okengine 0.2.6 → 0.2.8

package/src/upgrade/codemods.ts

@@ -6,6 +6,9 @@
  * registry is the checklist.
  */
 
+import { readdir } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+
 /** One file rewrite produced by a codemod. */
 export interface CodemodChange {
   /** Path relative to the project root. */
@@ -35,10 +38,120 @@ export interface Codemod {
 }
 
 /**
- * Built-in transforms. Empty until the next intentional breaking release —
- * the infrastructure is the gate; entries are added with the break.
+ * Rewrite driver-map keys `dev:` → `local:` and `stack:` → `docker:`.
+ *
+ * Vault `dev:` fallbacks are intentionally excluded — callers pass only
+ * `oke.config.*` paths into this rewriter.
+ *
+ * @param source - File contents
+ */
+export function rewriteConfigEnvKeys(source: string): string {
+  return source
+    .replace(/(^|[^\w.])dev(\s*:)/gm, "$1local$2")
+    .replace(/(^|[^\w.])stack(\s*:)/gm, "$1docker$2");
+}
+
+/**
+ * Rewrite removed vault stack markers to docker equivalents.
+ *
+ * @param source - File contents
+ */
+export function rewriteFromStackMarkers(source: string): string {
+  return source
+    .replace(/\bfromStack\b/g, "fromDocker")
+    .replace(/\bFROM_STACK_PREFIX\b/g, "FROM_DOCKER_PREFIX")
+    .replace(/\bisFromStack\b/g, "isFromDocker")
+    .replace(/\bfromStackRole\b/g, "fromDockerRole")
+    .replace(/__oke_from_stack__/g, "__oke_from_docker__");
+}
+
+/**
+ * Collect `oke.config.*` files under a project root.
+ *
+ * @param cwd - Project root
+ */
+async function collectConfigCandidates(cwd: string): Promise<string[]> {
+  const out: string[] = [];
+  for (const name of ["oke.config.ts", "oke.config.mts", "oke.config.js"]) {
+    const path = resolve(cwd, name);
+    if (await Bun.file(path).exists()) out.push(path);
+  }
+  return out;
+}
+
+/**
+ * Collect TypeScript sources that may reference `fromStack`.
+ *
+ * @param cwd - Project root
+ */
+async function collectVaultCandidates(cwd: string): Promise<string[]> {
+  const out: string[] = [];
+  const roots = ["src", "app"];
+  for (const root of roots) {
+    const dir = resolve(cwd, root);
+    try {
+      await walkTs(dir, out);
+    } catch {
+      // missing dir
+    }
+  }
+  return out;
+}
+
+/**
+ * @param dir - Directory
+ * @param out - Accumulator of absolute paths
+ */
+async function walkTs(dir: string, out: string[]): Promise<void> {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules" || entry.name === ".git") continue;
+      await walkTs(path, out);
+    } else if (entry.isFile() && /\.(ts|mts|tsx)$/.test(entry.name)) {
+      out.push(path);
+    }
+  }
+}
+
+/**
+ * Built-in transforms.
  */
-export const CODEMODS: readonly Codemod[] = [];
+export const CODEMODS: readonly Codemod[] = [
+  {
+    id: "0.2.7-config-env-local-docker",
+    from: "0.2.6",
+    to: "0.2.7",
+    description: "Rename driver-map keys dev→local, stack→docker; fromStack→fromDocker",
+    async apply(cwd) {
+      const changes: CodemodChange[] = [];
+      for (const path of await collectConfigCandidates(cwd)) {
+        const before = await Bun.file(path).text();
+        const after = rewriteConfigEnvKeys(before);
+        if (after !== before) {
+          changes.push({
+            path: relative(cwd, path) || path,
+            before,
+            after,
+          });
+        }
+      }
+      for (const path of await collectVaultCandidates(cwd)) {
+        const before = await Bun.file(path).text();
+        const after = rewriteFromStackMarkers(before);
+        if (after !== before) {
+          changes.push({
+            path: relative(cwd, path) || path,
+            before,
+            after,
+          });
+        }
+      }
+      return changes;
+    },
+  },
+];
 
 /**
  * Validate the registry (unique ids, non-empty metadata, apply present).

