === '"203.0.113.7"')).toBe(true);
+    expect(rows.some((r) => r.key === 'public_ip' && r.source === 'hook')).toBe(true);
+  });
+
+  it('set on an undeclared secret throws naming the module and the declared set', async () => {
+    const { secrets: store } = await createHookStores(db, 'test-module');
+
+    expect(store.set('not_declared', 'x')).rejects.toThrow(
+      /test-module[\s\S]*not_declared[\s\S]*bot_token[\s\S]*api_key/,
+    );
+  });
+
+  it('set on a name not owned as source: hook config throws naming the declared set', async () => {
+    const { config } = await createHookStores(db, 'test-module');
+
+    // acme_email is declared, but as source: user — the operator owns it.
+    await expect(config.set('acme_email', 'x')).rejects.toThrow(/source: hook/);
+    await expect(config.set('not_declared', 'x')).rejects.toThrow(/public_ip/);
+  });
+
+  it('delete of an absent name is a no-op', async () => {
+    const { secrets: store, config } = await createHookStores(db, 'test-module');
+
+    await expect(store.delete('bot_token')).resolves.toBeUndefined();
+    await expect(config.delete('public_ip')).resolves.toBeUndefined();
+  });
+
+  it('delete removes an existing row', async () => {
+    const { config } = await createHookStores(db, 'test-module');
+
+    await config.set('public_ip', '203.0.113.7');
+    await config.delete('public_ip');
+    expect(await config.get('public_ip')).toBeUndefined();
+  });
+
+  it('applyTransaction commits every buffered op on success', async () => {
+    const { secrets: store } = await createHookStores(db, 'test-module');
+
+    await store.applyTransaction([
+      { op: 'set', name: 'bot_token', value: 'committed' },
+      { op: 'set', name: 'api_key', value: 'committed-too' },
+    ]);
+    expect(await store.get('bot_token')).toBe('committed');
+    expect(await store.get('api_key')).toBe('committed-too');
+  });
+
+  it('an undeclared name inside a transaction discards the whole batch', async () => {
+    const { secrets: store } = await createHookStores(db, 'test-module');
+
+    await expect(
+      store.applyTransaction([
+        { op: 'set', name: 'api_key', value: 'good' },
+        { op: 'set', name: 'not_declared', value: 'bad' },
+      ]),
+    ).rejects.toThrow(/not_declared/);
+
+    expect(await store.get('api_key')).toBeUndefined();
+  });
+
+  it('a name owned as config is not writable through the secrets store and vice versa', async () => {
+    const { secrets: store, config } = await createHookStores(db, 'test-module');
+
+    await expect(store.set('public_ip', 'x')).rejects.toThrow(/bot_token|api_key/);
+    await expect(config.set('bot_token', 'x')).rejects.toThrow(/source: hook|public_ip/);
+  });
+
+  it('reads secrets the ordinary interview path wrote, and writes stay visible to it', async () => {
+    // The interview encrypts directly into the secrets table; the store must
+    // read those rows, not only its own writes.
+    const { encryptSecret } = await import('../secrets/encryption');
+    const { getOrCreateMasterKey } = await import('../secrets/master-key');
+    const masterKey = await getOrCreateMasterKey();
+    const encrypted = encryptSecret('interview-value', masterKey);
+    db.insert(secrets)
+      .values({ moduleId: 'test-module', name: 'bot_token', ...encrypted })
+      .run();
+
+    const { secrets: store } = await createHookStores(db, 'test-module');
+    expect(await store.get('bot_token')).toBe('interview-value');
+  });
+
+  it('reports the declared sets in the store metadata', async () => {
+    const stores = await createHookStores(db, 'test-module');
+    expect(stores.declaredSecretNames.sort()).toEqual(['api_key', 'bot_token']);
+    expect(stores.declaredConfigNames.sort()).toEqual(['public_ip', 'registered_peers']);
+  });
+});

