okengine 0.2.6 → 0.2.8

package/src/elements/vault/declare.ts

@@ -41,10 +41,7 @@ export interface VaultSecretDecl {
  * @param name - Secret name
  * @param options - Description / rotate / schema / dev fallback
  */
-function declareSecret(
-  name: string,
-  options: VaultSecretOptions = {},
-): VaultSecretDecl {
+function declareSecret(name: string, options: VaultSecretOptions = {}): VaultSecretDecl {
   if (!name) {
     throw new TypeError("vault.secret: name is required");
   }
@@ -52,9 +49,7 @@ function declareSecret(
     kind: "secret",
     name,
     sensitive: options.sensitive ?? true,
-    ...(options.description !== undefined
-      ? { description: options.description }
-      : {}),
+    ...(options.description !== undefined ? { description: options.description } : {}),
     ...(options.rotate !== undefined ? { rotate: options.rotate } : {}),
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
@@ -67,10 +62,7 @@ function declareSecret(
  * @param name - Config name
  * @param options - Description / schema / dev fallback
  */
-function declareConfig(
-  name: string,
-  options: VaultSecretOptions = {},
-): VaultSecretDecl {
+function declareConfig(name: string, options: VaultSecretOptions = {}): VaultSecretDecl {
   if (!name) {
     throw new TypeError("vault.config: name is required");
   }
@@ -78,9 +70,7 @@ function declareConfig(
     kind: "config",
     name,
     sensitive: options.sensitive ?? false,
-    ...(options.description !== undefined
-      ? { description: options.description }
-      : {}),
+    ...(options.description !== undefined ? { description: options.description } : {}),
     ...(options.rotate !== undefined ? { rotate: options.rotate } : {}),
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
@@ -88,41 +78,41 @@ function declareConfig(
 }
 
 /**
- * Marker prefix for {@link vault.fromStack} dev fallbacks.
- * Resolved from `.env.stack` by `oke dev --stack` / vault boot.
+ * Marker prefix for {@link vault.fromDocker} local fallbacks.
+ * Resolved from `docker/.env.docker` by `oke dev --docker` / vault boot.
  */
-export const FROM_STACK_PREFIX = "__oke_from_stack__:";
+export const FROM_DOCKER_PREFIX = "__oke_from_docker__:";
 
 /**
- * Dev fallback that reads the URL built by the image recipe for `role`.
+ * Local fallback that reads the URL built by the image recipe for `role`.
  * The kernel never sees the underlying env-var names — only the URL.
  *
  * @param role - Image role (`store.sql`, …)
  */
-export function fromStack(role: string): string {
-  if (!role) throw new TypeError("vault.fromStack: role is required");
-  return `${FROM_STACK_PREFIX}${role}`;
+export function fromDocker(role: string): string {
+  if (!role) throw new TypeError("vault.fromDocker: role is required");
+  return `${FROM_DOCKER_PREFIX}${role}`;
 }
 
 /**
- * Whether a dev fallback is a {@link fromStack} marker.
+ * Whether a local fallback is a {@link fromDocker} marker.
  *
  * @param value - Candidate
  */
-export function isFromStack(value: string): boolean {
-  return value.startsWith(FROM_STACK_PREFIX);
+export function isFromDocker(value: string): boolean {
+  return value.startsWith(FROM_DOCKER_PREFIX);
 }
 
 /**
- * Role encoded in a {@link fromStack} marker.
+ * Role encoded in a {@link fromDocker} marker.
  *
- * @param value - Marker from {@link fromStack}
+ * @param value - Marker from {@link fromDocker}
  */
-export function fromStackRole(value: string): string {
-  if (!isFromStack(value)) {
-    throw new TypeError(`vault: not a fromStack marker: ${value}`);
+export function fromDockerRole(value: string): string {
+  if (!isFromDocker(value)) {
+    throw new TypeError(`vault: not a fromDocker marker: ${value}`);
   }
-  return value.slice(FROM_STACK_PREFIX.length);
+  return value.slice(FROM_DOCKER_PREFIX.length);
 }
 
