okengine 0.2.5 → 0.2.8

package/src/elements/store/sql-session.ts

@@ -5,13 +5,12 @@
  * Same flow code runs against sqlite, postgres, and memory.
  */
 
+import type { DomainDdlMode } from "../../config/index.ts";
 import type { ClassificationMap, SqlConnection, SqlRow } from "../../drivers/types.ts";
+import { throwOke } from "../../kernel/errors.ts";
 import { maskRows, tableFromSql } from "./classify.ts";
-import {
-  compileWhere,
-  resolveSelectColumns,
-  type WhereMap,
-} from "./sql-condition.ts";
+import { isMissingDomainRelationError } from "./missing-relation.ts";
+import { compileWhere, resolveSelectColumns, type WhereMap } from "./sql-condition.ts";
 import {
   mapRowToJs,
   prepareInsertRow,
@@ -32,6 +31,12 @@ export interface SqlSessionOptions {
   readonly revealPii?: boolean;
   /** Which connection was chosen — exposed for replica proofs. */
   readonly routedRole: "primary" | "replica";
+  /**
+   * Domain DDL policy. `ensure` runs `CREATE TABLE IF NOT EXISTS` on first
+   * touch; `off` means migrations / `oke db push` own the schema (docker/prod
+   * and local+autoPush). Default `ensure` for backward-compatible tests.
+   */
+  readonly domainDdl?: DomainDdlMode;
 }
 
 /**
@@ -172,10 +177,7 @@ export interface SqlStoreHandle {
    * @param table - Table
    * @param idOrWhere - Primary key string, or column equality map
    */
-  exists(
-    table: TableHandle | unknown,
-    idOrWhere: string | WhereMap,
-  ): Promise<boolean>;
+  exists(table: TableHandle | unknown, idOrWhere: string | WhereMap): Promise<boolean>;
   /**
    * Atomically add `by` to `column` on the PK row.
    *
@@ -184,12 +186,7 @@ export interface SqlStoreHandle {
    * @param column - Numeric column to bump
    * @param by - Delta (default `1`)
    */
-  increment(
-    table: TableHandle | unknown,
-    id: string,
-    column: string,
-    by?: number,
-  ): Promise<number>;
+  increment(table: TableHandle | unknown, id: string, column: string, by?: number): Promise<number>;
   /**
    * Raw SQL — PII masking still applied at the boundary.
    *
@@ -216,38 +213,55 @@ export function createSqlStoreHandle(
   options: SqlSessionOptions,
 ): SqlStoreHandle {
   const { connection, classifications, revealPii } = options;
+  const domainDdl: DomainDdlMode = options.domainDdl ?? "ensure";
 
   function mask(rows: SqlRow[], table?: string): SqlRow[] {
     return maskRows(rows, { classifications, table, revealPii });
   }
 
+  /**
+   * Run a connection op; remap missing-relation driver errors to OKE1101
+   * when domain auto-DDL is off.
+   */
+  async function withSchemaGuard<T>(fn: () => Promise<T>): Promise<T> {
+    try {
+      return await fn();
+    } catch (err) {
+      if (domainDdl === "off" && isMissingDomainRelationError(err)) {
+        throwOke("DOMAIN_SCHEMA_MISSING");
+      }
+      throw err;
+    }
+  }
+
+  function query(sql: string, params: readonly unknown[] = []): Promise<SqlRow[]> {
+    return withSchemaGuard(() => connection.query(sql, params));
+  }
+
+  function exec(sql: string, params: readonly unknown[] = []): Promise<{ changes: number }> {
+    return withSchemaGuard(() => connection.exec(sql, params));
+  }
+
   async function ensureFromMeta(table: TableHandle | unknown): Promise<void> {
+    if (domainDdl !== "ensure") return;
     const cols = resolveColumns(table);
     if (cols.length === 0) return;
     const name = resolveTableName(table);
     const pk = cols.find((c) => c.primary)?.sqlName;
     const colSql = cols
       .map((c) => {
-        const typ =
-          pk && c.sqlName === pk
-            ? `${c.sqlType} PRIMARY KEY`
-            : c.sqlType;
+        const typ = pk && c.sqlName === pk ? `${c.sqlType} PRIMARY KEY` : c.sqlType;
         return `${quoteIdent(c.sqlName)} ${typ}`;
       })
       .join(", ");
-    await connection.exec(
-      `CREATE TABLE IF NOT EXISTS ${quoteIdent(name)} (${colSql})`,
-    );
+    await exec(`CREATE TABLE IF NOT EXISTS ${quoteIdent(name)} (${colSql})`);
   }
 