package/src/hooks/hook-store.ts

@@ -0,0 +1,290 @@
+/**
+ * The broker side of the hook-owned-state accessor (hook-owned-state tasks
+ * 3.1-3.4, design option C).
+ *
+ * A hook runs out of process and reaches its own persistent state only through
+ * the wire (see `hook-protocol.ts` `StoreCallFrame`). This module is the thing
+ * those frames land on: two stores over `(db, moduleId, manifest, masterKey)`
+ * — `secrets`, validated against `manifest.secrets.declares` and encrypted,
+ * and `config`, validated against `variables.owns` where `source: hook` and
+ * stored plaintext in `module_configs`.
+ *
+ * Validation is against the MANIFEST, not the database. The whole point
+ * (design D2) is that a typo in a hook is a loud error naming the module and
+ * the declared set, never a phantom row some later reader mistakes for state.
+ *
+ * The transaction is applied inside one `db.transaction` (same mechanism as
+ * IPAM allocation in `variables/context.ts`). The buffering half lives
+ * child-side in the runner proxy, so a throwing `fn` sends no frame at all;
+ * what arrives here is a finished operation list that either applies whole or
+ * throws whole.
+ *
+ * Execution functions (Rule 10.1) — each method performs its own storage
+ * effects; construction is pure planning.
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { z } from 'zod';
+import type { DbClient } from '../db/client';
+import { moduleConfigs, modules, secrets } from '../db/schema';
+import { type EncryptedSecret, decryptSecret, encryptSecret } from '../secrets/encryption';
+import { getOrCreateMasterKey } from '../secrets/master-key';
+import { deleteModuleConfig, upsertModuleConfig } from '../services/module-config';
+import type { BufferedStoreOp } from './hook-protocol';
+
+/**
+ * The manifest surface the stores validate against, read out of
+ * `modules.manifestData` and narrowed. Everything else in the manifest is
+ * irrelevant here — this is deliberately a projection, not a parse of the
+ * whole schema, so a manifest feature the stores never read cannot break a
+ * hook run.
+ */
+const StoreManifestSchema = z.object({
+  secrets: z
+    .object({ declares: z.array(z.object({ name: z.string() }).passthrough()).optional() })
+    .optional(),
+  variables: z
+    .object({
+      owns: z
+        .array(z.object({ name: z.string(), source: z.string().optional() }).passthrough())
+        .optional(),
+    })
+    .optional(),
+});
+
+/** The two stores a hook may touch, keyed as the wire names them. */
+export interface HookStores {
+  readonly secrets: HookStoreBackend;
+  readonly config: HookStoreBackend;
+  /** Diagnostic mirror of what each store validates against. */
+  readonly declaredSecretNames: string[];
+  readonly declaredConfigNames: string[];
+}
+
+/**
+ * One store's answering half. Shaped like `HookStore` from
+ * `@celilo/capabilities` except that `transaction` takes the operation list
+ * the child buffered — the buffering happens there, the atomicity here.
+ */
+export interface HookStoreBackend {
+  get(name: string): Promise<string | undefined>;
+  set(name: string, value: string): Promise<void>;
+  delete(name: string): Promise<void>;
+  applyTransaction(ops: readonly BufferedStoreOp[]): Promise<void>;
+}
+
+/**
+ * Throw for an undeclared name, naming the module and the declared set
+ * (task 3.4 — ERROR, not warning, design D2).
+ */
+function undeclared(
+  moduleId: string,
+  kind: 'secret' | 'hook-owned config',
+  name: string,
+  declared: string[],
+): Error {
+  const declaredList = declared.length > 0 ? declared.join(', ') : '(none)';
+  const where =
+    kind === 'secret'
+      ? `Add '${name}' to secrets.declares in the module's manifest.yml.`
+      : `Add '${name}' to variables.owns with source: hook in the module's manifest.yml.`;
+  return new Error(
+    `Module '${moduleId}' has no declared ${kind} '${name}'. Declared ${kind} names: ${declaredList}. ${where}`,
+  );
+}
+
+/** Secrets store: encrypted rows in the `secrets` table, keyed `(moduleId, name)`. */
+function createSecretsStore(db: DbClient, moduleId: string, declared: string[]): HookStoreBackend {
+  const assertDeclared = (name: string) => {
+    if (!declared.includes(name)) throw undeclared(moduleId, 'secret', name, declared);
+  };
+
+  const upsert = (name: string, encrypted: EncryptedSecret) => {
+    const existing = db
+      .select()
+      .from(secrets)
+      .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, name)))
+      .get();
+    if (existing) {
+      db.update(secrets)
+        .set({
+          encryptedValue: encrypted.encryptedValue,
+          iv: encrypted.iv,
+          authTag: encrypted.authTag,
+          updatedAt: new Date(),
+        })
+        .where(eq(secrets.id, existing.id))
+        .run();
+    } else {
+      db.insert(secrets)
+        .values({ moduleId, name, ...encrypted })
+        .run();
+    }
+  };
+
+  return {
+    async get(name) {
+      assertDeclared(name);
+      const row = db
+        .select()
+        .from(secrets)
+        .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, name)))
+        .get();
+      if (!row) return undefined;
+      const masterKey = await getOrCreateMasterKey();
+      return decryptSecret(
+        { encryptedValue: row.encryptedValue, iv: row.iv, authTag: row.authTag },
+        masterKey,
+      );
+    },
+
+    async set(name, value) {
+      assertDeclared(name);
+      const masterKey = await getOrCreateMasterKey();
+      upsert(name, encryptSecret(value, masterKey));
+    },
+
+    async delete(name) {
+      assertDeclared(name);
