okengine 0.11.0 → 0.11.2

package/src/elements/gate/config.ts

@@ -1,8 +1,12 @@
 /**
  * `oke({ gate })` — nested Gate bag (auth · policies · rate · posture).
+ *
+ * Auth resolution is sync-lazy via {@link requirePackageModule} so HTTP-only
+ * apps never evaluate `auth/config` (and so `dist/` can ship a separate chunk).
  */
 
-import { resolveGateAuth, type GateAuthOptions, type ResolvedGateAuth } from "../../auth/config.ts";
+import type { GateAuthOptions, ResolvedGateAuth } from "../../auth/config.ts";
+import { requirePackageModule } from "../../shared/lazy-src.ts";
 import type { GateDecl } from "./declare.ts";
 
 /** Rate-limit defaults under Gate. */
@@ -51,8 +55,14 @@ export interface ResolveGateConfigOptions {
  */
 export function resolveGateConfig(options: ResolveGateConfigOptions = {}): ResolvedGateConfig {
   const bag = options.gate ?? {};
-  const auth =
-    bag.auth !== undefined ? resolveGateAuth({ auth: bag.auth, env: options.env }) : undefined;
+  let auth: ResolvedGateAuth | undefined;
+  if (bag.auth !== undefined) {
+    const { resolveGateAuth } = requirePackageModule<typeof import("../../auth/config.ts")>(
+      "auth/config",
+      "auth-config",
+    );
+    auth = resolveGateAuth({ auth: bag.auth, env: options.env });
+  }
   const rateLimitEnabled =
     bag.rateLimit?.enabled !== undefined
       ? bag.rateLimit.enabled

package/src/elements/gate/declare.ts

@@ -5,7 +5,7 @@
  */
 
 import type { RateStrategy } from "../../manifest/types.ts";
-import { DEFAULT_RATE_STRATEGY } from "./strategies.ts";
+import { DEFAULT_RATE_STRATEGY } from "./constants.ts";
 
 /** Context passed to policy predicates at evaluation time. */
 export interface GatePolicyContext {

package/src/elements/gate/strategies.ts

@@ -11,6 +11,8 @@
 import { registerLuaScript, type LuaKvStore } from "../../drivers/kv-lua.ts";
 import type { RateStrategy } from "../../manifest/types.ts";
 
+export { ALL_RATE_STRATEGIES, DEFAULT_RATE_STRATEGY } from "./constants.ts";
+
 /** Result of a rate-limit take attempt. */
 export interface RateTakeResult {
   /** Whether the request is allowed. */
@@ -338,18 +340,6 @@ export const RATE_STRATEGIES: Record<RateStrategy, StrategyDef> = {
   "leaky-bucket": leakyBucket,
 };
 
-/** Default rate strategy (unified-theory §16). */
-export const DEFAULT_RATE_STRATEGY: RateStrategy = "sliding-window-counter";
-
-/** All five strategy ids. */
-export const ALL_RATE_STRATEGIES: readonly RateStrategy[] = [
-  "fixed-window",
-  "sliding-window-counter",
-  "sliding-log",
-  "token-bucket",
-  "leaky-bucket",
-];
-
 for (const def of Object.values(RATE_STRATEGIES)) {
   registerLuaScript(def.lua, (store, keys, args) => def.run(store, keys, args));
 }

package/src/elements/index.ts

@@ -163,6 +163,8 @@ export type {
 
 export {
   ai,
+  listAiDecls,
+  resetAiDecls,
   createAiRuntime,
   assertAllowPiiForAsk,
   AiPiiBuildError,

package/src/elements/store/index-boot.test.ts

@@ -6,7 +6,7 @@
  * native ANN index — no JS-side full scan survives.
  */
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
 import { connectPglite } from "../../drivers/pglite.ts";
 import { openPgvectorIndex } from "../../drivers/pgvector.ts";
 import { connectPostgres } from "../../drivers/postgres.ts";
@@ -22,6 +22,17 @@ const prev = {
   pglite: process.env.OKE_PGLITE_URL,
 };
 
