okengine 0.14.1 → 0.16.0

package/src/cli/dev-controls.test.ts

@@ -14,6 +14,7 @@ describe("dev-controls", () => {
     expect(parseDevControlKey("?")).toBe("?");
     expect(parseDevControlKey("h")).toBe("?");
     expect(parseDevControlKey("r")).toBe("r");
+    expect(parseDevControlKey("s")).toBe("s");
     expect(parseDevControlKey("u")).toBe("u");
     expect(parseDevControlKey("x")).toBe("x");
     expect(parseDevControlKey("c")).toBeNull();
@@ -33,6 +34,9 @@ describe("dev-controls", () => {
     expect(formatDevControlsHint(false)).toContain("quit");
     expect(formatDevControlsHint(false)).not.toContain("services");
     expect(formatDevControlsHelp(false)).toContain("refresh");
+    expect(formatDevControlsHint(false)).toContain("seed");
+    expect(formatDevControlsHint(false)).not.toContain("restart");
+    expect(formatDevControlsHelp(false)).toContain("oke db seed");
     expect(formatDevControlsHelp(false)).not.toContain("select service");
   });
 
@@ -77,6 +81,22 @@ describe("dev-controls", () => {
     d.stop();
   });
 
+  test("dispatcher s runs onSeed", async () => {
+    let seeded = 0;
+    const d = createDevControlDispatcher({
+      write: () => {},
+      onQuit: () => {},
+      onSeed: () => {
+        seeded += 1;
+      },
+      composeAction: async () => {},
+    });
+    d.handleKey("s");
+    await Bun.sleep(10);
+    expect(seeded).toBe(1);
+    d.stop();
+  });
+
   test("busy compose action ignores a concurrent key press", async () => {
     let running = 0;
     let maxConcurrent = 0;

package/src/cli/dev-controls.ts

@@ -30,6 +30,10 @@ export type StartDevControlsOptions = {
    * After a compose up/stop — sync health into the board.
    */
   readonly onComposeSettled?: () => void | Promise<void>;
+  /**
+   * Run `oke db seed` (tests / non-Ink dispatcher).
+   */
+  readonly onSeed?: () => void | Promise<void>;
   /**
    * Run a compose control action against the whole stack.
    *
@@ -50,6 +54,7 @@ export function formatDevControlsHint(color: boolean = termColorEnabled()): stri
     `${s.dim}│${s.reset}  ${s.dim}keys${s.reset}  ` +
     `${s.cyan}?${s.reset} help · ` +
     `${s.cyan}r${s.reset} refresh · ` +
+    `${s.cyan}s${s.reset} seed · ` +
     `${s.cyan}q${s.reset} quit · ` +
     `${s.cyan}u${s.reset} up · ` +
     `${s.cyan}x${s.reset} stop` +
@@ -72,6 +77,7 @@ export function formatDevControlsHelp(color: boolean = termColorEnabled()): stri
     `${s.green}◇${s.reset}  ${s.bold}Keys${s.reset}`,
     k("?", "help"),
     k("r", "refresh — clear logs, show latest ●"),
+    k("s", "oke db seed"),
     k("q", "quit oke dev"),
     k("u", "compose up -d (all)"),
     k("x", "compose stop (all)"),
@@ -140,6 +146,13 @@ export function createDevControlDispatcher(opts: StartDevControlsOptions): DevCo
         void Promise.resolve(opts.onShowPanel?.(body) ?? opts.write(body));
         return;
       }
+      if (key === "s") {
+        void Promise.resolve(opts.onSeed?.()).catch((err: unknown) => {
+          const msg = err instanceof Error ? err.message : String(err);
+          opts.write(formatStatusLine(`seed failed — ${msg}`, color, "error"));
+        });
+        return;
+      }
       if (key === "u" || key === "x") {
         void runAction(key === "u" ? "up" : "stop");
       }

package/src/cli/dev.test.ts

@@ -19,7 +19,7 @@ import type { Manifest } from "../manifest/types.ts";
 import type { WideEvent } from "../runs/types.ts";
 import { isDataEnvelope, MCP_DATA_KIND } from "../mcp/data.ts";
 import { mintMcpSession } from "../mcp/session.ts";
-import { runDev, type DevOptions, type DevSession } from "./dev.ts";
+import { isFlowsTreeWatchPath, runDev, type DevOptions, type DevSession } from "./dev.ts";
 import { mcpContextFromConsole } from "./mcp-from-console.ts";
 
