okengine 0.2.6 → 0.3.2

package/src/auth/operator.ts

@@ -8,11 +8,7 @@
  */
 
 import { createBunCrypto } from "../runtime/primitives.ts";
-import type {
-  OperatorCredentialRow,
-  OperatorRow,
-  OperatorSsoLinkRow,
-} from "./tables.ts";
+import type { OperatorCredentialRow, OperatorRow, OperatorSsoLinkRow } from "./tables.ts";
 
 /** Operator-plane store. */
 export interface OperatorStore {
@@ -82,15 +78,10 @@ export async function createOperator(
  * @param store - Operator store
  * @param operatorId - Operator id
  */
-export function removeOperatorCredential(
-  store: OperatorStore,
-  operatorId: string,
-): never {
+export function removeOperatorCredential(store: OperatorStore, operatorId: string): never {
   void store;
   void operatorId;
-  throw new OperatorError(
-    "operator local credential cannot be removed; SSO is additive only",
-  );
+  throw new OperatorError("operator local credential cannot be removed; SSO is additive only");
 }
 
 /**
@@ -111,9 +102,7 @@ export function linkOperatorSso(
     throw new OperatorError(`unknown operator: ${operatorId}`);
   }
   if (!store.credentials.has(operatorId)) {
-    throw new OperatorError(
-      "operator is missing local credential — invariant violated",
-    );
+    throw new OperatorError("operator is missing local credential — invariant violated");
   }
   const link: OperatorSsoLinkRow = { operatorId, provider, subject };
   const list = store.ssoLinks.get(operatorId) ?? [];
@@ -128,14 +117,9 @@ export function linkOperatorSso(
  */
 let dummyPasswordHash: string | null = null;
 
-async function dummyHash(
-  crypto: ReturnType<typeof createBunCrypto>,
-): Promise<string> {
+async function dummyHash(crypto: ReturnType<typeof createBunCrypto>): Promise<string> {
   if (dummyPasswordHash === null) {
-    dummyPasswordHash = await crypto.hashPassword(
-      "oke-operator-timing-dummy",
-      "argon2id",
-    );
+    dummyPasswordHash = await crypto.hashPassword("oke-operator-timing-dummy", "argon2id");
   }
   return dummyPasswordHash;
 }
@@ -157,10 +141,8 @@ export async function authenticateOperator(
 ): Promise<OperatorRow | null> {
   const crypto = createBunCrypto();
   const op = [...store.operators.values()].find((o) => o.email === email);
-  const cred =
-    op && op.status === "active" ? store.credentials.get(op.id) : undefined;
-  const hash =
-    cred && cred.loginEnabled ? cred.passwordHash : await dummyHash(crypto);
+  const cred = op && op.status === "active" ? store.credentials.get(op.id) : undefined;
+  const hash = cred && cred.loginEnabled ? cred.passwordHash : await dummyHash(crypto);
   const ok = await crypto.verifyPassword(password, hash);
   if (!ok || !op || !cred || !cred.loginEnabled || op.status !== "active") {
     return null;

package/src/auth/planes.ts

@@ -81,14 +81,9 @@ export function operatorPrincipal(fields: {
  * @param principal - Acting principal
  * @param flowPlane - Target flow plane
  */
-export function assertPlaneAccess(
-  principal: Principal,
-  flowPlane: AuthPlane,
-): void {
+export function assertPlaneAccess(principal: Principal, flowPlane: AuthPlane): void {
   if (principal.plane === "user" && flowPlane === "operator") {
-    throw new CrossPlaneError(
-      "application principal cannot reach a console (operator) flow",
-    );
+    throw new CrossPlaneError("application principal cannot reach a console (operator) flow");
   }
 }
 

package/src/auth/plugin.ts

@@ -23,15 +23,12 @@ export interface AuthPluginOptions {
  * @param options - Session crypto options
  */
 export function auth(options: AuthPluginOptions = {}): PluginDef {
-  let builder = plugin("auth", { version: "0.0.1", config: options }).hook(
-    "onAuth",
-    (_ctx) => {
-      /* principals resolved by session / API key middleware at runtime */
-    },
-  );
+  let builder = plugin("auth", { version: "0.0.1", config: options }).hook("onAuth", (_ctx) => {
+    /* principals resolved by session / API key middleware at runtime */
+  });
 