   function toJs(table: TableHandle | unknown, rows: SqlRow[]): SqlRow[] {
     return rows.map((r) => mapRowToJs(table, r) as SqlRow);
   }
 
-  function normalizeWhereMap(
-    table: TableHandle | unknown,
-    where: WhereMap,
-  ): WhereMap {
+  function normalizeWhereMap(table: TableHandle | unknown, where: WhereMap): WhereMap {
     const cols = resolveColumns(table);
     if (cols.length === 0) return where;
     const out: Record<string, unknown> = {};
@@ -305,7 +319,7 @@ export function createSqlStoreHandle(
       sql += ` LIMIT ${Math.max(0, Math.floor(limit))}`;
     }
 
-    const rows = await connection.query(sql, params);
+    const rows = await query(sql, params);
     if (projection === null) {
       return toJs(table, mask(rows, name));
     }
@@ -322,10 +336,7 @@ export function createSqlStoreHandle(
     );
   }
 
-  function selectFrom(
-    table: TableHandle | unknown,
-    columns?: unknown,
-  ): SelectFromBuilder {
+  function selectFrom(table: TableHandle | unknown, columns?: unknown): SelectFromBuilder {
     const projection = resolveSelectColumns(columns);
     const all = runSelect(table, projection, undefined);
     return {
@@ -371,7 +382,7 @@ export function createSqlStoreHandle(
             const colList = cols.map(quoteIdent).join(", ");
             const params = cols.map((c) => prepared[c]);
             const sql = `INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders})`;
-            await connection.exec(sql, params);
+            await exec(sql, params);
           };
           return {
             async returning() {
@@ -382,7 +393,7 @@ export function createSqlStoreHandle(
               const colList = cols.map(quoteIdent).join(", ");
               const params = cols.map((c) => prepared[c]);
               const sql = `INSERT INTO ${quoteIdent(name)} (${colList}) VALUES (${placeholders}) RETURNING *`;
-              const rows = await connection.query(sql, params);
+              const rows = await query(sql, params);
               return toJs(table, mask(rows, name));
             },
             execute: runExecute,
@@ -404,18 +415,13 @@ export function createSqlStoreHandle(
               const prepared = prepareInsertRow(table, row);
               const setEntries = Object.entries(prepared);
               if (setEntries.length === 0) return 0;
-              const setSql = setEntries
-                .map(([col]) => `${quoteIdent(col)} = ?`)
-                .join(", ");
+              const setSql = setEntries.map(([col]) => `${quoteIdent(col)} = ?`).join(", ");
               const compiled = compileTableWhere(table, where);
               if (!compiled.clause) {
                 throw new Error("update().set().where(): condition required");
               }
-              const params = [
-                ...setEntries.map(([, v]) => v),
-                ...compiled.params,
-              ];
-              const result = await connection.exec(
+              const params = [...setEntries.map(([, v]) => v), ...compiled.params];
+              const result = await exec(
                 `UPDATE ${quoteIdent(name)} SET ${setSql} WHERE ${compiled.clause}`,
                 params,
               );
@@ -430,27 +436,22 @@ export function createSqlStoreHandle(
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const pk = resolvePkColumn(table);
-      const rows = await connection.query(
-        `SELECT * FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ?`,
-        [idValue],
-      );
+      const rows = await query(`SELECT * FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ?`, [
+        idValue,
+      ]);
       const masked = toJs(table, mask(rows, name));
       return masked[0] ?? null;
     },
 