 /** Repo public entry — absolute import so temp apps need no install. */
@@ -519,11 +519,11 @@ async function writePingApp(dir: string, version: string): Promise<void> {
     join(dir, "src/flows/ping.ts"),
     `import { on, flow, http, gate } from ${JSON.stringify(OKE_INDEX)};
 
-export const ping = on(http.get("/ping").gate.public, flow("ping", {
+export const ping = on(http.get("/ping").public(), flow("ping", {
   do: () => ({ version: ${JSON.stringify(version)} as const }),
 }));
 
-export const slow = on(http.get("/slow").gate.public, flow("slow", {
+export const slow = on(http.get("/slow").public(), flow("slow", {
   do: async () => {
     const started = ${JSON.stringify(version)};
     await Bun.sleep(800);
@@ -725,7 +725,8 @@ describe("oke dev syncAdoptBarrel atomic write", () => {
 
     const barrelPath = join(dir, "src/flows", ADOPT_BARREL_FILE);
     const text = await Bun.file(barrelPath).text();
-    expect(text).toContain('export * as notes from "./notes/index.ts";');
+    expect(text).toContain('import * as notes from "./notes/index.ts";');
+    expect(text).toContain("export { notes }");
     expect(text).not.toContain("stale stub");
     expect(await Bun.file(`${barrelPath}.tmp`).exists()).toBe(false);
     const leftovers = (await readdir(join(dir, "src/flows"))).filter((f) => f.includes(".tmp"));
@@ -789,6 +790,16 @@ describe("oke dev syncAdoptBarrel atomic write", () => {
   });
 });
 
+describe("isFlowsTreeWatchPath", () => {
+  test("flows tree files trigger regen; generated.ts does not", () => {
+    expect(isFlowsTreeWatchPath("flows/notes/[id]/get.ts")).toBe(true);
+    expect(isFlowsTreeWatchPath("flows\\notes\\list.ts")).toBe(true);
+    expect(isFlowsTreeWatchPath("flows/generated.ts")).toBe(false);
+    expect(isFlowsTreeWatchPath("flows/generated.ts.tmp")).toBe(false);
+    expect(isFlowsTreeWatchPath("core.ts")).toBe(false);
+  });
+});
+
 describe("oke dev Docker-first", () => {
   test("dryRun always plans compose (no mode ask)", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-dev-always-compose-"));

package/src/cli/dev.ts

@@ -31,8 +31,8 @@ import {
   createAnchoredBoard,
   createBootProgress,
   devStatusFromAiPhase,
-  formatAppReadyLine,
   formatBootWarn,
+  formatBoundSurfaces,
   formatClaimNote,
   formatCliChrome,
   formatDevBanner,
@@ -83,7 +83,7 @@ export interface DevSurfaceHandle {
 
