okengine 0.11.0 → 0.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okengine",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "One law. Eight elements. Ten exports. One package. One manifest. Every backend need is derived, never added.",
   "license": "MIT",
   "repository": {

package/src/elements/gate/config.ts

@@ -1,8 +1,12 @@
 /**
  * `oke({ gate })` — nested Gate bag (auth · policies · rate · posture).
+ *
+ * Auth resolution is sync-lazy via {@link requirePackageModule} so HTTP-only
+ * apps never evaluate `auth/config` (and so `dist/` can ship a separate chunk).
  */
 
-import { resolveGateAuth, type GateAuthOptions, type ResolvedGateAuth } from "../../auth/config.ts";
+import type { GateAuthOptions, ResolvedGateAuth } from "../../auth/config.ts";
+import { requirePackageModule } from "../../shared/lazy-src.ts";
 import type { GateDecl } from "./declare.ts";
 
 /** Rate-limit defaults under Gate. */
@@ -51,8 +55,14 @@ export interface ResolveGateConfigOptions {
  */
 export function resolveGateConfig(options: ResolveGateConfigOptions = {}): ResolvedGateConfig {
   const bag = options.gate ?? {};
-  const auth =
-    bag.auth !== undefined ? resolveGateAuth({ auth: bag.auth, env: options.env }) : undefined;
+  let auth: ResolvedGateAuth | undefined;
+  if (bag.auth !== undefined) {
+    const { resolveGateAuth } = requirePackageModule<typeof import("../../auth/config.ts")>(
+      "auth/config",
+      "auth-config",
+    );
+    auth = resolveGateAuth({ auth: bag.auth, env: options.env });
+  }
   const rateLimitEnabled =
     bag.rateLimit?.enabled !== undefined
       ? bag.rateLimit.enabled

package/src/elements/gate/declare.ts

@@ -5,7 +5,7 @@
  */
 
 import type { RateStrategy } from "../../manifest/types.ts";
-import { DEFAULT_RATE_STRATEGY } from "./strategies.ts";
+import { DEFAULT_RATE_STRATEGY } from "./constants.ts";
 
 /** Context passed to policy predicates at evaluation time. */
 export interface GatePolicyContext {

package/src/elements/gate/strategies.ts

@@ -11,6 +11,8 @@
 import { registerLuaScript, type LuaKvStore } from "../../drivers/kv-lua.ts";
 import type { RateStrategy } from "../../manifest/types.ts";
 
+export { ALL_RATE_STRATEGIES, DEFAULT_RATE_STRATEGY } from "./constants.ts";
+
 /** Result of a rate-limit take attempt. */
 export interface RateTakeResult {
   /** Whether the request is allowed. */
@@ -338,18 +340,6 @@ export const RATE_STRATEGIES: Record<RateStrategy, StrategyDef> = {
   "leaky-bucket": leakyBucket,
 };
 
-/** Default rate strategy (unified-theory §16). */
-export const DEFAULT_RATE_STRATEGY: RateStrategy = "sliding-window-counter";
-
-/** All five strategy ids. */
-export const ALL_RATE_STRATEGIES: readonly RateStrategy[] = [
-  "fixed-window",
-  "sliding-window-counter",
-  "sliding-log",
-  "token-bucket",
-  "leaky-bucket",
-];
-
 for (const def of Object.values(RATE_STRATEGIES)) {
   registerLuaScript(def.lua, (store, keys, args) => def.run(store, keys, args));
 }

