okengine 0.10.3 → 0.11.1

package/src/drivers/conformance.test.ts

@@ -12,21 +12,17 @@ import {
   runTextIndexConformance,
 } from "./conformance.ts";
 import { fsDriver } from "./fs.ts";
-import { libsqlDriver, libsqlIndexDriver } from "./libsql.ts";
 import { memoryFilesDriver, memoryIndexDriver, memoryKvDriver, memorySqlDriver } from "./memory.ts";
 import { meilisearchDriver } from "./meilisearch.ts";
 import { createMeilisearchFakeFetch } from "./meilisearch.test.ts";
-import { pgliteDriver } from "./pglite.ts";
+import { PGLITE_DEFAULT_DATADIR, pgliteDriver, resolvePgliteDataDir } from "./pglite.ts";
 import { pgvectorDriver } from "./pgvector.ts";
 import { createPostgresFakeClient, postgresDriver } from "./postgres.ts";
 import { createRedisFakeClient, redisDriver } from "./redis.ts";
 import { createS3FakeClient, s3Driver } from "./s3.ts";
-import { sqliteDriver } from "./sqlite.ts";
 
 describe("sql conformance", () => {
   test("memory", () => runSqlConformance(memorySqlDriver));
-  test("sqlite", () => runSqlConformance(sqliteDriver, { url: ":memory:" }));
-  test("libsql", () => runSqlConformance(libsqlDriver, { url: ":memory:" }));
   // pglite cold-starts WASM + extension load — slow disks / CI need > default 5s
   test("pglite", () => runSqlConformance(pgliteDriver, { url: "memory://" }), 15_000);
   test("postgres (fake Bun.SQL client)", () =>
@@ -35,6 +31,16 @@ describe("sql conformance", () => {
     }));
 });
 
+describe("pglite dataDir resolution", () => {
+  test("memory:// stays in-process; :memory: persists under .oke/pgdata", () => {
+    expect(resolvePgliteDataDir("memory://")).toBe("memory");
+    expect(resolvePgliteDataDir("memory://suite")).toBe("memory");
+    expect(resolvePgliteDataDir(":memory:")).toBe(PGLITE_DEFAULT_DATADIR);
+    expect(resolvePgliteDataDir(undefined)).toBe(PGLITE_DEFAULT_DATADIR);
+    expect(resolvePgliteDataDir(".oke/custom")).toBe(".oke/custom");
+  });
+});
+
 describe("kv conformance", () => {
   test("memory", () => runKvConformance(memoryKvDriver));
   test("redis (fake Bun.redis client)", () =>
@@ -54,7 +60,6 @@ describe("files conformance", () => {
 describe("index conformance", () => {
   test("memory", () => runIndexConformance(memoryIndexDriver, { dims: 3 }));
   test("pgvector", () => runIndexConformance(pgvectorDriver, { dims: 3 }));
-  test("libsql", () => runIndexConformance(libsqlIndexDriver, { dims: 3 }));
 });
 
 describe("text index conformance", () => {
@@ -70,8 +75,6 @@ describe("protocol naming", () => {
   test("driver ids are protocols, never vendors", () => {
     const ids = [
       memorySqlDriver.id,
-      sqliteDriver.id,
-      libsqlDriver.id,
       pgliteDriver.id,
       postgresDriver.id,
       memoryKvDriver.id,
@@ -81,13 +84,10 @@ describe("protocol naming", () => {
       s3Driver.id,
       memoryIndexDriver.id,
       pgvectorDriver.id,
-      libsqlIndexDriver.id,
       meilisearchDriver.id,
     ];
     expect(ids).toEqual([
       "memory",
-      "sqlite",
-      "libsql",
       "pglite",
       "postgres",
       "memory",
@@ -97,7 +97,6 @@ describe("protocol naming", () => {
       "s3",
       "memory",
       "pgvector",
-      "libsql",
       "meilisearch",
     ]);
     for (const id of ids) {

