okengine 0.10.2 → 0.11.0

package/src/config/resolve-driver.test.ts

@@ -1,41 +1,36 @@
 /**
- * Driver map resolution — including `docker` → prod fallback.
+ * Driver map resolution — including `dev` → prod fallback.
  */
 
 import { describe, expect, test } from "bun:test";
 import { resolveDomainDdlMode, resolveDriverId } from "./index.ts";
 
 describe("resolveDomainDdlMode", () => {
-  test("test keeps ensure; docker/prod always off", () => {
+  test("test keeps ensure; prod always off", () => {
     expect(resolveDomainDdlMode("test", true)).toBe("ensure");
-    expect(resolveDomainDdlMode("docker", true)).toBe("off");
     expect(resolveDomainDdlMode("prod", true)).toBe("off");
   });
 
-  test("local follows autoPush", () => {
-    expect(resolveDomainDdlMode("local", true)).toBe("off");
-    expect(resolveDomainDdlMode("local", false)).toBe("ensure");
+  test("dev follows autoPush", () => {
+    expect(resolveDomainDdlMode("dev", true)).toBe("off");
+    expect(resolveDomainDdlMode("dev", false)).toBe("ensure");
   });
 });
 
 describe("resolveDriverId", () => {
   test("reads the named env key", () => {
-    expect(resolveDriverId({ local: "sqlite", prod: "postgres" }, "local")).toBe("sqlite");
-    expect(resolveDriverId({ local: "sqlite", prod: "postgres" }, "prod")).toBe("postgres");
+    expect(resolveDriverId({ dev: "postgres", prod: "postgres" }, "dev")).toBe("postgres");
+    expect(resolveDriverId({ dev: "postgres", prod: "postgres" }, "prod")).toBe("postgres");
   });
 
-  test("docker prefers docker, then prod, then local", () => {
-    expect(
-      resolveDriverId({ local: "sqlite", docker: "postgres", prod: "postgres" }, "docker"),
-    ).toBe("postgres");
-    expect(resolveDriverId({ local: "sqlite", prod: "postgres" }, "docker")).toBe("postgres");
-    expect(resolveDriverId({ local: "sqlite" }, "docker")).toBe("sqlite");
+  test("without defaults, cascade is env → dev → prod → test", () => {
+    expect(resolveDriverId({ prod: "postgres" }, "dev")).toBe("postgres");
+    expect(resolveDriverId({ test: "pglite" }, "dev")).toBe("pglite");
   });
 
-  test("legacy keys resolve after normalize", () => {
-    expect(resolveDriverId({ dev: "sqlite", stack: "postgres" } as never, "local")).toBe("sqlite");
-    expect(resolveDriverId({ dev: "sqlite", stack: "postgres" } as never, "docker")).toBe(
-      "postgres",
-    );
+  test("bare string expands to all envs", () => {
+    expect(resolveDriverId("redis", "dev")).toBe("redis");
+    expect(resolveDriverId("redis", "test")).toBe("redis");
+    expect(resolveDriverId("redis", "prod")).toBe("redis");
   });
 });

package/src/console/server/app.ts

@@ -21,7 +21,7 @@ import { createManifestChannelRuntime } from "./channels.ts";
 import { createManifestClockRuntime } from "./clock.ts";
 import { createManifestStoreRuntime } from "./store.ts";
 import { VaultBootError } from "../../elements/vault.ts";
-import { createManifestVaultRuntime } from "./vault.ts";
+import { createManifestVaultRuntime, resolveVaultDriverId } from "./vault.ts";
 import { printClaimCodeOnce } from "./claim.ts";
 
 /** Options for {@link createConsoleApp}. */
@@ -248,12 +248,14 @@ export async function bindManifestVaultRuntime(state: ConsoleState): Promise<voi
   if (!state.manifest?.vault || Object.keys(state.manifest.vault).length === 0) {
     return;
   }
+  const env = state.production ? "prod" : "dev";
   try {
     state.vaultRuntime = await createManifestVaultRuntime(state.manifest, {
       cwd: state.cwd,
-      env: state.production ? "prod" : "local",
+      env,
       allowDevFallbacks: !state.production,
       now: state.now,
+      driverId: resolveVaultDriverId(state.okeConfig, env),
     });
   } catch (err) {
     // Gaps are a doctor concern — Console still lists contracts from Manifest.

package/src/console/server/console.test.ts

@@ -14,6 +14,7 @@ import { join } from "node:path";
 import { issueSession } from "../../auth/index.ts";
 import { createClient } from "../../client/index.ts";
 import { CONSOLE_CSP, PLUGIN_IFRAME_SANDBOX } from "./security-headers.ts";
+import { createConsoleApp } from "./app.ts";
 import { serveConsole, type ConsoleServerHandle } from "./serve.ts";
 import { startConsoleApp } from "./serve.ts";
 