 /**
@@ -135,9 +125,9 @@ export const vault: {
   (name: string, options?: VaultSecretOptions): VaultSecretDecl;
   secret(name: string, options?: VaultSecretOptions): VaultSecretDecl;
   config(name: string, options?: VaultSecretOptions): VaultSecretDecl;
-  fromStack(role: string): string;
+  fromDocker(role: string): string;
 } = Object.assign(declareSecret, {
   secret: declareSecret,
   config: declareConfig,
-  fromStack,
+  fromDocker,
 });

package/src/elements/vault/fingerprint.ts

@@ -8,13 +8,8 @@
  * @param value - Cleartext secret
  */
 export async function fingerprintSecret(value: string): Promise<string> {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(value),
-  );
-  const hex = [...new Uint8Array(digest)]
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
   return `sha256:${hex.slice(0, 16)}`;
 }
 

package/src/elements/vault/redact.ts

@@ -11,17 +11,13 @@ export const SECRET_MASK = "[redacted:secret]";
  *
  * @param secrets - Cleartext values currently loaded
  */
-export function createSecretRedactor(
-  secrets: Iterable<string>,
-): {
+export function createSecretRedactor(secrets: Iterable<string>): {
   /** Redact a free-form string. */
   redactString(input: string): string;
   /** Deep-redact a JSON-like value. */
   redact(value: unknown): unknown;
 } {
-  const values = [...secrets]
-    .filter((v) => v.length > 0)
-    .sort((a, b) => b.length - a.length);
+  const values = [...secrets].filter((v) => v.length > 0).sort((a, b) => b.length - a.length);
 
   function redactString(input: string): string {
     let out = input;

package/src/elements/vault/runtime.ts

@@ -3,7 +3,7 @@
  */
 
 import type { VaultBag, VaultDriver } from "../../drivers/vault-types.ts";
-import { fromStackRole, isFromStack } from "./declare.ts";
+import { fromDockerRole, isFromDocker } from "./declare.ts";
 import type { VaultSecretDecl } from "./declare.ts";
 import { fingerprintSecretSync } from "./fingerprint.ts";
 import { createSecretRedactor, SECRET_MASK } from "./redact.ts";
@@ -25,13 +25,8 @@ export class VaultBootError extends Error {
    * @param gaps - Missing secrets
    */
   constructor(gaps: readonly VaultGap[]) {
-    const lines = gaps.map(
-      (g) =>
-        `  - ${g.name}${g.description ? `: ${g.description}` : ""}`,
-    );
-    super(
-      `vault boot failed — ${gaps.length} missing secret(s):\n${lines.join("\n")}`,
-    );
+    const lines = gaps.map((g) => `  - ${g.name}${g.description ? `: ${g.description}` : ""}`);
+    super(`vault boot failed — ${gaps.length} missing secret(s):\n${lines.join("\n")}`);
     this.name = "VaultBootError";
     this.gaps = gaps;
   }
@@ -39,12 +34,12 @@ export class VaultBootError extends Error {
 
 /**
  * Named layer in the resolution chain (console §9.8).
- * Spec order: process.env → .env.local → .env.stack → driver → dev-fallback.
+ * Spec order: process.env → .env.local → .env.docker → driver → dev-fallback.
  */
 export type VaultResolutionSource =
   | "process.env"
   | ".env.local"
-  | ".env.stack"
+  | ".env.docker"
   | "driver"
   | "dev-fallback";
 
@@ -173,9 +168,7 @@ export interface VaultRuntime {
  *
  * @param options - Contracts + resolution chain
  */
-export function createVaultRuntime(
-  options: CreateVaultRuntimeOptions = {},
-): VaultRuntime {
+export function createVaultRuntime(options: CreateVaultRuntimeOptions = {}): VaultRuntime {
   const contracts = new Map<string, VaultSecretDecl>();
   for (const s of options.secrets ?? []) {
     contracts.set(s.name, s);
@@ -236,9 +229,7 @@ export function createVaultRuntime(
       if (value === undefined || value.length === 0) {
         gaps.push({
           name: c.name,
-          ...(c.description !== undefined
-            ? { description: c.description }
-            : {}),
+          ...(c.description !== undefined ? { description: c.description } : {}),
         });
       }
     }
@@ -384,17 +375,15 @@ export function createVaultRuntime(
  *
  * @param layer - Chain layer
  */
-export function resolveLayerSource(
-  layer: VaultChainLayer,
-): VaultResolutionSource {
+export function resolveLayerSource(layer: VaultChainLayer): VaultResolutionSource {
   if (layer.source) return layer.source;
   const path = layer.options?.path;
   if (typeof path === "string") {
     if (path.endsWith(".env.local") || path.includes("/.env.local")) {
       return ".env.local";
     }
-    if (path.endsWith(".env.stack") || path.includes("/.env.stack")) {
-      return ".env.stack";
+    if (path.endsWith(".env.docker") || path.includes("/.env.docker")) {
+      return ".env.docker";
     }
   }
   if (layer.driver.id === "env" && path === undefined) {
@@ -404,25 +393,25 @@ export function resolveLayerSource(
 }
 
