okengine 0.2.3 → 0.2.4

package/src/console/ui/shell/App.tsx

@@ -17,7 +17,10 @@ export function App() {
     queryKey: ["console.setup.status"],
     queryFn: async () => {
       const res = await consoleCalls.setupStatus();
-      if (res.error) throw new Error(res.error.code);
+      if (res.error) {
+        if (res.error.code === "Unauthorized") setAccessToken(null);
+        throw new Error(res.error.code);
+      }
       return res.data as { setupClosed: boolean; claimRequired: boolean };
     },
     retry: 2,
@@ -36,7 +39,12 @@ export function App() {
     retry: false,
     queryFn: async () => {
       const res = await consoleCalls.sessionMe();
-      if (res.error) throw new Error(res.error.code);
+      if (res.error) {
+        if (res.error.code === "Unauthorized" || res.error.code === "AuthFailed") {
+          setAccessToken(null);
+        }
+        throw new Error(res.error.code);
+      }
       return res.data;
     },
   });

package/src/docker/compose.ts

@@ -21,12 +21,32 @@ import type {
   ServiceCredentials,
   ServiceSpec,
 } from "./types.ts";
+import { DEFAULT_DOCKER_DIR } from "./types.ts";
 import { generateCredentials } from "./credentials.ts";
+import { hostPortForInstance } from "./stack-id.ts";
 import { APP_PORT } from "../runtime/types.ts";
 
 /** Canonical layer-4 filename — never written by derivation. */
 export const COMPOSE_OVERRIDE = "compose.override.yml";
 
+/**
+ * Relative path refs for compose files living under {@link DeriveOptions.composeDir}.
+ *
+ * @param composeDir - Directory relative to project root (`docker` or `.`)
+ */
+export function composePathRefs(composeDir: string = DEFAULT_DOCKER_DIR): {
+  readonly envFile: string;
+  readonly buildContext: string;
+  readonly dockerfile: string;
+} {
+  const flat = composeDir === "." || composeDir === "";
+  return {
+    envFile: flat ? ".env.stack" : "../.env.stack",
+    buildContext: flat ? "." : "..",
+    dockerfile: "Dockerfile",
+  };
+}
+
 /**
  * Build normalised {@link ServiceSpec} list from image pins.
  *
@@ -40,12 +60,15 @@ export function buildSpecs(options: DeriveOptions): ServiceSpec[] {
     const creds =
       options.credentials?.[role] ?? generateCredentials(role);
     const port = recipe.port;
+    const hostPort = options.instanceId
+      ? hostPortForInstance(role, port, options.instanceId)
+      : defaultHostPort(role, port);
     specs.push({
       role,
       serviceName: serviceNameFor(role),
       image,
       port,
-      hostPort: defaultHostPort(role, port),
+      hostPort,
       credentials: creds,
     });
   }
@@ -65,24 +88,31 @@ export function emitComposeLayers(
   const recipes = options.recipes ?? [];
   const appPort = options.appPort ?? APP_PORT;
   const app = options.app ?? "app";
+  const includeApp = options.includeApp !== false;
+  const paths = composePathRefs(options.composeDir ?? DEFAULT_DOCKER_DIR);
   const files: GeneratedFile[] = [];
 
-  // Layer 1 — app + network
-  const base = {
+  // Layer 1 — project name + network (+ optional app for deploy / oke docker)
+  const base: Record<string, unknown> = {
     name: `oke-${app}`,
-    services: {
+    networks: { oke: { driver: "bridge" } },
+  };
+  if (includeApp) {
+    base.services = {
       app: {
-        build: { context: ".", dockerfile: "Dockerfile" },
+        build: {
+          context: paths.buildContext,
+          dockerfile: paths.dockerfile,
+        },
         ports: [`${appPort}:${appPort}`],
-        env_file: [".env.stack"],
+        env_file: [paths.envFile],
         depends_on: Object.fromEntries(
           specs.map((s) => [s.serviceName, { condition: "service_healthy" }]),
         ),
         networks: ["oke"],
       },
-    },
-    networks: { oke: { driver: "bridge" } },
-  };
+    };
+  }
   files.push({ path: "compose.yml", content: `${toYaml(base)}\n` });
 