@@ -321,7 +322,7 @@ describe("console serve security", () => {
       cwd,
       secret: "serve-secret",
       silentClaim: true,
-      env: "dev",
+      env: "test",
     });
   });
 
@@ -379,3 +380,59 @@ describe("console serve security", () => {
     expect(PLUGIN_IFRAME_SANDBOX).toContain("allow-scripts");
   });
 });
+
+describe("console boot under oke dev compose env", () => {
+  /**
+   * Isolate from compose URLs — this suite proves capability minting, not
+   * driver wiring. `serveConsole` passes the same `docker: false` flag.
+   */
+  const isolatedDevConfig = {
+    drivers: {
+      store: {
+        sql: { dev: "memory" },
+        kv: { dev: "memory" },
+        files: { dev: "memory" },
+        index: { dev: "memory" },
+      },
+      signal: { dev: "memory" },
+      clock: { dev: "frozen" },
+      journal: { dev: "memory" },
+      vault: { dev: "memory" },
+      channel: { email: { dev: "console" } },
+      ai: { dev: "mock" },
+    },
+  } as const;
+
+  test("docker:true + env:dev hard-fails OKE1008 on undeclared console flows", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-docker-strict-"));
+    const handle = createConsoleApp({
+      cwd,
+      secret: "compose-dev-secret",
+      silentClaim: true,
+    });
+    await expect(
+      handle.app.boot({ env: "dev", docker: true, config: isolatedDevConfig }),
+    ).rejects.toThrow(/OKE1008/);
+  });
+
+  test("docker:false + env:dev boots even when OKE_DOCKER=1 (serveConsole contract)", async () => {
+    const prev = process.env.OKE_DOCKER;
+    process.env.OKE_DOCKER = "1";
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-docker-open-"));
+    const handle = createConsoleApp({
+      cwd,
+      secret: "compose-dev-secret",
+      silentClaim: true,
+    });
+    try {
+      // Same flags `serveConsole` now passes — must not inherit OKE_DOCKER=1.
+      await handle.app.boot({ env: "dev", docker: false, config: isolatedDevConfig });
+      const res = await handle.app.fetch(new Request("http://console.test/console/setup/status"));
+      expect(res.status).toBe(200);
+    } finally {
+      await handle.app.stop();
+      if (prev === undefined) delete process.env.OKE_DOCKER;
+      else process.env.OKE_DOCKER = prev;
+    }
+  });
+});

package/src/console/server/flows.ts

@@ -596,9 +596,29 @@ const VaultRowOut = z.object({
   sharedFingerprintEnvs: z.array(z.string()),
 });
 
+const VaultBuiltinStatusOut = z.object({
+  initialized: z.boolean(),
+  sealed: z.boolean(),
+  masterKeyPresent: z.boolean(),
+  kekVersion: z.number(),
+  secretCount: z.number(),
+  sealCount: z.number(),
+  lastSealedAt: z.number().nullable(),
+  lastUnsealedAt: z.number().nullable(),
+  rewrapTargetKekVersion: z.number().nullable(),
+});
+
+const VaultBackendOut = z.object({
+  driverId: z.enum(["env", "vault", "managed", "memory"]),
+  builtin: z.boolean(),
+  status: VaultBuiltinStatusOut.nullable(),
+  unavailable: z.string().nullable(),
+});
+
 const VaultListOut = z.object({
   secrets: z.array(VaultRowOut),
   env: z.string(),
+  backend: VaultBackendOut.nullable(),
 });
 
 const VaultWriteIn = z.object({
@@ -1725,7 +1745,7 @@ function createSetupClaim(state: ConsoleState) {
         }
         throw err;
       }
-      state.persistOperator(op.id);
+      await state.persistOperator(op.id);
       const issued = await issueOperatorSession(state, op.id);
       fx.log.info("console.setup.claim", { operatorId: op.id });
       return sessionPayload(op.id, op.email, op.name, issued);
@@ -2272,7 +2292,7 @@ async function issueOperatorSession(
       scopes: ["console:*"],
     },
   );
-  state.persistSessions();
+  await state.persistSessions();
   return issued;
 }
 

package/src/console/server/index.ts

@@ -72,9 +72,12 @@ export {
   type ClaimVerifyResult,
 } from "./claim.ts";
 export {
+  CONSOLE_PG_SCHEMA,
+  consoleTable,
   openConsolePersistence,
   resolveConsoleSecret,
   type ConsolePersistence,
+  type OpenConsolePersistenceOptions,
 } from "./operator-db.ts";
 export { createConsoleBindings } from "./flows.ts";
 export { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";

