okengine 0.10.3 → 0.11.1

package/src/cli/vault-secure-input.test.ts

@@ -0,0 +1,56 @@
+/**
+ * Unit tests for hidden / stdin master-key helpers.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { EventEmitter } from "node:events";
+import { promptHidden, readStdinSecure } from "./vault-secure-input.ts";
+
+describe("readStdinSecure", () => {
+  test("trims a full stdin payload", async () => {
+    const stdin = new EventEmitter() as EventEmitter & {
+      setEncoding?: (encoding: BufferEncoding) => void;
+    };
+    stdin.setEncoding = () => undefined;
+    const pending = readStdinSecure(stdin);
+    stdin.emit("data", "  abc123\n");
+    stdin.emit("end");
+    expect(await pending).toBe("abc123");
+  });
+});
+
+describe("promptHidden", () => {
+  test("masks characters and resolves on Enter", async () => {
+    const stdin = new EventEmitter() as EventEmitter & {
+      setRawMode?: (mode: boolean) => void;
+      off?: (event: string, listener: (...args: unknown[]) => void) => void;
+    };
+    let raw = false;
+    stdin.setRawMode = (mode) => {
+      raw = mode;
+    };
+    stdin.off = (event: string | symbol, listener: (...args: unknown[]) => void) => {
+      stdin.removeListener(event, listener);
+      return stdin;
+    };
+    let written = "";
+    const pending = promptHidden("key: ", {
+      stdin,
+      write: (t) => {
+        written += t;
+      },
+      exit: () => {
+        throw new Error("exit should not run");
+      },
+    });
+    // Allow the listener to attach.
+    await Promise.resolve();
+    stdin.emit("data", "ab");
+    stdin.emit("data", "\r");
+    expect(await pending).toBe("ab");
+    expect(written).toContain("key: ");
+    expect(written).toContain("**");
+    expect(written).not.toContain("ab");
+    expect(raw).toBe(false);
+  });
+});