   // Layer 2 — per-role
@@ -93,7 +123,7 @@ export function emitComposeLayers(
       image: spec.image,
       ports: [`${spec.hostPort}:${spec.port}`],
       networks: ["oke"],
-      env_file: [".env.stack"],
+      env_file: [paths.envFile],
     };
     if (applied.environment) service.environment = applied.environment;
     if (applied.command) service.command = applied.command;
@@ -111,8 +141,9 @@ export function emitComposeLayers(
 
   // Layer 3 — prod overlay
   if (options.prod) {
-    const prodServices: Record<string, unknown> = {
-      app: {
+    const prodServices: Record<string, unknown> = {};
+    if (includeApp) {
+      prodServices.app = {
         deploy: {
           replicas: 1,
           resources: {
@@ -120,8 +151,8 @@ export function emitComposeLayers(
           },
         },
         secrets: specs.flatMap((s) => secretNames(s)),
-      },
-    };
+      };
+    }
     for (const spec of specs) {
       prodServices[spec.serviceName] = {
         deploy: {

package/src/docker/derive.ts

@@ -2,6 +2,7 @@
  * Derive Dockerfile + compose files from config image pins.
  */
 
+import { mkdirSync } from "node:fs";
 import {
   assertNoCredentialsInYaml,
   buildSpecs,
@@ -11,6 +12,7 @@ import {
 } from "./compose.ts";
 import { emitDockerfile } from "./dockerfile.ts";
 import type { DeriveOptions, DeriveResult, GeneratedFile } from "./types.ts";
+import { DEFAULT_DOCKER_DIR } from "./types.ts";
 
 /**
  * Derive infrastructure files from normalised image pins.
@@ -28,15 +30,22 @@ export function deriveInfrastructure(options: DeriveOptions): DeriveResult {
     );
   }
 
-  const specs = buildSpecs(options);
+  const normalised: DeriveOptions = {
+    ...options,
+    composeDir: options.composeDir ?? DEFAULT_DOCKER_DIR,
+    includeApp: options.includeApp !== false,
+  };
+
+  const specs = buildSpecs(normalised);
   const { files: composeFilesContent, composeFiles } = emitComposeLayers(
     specs,
-    options,
+    normalised,
   );
   const dockerfile: GeneratedFile = {
     path: "Dockerfile",
-    content: emitDockerfile({ appPort: options.appPort }),
+    content: emitDockerfile({ appPort: normalised.appPort }),
   };
+  // Always emit Dockerfile for deploy; stack-only runs ignore it.
   const files = [dockerfile, ...composeFilesContent];
 
   for (const f of files) {
@@ -50,8 +59,8 @@ export function deriveInfrastructure(options: DeriveOptions): DeriveResult {
 
   const stackEnv = buildStackEnv(
     specs,
-    options.recipes ?? [],
-    options.host ?? "127.0.0.1",
+    normalised.recipes ?? [],
+    normalised.host ?? "127.0.0.1",
   );
 