+      db.delete(secrets)
+        .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, name)))
+        .run();
+    },
+
+    async applyTransaction(ops) {
+      // Validate EVERY name before writing ANY row: a batch with one undeclared
+      // name must discard whole, not half-apply then throw (task 3.7).
+      for (const entry of ops) assertDeclared(entry.name);
+      const masterKey = await getOrCreateMasterKey();
+      db.transaction((tx) => {
+        for (const entry of ops) {
+          if (entry.op === 'set') {
+            upsertTx(
+              tx as unknown as DbClient,
+              entry.name,
+              encryptSecret(entry.value ?? '', masterKey),
+            );
+          } else {
+            tx.delete(secrets)
+              .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, entry.name)))
+              .run();
+          }
+        }
+      });
+    },
+  };
+
+  function upsertTx(tx: DbClient, name: string, encrypted: EncryptedSecret): void {
+    const existing = tx
+      .select()
+      .from(secrets)
+      .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, name)))
+      .get();
+    if (existing) {
+      tx.update(secrets)
+        .set({
+          encryptedValue: encrypted.encryptedValue,
+          iv: encrypted.iv,
+          authTag: encrypted.authTag,
+          updatedAt: new Date(),
+        })
+        .where(eq(secrets.id, existing.id))
+        .run();
+    } else {
+      tx.insert(secrets)
+        .values({ moduleId, name, ...encrypted })
+        .run();
+    }
+  }
+}
+
+/** Config store: plaintext rows in `module_configs`, `source: hook`. */
+function createConfigStore(db: DbClient, moduleId: string, declared: string[]): HookStoreBackend {
+  const assertDeclared = (name: string) => {
+    if (!declared.includes(name)) {
+      throw undeclared(moduleId, 'hook-owned config', name, declared);
+    }
+  };
+
+  return {
+    async get(name) {
+      assertDeclared(name);
+      const row = db
+        .select()
+        .from(moduleConfigs)
+        .where(and(eq(moduleConfigs.moduleId, moduleId), eq(moduleConfigs.key, name)))
+        .get();
+      // Hook-owned rows are always written through `set`, so `valueJson` holds
+      // a JSON string literal of exactly what the hook sent. Absent means never
+      // written; null valueJson is a legacy row shape no hook-owned key can
+      // have (the source column did not exist when those were written).
+      if (!row?.valueJson) return undefined;
+      const parsed: unknown = JSON.parse(row.valueJson);
+      return typeof parsed === 'string' ? parsed : JSON.stringify(parsed);
+    },
+
+    async set(name, value) {
+      assertDeclared(name);
+      upsertModuleConfig(db, moduleId, name, value, 'hook');
+    },
+
+    async delete(name) {
+      assertDeclared(name);
+      deleteModuleConfig(db, moduleId, name);
+    },
+
+    async applyTransaction(ops) {
+      for (const entry of ops) assertDeclared(entry.name);
+      db.transaction((tx) => {
+        // Same narrowing the secrets store applies below: drizzle hands the
+        // callback a transaction handle, and module-config's writers accept
+        // the full client it derives from.
+        const txDb = tx as unknown as DbClient;
+        for (const entry of ops) {
+          if (entry.op === 'set') {
+            upsertModuleConfig(txDb, moduleId, entry.name, entry.value ?? '', 'hook');
+          } else {
+            deleteModuleConfig(txDb, moduleId, entry.name);
+          }
+        }
+      });
+    },
+  };
+}
+
+/**
+ * Build both stores for a module from its stored manifest.
+ *
+ * The master key is NOT touched here — it loads lazily inside the operations
+ * that need it, so building stores for a hook that never writes a secret has
+ * no key-file side effect.
+ *
+ * Execution function — reads the module row. Throws when the module row or its
+ * manifest is missing, because a hook for a module celilo cannot describe is a
+ * run that cannot be attributed.
+ */
+export async function createHookStores(db: DbClient, moduleId: string): Promise<HookStores> {
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) {
+    throw new Error(`Cannot build hook stores: module '${moduleId}' not found.`);
+  }
+
+  const parsed = StoreManifestSchema.safeParse(module.manifestData);
+  if (!parsed.success) {
+    throw new Error(
+      `Cannot build hook stores for '${moduleId}': stored manifest does not match the expected shape (${parsed.error.issues[0]?.message ?? 'invalid'}).`,
+    );
+  }
+
+  const declaredSecretNames = (parsed.data.secrets?.declares ?? []).map((s) => s.name);
+  const declaredConfigNames = (parsed.data.variables?.owns ?? [])
+    .filter((v) => v.source === 'hook')
+    .map((v) => v.name);
+
+  return {
+    secrets: createSecretsStore(db, moduleId, declaredSecretNames),
+    config: createConfigStore(db, moduleId, declaredConfigNames),
+    declaredSecretNames,
+    declaredConfigNames,
+  };
+}

package/src/hooks/hook-timeout.test.ts

@@ -23,6 +23,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { executeHookScript } from './executor';
 import { createCapturingLogger } from './logger';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 
 const FIXTURES = join(__dirname, 'test-fixtures');
@@ -40,8 +41,8 @@ function scratch(): string {
 
 function contextFor(config: Record<string, unknown>): HookContext {
   return {
-    config,
-    secrets: {},
+    config: configStore(config),
+    secrets: secretStore(),
     systems: [],
     logger: createCapturingLogger().logger,
     debug: false,