-    delete: ((
-      table: TableHandle | unknown,
-      idValue?: string,
-    ): DeleteBuilder | Promise<boolean> => {
+    delete: ((table: TableHandle | unknown, idValue?: string): DeleteBuilder | Promise<boolean> => {
       if (idValue !== undefined) {
         return (async () => {
           await ensureFromMeta(table);
           const name = resolveTableName(table);
           const pk = resolvePkColumn(table);
-          const result = await connection.exec(
-            `DELETE FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ?`,
-            [idValue],
-          );
+          const result = await exec(`DELETE FROM ${quoteIdent(name)} WHERE ${quoteIdent(pk)} = ?`, [
+            idValue,
+          ]);
           return result.changes > 0;
         })();
       }
@@ -462,7 +463,7 @@ export function createSqlStoreHandle(
           if (!compiled.clause) {
             throw new Error("delete().where(): condition required");
           }
-          const result = await connection.exec(
+          const result = await exec(
             `DELETE FROM ${quoteIdent(name)} WHERE ${compiled.clause}`,
             compiled.params,
           );
@@ -483,7 +484,7 @@ export function createSqlStoreHandle(
       if (!compiled.clause) {
         throw new Error("exists() requires at least one where predicate");
       }
-      const rows = await connection.query(
+      const rows = await query(
         `SELECT 1 AS "ok" FROM ${quoteIdent(name)} WHERE ${compiled.clause} LIMIT 1`,
         compiled.params,
       );
@@ -498,22 +499,20 @@ export function createSqlStoreHandle(
       const colMeta = cols.find((c) => c.key === column || c.sqlName === column);
       const sqlCol = colMeta?.sqlName ?? column;
       const col = quoteIdent(sqlCol);
-      const rows = await connection.query(
+      const rows = await query(
         `UPDATE ${quoteIdent(name)} SET ${col} = ${col} + ? WHERE ${quoteIdent(pk)} = ? RETURNING ${col}`,
         [by, idValue],
       );
       const row = rows[0];
       if (!row) {
-        throw new Error(
-          `increment(): no row with ${pk} ${JSON.stringify(idValue)} in ${name}`,
-        );
+        throw new Error(`increment(): no row with ${pk} ${JSON.stringify(idValue)} in ${name}`);
       }
       return asNumber(row[sqlCol], sqlCol);
     },
 
     async raw(sql, params = []) {
       const table = tableFromSql(sql);
-      const rows = await connection.query(sql, params);
+      const rows = await query(sql, params);
       return mask(rows, table);
     },
 
@@ -534,9 +533,7 @@ export function createSqlStoreHandle(
           return `${quoteIdent(c.name)} ${typ}`;
         })
         .join(", ");
-      await connection.exec(
-        `CREATE TABLE IF NOT EXISTS ${quoteIdent(table.name)} (${colSql})`,
-      );
+      await exec(`CREATE TABLE IF NOT EXISTS ${quoteIdent(table.name)} (${colSql})`);
     },
   };
 

