okengine 0.13.0 → 0.15.2

package/src/drivers/ai-openai-compatible.ts

@@ -89,6 +89,7 @@ export async function openOpenaiCompatible(options: AiOpenOptions = {}): Promise
   const model = options.model ?? "gpt-4o-mini";
   const fetchFn = options.fetch ?? globalThis.fetch;
   const extraHeaders = options.headers;
+  preconnectFetch(fetchFn, baseUrl);
 
   return {
     driverId: "openai-compatible",
@@ -162,10 +163,7 @@ export async function openOpenaiCompatible(options: AiOpenOptions = {}): Promise
         const msg = raw.error?.message ?? `openai-compatible HTTP ${res.status}`;
         throwHttp(`openai-compatible: ${msg}`, res.status);
       }
-      if (!res.body) {
-        throw new Error("openai-compatible: stream response has no body");
-      }
-      yield* readOpenaiSse(res.body, opts.signal);
+      yield* readOpenaiSse(res, opts.signal);
     },
     async embed(opts: AiEmbedOptions): Promise<AiEmbedResult> {
       const resolvedModel = opts.model ?? model;
@@ -262,57 +260,70 @@ function parseToolCalls(
 /**
  * Parse OpenAI SSE chat.completion.chunk stream.
  *
- * @param body - Response body
+ * @param res - Streaming response
  * @param signal - Optional abort
  */
-async function* readOpenaiSse(
-  body: ReadableStream<Uint8Array>,
-  signal?: AbortSignal,
-): AsyncGenerator<AiStreamChunk> {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
+async function* readOpenaiSse(res: Response, signal?: AbortSignal): AsyncGenerator<AiStreamChunk> {
   let buffer = "";
-  try {
-    while (true) {
-      if (signal?.aborted) {
-        throw abortAsError(signal.reason);
+  for await (const piece of responseTextStream(res)) {
+    if (signal?.aborted) throw abortAsError(signal.reason);
+    buffer += piece;
+    const lines = buffer.split("\n");
+    buffer = lines.pop() ?? "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("data:")) continue;
+      const data = trimmed.slice(5).trim();
+      if (data === "[DONE]") {
+        yield { text: "", done: true };
+        return;
       }
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() ?? "";
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed.startsWith("data:")) continue;
-        const data = trimmed.slice(5).trim();
-        if (data === "[DONE]") {
+      try {
+        const chunk = JSON.parse(data) as {
+          choices?: readonly {
+            delta?: { content?: string | null };
+            finish_reason?: string | null;
+          }[];
+        };
+        const delta = chunk.choices?.[0]?.delta?.content;
+        if (typeof delta === "string" && delta.length > 0) {
+          yield { text: delta };
+        }
+        if (chunk.choices?.[0]?.finish_reason) {
           yield { text: "", done: true };
           return;
         }
-        try {
-          const chunk = JSON.parse(data) as {
-            choices?: readonly {
-              delta?: { content?: string | null };
-              finish_reason?: string | null;
-            }[];
-          };
-          const delta = chunk.choices?.[0]?.delta?.content;
-          if (typeof delta === "string" && delta.length > 0) {
-            yield { text: delta };
-          }
-          if (chunk.choices?.[0]?.finish_reason) {
-            yield { text: "", done: true };
-            return;
-          }
-        } catch {
-          // ignore malformed SSE lines
-        }
+      } catch {
+        // ignore malformed SSE lines
       }
     }
-    yield { text: "", done: true };
-  } finally {
-    reader.releaseLock();
+  }
+  yield { text: "", done: true };
+}
+
+/**
+ * UTF-8 text chunks from a Response (`textStream` on Bun ≥1.4).
+ *
+ * @param res - HTTP response
+ */
+function responseTextStream(res: Response): AsyncIterable<string> {
+  const stream = (res as Response & { textStream?: () => AsyncIterable<string> }).textStream;
+  if (typeof stream !== "function") {
+    throw new Error("openai-compatible: Response.textStream is required (Bun >= 1.4.0)");
+  }
+  return stream.call(res);
+}
+
+/**
+ * Warm DNS+TCP+TLS for a cloud origin. No-op when `fetch` is a test stub.
+ *
+ * @param fetchFn - Fetch implementation
+ * @param url - Provider base URL
+ */
+function preconnectFetch(fetchFn: typeof fetch, url: string): void {
+  const preconnect = (fetchFn as { preconnect?: (href: string) => void }).preconnect;
+  if (typeof preconnect === "function") {
+    preconnect(url);
   }
 }
 