package/src/drivers/drizzle-dialect.test.ts

@@ -8,17 +8,13 @@ import { drizzleDialectFromSqlDriver, SQL_DRIVER_TO_DRIZZLE_DIALECT } from "./dr
 describe("SQL_DRIVER_TO_DRIZZLE_DIALECT", () => {
   test("maps owned SQL drivers", () => {
     expect(SQL_DRIVER_TO_DRIZZLE_DIALECT).toEqual({
-      sqlite: "sqlite",
       postgres: "postgresql",
-      libsql: "sqlite",
       pglite: "postgresql",
     });
   });
 
   test("drizzleDialectFromSqlDriver resolves", () => {
-    expect(drizzleDialectFromSqlDriver("sqlite")).toBe("sqlite");
     expect(drizzleDialectFromSqlDriver("postgres")).toBe("postgresql");
-    expect(drizzleDialectFromSqlDriver("libsql")).toBe("sqlite");
     expect(drizzleDialectFromSqlDriver("pglite")).toBe("postgresql");
   });
 });

package/src/drivers/drizzle-dialect.ts

@@ -1,18 +1,14 @@
 /**
  * Map OKE `store.sql` driver ids to drizzle-kit dialects.
  *
- * drizzle-kit `1.0.0-rc.4` dialects (from its schema validator):
- * `postgresql` · `mysql` · `sqlite` · `turso` · `singlestore` · `mssql` ·
- * `cockroach` · `duckdb`. OKE owns kit-facing SQL drivers `sqlite` /
- * `postgres` / `libsql` / `pglite` only — map those, never infer from
- * connection URLs. `libsql` speaks the sqlite wire dialect; `pglite` speaks
- * postgresql (same dialect as `postgres`, different transport).
+ * Owned SQL drivers are Postgres-family only (`postgres` · `pglite`) — both
+ * map to kit dialect `postgresql`. Never infer from connection URLs.
  */
 
 import type { StoreDriverId } from "./types.ts";
 
-/** drizzle-kit `Dialect` values OKE currently emits for owned SQL drivers. */
-export type OkeDrizzleKitDialect = "sqlite" | "postgresql";
+/** drizzle-kit `Dialect` values OKE emits for owned SQL drivers. */
+export type OkeDrizzleKitDialect = "postgresql";
 
 /**
  * Exhaustive map: adding a new SQL id to `StoreDriverId` without updating
@@ -20,22 +16,20 @@ export type OkeDrizzleKitDialect = "sqlite" | "postgresql";
  * dialect months later.
  */
 export const SQL_DRIVER_TO_DRIZZLE_DIALECT: Record<
-  Extract<StoreDriverId, "sqlite" | "postgres" | "libsql" | "pglite">,
+  Extract<StoreDriverId, "postgres" | "pglite">,
   OkeDrizzleKitDialect
 > = {
-  sqlite: "sqlite",
   postgres: "postgresql",
-  libsql: "sqlite",
   pglite: "postgresql",
 };
 
 /**
  * Resolve the drizzle-kit dialect for an OKE SQL driver id.
  *
- * @param driverId - Protocol driver id (`sqlite` | `postgres` | `libsql` | `pglite`)
+ * @param driverId - Protocol driver id (`postgres` | `pglite`)
  */
 export function drizzleDialectFromSqlDriver(
-  driverId: Extract<StoreDriverId, "sqlite" | "postgres" | "libsql" | "pglite">,
+  driverId: Extract<StoreDriverId, "postgres" | "pglite">,
 ): OkeDrizzleKitDialect {
   return SQL_DRIVER_TO_DRIZZLE_DIALECT[driverId];
 }

package/src/drivers/index.ts

@@ -66,8 +66,6 @@ export {
   memoryDrivers,
 } from "./memory.ts";
 
-export { sqliteDriver, connectSqlite } from "./sqlite.ts";
-
 export {
   postgresDriver,
   connectPostgres,
@@ -86,8 +84,6 @@ export { s3Driver, openS3Bucket, createS3FakeClient } from "./s3.ts";
 
 export { pgvectorDriver, openPgvectorIndex } from "./pgvector.ts";
 
-export { libsqlDriver, connectLibsql, libsqlIndexDriver, openLibsqlIndex } from "./libsql.ts";
-
 export {
   meilisearchDriver,
   openMeilisearchIndex,
@@ -95,7 +91,12 @@ export {
   type MeilisearchIndexOptions,
 } from "./meilisearch.ts";
 