package/src/kernel/app-auth.ts

@@ -0,0 +1,98 @@
+/**
+ * Sync auth wiring for `oke({ gate: { auth } })`.
+ *
+ * Loaded only when auth is configured so HTTP-only cold graphs never import
+ * bindings / sessions / identity (`requirePackageModule` in `app.ts`).
+ */
+
+import type { ResolvedGateAuth } from "../auth/config.ts";
+import { auth as authPlugin } from "../auth/plugin.ts";
+import { createAuthHttpBindings, type AuthHttpMaterialization } from "../auth/bindings.ts";
+import { tokenFromCookieHeader } from "../auth/cookies.ts";
+import { setActiveGateAuthContext } from "../auth/method-context.ts";
+import type { ResolvedGateConfig } from "../elements/gate/config.ts";
+import { createAppAuthBinding, verifyBearerToken, type AppAuthBinding } from "./auth-resolve.ts";
+import type { PluginDef } from "./plugin.ts";
+
+/** Result of wiring Gate auth at construction. */
+export interface WiredGateAuth {
+  readonly materialization: AuthHttpMaterialization | undefined;
+  readonly authPlugin: PluginDef | undefined;
+  readonly authBinding: AppAuthBinding;
+  readonly verifyBearerToken: typeof verifyBearerToken;
+  readonly tokenFromCookieHeader: typeof tokenFromCookieHeader;
+  /** Rebuild binding when boot supplies a clock. */
+  rebind(now: () => number): AppAuthBinding;
+}
+
+/** Options for {@link wireGateAuth}. */
+export interface WireGateAuthOptions {
+  readonly gateConfig: ResolvedGateConfig & { readonly auth: ResolvedGateAuth };
+  /** Clock fallback when `gate.auth.now` is omitted (`oke({ fx: { now } })`). */
+  readonly now?: () => number;
+}
+
+/**
+ * Materialize auth HTTP bindings, absorb the builtin auth plugin, and publish
+ * the active Gate auth context for `.plug(username())` etc.
+ *
+ * @param options - Resolved Gate bag + optional clock
+ */
+export function wireGateAuth(options: WireGateAuthOptions): WiredGateAuth {
+  const { gateConfig } = options;
+  const auth = gateConfig.auth;
+  let materialization: AuthHttpMaterialization | undefined;
+  if (auth.http) {
+    materialization = createAuthHttpBindings(auth, {
+      rateLimitEnabled: gateConfig.rateLimitEnabled,
+      sessions: auth.sessions,
+    });
+  }
+
+  const pluginDef = authPlugin({
+    secret: auth.secret,
+    accessTtlMs: auth.session.accessTtlMs,
+    refreshTtlMs: auth.session.refreshTtlMs,
+    session: {
+      accessTtlMs: auth.session.accessTtlMs,
+      refreshTtlMs: auth.session.refreshTtlMs,
+      idleTtlMs: auth.session.idleTtlMs,
+      absoluteTtlMs: auth.session.absoluteTtlMs,
+      singleSessionPerUser: auth.session.singleSessionPerUser,
+    },
+    password: auth.password,
+    passwordPolicy: auth.passwordPolicy,
+    breachCheck: auth.breachCheck,
+  });
+
+  let authBinding = createAppAuthBinding({
+    secret: auth.secret,
+    sessions: materialization?.ctx.sessions ?? auth.sessions,
+    now: auth.now ?? options.now,
+  });
+
+  setActiveGateAuthContext({
+    secret: authBinding.secret,
+    sessions: authBinding.sessions,
+    now: authBinding.now,
+    passwordPolicy: auth.passwordPolicy,
+    password: auth.password,
+    breachCheck: auth.breachCheck,
+  });
+
+  return {
+    materialization,
+    authPlugin: pluginDef,
+    authBinding,
+    verifyBearerToken,
+    tokenFromCookieHeader,
+    rebind(now) {
+      authBinding = createAppAuthBinding({
+        secret: authBinding.secret,
+        sessions: authBinding.sessions,
+        now,
+      });
+      return authBinding;
+    },
+  };
+}

package/src/kernel/app.ts

@@ -6,12 +6,9 @@
  * pipeline, and wires `fx.call` to untriggered (and triggered) flows.
  */
 