package/src/validation/standard-schema.test.ts

@@ -31,9 +31,7 @@ describe("Standard Schema — four libraries", () => {
       expect(bad.failure.data).toBeNull();
       expect(bad.failure.error.code).toBe(VALIDATION_ERROR_CODE);
       expect(bad.failure.error.data.issues.length).toBeGreaterThan(0);
-      expect(bad.failure.error.data.issues[0]?.message.length).toBeGreaterThan(
-        0,
-      );
+      expect(bad.failure.error.data.issues[0]?.message.length).toBeGreaterThan(0);
     }
   });
 
@@ -82,8 +80,7 @@ describe("Standard Schema — four libraries", () => {
     expect(bad.ok).toBe(false);
     if (!bad.ok) {
       expect(bad.failure.error.code).toBe(VALIDATION_ERROR_CODE);
-      expect(bad.failure.error.data.issues.some((i) => i.path.includes("seats")))
-        .toBe(true);
+      expect(bad.failure.error.data.issues.some((i) => i.path.includes("seats"))).toBe(true);
     }
   });
 

package/src/validation/standard-schema.ts

@@ -48,8 +48,10 @@ export interface StandardSchemaV1<Input = unknown, Output = Input> {
 
 export declare namespace StandardSchemaV1 {
   /** Standard Schema properties. */
-  export interface Props<Input = unknown, Output = Input>
-    extends StandardTypedV1.Props<Input, Output> {
+  export interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<
+    Input,
+    Output
+  > {
     readonly validate: (
       value: unknown,
       options?: Options | undefined,
@@ -87,12 +89,10 @@ export declare namespace StandardSchemaV1 {
   }
 
   /** Infer input. */
-  export type InferInput<Schema extends StandardTypedV1> =
-    StandardTypedV1.InferInput<Schema>;
+  export type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
 
   /** Infer output. */
-  export type InferOutput<Schema extends StandardTypedV1> =
-    StandardTypedV1.InferOutput<Schema>;
+  export type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
 }
 
 /** Accept a Standard Schema or any other schema-shaped value. */
@@ -122,14 +122,9 @@ export type ValidateResult<T> =
  *
  * @param value - Unknown value
  */
-export function isStandardSchema(
-  value: unknown,
-): value is StandardSchemaV1 {
+export function isStandardSchema(value: unknown): value is StandardSchemaV1 {
   // ArkType schemas are callable functions that still carry `~standard`.
-  if (
-    (typeof value !== "object" && typeof value !== "function") ||
-    value === null
-  ) {
+  if ((typeof value !== "object" && typeof value !== "function") || value === null) {
     return false;
   }
   const standard = (value as StandardSchemaV1)["~standard"];
@@ -144,36 +139,23 @@ export function isStandardSchema(
 /**
  * Infer output type of a schema input (unknown when not a Standard Schema).
  */
-export type InferSchemaOutput<S> = S extends StandardSchemaV1<
-  infer _I,
-  infer O
->
-  ? O
-  : unknown;
+export type InferSchemaOutput<S> = S extends StandardSchemaV1<infer _I, infer O> ? O : unknown;
 
 /**
  * Infer input type of a schema input.
  */
-export type InferSchemaInput<S> = S extends StandardSchemaV1<infer I, infer _O>
-  ? I
-  : unknown;
+export type InferSchemaInput<S> = S extends StandardSchemaV1<infer I, infer _O> ? I : unknown;
 
 /**
  * Normalize a Standard Schema issue path to JSON-stable keys.
  *
  * @param path - Spec path array
  */
-export function normalizeIssuePath(
-  path: StandardSchemaV1.Issue["path"],
-): Array<string | number> {
+export function normalizeIssuePath(path: StandardSchemaV1.Issue["path"]): Array<string | number> {
   if (!path) return [];
   const out: Array<string | number> = [];
   for (const segment of path) {
-    if (
-      typeof segment === "object" &&
-      segment !== null &&
-      "key" in segment
-    ) {
+    if (typeof segment === "object" && segment !== null && "key" in segment) {
       const key = (segment as StandardSchemaV1.PathSegment).key;
       if (typeof key === "string" || typeof key === "number") out.push(key);
       else out.push(String(key));
@@ -290,9 +272,7 @@ export function fromTypeBox<T = unknown>(
       validate(value) {
         if (valueApi.Check(schema, value)) {
           const parsed =
-            valueApi.Parse !== undefined
-              ? valueApi.Parse<T>(schema, value)
-              : (value as T);
+            valueApi.Parse !== undefined ? valueApi.Parse<T>(schema, value) : (value as T);
           return { value: parsed };
         }
         const issues: StandardSchemaV1.Issue[] = [];