 /**
- * Resolve a `dev` fallback, expanding {@link import("./declare.ts").fromStack}
- * markers via stack env (`OKE_<ROLE>_URL`) without teaching the kernel
+ * Resolve a `dev` fallback, expanding {@link import("./declare.ts").fromDocker}
+ * markers via docker env (`OKE_<ROLE>_URL`) without teaching the kernel
  * image-specific env-var names.
  *
  * @param dev - Declared fallback
  */
 function resolveDevFallback(dev: string): string | undefined {
-  if (!isFromStack(dev)) return dev;
-  const role = fromStackRole(dev);
+  if (!isFromDocker(dev)) return dev;
+  const role = fromDockerRole(dev);
   const key = `OKE_${role.replaceAll(".", "_").toUpperCase()}_URL`;
   const fromEnv =
     (typeof Bun !== "undefined" ? Bun.env[key] : undefined) ??
     process.env[key] ??
     (role === "store.sql"
-      ? (typeof Bun !== "undefined" ? Bun.env.DATABASE_URL : undefined) ??
-        process.env.DATABASE_URL
+      ? ((typeof Bun !== "undefined" ? Bun.env.DATABASE_URL : undefined) ??
+        process.env.DATABASE_URL)
       : undefined);
   if (fromEnv && fromEnv.length > 0) return fromEnv;
-  // Dev/test without `oke dev --stack`: still satisfy url-shaped contracts.
+  // Local/test without `oke dev --docker`: still satisfy url-shaped contracts.
   if (role === "store.sql") return "postgres://localhost/oke";
   return undefined;
 }
@@ -431,10 +420,7 @@ function resolveDevFallback(dev: string): string | undefined {
  * @param contracts - Declared contracts
  * @param name - Contract name
  */
-function isSensitiveName(
-  contracts: ReadonlyMap<string, VaultSecretDecl>,
-  name: string,
-): boolean {
+function isSensitiveName(contracts: ReadonlyMap<string, VaultSecretDecl>, name: string): boolean {
   const c = contracts.get(name);
   if (!c) return true;
   return c.sensitive;

package/src/elements/vault.test.ts

@@ -43,27 +43,23 @@ describe("vault declaration", () => {
     expect(cfg.kind).toBe("config");
     expect(cfg.sensitive).toBe(false);
 
-    const fromStack = vault.fromStack("store.sql");
-    expect(fromStack).toStartWith("__oke_from_stack__:");
-    const c = vault.secret("DATABASE_URL", { dev: fromStack });
-    expect(c.dev).toBe(fromStack);
+    const fromDocker = vault.fromDocker("store.sql");
+    expect(fromDocker).toStartWith("__oke_from_docker__:");
+    const c = vault.secret("DATABASE_URL", { dev: fromDocker });
+    expect(c.dev).toBe(fromDocker);
   });
 