-import {
-  compileRoute,
-  encodeExecuteResult,
-  encodeFailure,
-  type CompiledRoute,
-} from "../compiler/index.ts";
+import { compileRoute } from "../compiler/dynamic.ts";
+import type { CompiledRoute } from "../compiler/aot.ts";
+import { encodeExecuteResult, encodeFailure } from "../compiler/response.ts";
 import { validate } from "../validation/standard-schema.ts";
 import {
   accumulateAdoptArgs,
@@ -25,16 +22,15 @@ import {
 // when an app actually boots (AGENTS.md / unified-theory budget: cold start < 75 ms).
 import type { BootOptions, BootResult, ElementRuntimes } from "./boot.ts";
 import type { CapabilityToken } from "./capability.ts";
-import { createAppAuthBinding, verifyBearerToken, type AppAuthBinding } from "./auth-resolve.ts";
-import { createAuthHttpBindings, type AuthHttpMaterialization } from "../auth/bindings.ts";
-import { auth as authPlugin } from "../auth/plugin.ts";
-import { tokenFromCookieHeader } from "../auth/cookies.ts";
-import { setActiveGateAuthContext } from "../auth/method-context.ts";
+import type { AppAuthBinding } from "./auth-resolve.ts";
+import type { AuthHttpMaterialization } from "../auth/bindings.ts";
+import type { WiredGateAuth } from "./app-auth.ts";
 import {
   resolveGateConfig,
   type GateOptions,
   type ResolvedGateConfig,
 } from "../elements/gate/config.ts";
+import { requirePackageModule } from "../shared/lazy-src.ts";
 import type { TemplateCatalog } from "../elements/channel/runtime.ts";
 import { parseAcceptLanguage } from "../elements/channel/locale.ts";
 import { runWithLocale } from "../i18n/locale-context.ts";
@@ -534,14 +530,6 @@ export function oke(options: OkeOptions): OkeApp {
     gate: options.gate,
     env: options.env,
   });
-  let authMaterialization: AuthHttpMaterialization | undefined;
-  if (gateConfig.auth?.http) {
-    authMaterialization = createAuthHttpBindings(gateConfig.auth, {
-      rateLimitEnabled: gateConfig.rateLimitEnabled,
-      sessions: gateConfig.auth.sessions,
-    });
-    adopted.push(...authMaterialization.bindings);
-  }
 
   /** Retained for test harness / boot merges. */
   const $options = options;
@@ -555,27 +543,26 @@ export function oke(options: OkeOptions): OkeApp {
   /** Runtime route table — types accumulate on the returned {@link OkeApp}. */
   const routes: RuntimeRouteMap = {};
 
-  // Absorb auth() tables into gate.auth — `.needs("auth")` sees plugin name.
+  let authMaterialization: AuthHttpMaterialization | undefined;
+  let wiredAuth: WiredGateAuth | undefined;
+  let authBinding: AppAuthBinding | undefined;
   if (gateConfig.auth) {
-    applyPlugin(
-      pluginRegistry,
-      authPlugin({
-        secret: gateConfig.auth.secret,
-        accessTtlMs: gateConfig.auth.session.accessTtlMs,
-        refreshTtlMs: gateConfig.auth.session.refreshTtlMs,
-        session: {
-          accessTtlMs: gateConfig.auth.session.accessTtlMs,
-          refreshTtlMs: gateConfig.auth.session.refreshTtlMs,
-          idleTtlMs: gateConfig.auth.session.idleTtlMs,
-          absoluteTtlMs: gateConfig.auth.session.absoluteTtlMs,
-          singleSessionPerUser: gateConfig.auth.session.singleSessionPerUser,
-        },
-        password: gateConfig.auth.password,
-        passwordPolicy: gateConfig.auth.passwordPolicy,
-        breachCheck: gateConfig.auth.breachCheck,
-      }),
-      appPluginScope,
+    const { wireGateAuth } = requirePackageModule<typeof import("./app-auth.ts")>(
+      "kernel/app-auth",
+      "app-auth",
     );
+    wiredAuth = wireGateAuth({
+      gateConfig: { ...gateConfig, auth: gateConfig.auth },
+      now: options.fx?.now,
+    });
+    authMaterialization = wiredAuth.materialization;
+    authBinding = wiredAuth.authBinding;
+    if (authMaterialization) {
+      adopted.push(...authMaterialization.bindings);
+    }
+    if (wiredAuth.authPlugin) {
+      applyPlugin(pluginRegistry, wiredAuth.authPlugin, appPluginScope);
+    }
   }
 