package/src/elements/store/table.ts

@@ -31,9 +31,7 @@ export interface TableHandle {
  */
 export function defineTable(
   name: string,
-  columns: Readonly<
-    Record<string, ColumnDef | ColumnClassification | true | undefined>
-  >,
+  columns: Readonly<Record<string, ColumnDef | ColumnClassification | true | undefined>>,
 ): TableHandle {
   const resolved: Record<string, ColumnDef> = {};
   for (const [key, value] of Object.entries(columns)) {
@@ -120,14 +118,38 @@ export function resolveColumns(table: unknown): ResolvedColumn[] {
   if (table && typeof table === "object") {
     const t = table as Record<string, unknown>;
     if ("columns" in t && t.columns && typeof t.columns === "object") {
-      return Object.entries(t.columns as Record<string, ColumnDef>).map(
-        ([key, col]) => ({
+      return Object.entries(
+        t.columns as Record<
+          string,
+          ColumnDef & {
+            sqlName?: string;
+            sqlType?: string;
+            primaryKey?: boolean;
+            defaultFn?: () => unknown;
+          }
+        >,
+      ).map(([key, col]) => {
+        const sqlName = col.sqlName ?? col.name;
+        const primary =
+          typeof col.primaryKey === "boolean"
+            ? col.primaryKey
+            : col.name === "id" || key === "id" || sqlName === "id";
+        const sqlType =
+          col.sqlType === "integer" || col.sqlType === "INTEGER"
+            ? ("INTEGER" as const)
+            : col.sqlType === "real" || col.sqlType === "REAL"
+              ? ("REAL" as const)
+              : col.sqlType === "blob" || col.sqlType === "BLOB"
+                ? ("BLOB" as const)
+                : ("TEXT" as const);
+        return {
           key,
-          sqlName: col.name,
-          primary: col.name === "id" || key === "id",
-          sqlType: "TEXT" as const,
-        }),
-      );
+          sqlName,
+          primary,
+          sqlType,
+          ...(typeof col.defaultFn === "function" ? { defaultFn: col.defaultFn } : {}),
+        };
+      });
     }
     if (isDrizzleTable(t)) {
       return drizzleColumns(t);
@@ -168,18 +190,14 @@ function drizzleColumns(t: Record<string, unknown>): ResolvedColumn[] {
       config?: { primaryKey?: boolean };
     };
     const sqlName = typeof col.name === "string" ? col.name : key;
-    const primary = Boolean(
-      col.primary || col.config?.primaryKey || sqlName === "id",
-    );
+    const primary = Boolean(col.primary || col.config?.primaryKey || sqlName === "id");
     const sqlType = drizzleSqlType(col.columnType, col.dataType);
     out.push({
       key,
       sqlName,
       primary,
       sqlType,
-      ...(typeof col.defaultFn === "function"
-        ? { defaultFn: col.defaultFn.bind(col) }
-        : {}),
+      ...(typeof col.defaultFn === "function" ? { defaultFn: col.defaultFn.bind(col) } : {}),
     });
   }
   return out;
@@ -257,9 +275,7 @@ export function mapRowToJs(
  *
  * @param table - Table handle
  */
-export function classificationsFromTable(
-  table: TableHandle,
-): Record<string, ColumnClassification> {
+export function classificationsFromTable(table: TableHandle): Record<string, ColumnClassification> {
   const out: Record<string, ColumnClassification> = {};
   for (const [key, col] of Object.entries(table.columns)) {
     if (col.classification) out[key] = col.classification;

package/src/elements/store.test.ts

@@ -7,11 +7,7 @@
  */
 
 import { describe, expect, test } from "bun:test";
-import {
-  createPostgresFakeClient,
-  postgresDriver,
-  sqliteDriver,
-} from "../drivers/index.ts";
+import { createPostgresFakeClient, postgresDriver, sqliteDriver } from "../drivers/index.ts";
 import type { Effects } from "../manifest/types.ts";
 import {
   classify,
@@ -72,9 +68,7 @@ describe("store facets", () => {
   });
 
   test("id and now helpers", () => {
-    expect(id()).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
-    );
+    expect(id()).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
     expect(now()).toBeGreaterThan(0);
   });
 });
@@ -119,13 +113,11 @@ describe("same flow against sqlite and postgres", () => {
 describe("replica routing from effects", () => {
   test("read-only flows are detected from the effect set", () => {
     expect(isReadOnlyStoreFlow({ reads: ["sql:notes"] })).toBe(true);
-    expect(
-      isReadOnlyStoreFlow({ reads: ["sql:notes"], writes: ["sql:notes"] }),
-    ).toBe(false);
+    expect(isReadOnlyStoreFlow({ reads: ["sql:notes"], writes: ["sql:notes"] })).toBe(false);
     expect(sqlRoleForEffects({ reads: ["sql:notes"] }, true)).toBe("replica");
-    expect(
-      sqlRoleForEffects({ reads: ["sql:notes"], writes: ["sql:notes"] }, true),
-    ).toBe("primary");
+    expect(sqlRoleForEffects({ reads: ["sql:notes"], writes: ["sql:notes"] }, true)).toBe(
+      "primary",
+    );
   });
 