-export { pgliteDriver, connectPglite } from "./pglite.ts";
+export {
+  pgliteDriver,
+  connectPglite,
+  PGLITE_DEFAULT_DATADIR,
+  resolvePgliteDataDir,
+} from "./pglite.ts";
 
 export { memorySignalDriver, openMemorySignal } from "./signal-memory.ts";
 
@@ -139,8 +140,24 @@ export type { VaultDriverId, VaultOpenOptions, VaultBag, VaultDriver } from "./v
 
 export { memoryVaultDriver } from "./vault-memory.ts";
 export { envVaultDriver } from "./vault-env.ts";
-export { openbaoVaultDriver, OpenBaoUnavailableError } from "./vault-openbao.ts";
-export { managedVaultDriver } from "./vault-managed.ts";
+export {
+  builtinVaultDriver,
+  openBuiltinVaultAdapter,
+  VAULT_MASTER_KEY_ENV,
+  type OpenBuiltinVaultOptions,
+  type OpenedBuiltinVault,
+} from "./vault-builtin.ts";
+export {
+  managedVaultDriver,
+  createManagedVaultBag,
+  type ManagedVaultOptions,
+  type ManagedVaultProviderId,
+} from "./vault-managed.ts";
+export {
+  openAwsSecretsManagerBag,
+  type AwsSecretsManagerClient,
+  type OpenAwsSecretsManagerOptions,
+} from "./vault-aws-secrets-manager.ts";
 
 export type {
   ChannelDriverId,

package/src/drivers/journal-postgres.test.ts

@@ -142,18 +142,20 @@ describe("postgres JournalStore (fake)", () => {
     await store.close();
   });
 
-  test("listOrphans: running/sleeping without a live lease; never completed", async () => {
+  test("listOrphans: running/sleeping/compensating without a live lease; never completed", async () => {
     const store = await createPostgresJournalStore({ sql: createPostgresJournalFake() });
     await store.put(seedRun({ id: "running-unlocked" }));
     await store.put(seedRun({ id: "running-expired", lockedBy: "dead", leaseExpiresAt: 10 }));
     await store.put(seedRun({ id: "running-live", lockedBy: "alive", leaseExpiresAt: 9_000 }));
     await store.put(seedRun({ id: "sleeping-future", status: "sleeping", wakeAt: 99_000 }));
+    await store.put(seedRun({ id: "compensating-open", status: "compensating" }));
     await store.put(seedRun({ id: "done", status: "completed" }));
 
     const orphans = (await store.listOrphans(1_000)).map((r) => r.id);
     expect(orphans).toContain("running-unlocked");
     expect(orphans).toContain("running-expired");
     expect(orphans).toContain("sleeping-future");
+    expect(orphans).toContain("compensating-open");
     expect(orphans).not.toContain("running-live");
     expect(orphans).not.toContain("done");
     await store.close();

package/src/drivers/journal-postgres.ts

@@ -60,7 +60,7 @@ const CLAIM_LEASE_SQL = `SELECT * FROM oke_journal_runs WHERE id=? AND ((locked_
 const CLAIM_DUE_SQL = `SELECT * FROM oke_journal_runs WHERE status='sleeping' AND wake_at<=? AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?)) ORDER BY wake_at ASC LIMIT 1 FOR UPDATE SKIP LOCKED`;
 
 /** Boot-time orphan discovery: running/sleeping runs with no live lease. */
-const ORPHANS_SQL = `SELECT * FROM oke_journal_runs WHERE (status='running' OR status='sleeping') AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?))`;
+const ORPHANS_SQL = `SELECT * FROM oke_journal_runs WHERE (status='running' OR status='sleeping' OR status='compensating') AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?))`;
 
 const UPDATE_LEASE_SQL = `UPDATE oke_journal_runs SET locked_by = ?, lease_expires_at = ? WHERE id = ?`;
 