   return { specs, files, stackEnv, composeFiles };
@@ -62,22 +71,33 @@ export function deriveInfrastructure(options: DeriveOptions): DeriveResult {
  * credential values into YAML. Optionally writes `.env.stack`.
  *
  * @param result - Derive result
- * @param outDir - Destination
+ * @param outDir - Destination for Dockerfile / compose (usually `docker/`)
  * @param options - Write controls
  */
 export async function writeDerivedFiles(
   result: DeriveResult,
   outDir: string,
-  options: { readonly writeStackEnv?: boolean } = {},
+  options: {
+    readonly writeStackEnv?: boolean;
+    /**
+     * Directory for `.env.stack` (project root). Defaults to `outDir`.
+     * Prefer the project cwd when compose lives under `docker/`.
+     */
+    readonly stackEnvDir?: string;
+  } = {},
 ): Promise<readonly string[]> {
   const written: string[] = [];
+  const root = outDir.replace(/\/$/, "");
+  mkdirSync(root, { recursive: true });
   for (const file of result.files) {
-    const path = `${outDir.replace(/\/$/, "")}/${file.path}`;
+    const path = `${root}/${file.path}`;
     await Bun.write(path, file.content);
     written.push(path);
   }
   if (options.writeStackEnv) {
-    const envPath = `${outDir.replace(/\/$/, "")}/.env.stack`;
+    const envRoot = (options.stackEnvDir ?? outDir).replace(/\/$/, "");
+    mkdirSync(envRoot, { recursive: true });
+    const envPath = `${envRoot}/.env.stack`;
     await Bun.write(envPath, formatStackEnv(result.stackEnv));
     written.push(envPath);
   }

package/src/docker/docker.test.ts

@@ -125,8 +125,13 @@ describe("deriveInfrastructure", () => {
     expect(sqlYml).toContain("pgvector/pgvector:pg17");
     expect(sqlYml).toContain("POSTGRES_PASSWORD");
     expect(sqlYml).toContain("${OKE_STORE_SQL_PASSWORD}");
+    expect(sqlYml).toContain("../.env.stack");
     expect(sqlYml).not.toContain(fixedCreds["store.sql"].password);
 
+    const baseYml = result.files.find((f) => f.path === "compose.yml")!.content;
+    expect(baseYml).toContain("context: \"..\"");
+    expect(baseYml).toContain("app:");
+
     for (const f of result.files) {
       assertNoCredentialsInYaml(
         f.content,
@@ -140,6 +145,20 @@ describe("deriveInfrastructure", () => {
     );
   });
 
+  test("includeApp false omits app service (infra-only stack)", () => {
+    const result = deriveInfrastructure({
+      images: { "store.sql": "postgres:16" },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      includeApp: false,
+      app: "dev",
+    });
+    const base = result.files.find((f) => f.path === "compose.yml")!.content;
+    expect(base).toContain("oke-dev");
+    expect(base).toContain("networks:");
+    expect(base).not.toContain("app:");
+    expect(base).not.toContain("build:");
+  });
+
   test("prod overlay adds deploy.replicas and is layer 3", () => {
     const result = deriveInfrastructure({
       images: { "store.sql": "postgres:16" },
@@ -160,15 +179,20 @@ describe("deriveInfrastructure", () => {
   });
 
   test("writeDerivedFiles never writes compose.override.yml", async () => {
-    const dir = await mkdtemp(join(tmpdir(), "oke-docker-"));
+    const root = await mkdtemp(join(tmpdir(), "oke-docker-"));
+    const dockerDir = join(root, "docker");
     const result = deriveInfrastructure({
       images: { "store.sql": "postgres:16" },
       credentials: { "store.sql": fixedCreds["store.sql"] },
     });
-    const written = await writeDerivedFiles(result, dir, { writeStackEnv: true });
+    const written = await writeDerivedFiles(result, dockerDir, {
+      writeStackEnv: true,
+      stackEnvDir: root,
+    });
     expect(written.some((p) => p.endsWith(COMPOSE_OVERRIDE))).toBe(false);
-    expect(await Bun.file(join(dir, ".env.stack")).exists()).toBe(true);
-    const envText = await Bun.file(join(dir, ".env.stack")).text();
+    expect(await Bun.file(join(root, ".env.stack")).exists()).toBe(true);
+    expect(await Bun.file(join(dockerDir, "compose.yml")).exists()).toBe(true);
+    const envText = await Bun.file(join(root, ".env.stack")).text();
     expect(envText).toContain("DATABASE_URL=");
     expect(formatStackEnv(result.stackEnv)).toContain("OKE_STORE_SQL_PASSWORD=");
   });

package/src/docker/dockerfile.integration.test.ts

@@ -82,6 +82,8 @@ console.log("listening", server.port);
           },
         },
         app: "fixture",
+        // Flat fixture root (build context `.`).
+        composeDir: ".",
       });
       await writeDerivedFiles(derived, dir);
 

package/src/docker/index.ts

@@ -19,11 +19,14 @@ export type {
   ServiceSpec,
 } from "./types.ts";
 