package/src/console/server/operator-db.test.ts

@@ -1,5 +1,6 @@
 /**
- * Durable Console operators + sessions under `.oke/console.sqlite`.
+ * Durable Console operators + sessions in Postgres schema `oke_console`
+ * (PGlite under `.oke/console-pg` when no DATABASE_URL).
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
@@ -8,8 +9,15 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createOperator } from "../../auth/operator.ts";
 import { issueSession, verifyAccess } from "../../auth/sessions.ts";
+import { AUTH_TABLES } from "../../auth/tables.ts";
+import { connectPglite } from "../../drivers/pglite.ts";
 import { bootConsoleApp, createConsoleApp } from "./app.ts";
-import { openConsolePersistence, resolveConsoleSecret } from "./operator-db.ts";
+import {
+  CONSOLE_PG_SCHEMA,
+  consoleTable,
+  openConsolePersistence,
+  resolveConsoleSecret,
+} from "./operator-db.ts";
 
 describe("console operator persistence", () => {
   const dirs: string[] = [];
@@ -38,8 +46,8 @@ describe("console operator persistence", () => {
       name: "Ops",
       password: "password1234",
     });
-    first.persistOperator(op.id);
-    first.close();
+    await first.persistOperator(op.id);
+    await first.close();
 
     const second = await openConsolePersistence(cwd);
     expect(second.operators.operators.size).toBe(1);
@@ -65,7 +73,7 @@ describe("console operator persistence", () => {
       expect(printed.join("\n")).not.toContain("Claim code");
     } finally {
       console.log = origLog;
-      second.close();
+      await second.close();
     }
   });
 
@@ -79,20 +87,20 @@ describe("console operator persistence", () => {
       name: "Ops",
       password: "password1234",
     });
-    first.persistOperator(op.id);
+    await first.persistOperator(op.id);
     const issued = await issueSession(
       first.sessions,
       { secret: first.secret },
       { id: op.id, plane: "operator", scopes: ["console:*"] },
     );
-    first.persistSessions();
-    first.close();
+    await first.persistSessions();
+    await first.close();
 
     const second = await openConsolePersistence(cwd);
     expect(second.sessions.sessions.size).toBe(1);
     const claims = await verifyAccess(second.sessions, second.secret, issued.accessToken);
     expect(claims.sub).toBe(op.id);
-    second.close();
+    await second.close();
   });
 
   test("claim then reopen keeps session.me authorized", async () => {
@@ -131,7 +139,7 @@ describe("console operator persistence", () => {
       accessToken = body.data.accessToken;
     } finally {
       await first.app.stop();
-      firstPersist.close();
+      await firstPersist.close();
     }
 
     const secondPersist = await openConsolePersistence(cwd);
@@ -158,7 +166,7 @@ describe("console operator persistence", () => {
       expect(meBody.data.email).toBe("ops@example.com");
     } finally {
       await second.app.stop();
-      secondPersist.close();
+      await secondPersist.close();
     }
   });
 
@@ -171,7 +179,7 @@ describe("console operator persistence", () => {
       name: "Ops",
       password: "password1234",
     });
-    persistence.persistOperator(op.id);
+    await persistence.persistOperator(op.id);
 
     const handle = createConsoleApp({
       cwd,
@@ -196,7 +204,41 @@ describe("console operator persistence", () => {
       expect(body.data.setupClosed).toBe(true);
     } finally {
       await handle.app.stop();
-      persistence.close();
+      await persistence.close();
     }
   });
+
+  test("tables live in oke_console schema, not public", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-schema-"));
+    dirs.push(cwd);
+    const shared = await connectPglite({
+      url: `memory://console-schema-${crypto.randomUUID()}`,
+    });
+    const opened = await openConsolePersistence(cwd, { connection: shared });
+    try {
+      const op = await createOperator(opened.operators, {
+        email: "schema@example.com",
+        name: "Schema",
+        password: "password1234",
+      });
+      await opened.persistOperator(op.id);
+
+      const inConsole = await shared.query(
+        `SELECT email FROM ${consoleTable(AUTH_TABLES.operators)} WHERE id = ?`,
+        [op.id],
+      );
+      expect(inConsole[0]?.["email"]).toBe("schema@example.com");
+
+      const schemas = await shared.query(
+        `SELECT table_schema
+         FROM information_schema.tables
+         WHERE table_name = ?`,
+        [AUTH_TABLES.operators],
+      );
+      expect(schemas.map((r) => r["table_schema"])).toEqual([CONSOLE_PG_SCHEMA]);
+    } finally {
+      // connection was injected — close the shared handle ourselves
+      await shared.close();
+    }
+  }, 15_000);
 });