okengine 0.10.2 → 0.11.0

package/src/cli/vault-secure-input.test.ts

@@ -0,0 +1,56 @@
+/**
+ * Unit tests for hidden / stdin master-key helpers.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { EventEmitter } from "node:events";
+import { promptHidden, readStdinSecure } from "./vault-secure-input.ts";
+
+describe("readStdinSecure", () => {
+  test("trims a full stdin payload", async () => {
+    const stdin = new EventEmitter() as EventEmitter & {
+      setEncoding?: (encoding: BufferEncoding) => void;
+    };
+    stdin.setEncoding = () => undefined;
+    const pending = readStdinSecure(stdin);
+    stdin.emit("data", "  abc123\n");
+    stdin.emit("end");
+    expect(await pending).toBe("abc123");
+  });
+});
+
+describe("promptHidden", () => {
+  test("masks characters and resolves on Enter", async () => {
+    const stdin = new EventEmitter() as EventEmitter & {
+      setRawMode?: (mode: boolean) => void;
+      off?: (event: string, listener: (...args: unknown[]) => void) => void;
+    };
+    let raw = false;
+    stdin.setRawMode = (mode) => {
+      raw = mode;
+    };
+    stdin.off = (event: string | symbol, listener: (...args: unknown[]) => void) => {
+      stdin.removeListener(event, listener);
+      return stdin;
+    };
+    let written = "";
+    const pending = promptHidden("key: ", {
+      stdin,
+      write: (t) => {
+        written += t;
+      },
+      exit: () => {
+        throw new Error("exit should not run");
+      },
+    });
+    // Allow the listener to attach.
+    await Promise.resolve();
+    stdin.emit("data", "ab");
+    stdin.emit("data", "\r");
+    expect(await pending).toBe("ab");
+    expect(written).toContain("key: ");
+    expect(written).toContain("**");
+    expect(written).not.toContain("ab");
+    expect(raw).toBe(false);
+  });
+});

package/src/cli/vault-secure-input.ts

@@ -0,0 +1,124 @@
+/**
+ * Secure master-key input for `oke vault` — avoid shell history.
+ *
+ * Prefer `--key -` (stdin) or an interactive hidden prompt over putting
+ * base64 keys on the argv in shared environments.
+ */
+
+/** Minimal readable stream used by {@link readStdinSecure}. */
+export interface SecureStdin {
+  setEncoding?(encoding: BufferEncoding): void;
+  on(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+  on(event: "end", listener: () => void): unknown;
+  on(event: "error", listener: (error: Error) => void): unknown;
+}
+
+/** Minimal TTY-ish stdin used by {@link promptHidden}. */
+export interface SecurePromptStdin {
+  setRawMode?(mode: boolean): void;
+  on(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+  removeListener?(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+  off?(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+}
+
+/** IO sinks for {@link promptHidden}. */
+export interface PromptHiddenOptions {
+  /** Prompt destination. Defaults to `process.stdout.write`. */
+  readonly write?: (text: string) => void;
+  /** Character stream (TTY). Defaults to `process.stdin`. */
+  readonly stdin?: SecurePromptStdin;
+  /** Exit handler for Ctrl+C. Defaults to `process.exit`. */
+  readonly exit?: (code: number) => void;
+}
+
+/**
+ * Read a trimmed secret from stdin (for `--key -` / `--new-key -`).
+ *
+ * @param stdin - Readable stream; defaults to `process.stdin`
+ */
+export async function readStdinSecure(stdin: SecureStdin = process.stdin): Promise<string> {
+  stdin.setEncoding?.("utf8");
+  return new Promise((resolve, reject) => {
+    let data = "";
+    stdin.on("data", (chunk) => {
+      data += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    });
+    stdin.on("end", () => resolve(data.trim()));
+    stdin.on("error", reject);
+  });
+}
+
+/**
+ * Prompt for a secret on a TTY without echoing the cleartext.
+ *
+ * Characters are masked with `*`. Backspace edits; Enter submits; Ctrl+C
+ * exits the process (or the injected `exit` handler).
+ *
+ * @param question - Prompt text written before input
+ * @param options - Injectable IO for tests
+ */
+export async function promptHidden(
+  question: string,
+  options: PromptHiddenOptions = {},
+): Promise<string> {
+  const write = options.write ?? ((t: string) => process.stdout.write(t));
+  const stdin = options.stdin ?? process.stdin;
+  const exit = options.exit ?? ((code: number) => process.exit(code));
+
+  write(question);
+  stdin.setRawMode?.(true);
+
+  return new Promise((resolve) => {
+    let input = "";
+    const onData = (char: string | Buffer): void => {
+      const text = typeof char === "string" ? char : char.toString("utf8");
+      for (const ch of text) {
+        if (ch === "\n" || ch === "\r" || ch === "\u0004") {
+          stdin.setRawMode?.(false);
+          write("\n");
+          removeDataListener(stdin, onData);
+          resolve(input);
+          return;
+        }
+        if (ch === "\u0003") {
+          stdin.setRawMode?.(false);
+          write("\n");
+          removeDataListener(stdin, onData);
+          exit(1);
+          return;
+        }
+        if (ch === "\u007f" || ch === "\b") {
+          if (input.length > 0) {
+            input = input.slice(0, -1);
+            write("\b \b");
+          }
+          continue;
+        }
+        // Ignore other control characters.
+        if (ch < " ") continue;
+        input += ch;
+        write("*");
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+/**
+ * Detach the raw-mode data listener when the host supports it.
+ *
+ * @param stdin - Prompt stdin
+ * @param listener - Handler to remove
+ */
+function removeDataListener(
+  stdin: SecurePromptStdin,
+  listener: (chunk: string | Buffer) => void,
+): void {
+  if (typeof stdin.off === "function") {
+    stdin.off("data", listener);
+    return;
+  }
+  if (typeof stdin.removeListener === "function") {
+    stdin.removeListener("data", listener);
+  }
+}