package/src/cli/vault-secure-input.ts

@@ -0,0 +1,124 @@
+/**
+ * Secure master-key input for `oke vault` — avoid shell history.
+ *
+ * Prefer `--key -` (stdin) or an interactive hidden prompt over putting
+ * base64 keys on the argv in shared environments.
+ */
+
+/** Minimal readable stream used by {@link readStdinSecure}. */
+export interface SecureStdin {
+  setEncoding?(encoding: BufferEncoding): void;
+  on(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+  on(event: "end", listener: () => void): unknown;
+  on(event: "error", listener: (error: Error) => void): unknown;
+}
+
+/** Minimal TTY-ish stdin used by {@link promptHidden}. */
+export interface SecurePromptStdin {
+  setRawMode?(mode: boolean): void;
+  on(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+  removeListener?(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+  off?(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+}
+
+/** IO sinks for {@link promptHidden}. */
+export interface PromptHiddenOptions {
+  /** Prompt destination. Defaults to `process.stdout.write`. */
+  readonly write?: (text: string) => void;
+  /** Character stream (TTY). Defaults to `process.stdin`. */
+  readonly stdin?: SecurePromptStdin;
+  /** Exit handler for Ctrl+C. Defaults to `process.exit`. */
+  readonly exit?: (code: number) => void;
+}
+
+/**
+ * Read a trimmed secret from stdin (for `--key -` / `--new-key -`).
+ *
+ * @param stdin - Readable stream; defaults to `process.stdin`
+ */
+export async function readStdinSecure(stdin: SecureStdin = process.stdin): Promise<string> {
+  stdin.setEncoding?.("utf8");
+  return new Promise((resolve, reject) => {
+    let data = "";
+    stdin.on("data", (chunk) => {
+      data += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    });
+    stdin.on("end", () => resolve(data.trim()));
+    stdin.on("error", reject);
+  });
+}
+
+/**
+ * Prompt for a secret on a TTY without echoing the cleartext.
+ *
+ * Characters are masked with `*`. Backspace edits; Enter submits; Ctrl+C
+ * exits the process (or the injected `exit` handler).
+ *
+ * @param question - Prompt text written before input
+ * @param options - Injectable IO for tests
+ */
+export async function promptHidden(
+  question: string,
+  options: PromptHiddenOptions = {},
+): Promise<string> {
+  const write = options.write ?? ((t: string) => process.stdout.write(t));
+  const stdin = options.stdin ?? process.stdin;
+  const exit = options.exit ?? ((code: number) => process.exit(code));
+
+  write(question);
+  stdin.setRawMode?.(true);
+
+  return new Promise((resolve) => {
+    let input = "";
+    const onData = (char: string | Buffer): void => {
+      const text = typeof char === "string" ? char : char.toString("utf8");
+      for (const ch of text) {
+        if (ch === "\n" || ch === "\r" || ch === "\u0004") {
+          stdin.setRawMode?.(false);
+          write("\n");
+          removeDataListener(stdin, onData);
+          resolve(input);
+          return;
+        }
+        if (ch === "\u0003") {
+          stdin.setRawMode?.(false);
+          write("\n");
+          removeDataListener(stdin, onData);
+          exit(1);
+          return;
+        }
+        if (ch === "\u007f" || ch === "\b") {
+          if (input.length > 0) {
+            input = input.slice(0, -1);
+            write("\b \b");
+          }
+          continue;
+        }
+        // Ignore other control characters.
+        if (ch < " ") continue;
+        input += ch;
+        write("*");
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+/**
+ * Detach the raw-mode data listener when the host supports it.
+ *
+ * @param stdin - Prompt stdin
+ * @param listener - Handler to remove
+ */
+function removeDataListener(
+  stdin: SecurePromptStdin,
+  listener: (chunk: string | Buffer) => void,
+): void {
+  if (typeof stdin.off === "function") {
+    stdin.off("data", listener);
+    return;
+  }
+  if (typeof stdin.removeListener === "function") {
+    stdin.removeListener("data", listener);
+  }
+}

package/src/compiler/effects-infer.ts

@@ -120,6 +120,9 @@ const WRITE_METHODS = new Set([
   "putImage",
 ]);
 
+/** `fx.vault.*` methods whose first argument is a secret path. */
+const VAULT_PATH_METHODS = new Set(["get", "set", "rotate", "delete"]);
+
 /** Methods whose first argument is a table / collection identifier. */
 const TABLE_ARG_METHODS = new Set([
   "insert",
@@ -189,6 +192,10 @@ export function inferEffects(options: InferEffectsOptions): InferredEffects {
     }
 
     if (chain.rootMethod === "vault" && call === chain.rootCall) {
+      // `fx.vault.list()` / `fx.vault.status()` take no path — nothing to
+      // declare. Every other method's first argument is the secret.
+      const method = chain.methods[1] ?? "get";
+      if (!VAULT_PATH_METHODS.has(method)) continue;
       const ref = resolveNamed(call.arguments[0], options.bindings, "secret");
       if (ref) secrets.add(ref);
       continue;

package/src/compiler/fixtures/skyport/oke.config.ts

@@ -2,15 +2,15 @@ import { defineConfig } from "okengine/config";
 
 export default defineConfig({
   drivers: {
-    prod: ["postgres", "redis", "s3", "smtp", "openbao", "anthropic", "pgvector"],
+    prod: ["postgres", "redis", "s3", "smtp", "vault", "anthropic", "pgvector"],
     store: {
-      sql: { local: "sqlite", prod: { driver: "postgres" } },
+      sql: { dev: { driver: "postgres" }, test: "pglite", prod: { driver: "postgres" } },
       kv: { prod: "redis" },
       files: { prod: "s3" },
       index: { prod: "pgvector" },
     },
     signal: { prod: "redis" },
-    vault: { prod: "openbao" },
+    vault: { prod: "vault" },
     channel: { email: { prod: "smtp" } },
     ai: { prod: { driver: "anthropic" } },
   },