+/** Warmed PGlite for direct openPgvectorIndex cases (boot path opens its own). */
+let sharedPglite: SqlConnection | undefined;
+
+beforeAll(async () => {
+  sharedPglite = await connectPglite({ url: "memory://index-boot-shared" });
+}, 15_000);
+
+afterAll(async () => {
+  await sharedPglite?.close();
+});
+
 afterEach(() => {
   if (prev.pglite === undefined) delete process.env.OKE_PGLITE_URL;
   else process.env.OKE_PGLITE_URL = prev.pglite;
@@ -43,7 +54,8 @@ function recordingConn(conn: SqlConnection): { conn: SqlConnection; statements:
         statements.push(sql);
         return conn.exec(sql, params);
       },
-      close: () => conn.close(),
+      // Never close the underlying shared PGlite — afterAll owns that.
+      close: async () => {},
     },
   };
 }
@@ -63,12 +75,16 @@ describe("store.index boot wiring — memory", () => {
 });
 
 describe("store.index boot wiring — pglite + pgvector", () => {
+  // bindStore opens its own PGlite — cannot inject the shared instance; allow
+  // cold WASM under suite contention (same budget as sql conformance).
   test("boot: sql=pglite + index=pgvector resolves end to end", async () => {
     process.env.OKE_PGLITE_URL = "memory://";
     const kb = declareIndex("kb", { dims: 3 });
     const runtime = bindStore(
       {
-        config: { drivers: { store: { sql: { test: "pglite" }, index: { test: "pgvector" } } } },
+        config: {
+          drivers: { store: { sql: { test: "pglite" }, index: { test: "pgvector" } } },
+        },
         stores: [kb],
       },
       "test",
@@ -86,10 +102,11 @@ describe("store.index boot wiring — pglite + pgvector", () => {
     expect(hits[0]!.meta).toEqual({ label: "near" });
     expect(await handle.delete("farther")).toBe(true);
     await runtime.close();
-  });
+  }, 15_000);
 
   test("pglite runs the shared pgvector HNSW path — real ANN, not a scan", async () => {
-    const real = await connectPglite({ url: "memory://" });
+    const real = sharedPglite!;
+    await real.exec(`DROP TABLE IF EXISTS oke_idx_ann CASCADE`);
     const { conn, statements } = recordingConn(real);
     const idx = await openPgvectorIndex({ name: "ann", dims: 3, sql: conn });
     await idx.upsert("a", [1, 0, 0]);
@@ -106,7 +123,7 @@ describe("store.index boot wiring — pglite + pgvector", () => {
     );
     expect(JSON.stringify(indexes)).toContain("USING hnsw");
     await idx.close();
-    await real.close();
+    // shared connection — closed in afterAll
   });
 });
 

package/src/elements/store/resource.test.ts

@@ -5,18 +5,19 @@
  * client-facing key.
  */
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
 import { createInsertSchema, createSelectSchema } from "drizzle-zod";
 import { z } from "zod";
 import { pgliteDriver } from "../../drivers/pglite.ts";
+import type { SqlConnection } from "../../drivers/types.ts";
 import { oke } from "../../kernel/app.ts";
 import { resetFlowSeq } from "../../kernel/flow.ts";
 import { on, resetBindings } from "../../kernel/on.ts";
 import { http } from "../../kernel/triggers.ts";
 import { createTestApp } from "../../test/create-test-app.ts";
 import { classify, field, id, now, PII_MASK, store } from "../store.ts";
-import { createSqlStoreHandle } from "./sql-session.ts";
+import { createSqlStoreHandle, type SqlStoreHandle } from "./sql-session.ts";
 import { mapRowToJs, resolveColumns } from "./table.ts";
 
 afterEach(() => {
@@ -24,6 +25,18 @@ afterEach(() => {
   resetFlowSeq();
 });
 
+/** Posts table for the JS-key exit lock (needs real Postgres dialect via PGlite). */
+const jsKeyPosts = pgTable("posts", {
+  id: text("id").primaryKey(),
+  title: text("title").notNull(),
+  createdAt: integer("created_at").notNull(),
+});
+
+/** File-scoped warmed PGlite for the SqlStoreHandle exit describe. */
+let sharedConn: SqlConnection;
+/** Handle over {@link sharedConn}. */
+let sharedHandle: SqlStoreHandle;
+
 describe("mapRowToJs — declared keys only", () => {
   const posts = pgTable("posts", {
     id: text("id").primaryKey(),
@@ -47,40 +60,46 @@ describe("mapRowToJs — declared keys only", () => {
 });
 