package/src/drivers/ai-providers.test.ts

@@ -43,12 +43,14 @@ describe("anthropic driver", () => {
       model: "claude-test",
       fetch: fetchFn,
     });
+    const ac = new AbortController();
     const result = await client.complete({
       messages: [
         { role: "system", content: "be brief" },
         { role: "user", content: "hi" },
       ],
       maxTokens: 64,
+      signal: ac.signal,
     });
 
     expect(result.driverId).toBe("anthropic");
@@ -62,6 +64,7 @@ describe("anthropic driver", () => {
     };
     expect(body.system).toBe("be brief");
     expect(body.messages).toEqual([{ role: "user", content: "hi" } as { role: string }]);
+    expect(calls[0]!.init?.signal).toBe(ac.signal);
   });
 
   test("HTTP error surfaces provider message", async () => {

package/src/drivers/bun-native-completeness.test.ts

@@ -1,8 +1,8 @@
 /**
  * Bun native-client completeness — gaps closed vs platform limitations.
  *
- * Checked against Bun 1.3.14 (runtime + bun-types). Do not invent custom
- * protocol clients where Bun still lacks an API.
+ * Checked against Bun 1.4 (runtime). Do not invent custom protocol clients
+ * where Bun still lacks an API.
  */
 
 import { describe, expect, test } from "bun:test";
@@ -46,7 +46,7 @@ export function bunNativeCompletenessReport(): readonly BunNativeGapRow[] {
       status: hasTypedEval ? "closed" : "bun_limitation",
       note: hasTypedEval
         ? "typed eval bound"
-        : "Bun 1.3.14 has no typed eval — driver uses send(EVAL)",
+        : "Bun.RedisClient.eval unavailable — would keep send(EVAL)",
     },
     {
       surface: "redis signal",
@@ -63,7 +63,7 @@ export function bunNativeCompletenessReport(): readonly BunNativeGapRow[] {
       status: hasTypedXadd ? "closed" : "bun_limitation",
       note: hasTypedXadd
         ? "typed stream helpers bound"
-        : "Bun 1.3.14 has no typed xadd — Streams use send (native, not a custom client)",
+        : "Bun.RedisClient.xadd unavailable — Streams would keep send",
     },
     {
       surface: "redis signal",
@@ -95,23 +95,21 @@ export function bunNativeCompletenessReport(): readonly BunNativeGapRow[] {
 }
 
 describe("Bun native client completeness", () => {
-  test("report table is exact and matches runtime Bun 1.3.x", () => {
+  test("report table is exact and matches runtime Bun 1.4", () => {
     const rows = bunNativeCompletenessReport();
     expect(rows.length).toBe(8);
 
     const closed = rows.filter((r) => r.status === "closed").map((r) => r.capability);
     const limited = rows.filter((r) => r.status === "bun_limitation").map((r) => r.capability);
 
-    // Closed on Bun 1.3.14
     expect(closed).toContain("SCAN (typed)");
+    expect(closed).toContain("EVAL (typed)");
     expect(closed).toContain("native Bun bind (publish/subscribe)");
+    expect(closed).toContain("XADD / XREADGROUP (typed)");
     expect(closed).toContain("send escape hatch");
     expect(closed).toContain("Bun.SQL.unsafe query/exec");
     expect(closed).toContain("Bun.S3Client file/list");
 
-    // Genuine Bun platform limitations (do not invent workarounds)
-    expect(limited).toContain("EVAL (typed)");
-    expect(limited).toContain("XADD / XREADGROUP (typed)");
     expect(limited).toContain("LISTEN / NOTIFY on Bun.SQL");
   });
 

package/src/drivers/clock-postgres.ts

@@ -7,7 +7,13 @@
  */
 
 import type { CronRow, CronStatus, CronStore } from "../elements/clock/reconcile.ts";
-import { toPostgresParams } from "./postgres.ts";
+import {
+  resolvePostgresUrl,
+  sharedPostgresClient,
+  toPostgresParams,
+  withPinnedPostgres,
+  type PostgresClientLike,
+} from "./postgres.ts";
 
 /** Row shape in `oke_crons` (lease columns mirror `oke_signal_messages`). */
 interface CronDbRow {
@@ -69,16 +75,16 @@ export interface BunCronClient {
   close?(options?: { timeout?: number }): Promise<void>;
 }
 