@@ -284,7 +284,9 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
         const cutoff = Number(params[0]);
         return state.rows
           .filter(
-            (r) => (r.status === "running" || r.status === "sleeping") && noLiveLease(r, cutoff),
+            (r) =>
+              (r.status === "running" || r.status === "sleeping" || r.status === "compensating") &&
+              noLiveLease(r, cutoff),
           )
           .map((r) => ({ ...r }));
       }

package/src/drivers/meilisearch.ts

@@ -1,7 +1,7 @@
 /**
  * `meilisearch` index driver — full-text search over the Meilisearch HTTP API.
  *
- * Product-as-protocol id (same pattern as `openbao` / `pgvector`); the image
+ * Product-as-protocol id (same pattern as `pgvector`); the image
  * pin lives in `images["store.index"]` (e.g. `getmeili/meilisearch`). This is
  * a genuinely different capability from the vector ANN drivers — typo-tolerant
  * / faceted full-text relevance, not cosine similarity.

package/src/drivers/pglite.ts

@@ -7,9 +7,8 @@
  *
  * Honest latency trade-off (measured on `@electric-sql/pglite@0.5.4`): first
  * init ~900 ms one-time (WASM instantiation); reopen of an existing datadir
- * ~44 ms; warm CRUD ~45 ms vs ~3 ms for `bun:sqlite` (~15× slower). Choose
- * `pglite` for dialect/pgvector parity on a laptop — never as a
- * latency-competitive default. `local` stays on `sqlite`.
+ * ~44 ms; warm CRUD ~45 ms. Default for `env: "test"` (`memory://`);
+ * `dev`/`prod` use real Postgres via Docker.
  */
 
 import { toPostgresParams } from "./postgres.ts";
@@ -39,6 +38,24 @@ async function loadPgliteVector(): Promise<PgliteVectorModule> {
   }
 }
 
+/** Default on-disk PGlite datadir (under the project `.oke/` tree). */
+export const PGLITE_DEFAULT_DATADIR = ".oke/pgdata";
+
+/**
+ * Resolve a PGlite URL to either in-memory (`memory://…`) or an on-disk datadir.
+ *
+ * SQLite's `":memory:"` is **not** in-memory for PGlite — it would create a
+ * literal `./:memory:` folder. Map that legacy token to {@link PGLITE_DEFAULT_DATADIR}.
+ *
+ * @param url - Raw connect URL / path
+ */
+export function resolvePgliteDataDir(url: string | undefined): string | "memory" {
+  const raw = url && url.length > 0 ? url : PGLITE_DEFAULT_DATADIR;
+  if (raw.startsWith("memory://")) return "memory";
+  if (raw === ":memory:") return PGLITE_DEFAULT_DATADIR;
+  return raw;
+}
+
 /**
  * Open a PGlite connection implementing {@link SqlConnection}.
  *
@@ -52,8 +69,14 @@ export async function connectPglite(options: SqlConnectOptions = {}): Promise<Sq
   const role = options.role ?? "primary";
   const { PGlite } = await loadPglite();
   const { vector } = await loadPgliteVector();
-  const dataDir = options.url && options.url.length > 0 ? options.url : ".oke/pgdata";
-  const db = await PGlite.create(dataDir, { extensions: { vector } });
+  const resolved = resolvePgliteDataDir(options.url);
+  // `memory://…` must be a fresh in-memory instance every connect — passing the
+  // string as dataDir is not reliably isolated across boots (IF NOT EXISTS then
+  // keeps a prior INTEGER column after we switch DDL to BIGINT).
+  const db =
+    resolved === "memory"
+      ? await PGlite.create({ extensions: { vector } })
+      : await PGlite.create(resolved, { extensions: { vector } });
   return {
     driverId: "pglite",
     role,

package/src/drivers/types.ts

@@ -9,9 +9,7 @@ import type { ColumnClassification, StoreFacet } from "../manifest/types.ts";
 
 /** Protocol ids for store drivers in scope. */
 export type StoreDriverId =
-  | "sqlite"
   | "postgres"
-  | "libsql"
   | "pglite"
   | "memory"
   | "redis"
@@ -31,14 +29,14 @@ export type SqlRow = Record<string, unknown>;
 