package/src/compiler/effects-infer.ts

@@ -120,6 +120,9 @@ const WRITE_METHODS = new Set([
   "putImage",
 ]);
 
+/** `fx.vault.*` methods whose first argument is a secret path. */
+const VAULT_PATH_METHODS = new Set(["get", "set", "rotate", "delete"]);
+
 /** Methods whose first argument is a table / collection identifier. */
 const TABLE_ARG_METHODS = new Set([
   "insert",
@@ -189,6 +192,10 @@ export function inferEffects(options: InferEffectsOptions): InferredEffects {
     }
 
     if (chain.rootMethod === "vault" && call === chain.rootCall) {
+      // `fx.vault.list()` / `fx.vault.status()` take no path — nothing to
+      // declare. Every other method's first argument is the secret.
+      const method = chain.methods[1] ?? "get";
+      if (!VAULT_PATH_METHODS.has(method)) continue;
       const ref = resolveNamed(call.arguments[0], options.bindings, "secret");
       if (ref) secrets.add(ref);
       continue;

package/src/compiler/extract.ts

@@ -1022,8 +1022,20 @@ function collectConfig(opts: AstNode | undefined, scope: ProjectScope): void {
   const images = objectProp(opts, "images");
   if (images) {
     const map: Record<string, string> = {};
+    // Nested like `drivers`: `store.*` / `channel.*` flatten to dotted keys;
+    // everything else (`vault`, `ai`, `pgdog`, `proxy`) is already flat.
+    for (const nestKey of ["store", "channel"] as const) {
+      const nested = objectProp(images, nestKey);
+      if (!nested || nested.type !== "ObjectExpression") continue;
+      for (const prop of objectProperties(nested)) {
+        const key = propKey(prop);
+        const val = stringArg((prop as AstNode & { value?: AstNode }).value);
+        if (key && val) map[`${nestKey}.${key}`] = val;
+      }
+    }
     for (const prop of objectProperties(images)) {
       const key = propKey(prop);
+      if (key === "store" || key === "channel") continue;
       const val = stringArg((prop as AstNode & { value?: AstNode }).value);
       if (key && val) map[key] = val;
     }