   for (const name of Object.values(AUTH_TABLES)) {
-    builder = builder.table(name, {
+    builder = builder.table(name, undefined, {
       plane: name.includes("operator")
         ? "operator"
         : name.includes("identit") || name === AUTH_TABLES.credentials

package/src/auth/roles.ts

@@ -38,11 +38,7 @@ export function upsertRole(store: RoleStore, role: RoleRow): void {
  * @param roleId - Role id
  * @param actions - Module:Action pairs
  */
-export function setRoleGrants(
-  store: RoleStore,
-  roleId: string,
-  actions: readonly string[],
-): void {
+export function setRoleGrants(store: RoleStore, roleId: string, actions: readonly string[]): void {
   if (!store.roles.has(roleId)) {
     throw new Error(`unknown role: ${roleId}`);
   }

package/src/auth/sessions.ts

@@ -229,10 +229,7 @@ const sessionAudiences = new Map<string, string>();
  * @param sessionId - Session id
  * @param scopes - Scopes
  */
-export function bindSessionScopes(
-  sessionId: string,
-  scopes: Iterable<string>,
-): void {
+export function bindSessionScopes(sessionId: string, scopes: Iterable<string>): void {
   sessionScopes.set(sessionId, [...scopes]);
 }
 
@@ -242,10 +239,7 @@ export function bindSessionScopes(
  * @param sessionId - Session id
  * @param audience - Audience claim
  */
-export function bindSessionAudience(
-  sessionId: string,
-  audience: string,
-): void {
+export function bindSessionAudience(sessionId: string, audience: string): void {
   sessionAudiences.set(sessionId, audience);
 }
 
@@ -292,9 +286,7 @@ export async function verifyAccess(
   nowOrOptions: (() => number) | VerifyAccessOptions = () => Date.now(),
 ): Promise<AccessClaims> {
   const options: VerifyAccessOptions =
-    typeof nowOrOptions === "function"
-      ? { now: nowOrOptions }
-      : nowOrOptions;
+    typeof nowOrOptions === "function" ? { now: nowOrOptions } : nowOrOptions;
   const now = options.now ?? (() => Date.now());
   const claims = await verifyAccessSignature(secret, token);
   if (claims.exp <= now()) {
@@ -302,9 +294,7 @@ export async function verifyAccess(
   }
   if (options.audience !== undefined) {
     if (claims.aud !== options.audience) {
-      throw new SessionError(
-        `access token audience mismatch: expected ${options.audience}`,
-      );
+      throw new SessionError(`access token audience mismatch: expected ${options.audience}`);
     }
   }
   const session = store.sessions.get(claims.sid);
@@ -325,11 +315,7 @@ export async function verifyAccess(
  * @param familyId - Family id
  * @param at - Timestamp
  */
-export function revokeFamily(
-  store: SessionStore,
-  familyId: string,
-  at: number = Date.now(),
-): void {
+export function revokeFamily(store: SessionStore, familyId: string, at: number = Date.now()): void {
   for (const session of store.sessions.values()) {
     if (session.familyId === familyId) session.revokedAt = at;
   }
@@ -348,23 +334,15 @@ export class SessionError extends Error {
 }
 
 async function hashToken(raw: string): Promise<string> {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(raw),
-  );
-  return [...new Uint8Array(digest)]
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 
 function cryptoRandomId(): string {
   return crypto.randomUUID().replace(/-/g, "");
 }
 
-async function signAccess(
-  secret: string,
-  claims: AccessClaims,
-): Promise<string> {
+async function signAccess(secret: string, claims: AccessClaims): Promise<string> {
   const header = b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
   const payload = b64url(JSON.stringify(claims));
   const data = `${header}.${payload}`;
@@ -372,10 +350,7 @@ async function signAccess(
   return `${data}.${sig}`;
 }
 
-async function verifyAccessSignature(
-  secret: string,
-  token: string,
-): Promise<AccessClaims> {
+async function verifyAccessSignature(secret: string, token: string): Promise<AccessClaims> {
   const parts = token.split(".");
   if (parts.length !== 3) throw new SessionError("malformed access token");
   const [header, payload, sig] = parts as [string, string, string];
@@ -393,11 +368,7 @@ async function hmac(secret: string, data: string): Promise<string> {
     false,
     ["sign"],
   );
-  const sig = await crypto.subtle.sign(
-    "HMAC",
-    key,
-    new TextEncoder().encode(data),
-  );
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
   return b64urlBytes(new Uint8Array(sig));
 }
 