package/src/console/ui/dist/assets/panel-vault-BbfWdox0.js

@@ -1 +0,0 @@
-import{a as e,r as t}from"./rolldown-runtime-CNC7AqOf.js";import{C as n,Q as r,Z as i,a,b as o,c as s,d as c,et as l,g as u,nt as d,o as f,tt as p,u as m,w as h,y as g}from"./panel-access-Dd37LU2c.js";var _=g({q:o().optional(),name:o().optional(),action:u([`set`,`rotate`]).optional()});function v(e){let t=_.safeParse(e);return t.success?t.data:{}}function y(e){let t={};return e.q&&(t.q=e.q),e.name&&(t.name=e.name),e.action&&(t.action=e.action),t}function b(e,t){return{...e,name:t,action:void 0}}function x(e,t=``){let n=t.trim().toLowerCase(),r=n?e.filter(e=>e.name.toLowerCase().includes(n)||(e.description?.toLowerCase().includes(n)??!1)):e,i=[`secret`,`config`],a={secret:`Secrets`,config:`Config`};return i.map(e=>({kind:e,label:a[e],secrets:r.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function S(e={production:!0}){return e.production?{kind:`typed`,phrase:`SET`,requireReason:!0}:{kind:`undo`,windowMs:15e3}}function C(e={production:!0}){return{kind:`typed`,phrase:`ROTATE`,requireReason:!0}}function w(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:T(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function T(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function E(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function D(e){return JSON.stringify(e.map(e=>E(e)),null,2)}var O=e(d(),1),k=p();function A(){let e=h({from:`/vault`}),t=n({from:`/vault`}),o=l(),[u,d]=(0,O.useState)(``),[p,g]=(0,O.useState)(``),[_,v]=(0,O.useState)(``),[T,E]=(0,O.useState)(null),A=e=>{t({search:y(e),replace:!0})},j=r({queryKey:[`console.vault.list`],queryFn:async()=>{let e=await c.vaultList();if(e.error)throw Error(e.error.code);return e.data},refetchInterval:1e4}),M=j.data?.secrets??[],N=j.data?.env??`dev`,P=(0,O.useMemo)(()=>x(M,e.q??``),[M,e.q]),F=M.find(t=>t.name===e.name),I=F?w(F.blastRadius):null,L=S({production:!0}),R=C({production:!0}),z=e.action;(0,O.useEffect)(()=>{d(``),g(``),v(``),E(null)},[F?.name,z]);let B=i({mutationFn:async()=>{if(!F)throw Error(`no secret`);if(L.kind===`typed`){let e=a({typed:u,reason:p,phrase:L.phrase});if(e)throw Error(e.typed??e.reason??`confirm`)}let e=await c.vaultSet({name:F.name,value:_,confirmation:L.kind===`typed`?u:void 0,reason:p||void 0});if(e.error)throw Error(e.error.code);return e.data},onSuccess:async()=>{v(``),d(``),g(``),A({...e,action:void 0}),await o.invalidateQueries({queryKey:[`console.vault.list`]})}}),V=i({mutationFn:async()=>{if(!F)throw Error(`no secret`);let e=a({typed:u,reason:p,phrase:R.kind===`typed`?R.phrase:`ROTATE`});if(e)throw Error(e.typed??e.reason??`confirm`);let t=await c.vaultRotate({name:F.name,value:_,confirmation:u,reason:p});if(t.error)throw Error(t.error.code);return t.data},onSuccess:async()=>{v(``),d(``),g(``),A({...e,action:void 0}),await o.invalidateQueries({queryKey:[`console.vault.list`]})}});return(0,k.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col`,children:[(0,k.jsxs)(`header`,{className:`flex shrink-0 flex-wrap items-end gap-3 border-b border-[var(--oke-line)] px-4 py-3`,children:[(0,k.jsxs)(`div`,{children:[(0,k.jsx)(`h1`,{className:`text-lg font-medium text-[var(--oke-fg)]`,children:`Vault`}),(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:`Fingerprints only — secrets are write-only`})]}),(0,k.jsxs)(`p`,{className:`text-sm text-[var(--oke-muted)]`,role:`status`,children:[`Environment `,N]}),(0,k.jsxs)(`label`,{className:`ml-auto flex min-w-[12rem] flex-col gap-1 text-sm`,children:[(0,k.jsx)(`span`,{className:`text-[var(--oke-muted)]`,children:`Filter vault`}),(0,k.jsx)(s,{"aria-label":`Filter vault`,value:e.q??