package/src/compiler/fixtures/skyport/oke.config.ts

@@ -2,21 +2,23 @@ import { defineConfig } from "okengine/config";
 
 export default defineConfig({
   drivers: {
-    prod: ["postgres", "redis", "s3", "smtp", "openbao", "anthropic", "pgvector"],
+    prod: ["postgres", "redis", "s3", "smtp", "vault", "anthropic", "pgvector"],
     store: {
-      sql: { local: "sqlite", prod: { driver: "postgres" } },
+      sql: { dev: { driver: "postgres" }, test: "pglite", prod: { driver: "postgres" } },
       kv: { prod: "redis" },
       files: { prod: "s3" },
       index: { prod: "pgvector" },
     },
     signal: { prod: "redis" },
-    vault: { prod: "openbao" },
+    vault: { prod: "vault" },
     channel: { email: { prod: "smtp" } },
     ai: { prod: { driver: "anthropic" } },
   },
   images: {
-    "store.sql": "pgvector/pgvector:pg17",
-    "store.kv": "valkey/valkey:8-alpine",
+    store: {
+      sql: "pgvector/pgvector:pg17",
+      kv: "valkey/valkey:8-alpine",
+    },
   },
   i18n: { locales: ["en", "ar"], default: "ar", dir: { ar: "rtl" } },
   tenancy: { isolation: "row" },

package/src/compiler/fixtures/skyport/src/flows/payments/index.ts

@@ -7,7 +7,7 @@ export const chargeBooking = flow("payments.chargeBooking", {
     // Journal only serializable step values — a Redacted is not journaled.
     const intent = await fx.step("create-intent", async () => ({
       id: `pi_${orderId}`,
-      key: fx.vault(stripeKey).reveal(),
+      key: (await fx.vault.get(stripeKey)).reveal(),
     }));
     await fx.clock.sleep("verify-window", "2m");
     return fx.step("confirm", () => intent);

package/src/compiler/fixtures/skyport.expected.json

@@ -162,7 +162,7 @@
     }
   },
   "drivers": {
-    "prod": ["postgres", "redis", "s3", "smtp", "openbao", "anthropic", "pgvector"]
+    "prod": ["postgres", "redis", "s3", "smtp", "vault", "anthropic", "pgvector"]
   },
   "tenancy": {
     "isolation": "row"

package/src/compiler/generate-adopt.ts

@@ -12,7 +12,7 @@
  * `<rootDir>/src/flows/*` has an `index.ts` barrel.
  */
 
-import { readdir } from "node:fs/promises";
+import { mkdir, readdir, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 /** Options for {@link generateAdoptBarrel}. */
@@ -37,9 +37,35 @@ const GENERATED_HEADER =
   "// AUTO-GENERATED by `oke dev` / `oke build` — do not edit by hand.\n" +
   "// Regenerated from every `src/flows/<unit>/index.ts` unit folder.\n";
 
+/** Filename of the on-disk `.adopt()` barrel under the flows directory. */
+export const ADOPT_BARREL_FILE = "generated.ts";
+
 /** A folder name usable as an `export * as <name>` binding. */
 const VALID_UNIT_NAME = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 
+/**
+ * Write the adopt barrel atomically: `generated.ts.tmp` → rename to
+ * `generated.ts`. Concurrent readers (e.g. `bun --hot` racing a save) never
+ * observe a torn/partial file — plain `writeFile` on the destination would
+ * truncate first.
+ *
+ * @param rootDir - Project root
+ * @param source - Full barrel source from {@link generateAdoptBarrel}
+ * @param flowsDir - Flows directory relative to root (default `"src/flows"`)
+ */
+export async function writeAdoptBarrel(
+  rootDir: string,
+  source: string,
+  flowsDir = "src/flows",
+): Promise<void> {
+  const dir = join(rootDir, flowsDir);
+  const target = join(dir, ADOPT_BARREL_FILE);
+  const tmp = `${target}.tmp`;
+  await mkdir(dir, { recursive: true });
+  await writeFile(tmp, source);
+  await rename(tmp, target);
+}
+
 /**
  * Scan `<rootDir>/<flowsDir>/*` and emit a barrel re-exporting every unit
  * folder's `index.ts` under its folder name — the same shape