 describe("SqlStoreHandle exit — list/get/create return JS keys only", () => {
-  const posts = pgTable("posts", {
-    id: text("id").primaryKey(),
-    title: text("title").notNull(),
-    createdAt: integer("created_at").notNull(),
-  });
-
-  test("select / findById / insert.returning never emit created_at", async () => {
-    const conn = await pgliteDriver.connect({
-      url: "memory://",
+  // Real Postgres dialect (PGlite) — share one warmed instance; TRUNCATE between tests.
+  beforeAll(async () => {
+    sharedConn = await pgliteDriver.connect({
+      url: "memory://resource-js-keys-shared",
       role: "primary",
     });
-    const handle = createSqlStoreHandle("sql:app", {
-      connection: conn,
+    sharedHandle = createSqlStoreHandle("sql:app", {
+      connection: sharedConn,
       classifications: new Map(),
       routedRole: "primary",
       domainDdl: "ensure",
     });
+    // Warm DDL via the insert path (pgTable is not a TableHandle for ensureTable).
+    await sharedHandle.insert(jsKeyPosts).values({ id: "_warmup", title: "x", createdAt: 0 });
+    await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+  }, 15_000);
+
+  afterAll(async () => {
+    await sharedConn.close();
+  });
 
-    const [created] = await handle
-      .insert(posts)
+  beforeEach(async () => {
+    await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+  });
+
+  test("select / findById / insert.returning never emit created_at", async () => {
+    const [created] = await sharedHandle
+      .insert(jsKeyPosts)
       .values({ id: "p1", title: "one", createdAt: 100 })
       .returning();
     expect(Object.keys(created!).sort()).toEqual(["createdAt", "id", "title"]);
     expect("created_at" in created!).toBe(false);
 
-    const listed = await handle.select().from(posts);
+    const listed = await sharedHandle.select().from(jsKeyPosts);
     expect(Object.keys(listed[0]!).sort()).toEqual(["createdAt", "id", "title"]);
     expect("created_at" in listed[0]!).toBe(false);
 
-    const got = await handle.findById(posts, "p1");
+    const got = await sharedHandle.findById(jsKeyPosts, "p1");
     expect(Object.keys(got!).sort()).toEqual(["createdAt", "id", "title"]);
     expect("created_at" in got!).toBe(false);
-
-    await conn.close();
   });
 });
 

package/src/elements/store/sql-session.test.ts

@@ -4,9 +4,13 @@
  * Relational `with:` / Drizzle RQB (`db.query.*.findMany({ with })`) is a
  * documented limitation: effects, cache keys, and PII masking assume one
  * table per call, so no relational query surface may appear on the handle.
+ *
+ * Upsert / orderBy / like need the real Postgres dialect (PGlite). One warmed
+ * in-memory PGlite is shared for the whole file (cold WASM once); TRUNCATE
+ * isolates each test without a fresh `PGlite.create`.
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { and, desc, eq, like, lt, or } from "drizzle-orm";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
 import { pgliteDriver } from "../../drivers/pglite.ts";
@@ -19,31 +23,38 @@ const posts = pgTable("posts", {
   createdAt: integer("created_at").notNull(),
 });
 
-async function openHandle(): Promise<{ handle: SqlStoreHandle; conn: SqlConnection }> {
-  const conn = await pgliteDriver.connect({
-    url: "memory://",
+/** File-scoped warmed PGlite — opened in {@link beforeAll}. */
+let sharedConn: SqlConnection;
+/** Handle over {@link sharedConn}. */
+let sharedHandle: SqlStoreHandle;
+
+beforeAll(async () => {
+  sharedConn = await pgliteDriver.connect({
+    url: "memory://sql-session-shared",
     role: "primary",
   });
-  const handle = createSqlStoreHandle("sql:app", {
-    connection: conn,
+  sharedHandle = createSqlStoreHandle("sql:app", {
+    connection: sharedConn,
     classifications: new Map(),
     routedRole: "primary",
     domainDdl: "ensure",
   });
-  return { handle, conn };
-}
+  // Warm DDL via the insert path (pgTable is not a TableHandle for ensureTable).
+  await sharedHandle.insert(posts).values({ id: "_warmup", title: "x", createdAt: 0 });
+  await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+}, 15_000);
+
+afterAll(async () => {
+  await sharedConn.close();
+});
+
+beforeEach(async () => {
+  await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+});
 
 describe("SqlStoreHandle — no relational query surface (path b)", () => {
-  test("created handle exposes exactly the single-table surface", async () => {
-    const conn = await pgliteDriver.connect({ url: "memory://", role: "primary" });
-    const handle = createSqlStoreHandle("sql:app", {
-      connection: conn,
-      classifications: new Map(),
-      routedRole: "primary",
-      domainDdl: "ensure",
-    });
-
-    expect(Object.keys(handle).sort()).toEqual(
+  test("created handle exposes exactly the single-table surface", () => {
+    expect(Object.keys(sharedHandle).sort()).toEqual(
       [
         "ref",
         "routedRole",
@@ -64,47 +75,40 @@ describe("SqlStoreHandle — no relational query surface (path b)", () => {
     );
 