 /** Options when opening a SQL connection. */
 export interface SqlConnectOptions {
-  /** Connection URL or path (`:memory:`, `file:…`, `postgres://…`). */
+  /** Connection URL or path (`memory://`, `.oke/pgdata`, `postgres://…`). */
   readonly url?: string;
   /** Explicit role (defaults to primary). */
   readonly role?: SqlRole;
-  /** Pool / open hint — ignored by memory/sqlite. */
+  /** Pool / open hint — ignored by memory drivers. */
   readonly pool?: { readonly max?: number };
   /**
-   * Injected client for tests (Bun.SQL-compatible query fn, or bun:sqlite Database).
+   * Injected client for tests (Bun.SQL-compatible query fn).
    * Production code omits this and binds the native client.
    */
   readonly client?: unknown;
@@ -47,7 +45,7 @@ export interface SqlConnectOptions {
 /** Low-level SQL connection used by every sql driver. */
 export interface SqlConnection {
   /** Protocol driver id. */
-  readonly driverId: "sqlite" | "postgres" | "libsql" | "pglite" | "memory";
+  readonly driverId: "postgres" | "pglite" | "memory";
   /** Primary vs replica. */
   readonly role: SqlRole;
   /**
@@ -71,7 +69,7 @@ export interface SqlConnection {
 /** SQL driver factory. */
 export interface SqlDriver {
   /** Protocol id. */
-  readonly id: "sqlite" | "postgres" | "libsql" | "pglite" | "memory";
+  readonly id: "postgres" | "pglite" | "memory";
   /** Facet this driver serves. */
   readonly facet: "sql";
   /**
@@ -262,7 +260,7 @@ export interface IndexHit {
 
 /** Vector (ANN) index handle. */
 export interface VectorIndexStore {
-  readonly driverId: "memory" | "pgvector" | "libsql";
+  readonly driverId: "memory" | "pgvector";
   /**
    * Upsert a vector.
    *
@@ -356,7 +354,7 @@ export interface IndexOpenOptions {
 
 /** Vector index driver factory. */
 export interface VectorIndexDriver {
-  readonly id: "memory" | "pgvector" | "libsql";
+  readonly id: "memory" | "pgvector";
   readonly facet: "index";
   /**
    * Open a vector index.
@@ -384,8 +382,8 @@ export type IndexDriver = VectorIndexDriver | TextIndexDriver;
 /** True when the index driver shares the sql facet's engine (never memory). */
 export function indexDriverNeedsSql(
   driver: IndexDriver,
-): driver is VectorIndexDriver & { id: "pgvector" | "libsql" } {
-  return driver.id === "pgvector" || driver.id === "libsql";
+): driver is VectorIndexDriver & { id: "pgvector" } {
+  return driver.id === "pgvector";
 }
 