``,onChange:t=>A({...e,q:t.currentTarget.value||void 0})})]}),(0,k.jsx)(f,{type:`button`,variant:`ghost`,onClick:()=>{let e=D(M);navigator.clipboard?.writeText(e),E(`Exported fingerprints only (no secret values)`)},children:`Export`})]}),T?(0,k.jsx)(`p`,{className:`px-4 py-2 text-sm text-[var(--oke-muted)]`,role:`status`,children:T}):null,(0,k.jsxs)(`div`,{className:`flex min-h-0 flex-1`,children:[(0,k.jsxs)(`section`,{"aria-label":`Vault list`,className:`w-80 shrink-0 overflow-y-auto border-r border-[var(--oke-line)]`,children:[(0,k.jsx)(`h2`,{className:`sr-only`,children:`Contracts`}),j.isLoading?(0,k.jsx)(`p`,{className:`p-4 text-sm text-[var(--oke-muted)]`,children:`Loading…`}):null,P.map(t=>(0,k.jsxs)(`section`,{"aria-label":t.label,className:`py-2`,children:[(0,k.jsx)(`h3`,{className:`px-4 py-1 text-xs uppercase tracking-wide text-[var(--oke-muted)]`,children:t.label}),(0,k.jsx)(`ul`,{children:t.secrets.map(t=>(0,k.jsx)(`li`,{children:(0,k.jsxs)(`button`,{type:`button`,"aria-pressed":t.name===F?.name,className:m(`flex min-h-10 w-full flex-col items-start px-4 py-2 text-left text-sm`,t.name===F?.name?`bg-[var(--oke-line)] text-[var(--oke-fg)]`:`text-[var(--oke-muted)] hover:text-[var(--oke-fg)]`),onClick:()=>A(b(e,t.name)),children:[(0,k.jsx)(`span`,{className:`font-mono`,children:t.name}),(0,k.jsx)(`span`,{className:`truncate text-xs`,children:t.sensitive?t.fingerprint??`unset`:t.cleartext??`unset`}),t.blastRadius.count>0?(0,k.jsxs)(`span`,{role:`status`,className:`text-xs text-[var(--oke-danger)]`,children:[`blast `,t.blastRadius.count]}):null,t.sharedFingerprintEnvs.length>0?(0,k.jsx)(`span`,{role:`status`,className:`text-xs`,children:`shared fingerprint`}):null]})},t.name))})]},t.kind))]}),(0,k.jsx)(`section`,{"aria-label":`Vault detail`,"aria-live":`polite`,className:`min-w-0 flex-1 overflow-y-auto p-4`,children:F?(0,k.jsxs)(`div`,{className:`flex max-w-2xl flex-col gap-6`,children:[(0,k.jsxs)(`div`,{children:[(0,k.jsx)(`h2`,{className:`font-mono text-lg text-[var(--oke-fg)]`,children:F.name}),F.description?(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:F.description}):null,F.rotate?(0,k.jsxs)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:[`Rotate hint: `,F.rotate]}):null]}),(0,k.jsxs)(`section`,{"aria-label":`Fingerprints by environment`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Fingerprints`}),F.sensitive?(0,k.jsxs)(`ul`,{className:`space-y-1 font-mono text-sm`,children:[Object.entries(F.fingerprints).map(([e,t])=>(0,k.jsxs)(`li`,{children:[(0,k.jsxs)(`span`,{className:`text-[var(--oke-muted)]`,children:[e,`:`]}),` `,t,F.sharedFingerprintEnvs.includes(e)?(0,k.jsxs)(`span`,{role:`status`,className:`ml-2 text-[var(--oke-warn,var(--oke-muted))]`,children:[`(matches `,N,` — warning, may be deliberate)`]}):null]},e)),Object.keys(F.fingerprints).length===0?(0,k.jsx)(`li`,{className:`text-[var(--oke-muted)]`,children:`Unset`}):null]}):(0,k.jsx)(`p`,{className:`font-mono text-sm`,role:`status`,children:F.cleartext??`unset`})]}),(0,k.jsxs)(`section`,{"aria-label":`Resolution chain`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Resolution chain`}),(0,k.jsx)(`ol`,{className:`list-decimal space-y-1 pl-5 text-sm`,children:F.resolution.map(e=>(0,k.jsxs)(`li`,{className:e.won?`text-[var(--oke-fg)]`:`text-[var(--oke-muted)]`,children:[(0,k.jsx)(`span`,{className:`font-mono`,children:e.source}),e.won?` — won`:e.present?