     // No Drizzle RQB / with: surface — ever.
-    expect("query" in handle).toBe(false);
-    expect("findMany" in handle).toBe(false);
-    expect("findFirst" in handle).toBe(false);
-    expect("with" in handle).toBe(false);
-
-    await conn.close();
+    expect("query" in sharedHandle).toBe(false);
+    expect("findMany" in sharedHandle).toBe(false);
+    expect("findFirst" in sharedHandle).toBe(false);
+    expect("with" in sharedHandle).toBe(false);
   });
 });
 
 describe("SqlStoreHandle — orderBy / limit select chain", () => {
   test("orderBy + limit without where", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
-    await handle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
+    await sharedHandle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
 
-    const rows = await handle.select().from(posts).orderBy(desc(posts.createdAt)).limit(2);
+    const rows = await sharedHandle.select().from(posts).orderBy(desc(posts.createdAt)).limit(2);
     expect(rows.map((r) => r.id)).toEqual(["p2", "p3"]);
-    await conn.close();
   });
 
   test("limit directly on from() — no where required", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
 
-    const rows = await handle.select().from(posts).limit(1);
+    const rows = await sharedHandle.select().from(posts).limit(1);
     expect(rows).toHaveLength(1);
-    await conn.close();
   });
 
   test("composite cursor predicate: where → orderBy → limit", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
-    await handle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
+    await sharedHandle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
     // Tie on createdAt=200 with an id that sorts after the cursor id.
-    await handle.insert(posts).values({ id: "p0", title: "four", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p0", title: "four", createdAt: 200 });
 
     const order = [desc(posts.createdAt), desc(posts.id)] as const;
-    const page1 = await handle
+    const page1 = await sharedHandle
       .select()
       .from(posts)
       .orderBy(...order)
@@ -112,61 +116,54 @@ describe("SqlStoreHandle — orderBy / limit select chain", () => {
     expect(page1.map((r) => r.id)).toEqual(["p2", "p3"]);
 
     // (createdAt, id) < (200, "p3") — the second page of a keyset cursor.
-    const page2 = await handle
+    const page2 = await sharedHandle
       .select()
       .from(posts)
       .where(or(lt(posts.createdAt, 200), and(eq(posts.createdAt, 200), lt(posts.id, "p3"))))
       .orderBy(...order)
       .limit(2);
     expect(page2.map((r) => r.id)).toEqual(["p0", "p1"]);
-    await conn.close();
   });
 
   test("like filters rows through the session (postgres case-sensitive)", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "alpha", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "bravo", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "alpha", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "bravo", createdAt: 200 });
 
-    const rows = await handle.select().from(posts).where(like(posts.title, "a%"));
+    const rows = await sharedHandle.select().from(posts).where(like(posts.title, "a%"));
     expect(rows.map((r) => r.id)).toEqual(["p1"]);
-    await conn.close();
   });
 });
 
 describe("SqlStoreHandle — upsert", () => {
   test("default inserts once then already-existed without touching the row", async () => {
-    const { handle, conn } = await openHandle();
-    const first = await handle.upsert(
+    const first = await sharedHandle.upsert(
       posts,
       { id: "welcome" },
       { id: "welcome", title: "Hello", createdAt: 1 },
     );
     expect(first.status).toBe("upserted");
 
-    const second = await handle.upsert(
+    const second = await sharedHandle.upsert(
       posts,
       { id: "welcome" },
       { id: "welcome", title: "Changed", createdAt: 2 },
     );
     expect(second.status).toBe("already-existed");
 
-    const row = await handle.findById(posts, "welcome");
+    const row = await sharedHandle.findById(posts, "welcome");
     expect(row).toEqual({ id: "welcome", title: "Hello", createdAt: 1 });
-    await conn.close();
   });
 
   test("onExisting update changes matched columns", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.upsert(posts, { id: "n1" }, { id: "n1", title: "one", createdAt: 10 });
-    const updated = await handle.upsert(
+    await sharedHandle.upsert(posts, { id: "n1" }, { id: "n1", title: "one", createdAt: 10 });
+    const updated = await sharedHandle.upsert(
       posts,
       { id: "n1" },
       { id: "n1", title: "two", createdAt: 20 },
       { onExisting: "update" },
     );
     expect(updated.status).toBe("changed");
-    const row = await handle.findById(posts, "n1");
+    const row = await sharedHandle.findById(posts, "n1");
     expect(row).toEqual({ id: "n1", title: "two", createdAt: 20 });
-    await conn.close();
   });
 });