 /** Union of all store drivers. */

package/src/drivers/vault-aws-secrets-manager.test.ts

@@ -0,0 +1,159 @@
+/**
+ * AWS Secrets Manager bag — snapshot reads, write-through, fail-loud, peer gap.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { isVaultError } from "../elements/vault/errors.ts";
+import {
+  openAwsSecretsManagerBag,
+  type AwsSecretsManagerClient,
+} from "./vault-aws-secrets-manager.ts";
+
+/** One recorded call against the fake API. */
+interface Call {
+  readonly op: "list" | "get" | "put" | "remove";
+  readonly name?: string;
+  readonly value?: string;
+}
+
+/** Fake API options — which operations should reject, and how. */
+interface FakeOptions {
+  readonly listError?: Error;
+  readonly getError?: Error;
+  readonly putError?: Error;
+}
+
+/** In-memory stand-in for the SDK-backed client. */
+function fakeClient(
+  seed: Record<string, string>,
+  calls: Call[],
+  options: FakeOptions = {},
+): AwsSecretsManagerClient {
+  const store = new Map(Object.entries(seed));
+  return {
+    async list() {
+      calls.push({ op: "list" });
+      if (options.listError) throw options.listError;
+      return [...store.keys()];
+    },
+    async get(name) {
+      calls.push({ op: "get", name });
+      if (options.getError) throw options.getError;
+      return store.get(name);
+    },
+    async put(name, value) {
+      calls.push({ op: "put", name, value });
+      if (options.putError) throw options.putError;
+      store.set(name, value);
+    },
+    async remove(name) {
+      calls.push({ op: "remove", name });
+      store.delete(name);
+    },
+  };
+}
+
+describe("aws secrets manager vault bag", () => {
+  test("list + get snapshots every secret", async () => {
+    const calls: Call[] = [];
+    const bag = await openAwsSecretsManagerBag({
+      client: fakeClient({ STRIPE_KEY: "sk_live", DATABASE_URL: "postgres://x" }, calls),
+    });
+    expect([...bag.names()].sort()).toEqual(["DATABASE_URL", "STRIPE_KEY"]);
+    expect(bag.get("STRIPE_KEY")).toBe("sk_live");
+    expect(calls.filter((c) => c.op === "get")).toHaveLength(2);
+  });
+
+  test("denied list falls back to the declared names", async () => {
+    const calls: Call[] = [];
+    const denied = new Error("denied");
+    denied.name = "AccessDeniedException";
+    const bag = await openAwsSecretsManagerBag({
+      secrets: { STRIPE_KEY: "seed" },
+      client: fakeClient({ STRIPE_KEY: "sk_live", OTHER: "nope" }, calls, { listError: denied }),
+    });
+    expect(bag.names()).toEqual(["STRIPE_KEY"]);
+    expect(bag.get("STRIPE_KEY")).toBe("sk_live");
+  });
+
+  test("denied list with no declared names fails loud", async () => {
+    const denied = new Error("denied");
+    denied.name = "AccessDeniedException";
+    let failed: unknown;
+    try {
+      await openAwsSecretsManagerBag({
+        client: fakeClient({}, [], { listError: denied }),
+      });
+    } catch (error) {
+      failed = error;
+    }
+    expect(isVaultError(failed, "PERMISSION_DENIED")).toBe(true);
+  });
+
+  test("a failing read is fatal, never a silently empty bag", async () => {
+    let failed: unknown;
+    try {
+      await openAwsSecretsManagerBag({
+        client: fakeClient({ A: "1" }, [], { getError: new Error("boom") }),
+      });
+    } catch (error) {
+      failed = error;
+    }
+    expect(isVaultError(failed, "BACKEND_ERROR")).toBe(true);
+  });
+
+  test("the authored message never carries the SDK error text", async () => {
+    let failed: unknown;
+    try {
+      await openAwsSecretsManagerBag({
+        client: fakeClient({ A: "1" }, [], { getError: new Error("SecretString=sk_live_leak") }),
+      });
+    } catch (error) {
+      failed = error;
+    }
+    expect((failed as Error).message).not.toContain("sk_live_leak");
+  });
+
+  test("set writes through and close settles it", async () => {
+    const calls: Call[] = [];
+    const bag = await openAwsSecretsManagerBag({ client: fakeClient({ A: "1" }, calls) });
+    bag.set?.("A", "2");
+    expect(bag.get("A")).toBe("2");
+    await bag.close?.();
+    expect(calls).toContainEqual({ op: "put", name: "A", value: "2" });
+  });
+
+  test("delete removes locally and remotely", async () => {
+    const calls: Call[] = [];
+    const bag = await openAwsSecretsManagerBag({ client: fakeClient({ A: "1" }, calls) });
+    expect(bag.delete?.("A")).toBe(true);
+    expect(bag.get("A")).toBeUndefined();
+    await bag.close?.();
+    expect(calls).toContainEqual({ op: "remove", name: "A" });
+  });
+
+  test("a lost write surfaces at close instead of vanishing", async () => {
+    const bag = await openAwsSecretsManagerBag({
+      client: fakeClient({ A: "1" }, [], { putError: new Error("throttled") }),
+    });
+    bag.set?.("A", "2");
+    let failed: unknown;
+    try {
+      await bag.close?.();
+    } catch (error) {
+      failed = error;
+    }
+    expect(isVaultError(failed, "BACKEND_ERROR")).toBe(true);
+  });
+
+  test("missing optional peer reports the install command", async () => {
+    let failed: unknown;
+    try {
+      await openAwsSecretsManagerBag({ region: "us-east-1" });
+    } catch (error) {
+      failed = error;
+    }
+    expect(isVaultError(failed, "MISSING_PEER")).toBe(true);
+    expect((failed as Error).message).toContain("@aws-sdk/client-secrets-manager");
+  });
+});