-function wrapBunClient(client: BunCronClient): PostgresCronSql {
+function wrapBunClient(client: PostgresClientLike): PostgresCronSql {
   const api: PostgresCronSql = {
     async query(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (Array.isArray(result)) return result as Record<string, unknown>[];
       return Array.from(result as ArrayLike<Record<string, unknown>>);
     },
     async exec(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (
         result &&
@@ -92,7 +98,7 @@ function wrapBunClient(client: BunCronClient): PostgresCronSql {
       return { changes: 0 };
     },
     async begin(fn) {
-      return client.begin(async (tx) => fn(wrapBunClient(tx)));
+      return withPinnedPostgres(client, (tx) => fn(wrapBunClient(tx)));
     },
     async close() {
       await client.close?.();
@@ -365,10 +371,8 @@ export async function createPostgresCronStore(
   const sql =
     options.sql ??
     wrapBunClient(
-      options.client ??
-        (new Bun.SQL(
-          options.url ?? process.env.DATABASE_URL ?? "postgres://localhost:5432/oke",
-        ) as unknown as BunCronClient),
+      (options.client ??
+        sharedPostgresClient(resolvePostgresUrl(options.url))) as PostgresClientLike,
     );
 
   await ensureSchema(sql);

package/src/drivers/instances-postgres.ts

@@ -7,7 +7,7 @@
 
 import type { ConfigEnv } from "../config/index.ts";
 import type { InstanceRow, InstanceStore } from "../kernel/instances.ts";
-import { toPostgresParams } from "./postgres.ts";
+import { resolvePostgresUrl, sharedPostgresClient, toPostgresParams } from "./postgres.ts";
 
 /** Minimal SQL surface for the postgres instance store. */
 export interface PostgresInstanceSql {
@@ -40,13 +40,13 @@ const UPSERT_SQL = `INSERT INTO oke_instances (id, started_at, heartbeat_at, lea
 function wrapBunClient(client: BunInstanceClient): PostgresInstanceSql {
   return {
     async query(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (Array.isArray(result)) return result as Record<string, unknown>[];
       return Array.from(result as ArrayLike<Record<string, unknown>>);
     },
     async exec(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (
         result &&
@@ -109,9 +109,7 @@ export async function createPostgresInstanceStore(
     options.sql ??
     wrapBunClient(
       options.client ??
-        (new Bun.SQL(
-          options.url ?? process.env.DATABASE_URL ?? "postgres://localhost:5432/oke",
-        ) as unknown as BunInstanceClient),
+        (sharedPostgresClient(resolvePostgresUrl(options.url)) as unknown as BunInstanceClient),
     );
 
   await ensureSchema(sql);

package/src/drivers/journal-postgres.ts

@@ -14,7 +14,13 @@ import {
   type JournalRun,
   type JournalStore,
 } from "../kernel/journal.ts";
-import { toPostgresParams } from "./postgres.ts";
+import {
+  resolvePostgresUrl,
+  sharedPostgresClient,
+  toPostgresParams,
+  withPinnedPostgres,
+  type PostgresClientLike,
+} from "./postgres.ts";
 
 /** Row shape in `oke_journal_runs` (lease columns mirror `oke_crons`). */
 interface JournalDbRow {
@@ -87,16 +93,16 @@ export interface BunJournalClient {
   close?(options?: { timeout?: number }): Promise<void>;
 }
 
-function wrapBunClient(client: BunJournalClient): PostgresJournalSql {
+function wrapBunClient(client: PostgresClientLike): PostgresJournalSql {
   const api: PostgresJournalSql = {
     async query(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (Array.isArray(result)) return result as Record<string, unknown>[];
       return Array.from(result as ArrayLike<Record<string, unknown>>);
     },
     async exec(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (
         result &&
@@ -110,7 +116,7 @@ function wrapBunClient(client: BunJournalClient): PostgresJournalSql {
       return { changes: 0 };
     },
     async begin(fn) {
-      return client.begin(async (tx) => fn(wrapBunClient(tx)));
+      return withPinnedPostgres(client, (tx) => fn(wrapBunClient(tx)));
     },
     async close() {
       await client.close?.();
@@ -437,10 +443,8 @@ export async function createPostgresJournalStore(
   const sql =
     options.sql ??
     wrapBunClient(
-      options.client ??
-        (new Bun.SQL(
-          options.url ?? process.env.DATABASE_URL ?? "postgres://localhost:5432/oke",
-        ) as unknown as BunJournalClient),
+      (options.client ??
+        sharedPostgresClient(resolvePostgresUrl(options.url))) as PostgresClientLike,
     );
 
   await ensureSchema(sql);

package/src/drivers/pg-rls.test.ts

@@ -2,7 +2,13 @@ import { describe, expect, test } from "bun:test";
 import {
   buildAlterPolicySql,
   buildCreatePolicySql,
+  buildRlsIdentityPreludeSql,
+  emitPgPolicySource,
+  formatPolicyRole,
+  OKE_RLS_HELPER_STATEMENTS,
+  OKE_RLS_ROLE,
   parseSqlPolicySpec,
+  rlsScopesJson,
   sqlPolicyRowId,
 } from "./pg-rls.ts";
 