package/src/compiler-entry.ts

@@ -0,0 +1,7 @@
+/**
+ * `okengine/compiler` — AoT / dynamic route compile + Manifest extract.
+ *
+ * @module
+ */
+
+export * from "./compiler/index.ts";

package/src/config/define-config.test.ts

@@ -1,82 +1,146 @@
 /**
- * `defineConfig` fills missing `docker` pins from `prod` and normalizes legacy keys.
+ * `defineConfig` fills missing `dev` pins from `prod` and normalizes legacy keys.
  */
 
 import { describe, expect, test } from "bun:test";
-import { defineConfig, fillDockerFromProd, normalizeEnvDriverMap } from "./index.ts";
+import { defineConfig, fillDevFromProd, normalizeEnvDriverMap } from "./index.ts";
 
-describe("fillDockerFromProd / defineConfig", () => {
-  test("copies prod onto docker when docker is omitted", () => {
-    const filled = fillDockerFromProd({
-      local: "sqlite",
+describe("fillDevFromProd / defineConfig", () => {
+  test("copies prod onto dev when dev is omitted", () => {
+    const filled = fillDevFromProd({
+      test: "pglite",
       prod: "postgres",
     });
-    expect(filled?.docker).toBe("postgres");
-    expect(filled?.local).toBe("sqlite");
+    expect(filled?.dev).toBe("postgres");
+    expect(filled?.test).toBe("pglite");
   });
 
-  test("does not overwrite an explicit docker pin", () => {
+  test("does not overwrite an explicit dev pin", () => {
     expect(
-      fillDockerFromProd({
-        local: "sqlite",
-        docker: "memory",
+      fillDevFromProd({
+        dev: "memory",
         prod: "postgres",
-      })?.docker,
+      })?.dev,
     ).toBe("memory");
   });
 
-  test("vault prod → docker copies the prod driver", () => {
-    expect(fillDockerFromProd({ local: "env", prod: "openbao" })?.docker).toBe("openbao");
+  test("vault prod → dev copies the prod driver", () => {
+    expect(fillDevFromProd({ prod: "vault" })?.dev).toBe("vault");
   });
 
   test("defineConfig fills every element from prod", () => {
     const cfg = defineConfig({
       drivers: {
         store: {
-          sql: { local: "sqlite", prod: "postgres" },
-          kv: { local: "memory", prod: "redis" },
-          files: { local: "fs", prod: "s3" },
+          sql: { test: "pglite", prod: "postgres" },
+          kv: { test: "memory", prod: "redis" },
+          files: { test: "memory", prod: "s3" },
         },
-        signal: { local: "memory", prod: "redis" },
-        clock: { local: "memory", prod: "file" },
-        vault: { local: "env", prod: "openbao" },
+        signal: { test: "memory", prod: "redis" },
+        clock: { test: "frozen", prod: "file" },
+        vault: { test: "memory", prod: "vault" },
         channel: {
-          email: { local: "console", prod: "smtp" },
+          email: { test: "console", prod: "smtp" },
         },
-        ai: { local: "mock", prod: "anthropic" },
+        ai: { test: "mock", prod: "anthropic" },
       },
     });
-    expect(cfg.drivers?.store?.sql?.docker).toBe("postgres");
-    expect(cfg.drivers?.store?.kv?.docker).toBe("redis");
-    expect(cfg.drivers?.store?.files?.docker).toBe("s3");
-    expect(cfg.drivers?.signal?.docker).toBe("redis");
-    expect(cfg.drivers?.clock?.docker).toBe("file");
-    expect(cfg.drivers?.vault?.docker).toBe("openbao");
-    expect(cfg.drivers?.channel?.email?.docker).toBe("smtp");
-    expect(cfg.drivers?.ai?.docker).toBe("anthropic");
+    expect(cfg.drivers?.store?.sql).toMatchObject({
+      dev: "postgres",
+      test: "pglite",
+      prod: "postgres",
+    });
+    expect(cfg.drivers?.store?.kv).toMatchObject({
+      dev: "redis",
+      test: "memory",
+      prod: "redis",
+    });
+    expect(cfg.drivers?.store?.files).toMatchObject({
+      dev: "s3",
+      test: "memory",
+      prod: "s3",
+    });
+    expect(cfg.drivers?.signal).toMatchObject({
+      dev: "redis",
+      test: "memory",
+      prod: "redis",
+    });
+    expect(cfg.drivers?.clock).toMatchObject({
+      dev: "file",
+      test: "frozen",
+      prod: "file",
+    });
+    expect(cfg.drivers?.vault).toMatchObject({
+      dev: "vault",
+      test: "memory",
+      prod: "vault",
+    });
+    expect(cfg.drivers?.channel?.email).toMatchObject({
+      dev: "smtp",
+      test: "console",
+      prod: "smtp",
+    });
+    expect(cfg.drivers?.ai).toMatchObject({
+      dev: "anthropic",
+      test: "mock",
+      prod: "anthropic",
+    });
+  });
+
+  test("normalizeEnvDriverMap expands a bare string to all envs", () => {
+    expect(normalizeEnvDriverMap("redis")).toEqual({
+      dev: "redis",
+      test: "redis",
+      prod: "redis",
+    });
   });
 