package/src/cli/args.ts

@@ -41,10 +41,6 @@ export function flagValue(
  * @param long - Long flag
  * @param short - Optional short flag
  */
-export function hasFlag(
-  args: readonly string[],
-  long: string,
-  short?: string,
-): boolean {
+export function hasFlag(args: readonly string[], long: string, short?: string): boolean {
   return args.includes(long) || (short !== undefined && args.includes(short));
 }

package/src/cli/ask-dev-mode.ts

@@ -0,0 +1,40 @@
+/**
+ * One-time interactive `oke dev` mode choice via `@clack/prompts`.
+ */
+
+import { isCancel, select } from "@clack/prompts";
+import type { DevMode } from "./dev-mode.ts";
+
+/**
+ * Injectable ask step — production uses {@link askDevMode}.
+ *
+ * @returns Chosen mode, or `null` if the user cancelled
+ */
+export type AskDevModeFn = () => Promise<DevMode | null>;
+
+/**
+ * Prompt once: local vs docker.
+ *
+ * @returns Chosen mode, or `null` on cancel
+ */
+export async function askDevMode(): Promise<DevMode | null> {
+  const value = await select({
+    message: "Run against",
+    options: [
+      {
+        value: "local",
+        label: "local",
+        hint: "sqlite file, instant, no Docker needed",
+      },
+      {
+        value: "docker",
+        label: "docker",
+        hint: "real Postgres/Redis via compose, closer to production",
+      },
+    ],
+    initialValue: "local",
+  });
+  if (isCancel(value)) return null;
+  if (value === "local" || value === "docker") return value;
+  return null;
+}

package/src/cli/build.ts

@@ -26,8 +26,7 @@ export async function runBuild(options: BuildOptions = {}): Promise<number> {
   const target = options.target ?? "bun";
   const entry = options.entry ?? "src/app.ts";
   const outdir = options.outdir ?? "dist";
-  const bunTarget =
-    target === "edge" ? "browser" : target === "node" ? "node" : "bun";
+  const bunTarget = target === "edge" ? "browser" : target === "node" ? "node" : "bun";
 
   const bundle =
     options.bundle ??

package/src/cli/client-add.test.ts

@@ -6,10 +6,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import {
-  clientAdd,
-  emitAmbient,
-} from "./client-add.ts";
+import { clientAdd, emitAmbient } from "./client-add.ts";
 import type { ClientDescriptor } from "../client/types.ts";
 
 const fixture: ClientDescriptor = {
@@ -72,10 +69,7 @@ void seats;
     // Minimal stub so `import type { Register }` resolves.
     const stubDir = join(dir, "node_modules/okengine");
     await Bun.$`mkdir -p ${stubDir}`.quiet();
-    await Bun.write(
-      join(stubDir, "client.d.ts"),
-      `export interface Register {}\n`,
-    );
+    await Bun.write(join(stubDir, "client.d.ts"), `export interface Register {}\n`);
     await Bun.write(
       join(stubDir, "package.json"),
       JSON.stringify({
@@ -102,10 +96,11 @@ void seats;
       }),
     );
 
-    const proc = Bun.spawn(
-      ["bunx", "tsc", "--project", tsconfig],
-      { cwd: dir, stdout: "pipe", stderr: "pipe" },
-    );
+    const proc = Bun.spawn(["bunx", "tsc", "--project", tsconfig], {
+      cwd: dir,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
     const [stdout, stderr, code] = await Promise.all([
       new Response(proc.stdout).text(),
       new Response(proc.stderr).text(),
@@ -113,9 +108,7 @@ void seats;
     ]);
 
     if (code !== 0) {
-      throw new Error(
-        `tsc failed (${code})\n${stdout}\n${stderr}\n--- d.ts ---\n${result.source}`,
-      );
+      throw new Error(`tsc failed (${code})\n${stdout}\n${stderr}\n--- d.ts ---\n${result.source}`);
     }
   });
 