   const smart = createRouter<Binding>(options.router ?? "default");
@@ -671,29 +658,10 @@ export function oke(options: OkeOptions): OkeApp {
   let bootPromise: Promise<BootResult> | undefined;
   let readyState: ReadyState = "booting";
   let bootEnv: BootOptions["env"] = options.env;
-  let authBinding: AppAuthBinding | undefined =
-    gateConfig.auth !== undefined
-      ? createAppAuthBinding({
-          secret: gateConfig.auth.secret,
-          sessions: authMaterialization?.ctx.sessions ?? gateConfig.auth.sessions,
-          now: gateConfig.auth.now ?? options.fx?.now,
-        })
-      : undefined;
-  if (authBinding) {
-    setActiveGateAuthContext({
-      secret: authBinding.secret,
-      sessions: authBinding.sessions,
-      now: authBinding.now,
-      passwordPolicy: gateConfig.auth?.passwordPolicy,
-      password: gateConfig.auth?.password,
-      breachCheck: gateConfig.auth?.breachCheck,
-    });
-  } else {
-    setActiveGateAuthContext(undefined);
-  }
   // Fallback journal for pre-boot / `autoBoot: false` unit tests. A booted
   // app replaces this with the bound `drivers.journal` store (postgres etc.).
-  const fallbackJournalStore = createMemoryJournalStore();
+  // Constructed on first use so non-durable HTTP apps skip the alloc.
+  let fallbackJournalStore: JournalStore | undefined;
   const fallbackJournalInstanceId = `app-${crypto.randomUUID()}`;
   const sleepingRuns = new Map<
     string,
@@ -715,6 +683,7 @@ export function oke(options: OkeOptions): OkeApp {
     if (bound) {
       return { store: bound.store, instanceId: bound.instanceId, leaseMs: bound.leaseMs };
     }
+    fallbackJournalStore ??= createMemoryJournalStore();
     return {
       store: fallbackJournalStore,
       instanceId: fallbackJournalInstanceId,
@@ -978,12 +947,9 @@ export function oke(options: OkeOptions): OkeApp {
       readyState = "ready";
     }
     // Prefer the booted clock for access-token expiry checks.
-    if (authBinding) {
-      authBinding = createAppAuthBinding({
-        secret: authBinding.secret,
-        sessions: authBinding.sessions,
-        now: result.clock?.now.bind(result.clock) ?? authBinding.now,
-      });
+    if (wiredAuth && authBinding) {
+      const now = result.clock?.now.bind(result.clock) ?? authBinding.now;
+      authBinding = wiredAuth.rebind(now);
     }
     return result;
   }
@@ -1144,21 +1110,24 @@ export function oke(options: OkeOptions): OkeApp {
 
       const binding = authBinding;
       const cookieOpts = gateConfig.auth?.cookies;
+      const verifyBearer = wiredAuth?.verifyBearerToken;
+      const cookieToken = wiredAuth?.tokenFromCookieHeader;
       const elementHooks = createElementPipelineHooks({
         gates: booted.gate,
         principals,
         telemetry,
         allowTestPrincipals: testMode,
-        verifyBearer: binding ? async (token) => verifyBearerToken(binding, token) : undefined,
+        verifyBearer:
+          binding && verifyBearer ? async (token) => verifyBearer(binding, token) : undefined,
         // Phase 1a: opt-in cookie → Bearer when Authorization is absent.
         resolveToken:
-          binding && cookieOpts?.enabled
+          binding && cookieOpts?.enabled && cookieToken
             ? (request) => {
                 const header = request.headers.get("authorization");
                 if (header?.startsWith("Bearer ")) {
                   return header.slice("Bearer ".length).trim() || undefined;
                 }
-                return tokenFromCookieHeader(request.headers.get("cookie"), cookieOpts);
+                return cookieToken(request.headers.get("cookie"), cookieOpts);
               }
             : undefined,
       });

package/src/kernel/boot.test.ts

@@ -79,7 +79,7 @@ describe("boot — lazy element needs", () => {
     expect(needs.signal).toBe(false);
   });
 
-  test("oke() Store-only graph stays under the prior 54.3 kB baseline", async () => {
+  test("oke() Store-only graph stays under the prior 39 kB baseline", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-store-only-"));
     const entry = join(dir, "entry.ts");
     const appPath = join(import.meta.dir, "app.ts");
@@ -116,23 +116,9 @@ describe("boot — lazy element needs", () => {
         if (raw.byteLength === 0) continue;
         total += Bun.gzipSync(new Uint8Array(raw)).byteLength;
       }
-      // Rebased after fx.sendOtp/verifyOtp on the shared fx surface (~50.1 kB
-      // gzip), durable-journal lease surface (~51.2 kB), fx.deliverOtp +
-      // unified otp() (~50.9 kB → 53 kB), then fx.runs / SLO window on the
-      // shared surface (~53.3 kB → 54 kB cap). Clock/channel/journal drivers
-      // stay lazy-bound; far below eager bind. Rebased again for the
-      // store/vault/signal/channel auto-registry drain (`element-registries.ts`
-      // + the `oke()` merge/dedup logic) — every app now carries this
-      // regardless of which elements it uses, since the drain must run
-      // synchronously at construction (same isolation guarantee as the
-      // `on()` binding registry) and can't be deferred behind a lazy import
-      // (~54.0 kB → 54.3 kB cap). Rebased again for `assertAdoptBarrelFresh`
-      // + `tryListFlowsUnits` in `boot.ts` (`.adopt()` barrel staleness
-      // check, OKE1009) — part of the already-lazily-loaded boot graph, not
-      // the `oke()` construction path, but `Bun.build` still traces and
-      // sums the dynamic-import chunk (~54.3 kB → 54.7 kB → 55.0 kB after
-      // ConfigEnv local/docker → dev/test/prod + sqlite removal).
-      expect(total).toBeLessThan(55_000);
+      // Rebased after lazy `gate.auth` / auth-config chunks + `gate.public`
+      // decoupling from kv-lua strategies (~38.9 kB gzip with export externals).
+      expect(total).toBeLessThan(40_000);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }

package/src/release/build-lib.ts

@@ -22,6 +22,9 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   { src: "src/i18n-entry.ts", out: "dist/i18n-entry.js" },
   { src: "src/compiler-entry.ts", out: "dist/compiler-entry.js" },
   { src: "src/journal-entry.ts", out: "dist/journal-entry.js" },
+  // Lazy sync chunks — loaded via requirePackageModule when gate.auth is set.
+  { src: "src/kernel/app-auth.ts", out: "dist/app-auth.js" },
+  { src: "src/auth/config.ts", out: "dist/auth-config.js" },
 ];
 
 /**

package/src/shared/lazy-src.ts

@@ -0,0 +1,79 @@
+/**
+ * Sync-load package-local modules that Bun.build leaves as runtime requires
+ * (not inlined). Bun `src/` first; published `dist/` chunks for `"import"`.
+ *
+ * Uses Bun APIs (`import.meta.dir`, `import.meta.require`) and try/catch load
+ * instead of exists()+require — Bun’s preferred pattern (the exists syscall
+ * is an extra round trip).
+ */
+
+import { dirname, join } from "node:path";
+
+let cachedRoot: string | undefined;
+
+/**
+ * Try a sync `import.meta.require`; return `undefined` only when the file is missing.
+ *
+ * @typeParam T - Module namespace shape
+ * @param path - Absolute module path
+ */
+function tryRequire<T>(path: string): T | undefined {
+  try {
+    return import.meta.require(path) as T;
+  } catch (err) {
+    const code =
+      err !== null && typeof err === "object" && "code" in err
+        ? String((err as { code?: unknown }).code)
+        : undefined;
+    if (
+      code === "MODULE_NOT_FOUND" ||
+      code === "ENOENT" ||
+      (err instanceof Error && /Cannot find module|ENOENT/i.test(err.message))
+    ) {
+      return undefined;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Walk up from this module to the okengine package root (`package.json` name).
+ */
+export function okengineRoot(): string {
+  if (cachedRoot) return cachedRoot;
+  let dir = import.meta.dir;
+  for (let i = 0; i < 12; i++) {
+    const pkg = tryRequire<{ name?: string }>(join(dir, "package.json"));
+    if (pkg?.name === "okengine") {
+      cachedRoot = dir;
+      return dir;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("okengine: package root not found from " + import.meta.dir);
+}
+
+/**
+ * Synchronously load `src/<rel>.ts` (Bun) or published `dist/<distName>.js`.
+ *
+ * @typeParam T - Module namespace shape
+ * @param relSrc - Path under `src/` without extension (e.g. `auth/config`)
+ * @param distName - Filename under `dist/` without extension (e.g. `auth-config`)
+ */
+export function requirePackageModule<T>(relSrc: string, distName: string): T {
+  const root = okengineRoot();
+  const srcPath = join(root, "src", `${relSrc}.ts`);
+  const distPath = join(root, "dist", `${distName}.js`);
+  // Bun native TS — prefer source so local `oke` / tests stay on one graph.
+  if (typeof Bun !== "undefined") {
+    const fromSrc = tryRequire<T>(srcPath);
+    if (fromSrc !== undefined) return fromSrc;
+  }
+  const fromDist = tryRequire<T>(distPath);
+  if (fromDist !== undefined) return fromDist;
+  const fallback = tryRequire<T>(srcPath);
+  if (fallback !== undefined) return fallback;
+  throw new Error(`okengine: missing lazy module src/${relSrc}.ts or dist/${distName}.js`);
+}