-  test("normalizeEnvDriverMap maps legacy keys", () => {
+  test("normalizeEnvDriverMap keeps only dev/test/prod keys", () => {
     const normalized = normalizeEnvDriverMap({
-      dev: "sqlite",
-      stack: "postgres",
+      dev: "postgres",
+      test: "pglite",
+      prod: "postgres",
+    });
+    expect(normalized).toEqual({
+      dev: "postgres",
+      test: "pglite",
       prod: "postgres",
     });
-    expect(normalized?.local).toBe("sqlite");
-    expect(normalized?.docker).toBe("postgres");
-    expect((normalized as { dev?: string } | undefined)?.dev).toBeUndefined();
-    expect((normalized as { stack?: string } | undefined)?.stack).toBeUndefined();
   });
 
-  test("defineConfig accepts legacy driver-map keys", () => {
-    const cfg = defineConfig({
-      drivers: {
-        store: {
-          sql: { dev: "sqlite", stack: "postgres", prod: "postgres" } as never,
+  test("defineConfig rejects sqlite", () => {
+    expect(() =>
+      defineConfig({
+        drivers: {
+          store: {
+            sql: { dev: "sqlite", test: "pglite", prod: "postgres" },
+          },
         },
-      },
-    });
-    expect(cfg.drivers?.store?.sql?.local).toBe("sqlite");
-    expect(cfg.drivers?.store?.sql?.docker).toBe("postgres");
+      }),
+    ).toThrow(/sqlite/);
+  });
+
+  test("defineConfig rejects libsql", () => {
+    expect(() =>
+      defineConfig({
+        drivers: {
+          store: {
+            sql: { dev: "libsql", test: "pglite", prod: "postgres" },
+          },
+        },
+      }),
+    ).toThrow(/libsql/);
+  });
+
+  test("defineConfig rejects non-pglite test SQL", () => {
+    expect(() =>
+      defineConfig({
+        drivers: {
+          store: {
+            sql: { dev: "postgres", test: "memory", prod: "postgres" },
+          },
+        },
+      }),
+    ).toThrow(/pglite/);
   });
 });