@@ -36,6 +42,22 @@ describe("parseSqlPolicySpec", () => {
     expect(spec.withCheck).toBe("true");
   });
 
+  test("accepts Drizzle as/to/for aliases", () => {
+    const spec = parseSqlPolicySpec({
+      name: "gate_read",
+      table: "bookings",
+      for: "select",
+      as: "permissive",
+      to: "current_user",
+      using: "oke.gate() = 'member'",
+    });
+    expect(spec.command).toBe("SELECT");
+    expect(spec.behavior).toBe("PERMISSIVE");
+    expect(spec.roles).toEqual(["current_user"]);
+    expect(buildCreatePolicySql(spec)).toContain("TO current_user");
+    expect(buildCreatePolicySql(spec)).not.toContain('"current_user"');
+  });
+
   test("rejects stacked statements in USING", () => {
     expect(() =>
       parseSqlPolicySpec({
@@ -69,3 +91,68 @@ describe("buildAlterPolicySql", () => {
     ).toThrow("invalid USING");
   });
 });
+
+describe("formatPolicyRole", () => {
+  test("leaves Drizzle special roles unquoted", () => {
+    expect(formatPolicyRole("public")).toBe("public");
+    expect(formatPolicyRole("current_user")).toBe("current_user");
+    expect(formatPolicyRole("member")).toBe('"member"');
+  });
+});
+
+describe("emitPgPolicySource", () => {
+  test("emits drizzle pgPolicy with oke helpers", () => {
+    const spec = parseSqlPolicySpec({
+      name: "gate_member_select",
+      table: "bookings",
+      command: "SELECT",
+      using: "oke.gate() = 'member'",
+    });
+    expect(emitPgPolicySource(spec)).toContain('pgPolicy("gate_member_select"');
+    expect(emitPgPolicySource(spec)).toContain('for: "select"');
+    expect(emitPgPolicySource(spec)).toContain("oke.gate() = 'member'");
+  });
+});
+
+describe("rlsScopesJson", () => {
+  test("sorts unique scopes", () => {
+    expect(rlsScopesJson(["booking:create", "member", "member"])).toBe(
+      '["booking:create","member"]',
+    );
+  });
+});
+
+describe("buildRlsIdentityPreludeSql", () => {
+  test("emits one statement per exec — never a multi-command batch", () => {
+    const stmts = buildRlsIdentityPreludeSql({
+      gate: "member",
+      userId: "alice",
+      scopes: ["member"],
+    });
+    expect(stmts.map((s) => s.sql)).toEqual([
+      `SET LOCAL ROLE ${OKE_RLS_ROLE}`,
+      "SET LOCAL row_security = on",
+      "SELECT set_config('oke.gate', ?, true), set_config('oke.user', ?, true), set_config('oke.scopes', ?, true)",
+    ]);
+    for (const stmt of stmts) {
+      expect(stmt.sql.includes(";")).toBe(false);
+    }
+    expect(stmts[2]?.params).toEqual(["member", "alice", '["member"]']);
+  });
+});
+
+describe("OKE_RLS_HELPER_STATEMENTS", () => {
+  test("has_scope uses jsonb_exists so ? is not a placeholder", () => {
+    const hasScope = OKE_RLS_HELPER_STATEMENTS.find((s) => s.includes("oke.has_scope"));
+    expect(hasScope).toBeDefined();
+    expect(hasScope).toContain("jsonb_exists(");
+    expect(hasScope).not.toMatch(/jsonb\s+\?/);
+  });
+
+  test("pins search_path to public so schema oke is not the table home", () => {
+    expect(OKE_RLS_HELPER_STATEMENTS).toContain("SET search_path TO public, oke");
+    expect(
+      OKE_RLS_HELPER_STATEMENTS.some((s) => s.includes("ALTER TABLE oke.%I SET SCHEMA public")),
+    ).toBe(true);
+  });
+});