package/src/cli/client-add.ts

@@ -32,12 +32,9 @@ export interface ClientAddResult {
  *
  * @param options - URL / out / test overrides
  */
-export async function clientAdd(
-  options: ClientAddOptions,
-): Promise<ClientAddResult> {
+export async function clientAdd(options: ClientAddOptions): Promise<ClientAddResult> {
   const out = options.out ?? "oke-client.d.ts";
-  const descriptor =
-    options.descriptor ?? (await fetchDescriptor(options.url, options.fetch));
+  const descriptor = options.descriptor ?? (await fetchDescriptor(options.url, options.fetch));
   const source = emitAmbient(descriptor);
   await Bun.write(out, source);
   return { out, source };
@@ -102,12 +99,8 @@ export function emitAmbient(descriptor: ClientDescriptor): string {
                   `          in: ${c.in ?? "unknown"};`,
                   `          out: ${c.out ?? "unknown"};`,
                   errorBlock,
-                  c.method
-                    ? `          method: ${JSON.stringify(c.method)};`
-                    : undefined,
-                  c.path
-                    ? `          path: ${JSON.stringify(c.path)};`
-                    : undefined,
+                  c.method ? `          method: ${JSON.stringify(c.method)};` : undefined,
+                  c.path ? `          path: ${JSON.stringify(c.path)};` : undefined,
                   `        }`,
                 ]
                   .filter((line): line is string => line !== undefined)
@@ -147,9 +140,7 @@ async function fetchDescriptor(
   const base = url.replace(/\/+$/, "");
   const res = await fetchFn(`${base}/_oke/client.json`);
   if (!res.ok) {
-    throw new Error(
-      `Failed to fetch ${base}/_oke/client.json (${res.status})`,
-    );
+    throw new Error(`Failed to fetch ${base}/_oke/client.json (${res.status})`);
   }
   const json: unknown = await res.json();
   if (

package/src/cli/completion.test.ts

@@ -4,11 +4,7 @@
 
 import { describe, expect, test } from "bun:test";
 import { generateCompletion } from "./completion.ts";
-import {
-  OKE_COMMANDS,
-  commandNames,
-  type CliCommand,
-} from "./registry.ts";
+import { OKE_COMMANDS, commandNames, type CliCommand } from "./registry.ts";
 
 describe("oke completion", () => {
   test("bash script lists every registry command", () => {

package/src/cli/completion.ts

@@ -3,12 +3,7 @@
  */
 
 import { EXIT_OK, EXIT_USAGE } from "./exit.ts";
-import {
-  OKE_COMMANDS,
-  commandNames,
-  type CliCommand,
-  type CliFlag,
-} from "./registry.ts";
+import { OKE_COMMANDS, commandNames, type CliCommand, type CliFlag } from "./registry.ts";
 
 /** Supported completion shells. */
 export const COMPLETION_SHELLS = ["bash", "zsh", "fish"] as const;
@@ -63,9 +58,7 @@ Install:
 
   const shell = args[0];
   if (!shell || !isCompletionShell(shell)) {
-    console.error(
-      "oke completion: require bash, zsh, or fish — e.g. oke completion zsh",
-    );
+    console.error("oke completion: require bash, zsh, or fish — e.g. oke completion zsh");
     return EXIT_USAGE;
   }
 
@@ -223,9 +216,7 @@ function fishScript(commands: readonly CliCommand[]): string {
       `complete -c oke -f -n "not __fish_seen_subcommand_from ${names}" -a "${cmd.name}" -d ${fishQuote(cmd.summary)}`,
     );
   }
-  rebuilt.push(
-    `complete -c oke -f -n "__fish_seen_subcommand_from completion" -a "bash zsh fish"`,
-  );
+  rebuilt.push(`complete -c oke -f -n "__fish_seen_subcommand_from completion" -a "bash zsh fish"`);
   for (const cmd of commands) {
     const subs = cmd.subcommands ?? [];
     if (subs.length === 0) {
@@ -248,11 +239,7 @@ function fishScript(commands: readonly CliCommand[]): string {
   return `${rebuilt.join("\n")}\n`;
 }
 
-function fishFlagLine(
-  command: string,
-  sub: string | undefined,
-  flag: CliFlag,
-): string {
+function fishFlagLine(command: string, sub: string | undefined, flag: CliFlag): string {
   const seen = sub
     ? `__fish_seen_subcommand_from ${command}; and __fish_seen_subcommand_from ${sub}`
     : `__fish_seen_subcommand_from ${command}`;