package/src/config/driver-defaults.test.ts

@@ -0,0 +1,115 @@
+/**
+ * Driver-map defaults — per-key merge onto the real established defaults,
+ * never a whole-object replace and never leaking across driver maps.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { mergeEnvDriverMap } from "./index.ts";
+import {
+  CHANNEL_EMAIL_DEFAULTS,
+  CHANNEL_SMS_DEFAULTS,
+  CLOCK_DEFAULTS,
+  JOURNAL_DEFAULTS,
+  resolveEffectiveDrivers,
+  SIGNAL_DEFAULTS,
+  STORE_FILES_DEFAULTS,
+  STORE_KV_DEFAULTS,
+  STORE_SQL_DEFAULTS,
+  VAULT_DEFAULTS,
+} from "./driver-defaults.ts";
+
+describe("mergeEnvDriverMap", () => {
+  test("an unset key keeps the real default, not a sibling key's value", () => {
+    const merged = mergeEnvDriverMap({ test: "pglite" }, STORE_SQL_DEFAULTS);
+    expect(merged).toEqual({
+      dev: "postgres",
+      test: "pglite",
+      prod: "postgres",
+    });
+  });
+
+  test("undefined override yields the untouched default map", () => {
+    expect(mergeEnvDriverMap(undefined, STORE_KV_DEFAULTS)).toEqual(STORE_KV_DEFAULTS);
+  });
+
+  test("a fully-specified override wins on every key", () => {
+    const override = { dev: "a", test: "b", prod: "c" };
+    expect(mergeEnvDriverMap(override, STORE_SQL_DEFAULTS)).toEqual(override);
+  });
+});
+
+describe("resolveEffectiveDrivers", () => {
+  test("`{ store: { sql: { test: 'pglite' } } }` keeps postgres on dev/prod", () => {
+    const effective = resolveEffectiveDrivers({
+      store: { sql: { test: "pglite" } },
+    });
+
+    expect(effective.store.sql).toEqual({
+      dev: "postgres",
+      test: "pglite",
+      prod: "postgres",
+    });
+  });
+
+  test("every other driver stays at its full, real, untouched default map", () => {
+    const effective = resolveEffectiveDrivers({
+      store: { sql: { test: "pglite" } },
+    });
+
+    expect(effective.store.kv).toEqual(STORE_KV_DEFAULTS);
+    expect(effective.store.files).toEqual(STORE_FILES_DEFAULTS);
+    expect(effective.signal).toEqual(SIGNAL_DEFAULTS);
+    expect(effective.clock).toEqual(CLOCK_DEFAULTS);
+    expect(effective.journal).toEqual(JOURNAL_DEFAULTS);
+    expect(effective.vault).toEqual(VAULT_DEFAULTS);
+    expect(effective.channel.email).toEqual(CHANNEL_EMAIL_DEFAULTS);
+    expect(effective.channel.sms).toEqual(CHANNEL_SMS_DEFAULTS);
+  });
+
+  test("overriding one driver's map has zero effect on a sibling driver's defaults", () => {
+    const effective = resolveEffectiveDrivers({
+      store: { kv: { dev: "redis" } },
+    });
+
+    expect(effective.store.kv).toEqual({
+      dev: "redis",
+      test: "memory",
+      prod: "redis",
+    });
+    expect(effective.store.sql).toEqual(STORE_SQL_DEFAULTS);
+    expect(effective.store.files).toEqual(STORE_FILES_DEFAULTS);
+    expect(effective.signal).toEqual(SIGNAL_DEFAULTS);
+    expect(effective.vault).toEqual(VAULT_DEFAULTS);
+  });
+
+  test("overriding one env key leaves the other two at real defaults for that driver", () => {
+    const effective = resolveEffectiveDrivers({
+      vault: { dev: "keychain" },
+    });
+
+    expect(effective.vault).toEqual({
+      dev: "keychain",
+      test: "memory",
+      prod: "vault",
+    });
+  });
+
+  test("no drivers config at all yields the real, untouched defaults for every map", () => {
+    const effective = resolveEffectiveDrivers(undefined);
+    expect(effective).toEqual({
+      store: {
+        sql: STORE_SQL_DEFAULTS,
+        kv: STORE_KV_DEFAULTS,
+        files: STORE_FILES_DEFAULTS,
+      },
+      signal: SIGNAL_DEFAULTS,
+      clock: CLOCK_DEFAULTS,
+      journal: JOURNAL_DEFAULTS,
+      vault: VAULT_DEFAULTS,
+      channel: {
+        email: CHANNEL_EMAIL_DEFAULTS,
+        sms: CHANNEL_SMS_DEFAULTS,
+      },
+    });
+  });
+});