` — present (lost)`:` — absent`]},e.source))}),(0,k.jsxs)(`p`,{className:`mt-2 text-sm`,role:`status`,children:[`Winner:`,` `,(0,k.jsx)(`span`,{className:`font-mono`,children:F.winner??`none`})]})]}),(0,k.jsxs)(`section`,{"aria-label":`Readers`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Readers`}),(0,k.jsxs)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:[`Flows that declare`,` `,(0,k.jsxs)(`code`,{className:`font-mono`,children:[`fx.vault(`,F.name,`)`]})]}),(0,k.jsx)(`ul`,{className:`mt-1 list-disc pl-5 font-mono text-sm`,children:F.readers.length===0?(0,k.jsx)(`li`,{className:`text-[var(--oke-muted)]`,children:`none`}):F.readers.map(e=>(0,k.jsx)(`li`,{children:e},e))})]}),(0,k.jsxs)(`section`,{"aria-label":`Rotation blast radius`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Rotation blast radius`}),I?(0,k.jsxs)(k.Fragment,{children:[(0,k.jsx)(`p`,{className:`text-sm`,role:I.warn?`alert`:`status`,children:I.summary}),I.detail?(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:I.detail}):null,F.blastRadius.runIds.length>0?(0,k.jsx)(`p`,{className:`mt-1 font-mono text-xs text-[var(--oke-muted)]`,children:F.blastRadius.runIds.join(`, `)}):null]}):null]}),(0,k.jsxs)(`section`,{"aria-label":`Last read`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Last read`}),(0,k.jsx)(`p`,{className:`text-sm`,role:`status`,children:F.lastReadAt==null?`Never read — possible dead secret`:new Date(F.lastReadAt).toISOString()})]}),(0,k.jsxs)(`section`,{"aria-label":`Set or rotate`,className:`space-y-3`,children:[(0,k.jsx)(`h3`,{className:`text-sm font-medium`,children:`Set / rotate`}),(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:`Write-only. Values are never revealed after submit. No preview.`}),(0,k.jsxs)(`div`,{className:`flex gap-2`,children:[(0,k.jsx)(f,{type:`button`,variant:z===`set`?`primary`:`ghost`,"aria-pressed":z===`set`,onClick:()=>A({...e,action:`set`}),children:`Set`}),(0,k.jsx)(f,{type:`button`,variant:z===`rotate`?`danger`:`ghost`,"aria-pressed":z===`rotate`,onClick:()=>A({...e,action:`rotate`}),children:`Rotate`})]}),z?(0,k.jsxs)(`div`,{className:`space-y-3 border border-[var(--oke-line)] p-3`,children:[(0,k.jsxs)(`label`,{className:`flex flex-col gap-1 text-sm`,children:[(0,k.jsx)(`span`,{children:`New value`}),(0,k.jsx)(s,{"aria-label":`New vault value`,type:`password`,autoComplete:`off`,value:_,onChange:e=>v(e.currentTarget.value)})]}),(z===`rotate`||L.kind===`typed`)&&(0,k.jsxs)(k.Fragment,{children:[(0,k.jsxs)(`label`,{className:`flex flex-col gap-1 text-sm`,children:[(0,k.jsxs)(`span`,{children:[`Type`,` `,z===`rotate`?R.kind===`typed`?R.phrase:`ROTATE`:L.kind===`typed`?L.phrase:`SET`,` `,`to confirm`]}),(0,k.jsx)(s,{"aria-label":`Confirmation phrase`,value:u,onChange:e=>d(e.currentTarget.value)})]}),(0,k.jsxs)(`label`,{className:`flex flex-col gap-1 text-sm`,children:[(0,k.jsx)(`span`,{children:`Reason`}),(0,k.jsx)(s,{"aria-label":`Reason for vault write`,value:p,onChange:e=>g(e.currentTarget.value)})]})]}),(0,k.jsx)(f,{type:`button`,variant:z===`rotate`?`danger`:`primary`,disabled:!_||(z===`set`?B.isPending:V.isPending),onClick:()=>{z===`set`?B.mutate():V.mutate()},children:z===`set`?`Commit set`:`Commit rotate`}),(B.isError||V.isError)&&(0,k.jsx)(`p`,{role:`alert`,className:`text-sm text-[var(--oke-danger)]`,children:(B.error??V.error)?.message??`Failed`})]}):null]})]}):(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:`Select a contract to inspect fingerprints, resolution, and readers.`})})]})]})}var j=t({default:()=>A});export{v as n,j as t};