package/src/compiler/fixtures/skyport/src/flows/payments/index.ts

@@ -7,7 +7,7 @@ export const chargeBooking = flow("payments.chargeBooking", {
     // Journal only serializable step values — a Redacted is not journaled.
     const intent = await fx.step("create-intent", async () => ({
       id: `pi_${orderId}`,
-      key: fx.vault(stripeKey).reveal(),
+      key: (await fx.vault.get(stripeKey)).reveal(),
     }));
     await fx.clock.sleep("verify-window", "2m");
     return fx.step("confirm", () => intent);

package/src/compiler/fixtures/skyport.expected.json

@@ -162,7 +162,7 @@
     }
   },
   "drivers": {
-    "prod": ["postgres", "redis", "s3", "smtp", "openbao", "anthropic", "pgvector"]
+    "prod": ["postgres", "redis", "s3", "smtp", "vault", "anthropic", "pgvector"]
   },
   "tenancy": {
     "isolation": "row"

package/src/compiler-entry.ts

@@ -0,0 +1,7 @@
+/**
+ * `okengine/compiler` — AoT / dynamic route compile + Manifest extract.
+ *
+ * @module
+ */
+
+export * from "./compiler/index.ts";

package/src/config/define-config.test.ts

@@ -1,82 +1,146 @@
 /**
- * `defineConfig` fills missing `docker` pins from `prod` and normalizes legacy keys.
+ * `defineConfig` fills missing `dev` pins from `prod` and normalizes legacy keys.
  */
 
 import { describe, expect, test } from "bun:test";
-import { defineConfig, fillDockerFromProd, normalizeEnvDriverMap } from "./index.ts";
+import { defineConfig, fillDevFromProd, normalizeEnvDriverMap } from "./index.ts";
 
-describe("fillDockerFromProd / defineConfig", () => {
-  test("copies prod onto docker when docker is omitted", () => {
-    const filled = fillDockerFromProd({
-      local: "sqlite",
+describe("fillDevFromProd / defineConfig", () => {
+  test("copies prod onto dev when dev is omitted", () => {
+    const filled = fillDevFromProd({
+      test: "pglite",
       prod: "postgres",
     });
-    expect(filled?.docker).toBe("postgres");
-    expect(filled?.local).toBe("sqlite");
+    expect(filled?.dev).toBe("postgres");
+    expect(filled?.test).toBe("pglite");
   });
 
-  test("does not overwrite an explicit docker pin", () => {
+  test("does not overwrite an explicit dev pin", () => {
     expect(
-      fillDockerFromProd({
-        local: "sqlite",
-        docker: "memory",
+      fillDevFromProd({
+        dev: "memory",
         prod: "postgres",
-      })?.docker,
+      })?.dev,
     ).toBe("memory");
   });
 
-  test("vault prod → docker copies the prod driver", () => {
-    expect(fillDockerFromProd({ local: "env", prod: "openbao" })?.docker).toBe("openbao");
+  test("vault prod → dev copies the prod driver", () => {
+    expect(fillDevFromProd({ prod: "vault" })?.dev).toBe("vault");
   });
 