-  test("fromStack resolves via OKE_<ROLE>_URL without env-var names in the kernel", async () => {
+  test("fromDocker resolves via OKE_<ROLE>_URL without env-var names in the kernel", async () => {
     const prev = process.env.OKE_STORE_SQL_URL;
     process.env.OKE_STORE_SQL_URL = "postgres://oke:x@127.0.0.1:5432/oke";
     try {
       const runtime = createVaultRuntime({
-        secrets: [
-          vault.secret("DATABASE_URL", { dev: vault.fromStack("store.sql") }),
-        ],
+        secrets: [vault.secret("DATABASE_URL", { dev: vault.fromDocker("store.sql") })],
         chain: [],
         allowDevFallbacks: true,
       });
       await runtime.boot();
-      expect(runtime.read("DATABASE_URL")).toBe(
-        "postgres://oke:x@127.0.0.1:5432/oke",
-      );
+      expect(runtime.read("DATABASE_URL")).toBe("postgres://oke:x@127.0.0.1:5432/oke");
     } finally {
       if (prev === undefined) delete process.env.OKE_STORE_SQL_URL;
       else process.env.OKE_STORE_SQL_URL = prev;
@@ -94,10 +90,7 @@ describe("boot lists every missing secret", () => {
       expect(err).toBeInstanceOf(VaultBootError);
       const boot = err as VaultBootError;
       expect(boot.gaps).toHaveLength(2);
-      expect(boot.gaps.map((g) => g.name).sort()).toEqual([
-        "DATABASE_URL",
-        "STRIPE_KEY",
-      ]);
+      expect(boot.gaps.map((g) => g.name).sort()).toEqual(["DATABASE_URL", "STRIPE_KEY"]);
       expect(boot.message).toContain("STRIPE_KEY");
       expect(boot.message).toContain("Payments gateway key");
       expect(boot.message).toContain("DATABASE_URL");
@@ -181,10 +174,7 @@ describe("resolution chain", () => {
 
   test("config cleartext is exposed; secrets are not", async () => {
     const runtime = createVaultRuntime({
-      secrets: [
-        vault.secret("STRIPE_KEY"),
-        vault.config("PUBLIC_URL"),
-      ],
+      secrets: [vault.secret("STRIPE_KEY"), vault.config("PUBLIC_URL")],
       chain: [
         {
           driver: memoryVaultDriver,
@@ -210,14 +200,11 @@ describe("redaction + fingerprints", () => {
     const secret = "sk_live_super_secret_value_do_not_leak";
     const runtime = createVaultRuntime({
       secrets: [vault("STRIPE_KEY")],
-      chain: [
-        { driver: memoryVaultDriver, options: { secrets: { STRIPE_KEY: secret } } },
-      ],
+      chain: [{ driver: memoryVaultDriver, options: { secrets: { STRIPE_KEY: secret } } }],
     });
     await runtime.boot();
 
-    const lines: Array<{ message: string; data?: Record<string, unknown> }> =
-      [];
+    const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
     const { fx } = createFxContextWithVault(runtime, lines);
 
     const value = fx.vault("STRIPE_KEY");
@@ -256,10 +243,7 @@ describe("sops / age (Typage)", () => {
   test("decrypts SOPS JSON in-process with age-encryption", async () => {
     const identity = await age.generateIdentity();
     const recipient = await age.identityToRecipient(identity);
-    const { json } = await buildSopsFixture(
-      { STRIPE_KEY: "sk_sops_decrypted" },
-      recipient,
-    );
+    const { json } = await buildSopsFixture({ STRIPE_KEY: "sk_sops_decrypted" }, recipient);
 
     const runtime = createVaultRuntime({
       secrets: [vault("STRIPE_KEY")],

package/src/elements/vault.ts

@@ -12,15 +12,12 @@
 
 export {
   vault,
-  fromStack,
-  FROM_STACK_PREFIX,
-  isFromStack,
-  fromStackRole,
-} from "./vault/declare.ts";
-export type {
-  VaultSecretDecl,
-  VaultSecretOptions,
+  fromDocker,
+  FROM_DOCKER_PREFIX,
+  isFromDocker,
+  fromDockerRole,
 } from "./vault/declare.ts";
+export type { VaultSecretDecl, VaultSecretOptions } from "./vault/declare.ts";
 
 export {
   createVaultRuntime,
@@ -37,9 +34,8 @@ export type {
   VaultRuntime,
 } from "./vault/runtime.ts";
 
-export {
-  fingerprintSecret,
-  fingerprintSecretSync,
-} from "./vault/fingerprint.ts";
+export { COMPOSE_ENV_REL, resolveComposeEnvPath } from "./vault/chain.ts";
+
+export { fingerprintSecret, fingerprintSecretSync } from "./vault/fingerprint.ts";
 
 export { createSecretRedactor } from "./vault/redact.ts";

package/src/index.ts

@@ -56,11 +56,14 @@ export {
   id,
   now,
   defineTable,
+  field,
   createStoreRuntime,
   type StoreDecl,
   type StoreRuntime,
   type SqlStoreHandle,
   type TableHandle,
+  type SchemaTableDecl,
+  type SchemaColumnDecl,
 } from "./elements/store.ts";
 