 /** App surface returned by {@link DevOptions.startApp}. */
 export interface DevAppHandle {
-  readonly stop: () => void;
+  readonly stop: () => void | Promise<void>;
   /** Bound listen port (set when serve chooses an ephemeral port). */
   readonly port?: number;
   /** Base URL of the app server. */
@@ -181,12 +181,9 @@ export interface DevOptions {
   /**
    * Injectable `.adopt()` barrel regeneration (tests). Default: real
    * `generateAdoptBarrel` + atomic write to `<cwd>/src/flows/generated.ts`
-   * (`generated.ts.tmp` → rename). Runs once per `oke dev` session, before
-   * the entry is resolved/imported — a real file on disk, so `oke dev`'s
-   * runtime `import()` and `oke build`'s `Bun.build()` resolve it
-   * identically (unlike a virtual-module Bun plugin, which does not — see
-   * `compiler/generate-adopt.ts`). Atomic so a concurrent import during
-   * `bun --hot` never sees a torn mid-write file.
+   * (`generated.ts.tmp` → rename). Runs at session start and again on
+   * `src/flows/**` changes except `generated.ts` itself. Write-if-changed
+   * so the `src/` watcher + bun `--hot` do not loop.
    *
    * @param cwd - Project root
    */
@@ -481,6 +478,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     files: readonly string[];
     cwd: string;
     env: Record<string, string>;
+    aiServiceName?: string;
   } | null = null;
   let stackSqlDriver = "postgres";
   let stackKvDriver = "redis";
@@ -658,6 +656,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
           files: composeFiles,
           cwd: dockerOut,
           env: { ...stackEnv! },
+          aiServiceName: derived.specs.find((s) => s.role === "ai")?.serviceName,
         };
 
         // Stream compose health until infra is up (AI may stay pending — model load).
@@ -942,7 +941,9 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     return { code: 0, plan };
   }
 
+  let boardPaused = false;
   const repaintBoard = (aiStatus?: DevStatus): void => {
+    if (boardPaused) return;
     bootBoard.paint(paintBootBoard(aiStatus ?? heroAiStatus));
   };
 
@@ -1026,15 +1027,6 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
           `oke db push (dev · ${result.dialect}) ${result.code === 0 ? "ok" : "failed"}`,
         ),
       );
-      if (result.code === 0) {
-        const { maybeAskSeed } = await import("./ask-seed.ts");
-        await maybeAskSeed({
-          cwd,
-          env: configEnv,
-          write,
-          stdinIsTTY: options.stdinIsTTY ?? process.stdin.isTTY,
-        });
-      }
     } catch (err) {
       write(await formatDevSchemaSyncFailure(cwd, err, "boot"));
     }
@@ -1323,14 +1315,14 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       write(formatBootWarn(notice));
     }
     bootNotices.length = 0;
-    write(formatAppReadyLine(`http://127.0.0.1:${boundAppPort}`));
-    write(formatServiceLine("Console", `http://127.0.0.1:${boundConsolePort}`));
-    if (mcpServer) {
-      write(formatServiceLine("MCP", `http://127.0.0.1:${boundMcpPort}`));
-    }
-    if (docsMcpServer) {
-      write(formatServiceLine("Docs MCP", `http://127.0.0.1:${boundDocsMcpPort}`));
-    }
+    write(
+      formatBoundSurfaces({
+        appUrl: `http://127.0.0.1:${boundAppPort}`,
+        consoleUrl: `http://127.0.0.1:${boundConsolePort}`,
+        mcpUrl: mcpServer ? `http://127.0.0.1:${boundMcpPort}` : null,
+        docsMcpUrl: docsMcpServer ? `http://127.0.0.1:${boundDocsMcpPort}` : null,
+      }),
+    );
     write(formatDevLogSeparator());
     chromeReady = true;
   };
@@ -1358,6 +1350,10 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
   const watchFs: DevWatchFn =
     options.watchFs ?? ((path, watchOptions, listener) => watch(path, watchOptions, listener));
   const watcher = watchFs(resolve(cwd, "src"), { recursive: true }, (_event, filename) => {
+    const rel = (filename?.toString() ?? "").replace(/\\/g, "/");
+    if (isFlowsTreeWatchPath(rel)) {
+      void syncAdoptBarrel(cwd);
+    }
     void regen(appUrl);
     // Only live-extract when the host did not pin a Manifest (tests).
     if (options.manifest === undefined) {
@@ -1388,7 +1384,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     const host = attachedHost;
     attachedHost = null;
     void host?.stop();
-    app.stop();
+    void Promise.resolve(app.stop());
     consoleServer.stop();
     mcpServer?.stop();
     docsMcpServer?.stop();
@@ -1489,6 +1485,25 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       await syncComposeBoard();
       paintReadyChrome();
     };
+    const waitComposeReady = async (): Promise<void> => {
+      const { watchComposeHealth } = await import("../docker/compose-health.ts");
+      const aiServiceName = started.aiServiceName;
+      liveComposeHealth = await watchComposeHealth({
+        files: started.files,
+        cwd: started.cwd,
+        env: started.env,
+        run: composeHealthRun,
+        timeoutMs: 20_000,
+        isDone: (map) => {
+          if (map.size === 0) return true;
+          return [...map.entries()].every(
+            ([name, s]) => name === aiServiceName || s === "ready" || s === "error",
+          );
+        },
+      });
+      if (liveComposeHealth.get("ai") === "error") heroAiStatus = "error";
+    };
+
     const composeAction = async (action: DevComposeControlAction): Promise<void> => {
       const files = started.files;
       const finalArgs =
@@ -1510,6 +1525,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
         const detail = [stdout.trim(), stderr.trim()].filter(Boolean).join("\n");
         throw new Error(`docker compose ${action} exited ${code}` + (detail ? `\n${detail}` : ""));
       }
+      if (action === "up") await waitComposeReady();
       await syncComposeBoard();
     };
 