+export { DEFAULT_DOCKER_DIR } from "./types.ts";
+
 export {
   COMPOSE_OVERRIDE,
   assertNoCredentialsInYaml,
   buildSpecs,
   buildStackEnv,
+  composePathRefs,
   emitComposeLayers,
   formatStackEnv,
 } from "./compose.ts";
@@ -43,6 +46,13 @@ export {
   resolveStack,
   type StackRow,
 } from "./stack.ts";
+export {
+  hostPortForInstance,
+  loadExistingStackCredentials,
+  parseStackCredentials,
+  stackAppSlug,
+  stackInstanceId,
+} from "./stack-id.ts";
 export {
   formatImagesLock,
   pinImages,

package/src/docker/stack-id.test.ts

@@ -0,0 +1,86 @@
+/**
+ * Per-project stack identity.
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+  hostPortForInstance,
+  parseStackCredentials,
+  stackAppSlug,
+  stackInstanceId,
+} from "./stack-id.ts";
+import { deriveInfrastructure } from "./derive.ts";
+
+describe("stackInstanceId", () => {
+  test("is stable for the same cwd and differs across paths", () => {
+    const a = stackInstanceId("/tmp/oke-project-a");
+    const b = stackInstanceId("/tmp/oke-project-a");
+    const c = stackInstanceId("/tmp/oke-project-b");
+    expect(a).toBe(b);
+    expect(a).toHaveLength(6);
+    expect(a).not.toBe(c);
+  });
+
+  test("stackAppSlug is dev-<id>", () => {
+    const id = stackInstanceId("/tmp/oke-x");
+    expect(stackAppSlug("/tmp/oke-x")).toBe(`dev-${id}`);
+  });
+});
+
+describe("hostPortForInstance", () => {
+  test("offsets sql and kv into separate ranges", () => {
+    const id = "abcd12";
+    const sql = hostPortForInstance("store.sql", 5432, id);
+    const kv = hostPortForInstance("store.kv", 6379, id);
+    expect(sql).toBeGreaterThanOrEqual(15_000);
+    expect(sql).toBeLessThan(16_000);
+    expect(kv).toBeGreaterThanOrEqual(16_000);
+    expect(kv).toBeLessThan(17_000);
+  });
+});
+
+describe("parseStackCredentials", () => {
+  test("reads OKE_* credential keys", () => {
+    const text = `
+OKE_STORE_SQL_USER=oke
+OKE_STORE_SQL_PASSWORD=s3cret
+OKE_STORE_SQL_DB=oke
+OKE_STORE_KV_USER=oke
+OKE_STORE_KV_PASSWORD=kvpass
+OKE_STORE_KV_DB=oke
+`;
+    const creds = parseStackCredentials(text, ["store.sql", "store.kv"]);
+    expect(creds["store.sql"]?.password).toBe("s3cret");
+    expect(creds["store.kv"]?.password).toBe("kvpass");
+  });
+});
+
+describe("deriveInfrastructure instanceId", () => {
+  test("unique app name and host ports land in stackEnv URLs", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:18-alpine",
+        "store.kv": "redis:8-alpine",
+      },
+      app: "dev-abcdef",
+      instanceId: "abcdef",
+      includeApp: false,
+      credentials: {
+        "store.sql": {
+          user: "oke",
+          password: "stack-id-test-sql-password",
+          database: "oke",
+        },
+        "store.kv": {
+          user: "oke",
+          password: "stack-id-test-kv-password",
+          database: "oke",
+        },
+      },
+    });
+    const base = result.files.find((f) => f.path === "compose.yml")!.content;
+    expect(base).toContain("oke-dev-abcdef");
+    expect(result.stackEnv.DATABASE_URL).toMatch(/:15\d{3}\//);
+    expect(result.stackEnv.REDIS_URL).toMatch(/:16\d{3}/);
+  });
+});