   test("defineConfig fills every element from prod", () => {
     const cfg = defineConfig({
       drivers: {
         store: {
-          sql: { local: "sqlite", prod: "postgres" },
-          kv: { local: "memory", prod: "redis" },
-          files: { local: "fs", prod: "s3" },
+          sql: { test: "pglite", prod: "postgres" },
+          kv: { test: "memory", prod: "redis" },
+          files: { test: "memory", prod: "s3" },
         },
-        signal: { local: "memory", prod: "redis" },
-        clock: { local: "memory", prod: "file" },
-        vault: { local: "env", prod: "openbao" },
+        signal: { test: "memory", prod: "redis" },
+        clock: { test: "frozen", prod: "file" },
+        vault: { test: "memory", prod: "vault" },
         channel: {
-          email: { local: "console", prod: "smtp" },
+          email: { test: "console", prod: "smtp" },
         },
-        ai: { local: "mock", prod: "anthropic" },
+        ai: { test: "mock", prod: "anthropic" },
       },
     });
-    expect(cfg.drivers?.store?.sql?.docker).toBe("postgres");
-    expect(cfg.drivers?.store?.kv?.docker).toBe("redis");
-    expect(cfg.drivers?.store?.files?.docker).toBe("s3");
-    expect(cfg.drivers?.signal?.docker).toBe("redis");
-    expect(cfg.drivers?.clock?.docker).toBe("file");
-    expect(cfg.drivers?.vault?.docker).toBe("openbao");
-    expect(cfg.drivers?.channel?.email?.docker).toBe("smtp");
-    expect(cfg.drivers?.ai?.docker).toBe("anthropic");
+    expect(cfg.drivers?.store?.sql).toMatchObject({
+      dev: "postgres",
+      test: "pglite",
+      prod: "postgres",
+    });
+    expect(cfg.drivers?.store?.kv).toMatchObject({
+      dev: "redis",
+      test: "memory",
+      prod: "redis",
+    });
+    expect(cfg.drivers?.store?.files).toMatchObject({
+      dev: "s3",
+      test: "memory",
+      prod: "s3",
+    });
+    expect(cfg.drivers?.signal).toMatchObject({
+      dev: "redis",
+      test: "memory",
+      prod: "redis",
+    });
+    expect(cfg.drivers?.clock).toMatchObject({
+      dev: "file",
+      test: "frozen",
+      prod: "file",
+    });
+    expect(cfg.drivers?.vault).toMatchObject({
+      dev: "vault",
+      test: "memory",
+      prod: "vault",
+    });
+    expect(cfg.drivers?.channel?.email).toMatchObject({
+      dev: "smtp",
+      test: "console",
+      prod: "smtp",
+    });
+    expect(cfg.drivers?.ai).toMatchObject({
+      dev: "anthropic",
+      test: "mock",
+      prod: "anthropic",
+    });
+  });
+
+  test("normalizeEnvDriverMap expands a bare string to all envs", () => {
+    expect(normalizeEnvDriverMap("redis")).toEqual({
+      dev: "redis",
+      test: "redis",
+      prod: "redis",
+    });
   });
 
-  test("normalizeEnvDriverMap maps legacy keys", () => {
+  test("normalizeEnvDriverMap keeps only dev/test/prod keys", () => {
     const normalized = normalizeEnvDriverMap({
-      dev: "sqlite",
-      stack: "postgres",
+      dev: "postgres",
+      test: "pglite",
+      prod: "postgres",
+    });
+    expect(normalized).toEqual({
+      dev: "postgres",
+      test: "pglite",
       prod: "postgres",
     });
-    expect(normalized?.local).toBe("sqlite");
-    expect(normalized?.docker).toBe("postgres");
-    expect((normalized as { dev?: string } | undefined)?.dev).toBeUndefined();
-    expect((normalized as { stack?: string } | undefined)?.stack).toBeUndefined();
   });
 
-  test("defineConfig accepts legacy driver-map keys", () => {
-    const cfg = defineConfig({
-      drivers: {
-        store: {
-          sql: { dev: "sqlite", stack: "postgres", prod: "postgres" } as never,
+  test("defineConfig rejects sqlite", () => {
+    expect(() =>
+      defineConfig({
+        drivers: {
+          store: {
+            sql: { dev: "sqlite", test: "pglite", prod: "postgres" },
+          },
         },
-      },
-    });
-    expect(cfg.drivers?.store?.sql?.local).toBe("sqlite");
-    expect(cfg.drivers?.store?.sql?.docker).toBe("postgres");
+      }),
+    ).toThrow(/sqlite/);
+  });
+
+  test("defineConfig rejects libsql", () => {
+    expect(() =>
+      defineConfig({
+        drivers: {
+          store: {
+            sql: { dev: "libsql", test: "pglite", prod: "postgres" },
+          },
+        },
+      }),
+    ).toThrow(/libsql/);
+  });
+
+  test("defineConfig rejects non-pglite test SQL", () => {
+    expect(() =>
+      defineConfig({
+        drivers: {
+          store: {
+            sql: { dev: "postgres", test: "memory", prod: "postgres" },
+          },
+        },
+      }),
+    ).toThrow(/pglite/);
   });
 });