@@ -1517,6 +1533,25 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       const { launchDevLiveControls } = await import("./tui/DevLive.tsx");
       await launchDevLiveControls({
         onRefresh: () => refreshChrome(),
+        onSeed: async () => {
+          const { runSlashCli } = await import("./tui/slash-run.ts");
+          boardPaused = true;
+          const lines: string[] = [];
+          try {
+            const code = await runSlashCli(cwd, ["db", "seed", "--force"], (line) => {
+              lines.push(line);
+              write(line);
+            });
+            if (code === 0) return;
+            const last = [...lines]
+              .reverse()
+              .map((line) => line.trim())
+              .find((line) => line.length > 0 && !line.startsWith("✗") && !line.startsWith("$"));
+            throw new Error(last || "oke db seed failed");
+          } finally {
+            boardPaused = false;
+          }
+        },
         onComposeUp: () => composeAction("up"),
         onComposeStop: () => composeAction("stop"),
         onQuit: () => {
@@ -1589,6 +1624,20 @@ function isSchemaDeclDefinitionError(err: unknown, declarePath: string): boolean
   return declarePath.length > 0 && blob.includes(declarePath);
 }
 
+/**
+ * True when a `src/` watcher event is a flows tree change that should
+ * regenerate `generated.ts` (never the generated file itself).
+ *
+ * @param rel - Watcher filename (POSIX or Windows)
+ */
+export function isFlowsTreeWatchPath(rel: string): boolean {
+  const posix = rel.replace(/\\/g, "/");
+  if (!posix.includes("flows/")) return false;
+  const base = posix.split("/").pop() ?? posix;
+  if (base === "generated.ts" || base === "generated.ts.tmp") return false;
+  return true;
+}
+
 /**
  * Frame a schema-sync failure for the `oke dev` loop: warn loud for developer
  * bugs, soft-skip only known environmental gaps. Never crashes the session.
@@ -1652,6 +1701,29 @@ async function tryLoadProjectManifest(cwd: string): Promise<Manifest | null | un
   return extracted;
 }
 