package/src/docker/stack-id.ts

@@ -0,0 +1,108 @@
+/**
+ * Per-project local stack identity — unique compose project + host ports.
+ *
+ * `oke dev --stack` must not share one `oke-dev` Postgres across every app on
+ * the machine. Identity is a stable short hash of the project cwd.
+ */
+
+import { createHash } from "node:crypto";
+import { resolve } from "node:path";
+import type { ServiceCredentials } from "./types.ts";
+import { defaultHostPort, envPrefix } from "./helpers.ts";
+
+/**
+ * Stable 6-hex id for a project directory (local stacks only).
+ *
+ * @param cwd - Project root
+ */
+export function stackInstanceId(cwd: string): string {
+  return createHash("sha256")
+    .update(resolve(cwd))
+    .digest("hex")
+    .slice(0, 6);
+}
+
+/**
+ * Compose project / app slug: `dev-<id>` → Docker name `oke-dev-<id>`.
+ *
+ * @param cwd - Project root
+ */
+export function stackAppSlug(cwd: string): string {
+  return `dev-${stackInstanceId(cwd)}`;
+}
+
+/**
+ * Host port for a role, offset by instance id so two stacks can run at once.
+ *
+ * @param role - Role key
+ * @param containerPort - Container listen port
+ * @param instanceId - 6-hex stack id
+ */
+export function hostPortForInstance(
+  role: string,
+  containerPort: number,
+  instanceId: string,
+): number {
+  const n = Number.parseInt(instanceId.slice(0, 4), 16) % 1000;
+  if (role === "store.sql") return 15_000 + n;
+  if (role === "store.kv") return 16_000 + n;
+  if (role === "signal") return 17_000 + n;
+  return defaultHostPort(role, containerPort) + n;
+}
+
+/**
+ * Parse role credentials from an existing `.env.stack` body (reuse on restart).
+ *
+ * @param text - Dotenv contents
+ * @param roles - Roles to look up
+ */
+export function parseStackCredentials(
+  text: string,
+  roles: readonly string[],
+): Record<string, ServiceCredentials> {
+  const map = new Map<string, string>();
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq);
+    let value = trimmed.slice(eq + 1);
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    map.set(key, value);
+  }
+
+  const out: Record<string, ServiceCredentials> = {};
+  for (const role of roles) {
+    const prefix = envPrefix(role);
+    const user = map.get(`${prefix}_USER`);
+    const password = map.get(`${prefix}_PASSWORD`);
+    const database = map.get(`${prefix}_DB`);
+    if (user && password && database) {
+      out[role] = { user, password, database };
+    }
+  }
+  return out;
+}
+
+/**
+ * Load credentials from project `.env.stack` when present.
+ *
+ * @param cwd - Project root
+ * @param roles - Image roles
+ */
+export async function loadExistingStackCredentials(
+  cwd: string,
+  roles: readonly string[],
+): Promise<Readonly<Record<string, ServiceCredentials>> | undefined> {
+  const path = resolve(cwd, ".env.stack");
+  const file = Bun.file(path);
+  if (!(await file.exists())) return undefined;
+  const parsed = parseStackCredentials(await file.text(), roles);
+  return Object.keys(parsed).length > 0 ? parsed : undefined;
+}

package/src/docker/stack.integration.test.ts

@@ -32,6 +32,7 @@ describe("oke dev --stack postgres integration", () => {
     }
 
     const dir = await mkdtemp(join(tmpdir(), "oke-stack-pg-"));
+    const dockerDir = join(dir, "docker");
     const project = `oke-pg-${Date.now()}`;
     try {
       const derived = deriveInfrastructure({
@@ -45,11 +46,16 @@ describe("oke dev --stack postgres integration", () => {
         },
         app: "stacktest",
         host: "127.0.0.1",
+        includeApp: false,
+        composeDir: "docker",
+      });
+      await writeDerivedFiles(derived, dockerDir, {
+        writeStackEnv: true,
+        stackEnvDir: dir,
       });
-      await writeDerivedFiles(derived, dir, { writeStackEnv: true });
 