package/src/config/driver-defaults.test.ts

@@ -20,11 +20,10 @@ import {
 
 describe("mergeEnvDriverMap", () => {
   test("an unset key keeps the real default, not a sibling key's value", () => {
-    const merged = mergeEnvDriverMap({ local: "pglite" }, STORE_SQL_DEFAULTS);
+    const merged = mergeEnvDriverMap({ test: "pglite" }, STORE_SQL_DEFAULTS);
     expect(merged).toEqual({
-      local: "pglite",
-      docker: "postgres",
-      test: "memory",
+      dev: "postgres",
+      test: "pglite",
       prod: "postgres",
     });
   });
@@ -34,28 +33,27 @@ describe("mergeEnvDriverMap", () => {
   });
 
   test("a fully-specified override wins on every key", () => {
-    const override = { local: "a", docker: "b", test: "c", prod: "d" };
+    const override = { dev: "a", test: "b", prod: "c" };
     expect(mergeEnvDriverMap(override, STORE_SQL_DEFAULTS)).toEqual(override);
   });
 });
 
-describe("resolveEffectiveDrivers — the drivers.store.sql.local discussion scenario", () => {
-  test("`{ store: { sql: { local: 'pglite' } } }` resolves sql to the real map, pglite only on local", () => {
+describe("resolveEffectiveDrivers", () => {
+  test("`{ store: { sql: { test: 'pglite' } } }` keeps postgres on dev/prod", () => {
     const effective = resolveEffectiveDrivers({
-      store: { sql: { local: "pglite" } },
+      store: { sql: { test: "pglite" } },
     });
 
     expect(effective.store.sql).toEqual({
-      local: "pglite",
-      docker: "postgres",
-      test: "memory",
+      dev: "postgres",
+      test: "pglite",
       prod: "postgres",
     });
   });
 
   test("every other driver stays at its full, real, untouched default map", () => {
     const effective = resolveEffectiveDrivers({
-      store: { sql: { local: "pglite" } },
+      store: { sql: { test: "pglite" } },
     });
 
     expect(effective.store.kv).toEqual(STORE_KV_DEFAULTS);
@@ -70,34 +68,29 @@ describe("resolveEffectiveDrivers — the drivers.store.sql.local discussion sce
 
   test("overriding one driver's map has zero effect on a sibling driver's defaults", () => {
     const effective = resolveEffectiveDrivers({
-      store: { kv: { local: "redis" } },
+      store: { kv: { dev: "redis" } },
     });
 
-    // The overridden driver (kv) reflects the override on its one set key.
     expect(effective.store.kv).toEqual({
-      local: "redis",
-      docker: "redis",
+      dev: "redis",
       test: "memory",
       prod: "redis",
     });
-    // sql / files (same element, different facet) stay fully at real defaults.
     expect(effective.store.sql).toEqual(STORE_SQL_DEFAULTS);
     expect(effective.store.files).toEqual(STORE_FILES_DEFAULTS);
-    // Unrelated elements stay fully at real defaults too.
     expect(effective.signal).toEqual(SIGNAL_DEFAULTS);
     expect(effective.vault).toEqual(VAULT_DEFAULTS);
   });
 
-  test("overriding one env key leaves the other three at real defaults for that driver", () => {
+  test("overriding one env key leaves the other two at real defaults for that driver", () => {
     const effective = resolveEffectiveDrivers({
-      vault: { local: "keychain" },
+      vault: { dev: "keychain" },
     });
 
     expect(effective.vault).toEqual({
-      local: "keychain",
-      docker: "env",
+      dev: "keychain",
       test: "memory",
-      prod: "env",
+      prod: "vault",
     });
   });