+/**
+ * SIGKILL a pid and every child (`bun --hot` leaves a worker).
+ *
+ * @param pid - Root pid
+ */
+function killProcessTree(pid: number): void {
+  const listed = Bun.spawnSync(["pgrep", "-P", String(pid)], {
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  if (listed.exitCode === 0) {
+    for (const line of listed.stdout.toString().split("\n")) {
+      const child = Number(line.trim());
+      if (Number.isInteger(child) && child > 0) killProcessTree(child);
+    }
+  }
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch {
+    // Already gone.
+  }
+}
+
 /**
  * Default app boot: `bun --hot` on the shipped runner (socket-preserving).
  *
@@ -1687,17 +1759,18 @@ async function startAppHot(
   });
 
   let stopped = false;
-  const stop = () => {
-    if (stopped) return;
+  const stop = (): Promise<void> => {
+    if (stopped) return proc.exited.then(() => {});
     stopped = true;
     try {
       // SIGKILL so `bun --hot` cannot linger and hold the project directory
       // open (create-oke afterEach `rmSync` otherwise races the child exit).
-      proc.kill("SIGKILL");
+      killProcessTree(proc.pid);
     } catch {
       // Inconsequential: process already exited — kill is idempotent best-effort.
     }
     void unlink(readyPath).catch(() => {});
+    return proc.exited.then(() => {});
   };
 
   try {

package/src/cli/ensure-drizzle-config.ts

@@ -24,7 +24,8 @@ export default defineConfig({
   dialect: "postgresql",
   schema: "./src/db/schema.drizzle.ts",
   out: "./src/db/migrations",
-  // Core runtime tables (oke_crons, …) are created by drivers — not domain schema.
+  // Domain tables live in public. Schema \`oke\` (RLS) and \`oke_console\` are engine-owned.
+  schemaFilter: ["public"],
   tablesFilter: ["!oke_*"],
   dbCredentials: {
     url: process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL!,

package/src/cli/tui/DevLive.tsx

@@ -13,6 +13,7 @@ import { TUI_BRAND, TUI_HINT, TUI_MUTED, TUI_WARN } from "./theme.ts";
 /** Props for {@link DevLiveControls}. */
 export type DevLiveControlsProps = {
   readonly onRefresh: () => void | Promise<void>;
+  readonly onSeed: () => void | Promise<void>;
   readonly onComposeUp: () => void | Promise<void>;
   readonly onComposeStop: () => void | Promise<void>;
   readonly onQuit: () => void;
@@ -49,6 +50,14 @@ export function DevLiveControls(props: DevLiveControlsProps): ReactElement {
         .finally(() => setBusy(false));
       return;
     }
+    if (ctrl === "s") {
+      setBusy(true);
+      void Promise.resolve(props.onSeed())
+        .then(() => setStatus("seeded"))
+        .catch((err: unknown) => setStatus(err instanceof Error ? err.message : String(err)))
+        .finally(() => setBusy(false));
+      return;
+    }
     if (ctrl === "u" || ctrl === "x") {
       setBusy(true);
       const run = ctrl === "u" ? props.onComposeUp : props.onComposeStop;
@@ -66,13 +75,13 @@ export function DevLiveControls(props: DevLiveControlsProps): ReactElement {
           oke dev
         </Text>
         <Text color={TUI_MUTED}> · controls · </Text>
-        <Text color={TUI_HINT}>? help · r refresh · q quit · u up · x stop</Text>
+        <Text color={TUI_HINT}>? help · r refresh · s seed · q quit · u up · x stop</Text>
         {busy ? <Text color={TUI_WARN}> · working…</Text> : null}
         {status ? <Text color={TUI_MUTED}>{` · ${status}`}</Text> : null}
       </Text>
       {help ? (
         <Text color={TUI_MUTED}>
-          r clear/refresh board · q quit · u compose up · x compose stop
+          r clear/refresh board · s oke db seed · q quit · u compose up · x compose stop
         </Text>
       ) : null}
     </Box>
@@ -104,6 +113,7 @@ export async function launchDevLiveControls(props: DevLiveControlsProps): Promis
 
   const bound: DevLiveControlsProps = {
     onRefresh: () => afterStdout(props.onRefresh),
+    onSeed: () => afterStdout(props.onSeed),
     onComposeUp: () => afterStdout(props.onComposeUp),
     onComposeStop: () => afterStdout(props.onComposeStop),
     onQuit: props.onQuit,