-      // Stack-only: no app service — just the role compose file.
-      const composeFiles = ["compose.store.sql.yml"];
+      // Infra-only: network + role compose (no app build).
+      const composeFiles = ["compose.yml", "compose.store.sql.yml"];
       const up = Bun.spawn(
         [
           "docker",
@@ -61,7 +67,7 @@ describe("oke dev --stack postgres integration", () => {
           "-d",
         ],
         {
-          cwd: dir,
+          cwd: dockerDir,
           stdout: "pipe",
           stderr: "pipe",
           env: {
@@ -92,7 +98,7 @@ describe("oke dev --stack postgres integration", () => {
             "--format",
             "json",
           ],
-          { cwd: dir, stdout: "pipe", stderr: "pipe" },
+          { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
         );
         const text = await new Response(ps.stdout).text();
         await ps.exited;
@@ -115,11 +121,12 @@ describe("oke dev --stack postgres integration", () => {
       }
 
       // Prove credentials live in .env.stack, not YAML.
-      const yml = await Bun.file(join(dir, "compose.store.sql.yml")).text();
+      const yml = await Bun.file(join(dockerDir, "compose.store.sql.yml")).text();
       expect(yml).not.toContain("stack-integration-pass");
       expect(formatStackEnv(derived.stackEnv)).toContain(
         "stack-integration-pass",
       );
+      expect(await Bun.file(join(dir, ".env.stack")).exists()).toBe(true);
     } finally {
       await Bun.spawn(
         [
@@ -128,11 +135,13 @@ describe("oke dev --stack postgres integration", () => {
           "-p",
           project,
           "-f",
+          "compose.yml",
+          "-f",
           "compose.store.sql.yml",
           "down",
           "-v",
         ],
-        { cwd: dir, stdout: "pipe", stderr: "pipe" },
+        { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
       ).exited.catch(() => {});
       await rm(dir, { recursive: true, force: true }).catch(() => {});
     }

package/src/docker/types.ts

@@ -100,7 +100,18 @@ export interface DeriveOptions {
   readonly appPort?: number;
   /** When true, emit prod overlays (limits, secret refs, deploy.replicas). */
   readonly prod?: boolean;
-  /** Output directory (default `.`). */
+  /**
+   * Include the `app` service in `compose.yml` (default true).
+   * `oke dev --stack` sets false — host Bun runs the app; Docker is infra only.
+   */
+  readonly includeApp?: boolean;
+  /**
+   * Compose artefact directory relative to the project root (default `docker`).
+   * Controls generated `env_file` / `build.context` paths (e.g. `../.env.stack`).
+   * Pass `"."` for legacy root-level layout.
+   */
+  readonly composeDir?: string;
+  /** Output directory (default `docker`). */
   readonly outDir?: string;
   /** Inject credentials (tests). Defaults to generated randoms. */
   readonly credentials?: Readonly<Record<string, ServiceCredentials>>;
@@ -108,8 +119,16 @@ export interface DeriveOptions {
   readonly host?: string;
   /** Extra image recipes (plugins). */
   readonly recipes?: readonly ImageRecipe[];
+  /**
+   * Local stack instance id (6-hex). When set, host ports are offset so two
+   * `oke dev -s` projects do not share one Postgres on `:5432`.
+   */
+  readonly instanceId?: string;
 }
 
+/** Default relative directory for generated Docker / compose artefacts. */
+export const DEFAULT_DOCKER_DIR = "docker";
+
 /** One generated file. */
 export interface GeneratedFile {
   /** Relative path under `outDir`. */