   test("read-only flow provably hits a replica", async () => {
@@ -135,10 +127,11 @@ describe("replica routing from effects", () => {
     await replicaClient.unsafe(
       `CREATE TABLE IF NOT EXISTS "notes" ("id" TEXT PRIMARY KEY, "title" TEXT, "email" TEXT)`,
     );
-    await replicaClient.unsafe(
-      `INSERT INTO "notes" ("id", "title", "email") VALUES ($1, $2, $3)`,
-      ["n1", "from-replica", "x@y.z"],
-    );
+    await replicaClient.unsafe(`INSERT INTO "notes" ("id", "title", "email") VALUES ($1, $2, $3)`, [
+      "n1",
+      "from-replica",
+      "x@y.z",
+    ]);
 
     const decl = store.sql("notes", {
       classify: { notes: { email: classify({ pii: true }) } },
@@ -213,12 +206,8 @@ describe("tier-1 cache invalidation from effects", () => {
       expiresAt: null,
     });
 
-    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:notes"] })).toBe(
-      true,
-    );
-    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:orders"] })).toBe(
-      false,
-    );
+    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:notes"] })).toBe(true);
+    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:orders"] })).toBe(false);
 
     const event = cache.invalidateFromEffects({ writes: ["sql:notes"] });
     expect(event.keys).toEqual([computedCacheKey("sql:notes")]);
@@ -268,10 +257,7 @@ describe("exists and increment helpers", () => {
         }),
       );
       await handle.ensureTable(counters);
-      await handle
-        .insert(counters)
-        .values({ id: "c1", clicks: 0 })
-        .execute();
+      await handle.insert(counters).values({ id: "c1", clicks: 0 }).execute();
 
       expect(await handle.exists(counters, { id: "c1" }), label).toBe(true);
       expect(await handle.exists(counters, { id: "gone" }), label).toBe(false);
@@ -301,16 +287,11 @@ describe("exists and increment helpers", () => {
         }),
       );
       await handle.ensureTable(counters);
-      await handle
-        .insert(counters)
-        .values({ id: "c1", clicks: 0 })
-        .execute();
+      await handle.insert(counters).values({ id: "c1", clicks: 0 }).execute();
 
       const n = 100;
       const results = await Promise.all(
-        Array.from({ length: n }, () =>
-          handle.increment(counters, "c1", "clicks"),
-        ),
+        Array.from({ length: n }, () => handle.increment(counters, "c1", "clicks")),
       );
       expect(new Set(results).size, label).toBe(n);
       expect(Math.max(...results), label).toBe(n);
@@ -337,10 +318,7 @@ describe("PII masking at the driver boundary", () => {
       }),
     );
     await handle.ensureTable(notes);
-    await handle
-      .insert(notes)
-      .values({ id: "1", title: "t", email: "pii@x.com" })
-      .execute();
+    await handle.insert(notes).values({ id: "1", title: "t", email: "pii@x.com" }).execute();
 
     const rows = await handle.raw(`SELECT * FROM notes`);
     expect(rows[0]?.title).toBe("t");

package/src/elements/store.ts

@@ -21,6 +21,37 @@ export type {
   IndexStoreOptions,
 } from "./store/declare.ts";
 