 export {
@@ -98,8 +101,8 @@ export {
 
 export {
   vault,
-  fromStack,
-  FROM_STACK_PREFIX,
+  fromDocker,
+  FROM_DOCKER_PREFIX,
   createVaultRuntime,
   VaultBootError,
   SECRET_MASK,

package/src/kernel/adopt-routes.ts

@@ -68,17 +68,12 @@ export type ErrorDataOf<E extends FlowErrorMap> = {
  *
  * @typeParam F - Flow definition
  */
-export type RouteFromFlow<F> = F extends FlowDef<
-  infer I,
-  infer O,
-  infer E,
-  any,
-  infer T
->
-  ? [T] extends [HttpTrigger<infer M, infer P>]
-    ? AppFlowRoute<I, O, ErrorDataOf<E>, M, P>
-    : AppFlowRoute<I, O, ErrorDataOf<E>>
-  : never;
+export type RouteFromFlow<F> =
+  F extends FlowDef<infer I, infer O, infer E, any, infer T>
+    ? [T] extends [HttpTrigger<infer M, infer P>]
+      ? AppFlowRoute<I, O, ErrorDataOf<E>, M, P>
+      : AppFlowRoute<I, O, ErrorDataOf<E>>
+    : never;
 
 /**
  * Map a flow namespace (`{ create, get, … }`) to a unit route table.
@@ -115,12 +110,11 @@ export type RoutesFromAdoptArg<A> = A extends AnyFlowDef
  *
  * @typeParam Args - Adopt argument tuple
  */
-export type RoutesFromAdoptArgs<Args extends readonly unknown[]> =
-  Args extends readonly []
-    ? {}
-    : Args extends readonly [infer H, ...infer T]
-      ? RoutesFromAdoptArg<H> & RoutesFromAdoptArgs<T>
-      : {};
+export type RoutesFromAdoptArgs<Args extends readonly unknown[]> = Args extends readonly []
+  ? {}
+  : Args extends readonly [infer H, ...infer T]
+    ? RoutesFromAdoptArg<H> & RoutesFromAdoptArgs<T>
+    : {};
 
 /** Runtime leaf: method/path when the flow has an HTTP trigger. */
 export interface RuntimeFlowRoute {
@@ -141,8 +135,7 @@ export type RuntimeRouteMap = {
  * @param flowDef - Flow definition
  */
 export function runtimeRouteFromFlow(flowDef: AnyFlowDef): RuntimeFlowRoute {
-  const trigger: Trigger | undefined =
-    flowDef.$trigger ?? flowDef.triggers[0];
+  const trigger: Trigger | undefined = flowDef.$trigger ?? flowDef.triggers[0];
   if (trigger?.kind === "http") {
     return { method: trigger.method, path: trigger.path };
   }
@@ -156,10 +149,7 @@ export function runtimeRouteFromFlow(flowDef: AnyFlowDef): RuntimeFlowRoute {
  * @param into - Mutable route map to extend
  * @returns Flows discovered (for `fx.call` registration)
  */
-export function accumulateAdoptArgs(
-  args: readonly unknown[],
-  into: RuntimeRouteMap,
-): AnyFlowDef[] {
+export function accumulateAdoptArgs(args: readonly unknown[], into: RuntimeRouteMap): AnyFlowDef[] {
   const found: AnyFlowDef[] = [];
 
   for (const arg of args) {
@@ -169,9 +159,7 @@ export function accumulateAdoptArgs(
     }
     if (typeof arg !== "object" || arg === null) continue;
 
-    for (const [unit, value] of Object.entries(
-      arg as Record<string, unknown>,
-    )) {
+    for (const [unit, value] of Object.entries(arg as Record<string, unknown>)) {
       if (isFlow(value)) {
         // Flat `{ create: flow }` without a unit wrapper — skip client map
         found.push(value);
@@ -180,9 +168,7 @@ export function accumulateAdoptArgs(
       if (typeof value !== "object" || value === null) continue;
 
       const unitBag = into[unit] ?? (into[unit] = {});
-      for (const [flowName, flowDef] of Object.entries(
-        value as Record<string, unknown>,
-      )) {
+      for (const [flowName, flowDef] of Object.entries(value as Record<string, unknown>)) {
         if (!isFlow(flowDef)) continue;
         found.push(flowDef);
         unitBag[flowName] = runtimeRouteFromFlow(flowDef);