package/src/cli/tui/keys.test.ts

@@ -2,10 +2,11 @@ import { describe, expect, test } from "bun:test";
 import { mapDevControlInput } from "./keys.ts";
 
 describe("mapDevControlInput", () => {
-  test("maps ? r q u x and aliases", () => {
+  test("maps ? r s q u x and aliases", () => {
     expect(mapDevControlInput("?", {})).toBe("?");
     expect(mapDevControlInput("h", {})).toBe("?");
     expect(mapDevControlInput("r", {})).toBe("r");
+    expect(mapDevControlInput("s", {})).toBe("s");
     expect(mapDevControlInput("q", {})).toBe("q");
     expect(mapDevControlInput("u", {})).toBe("u");
     expect(mapDevControlInput("x", {})).toBe("x");

package/src/cli/tui/keys.ts

@@ -1,10 +1,10 @@
 /**
  * Shared keyboard mapping for Ink `useInput` and pure tests.
- * Parity with legacy `parseDevControlKey` (`? r q u x`).
+ * Parity with legacy `parseDevControlKey` (`? r s q u x`).
  */
 
 /** Dev control action from a keypress. */
-export type DevControlKey = "?" | "r" | "q" | "u" | "x";
+export type DevControlKey = "?" | "r" | "s" | "q" | "u" | "x";
 
 /**
  * Map Ink input (+ ctrl) to a control key.
@@ -20,6 +20,7 @@ export function mapDevControlInput(
   if (input === "?" || input === "h" || input === "H") return "?";
   if (input === "q" || input === "Q") return "q";
   if (input === "r" || input === "R") return "r";
+  if (input === "s" || input === "S") return "s";
   if (input === "u" || input === "U") return "u";
   if (input === "x" || input === "X") return "x";
   return null;

package/src/compiler/aot.test.ts

@@ -129,7 +129,7 @@ describe("typed error narrowing end-to-end", () => {
     const FlightFull = z.object({ seatsLeft: z.number() });
 
     on(
-      http.post("/bookings").gate.public,
+      http.post("/bookings").public(),
       flow("bookings.create", {
         in: Booking,
         out: z.object({ id: z.string() }),

package/src/compiler/effects-infer.ts

@@ -7,6 +7,7 @@
  */
 
 import type {
+  AuthApiKeysResourceRef,
   Effects,
   PromptRef,
   ResourceRef,
@@ -145,8 +146,8 @@ const TABLE_ARG_METHODS = new Set([
  * @param options - Handler AST, bindings, and annotation flag
  */
 export function inferEffects(options: InferEffectsOptions): InferredEffects {
-  const reads = new Set<ResourceRef | SignalResourceRef>();
-  const writes = new Set<ResourceRef>();
+  const reads = new Set<ResourceRef | SignalResourceRef | AuthApiKeysResourceRef>();
+  const writes = new Set<ResourceRef | AuthApiKeysResourceRef>();
   const emits = new Set<SignalRef>();
   const sends = new Set<TemplateRef>();
   const asks = new Set<PromptRef>();
@@ -217,6 +218,20 @@ export function inferEffects(options: InferEffectsOptions): InferredEffects {
       continue;
     }
 
+    if (chain.rootMethod === "auth" && call === chain.rootCall) {
+      const method = chain.methods[1];
+      if (method === "listApiKeys") reads.add("auth:api-keys");
+      if (
+        method === "createApiKey" ||
+        method === "revokeApiKey" ||
+        method === "rotateApiKey" ||
+        method === "updateApiKey"
+      ) {
+        writes.add("auth:api-keys");
+      }
+      continue;
+    }
+
     if (chain.rootMethod === "search" && call === chain.rootCall) {
       const ref = resolveNamed(call.arguments[0], options.bindings, "embed");
       if (ref) {