+export {
+  field,
+  schema,
+  schemaTable,
+  schemaRelations,
+  isSchemaTableDecl,
+  isSchemaColumnDecl,
+  isSchemaRelationsDecl,
+  isFieldBuilder,
+  finalizeColumnMap,
+  tablesFromExports,
+  relationsFromExports,
+} from "./store/schema-decl.ts";
+export type {
+  FieldBuilder,
+  FieldSqlType,
+  DefaultFnKind,
+  SchemaColumnDecl,
+  SchemaColumnInput,
+  SchemaTableDecl,
+  SchemaTableWithColumns,
+  SchemaRelationsDecl,
+  SchemaRelationEntry,
+  SchemaRelationOne,
+  SchemaRelationMany,
+  RelationColumnRef,
+  ReferenceAction,
+  ReferenceActions,
+  ColumnReference,
+} from "./store/schema-decl.ts";
+
 export {
   classify,
   buildClassificationMap,
@@ -39,33 +70,15 @@ export {
   isInvalidatedByWrite,
   parseTtlMs,
 } from "./store/cache.ts";
-export type {
-  CacheTier,
-  CacheEntry,
-  InvalidationEvent,
-  StoreCache,
-} from "./store/cache.ts";
+export type { CacheTier, CacheEntry, InvalidationEvent, StoreCache } from "./store/cache.ts";
 
-export {
-  isReadOnlyStoreFlow,
-  sqlRoleForEffects,
-  resolveSqlTarget,
-} from "./store/replica.ts";
+export { isReadOnlyStoreFlow, sqlRoleForEffects, resolveSqlTarget } from "./store/replica.ts";
 export type { SqlBindingConfig } from "./store/replica.ts";
 
-export {
-  defineTable,
-  resolveTableName,
-  classificationsFromTable,
-  id,
-  now,
-} from "./store/table.ts";
+export { defineTable, resolveTableName, classificationsFromTable, id, now } from "./store/table.ts";
 export type { ColumnDef, TableHandle } from "./store/table.ts";
 
-export {
-  createSqlStoreHandle,
-  resolvePkColumn,
-} from "./store/sql-session.ts";
+export { createSqlStoreHandle, resolvePkColumn } from "./store/sql-session.ts";
 export type {
   SqlStoreHandle,
   SelectBuilder,
@@ -76,10 +89,7 @@ export type {
   WhereMap,
 } from "./store/sql-session.ts";
 
-export {
-  createStoreRuntime,
-  putTier2,
-} from "./store/runtime.ts";
+export { createStoreRuntime, putTier2 } from "./store/runtime.ts";
 export type {
   StoreRuntime,
   StoreDriverBundle,
@@ -92,9 +102,5 @@ export type {
   IndexStoreFxHandle,
 } from "./store/runtime.ts";
 
-export {
-  fileKeyWarnings,
-  contentAddressedKey,
-  projectFileKeys,
-} from "./store/files-policy.ts";
+export { fileKeyWarnings, contentAddressedKey, projectFileKeys } from "./store/files-policy.ts";
 export type { FileKeyWarning } from "./store/files-policy.ts";

package/src/elements/vault/chain.ts

@@ -0,0 +1,34 @@
+/**
+ * Canonical vault compose-env path resolution — shared by app boot and Console.
+ *
+ * Compose credentials live at `docker/.env.docker`. Legacy project-root
+ * `.env.docker` is consulted when absent (soft-compat).
+ */
+
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import type { VaultResolutionSource } from "./runtime.ts";
+
+/** Canonical relative path for compose stack credentials. */
+export const COMPOSE_ENV_REL = "docker/.env.docker";
+
+/**
+ * Resolve the compose-env path: prefer `docker/.env.docker`, then legacy
+ * project-root `.env.docker`.
+ *
+ * @param root - Project root
+ */
+export function resolveComposeEnvPath(root: string): {
+  readonly path: string;
+  readonly source: Extract<VaultResolutionSource, ".env.docker">;
+} {
+  const dockerPath = resolve(root, COMPOSE_ENV_REL);
+  if (existsSync(dockerPath)) {
+    return { path: dockerPath, source: ".env.docker" };
+  }
+  const legacyDocker = resolve(root, ".env.docker");
+  if (existsSync(legacyDocker)) {
+    return { path: legacyDocker, source: ".env.docker" };
+  }
+  return { path: dockerPath, source: ".env.docker" };
+}