package/src/cli/db-auto-push.test.ts

@@ -0,0 +1,64 @@
+/**
+ * Domain schema watch-path + auto-push policy.
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+  createDebouncedRunner,
+  isDomainSchemaWatchPath,
+  resolveDevAutoPush,
+} from "./db-auto-push.ts";
+
+describe("isDomainSchemaWatchPath", () => {
+  test("matches schema.ts and drizzle.config.ts", () => {
+    expect(isDomainSchemaWatchPath("schema.ts")).toBe(true);
+    expect(isDomainSchemaWatchPath("drizzle.config.ts")).toBe(true);
+    expect(isDomainSchemaWatchPath("flows/notes/schema.ts")).toBe(true);
+    expect(isDomainSchemaWatchPath("src/schema.decl.ts")).toBe(true);
+    expect(isDomainSchemaWatchPath("src/schema.generated.ts")).toBe(true);
+  });
+
+  test("ignores unrelated files", () => {
+    expect(isDomainSchemaWatchPath("flows/notes/index.ts")).toBe(false);
+    expect(isDomainSchemaWatchPath(undefined)).toBe(false);
+  });
+
+  test("matches app entry (plugin .table contributions)", () => {
+    expect(isDomainSchemaWatchPath("app.ts")).toBe(true);
+    expect(isDomainSchemaWatchPath("src/app.ts")).toBe(true);
+  });
+});
+
+describe("resolveDevAutoPush", () => {
+  test("default on for local", () => {
+    expect(resolveDevAutoPush({})).toBe(true);
+  });
+
+  test("off for docker", () => {
+    expect(resolveDevAutoPush({ docker: true })).toBe(false);
+  });
+
+  test("off for --no-db-push", () => {
+    expect(resolveDevAutoPush({ noDbPush: true })).toBe(false);
+  });
+
+  test("off when config.db.autoPush is false", () => {
+    expect(resolveDevAutoPush({ configAutoPush: false })).toBe(false);
+  });
+});
+
+describe("createDebouncedRunner", () => {
+  test("coalesces rapid triggers", async () => {
+    let count = 0;
+    const runner = createDebouncedRunner(() => {
+      count++;
+    }, 40);
+    runner.trigger();
+    runner.trigger();
+    runner.trigger();
+    expect(count).toBe(0);
+    await Bun.sleep(80);
+    expect(count).toBe(1);
+    runner.cancel();
+  });
+});

package/src/cli/db-auto-push.ts

@@ -0,0 +1,72 @@
+/**
+ * Debounced domain-schema auto-push for `oke dev` (local mode).
+ */
+
+import { basename } from "node:path";
+
+/** Default debounce for schema-change → push. */
+export const DB_AUTO_PUSH_DEBOUNCE_MS = 300;
+
+/**
+ * Whether a watched path should trigger `oke db push`.
+ *
+ * @param filename - Relative path from the watcher (may be undefined)
+ */
+export function isDomainSchemaWatchPath(filename: string | null | undefined): boolean {
+  if (!filename) return false;
+  const normalized = filename.replace(/\\/g, "/");
+  const base = basename(normalized);
+  if (base === "schema.ts" || base === "schema.tsx") return true;
+  if (base === "schema.decl.ts" || base === "schema.decl.tsx") return true;
+  if (base === "schema.generated.ts" || base === "schema.generated.tsx") return true;
+  if (base === "drizzle.config.ts" || base === "drizzle.config.js") return true;
+  // App entry / plugins — `.plug()` table contributions feed emit.
+  if (base === "app.ts" || base === "app.tsx") return true;
+  // Nested domain schemas commonly live under src/**/schema.ts
+  if (/(^|\/)schema(\.decl|\.generated)?\.tsx?$/.test(normalized)) return true;
+  return false;
+}
+
+/**
+ * Resolve whether auto-push is enabled for this `oke dev` session.
+ *
+ * @param options - Explicit CLI opt-out, config, docker mode
+ */
+export function resolveDevAutoPush(options: {
+  readonly noDbPush?: boolean;
+  readonly docker?: boolean;
+  readonly configAutoPush?: boolean;
+}): boolean {
+  if (options.docker) return false;
+  if (options.noDbPush) return false;
+  return options.configAutoPush !== false;
+}
+
+/**
+ * Create a debounced callback runner.
+ *
+ * @param fn - Async work
+ * @param ms - Debounce window
+ */
+export function createDebouncedRunner(
+  fn: () => void | Promise<void>,
+  ms = DB_AUTO_PUSH_DEBOUNCE_MS,
+): {
+  readonly trigger: () => void;
+  readonly cancel: () => void;
+} {
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  return {
+    trigger() {
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(() => {
+        timer = null;
+        void fn();
+      }, ms);
+    },
+    cancel() {
+      if (timer) clearTimeout(timer);
+      timer = null;
+    },
+  };
+}