okengine 0.2.6 → 0.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (681) hide show
  1. package/AGENTS.md +33 -30
  2. package/README.md +74 -340
  3. package/{spec/manifest.v1.schema.json → manifest.v1.schema.json} +40 -9
  4. package/package.json +47 -44
  5. package/site/content/docs/ai/llms-txt.mdx +54 -0
  6. package/site/content/docs/ai/mcp.mdx +123 -0
  7. package/site/content/docs/ai/meta.json +5 -0
  8. package/site/content/docs/ai/skills.mdx +53 -0
  9. package/site/content/docs/console/access.mdx +29 -0
  10. package/site/content/docs/console/ai.mdx +35 -0
  11. package/site/content/docs/console/architecture.mdx +35 -0
  12. package/site/content/docs/console/channels.mdx +37 -0
  13. package/site/content/docs/console/clock.mdx +31 -0
  14. package/site/content/docs/console/flows.mdx +31 -0
  15. package/site/content/docs/console/gates.mdx +35 -0
  16. package/site/content/docs/console/manifest-diff.mdx +34 -0
  17. package/site/content/docs/console/meta.json +23 -0
  18. package/site/content/docs/console/overview.mdx +40 -0
  19. package/site/content/docs/console/plugins.mdx +41 -0
  20. package/site/content/docs/console/privacy.mdx +32 -0
  21. package/site/content/docs/console/runs.mdx +40 -0
  22. package/site/content/docs/console/signals.mdx +31 -0
  23. package/site/content/docs/console/store.mdx +32 -0
  24. package/site/content/docs/console/tenancy.mdx +32 -0
  25. package/site/content/docs/console/traces.mdx +34 -0
  26. package/site/content/docs/console/vault.mdx +37 -0
  27. package/site/content/docs/elements/ai.mdx +180 -0
  28. package/site/content/docs/elements/channel.mdx +167 -0
  29. package/site/content/docs/elements/clock.mdx +182 -0
  30. package/site/content/docs/elements/flow.mdx +288 -0
  31. package/site/content/docs/elements/gate.mdx +171 -0
  32. package/site/content/docs/elements/meta.json +5 -0
  33. package/site/content/docs/elements/signal.mdx +171 -0
  34. package/site/content/docs/elements/store.mdx +320 -0
  35. package/site/content/docs/elements/vault.mdx +263 -0
  36. package/site/content/docs/get-started/basic-usage.mdx +124 -0
  37. package/site/content/docs/get-started/comparison.mdx +65 -0
  38. package/site/content/docs/get-started/installation.mdx +113 -0
  39. package/site/content/docs/get-started/introduction.mdx +123 -0
  40. package/site/content/docs/get-started/meta.json +5 -0
  41. package/site/content/docs/index.mdx +63 -0
  42. package/site/content/docs/meta.json +5 -0
  43. package/site/content/docs/plugins/compression.mdx +60 -0
  44. package/site/content/docs/plugins/cors.mdx +92 -0
  45. package/site/content/docs/plugins/csrf.mdx +96 -0
  46. package/site/content/docs/plugins/ip-allowlist.mdx +92 -0
  47. package/site/content/docs/plugins/maintenance-mode.mdx +101 -0
  48. package/site/content/docs/plugins/meta.json +15 -0
  49. package/site/content/docs/plugins/security-headers.mdx +136 -0
  50. package/site/content/docs/reference/cli.md +101 -0
  51. package/site/content/docs/reference/configuration.mdx +159 -0
  52. package/site/content/docs/reference/environment-variables.mdx +87 -0
  53. package/site/content/docs/reference/errors.mdx +80 -0
  54. package/site/content/docs/reference/fx.mdx +117 -0
  55. package/site/content/docs/reference/meta.json +5 -0
  56. package/site/content/docs/reference/plugins.mdx +249 -0
  57. package/site/content/docs/reference/security.md +63 -0
  58. package/src/auth/api-keys.ts +2 -5
  59. package/src/auth/attenuation.ts +2 -6
  60. package/src/auth/auth.test.ts +56 -31
  61. package/src/auth/invoke-as.ts +1 -3
  62. package/src/auth/operator.ts +8 -26
  63. package/src/auth/planes.ts +2 -7
  64. package/src/auth/plugin.ts +4 -7
  65. package/src/auth/roles.ts +1 -5
  66. package/src/auth/sessions.ts +10 -39
  67. package/src/cli/args.ts +1 -5
  68. package/src/cli/ask-dev-mode.ts +40 -0
  69. package/src/cli/build.ts +1 -2
  70. package/src/cli/client-add.test.ts +8 -15
  71. package/src/cli/client-add.ts +5 -14
  72. package/src/cli/completion.test.ts +1 -5
  73. package/src/cli/completion.ts +4 -17
  74. package/src/cli/db-auto-push.test.ts +64 -0
  75. package/src/cli/db-auto-push.ts +72 -0
  76. package/src/cli/db.test.ts +189 -0
  77. package/src/cli/db.ts +456 -0
  78. package/src/cli/dev-app-runner.ts +2 -8
  79. package/src/cli/dev-db-push.test.ts +193 -0
  80. package/src/cli/dev-mode.test.ts +45 -0
  81. package/src/cli/dev-mode.ts +78 -0
  82. package/src/cli/dev-schema-sync.test.ts +66 -0
  83. package/src/cli/dev-schema-sync.ts +139 -0
  84. package/src/cli/dev.test.ts +264 -15
  85. package/src/cli/dev.ts +355 -139
  86. package/src/cli/doc-staleness.test.ts +69 -0
  87. package/src/cli/docker-cli.test.ts +27 -8
  88. package/src/cli/docker.ts +11 -3
  89. package/src/cli/doctor-diff.test.ts +1 -5
  90. package/src/cli/doctor-diff.ts +17 -46
  91. package/src/cli/doctor-pii.ts +2 -7
  92. package/src/cli/doctor.test.ts +26 -4
  93. package/src/cli/doctor.ts +35 -11
  94. package/src/cli/drizzle-env.test.ts +67 -0
  95. package/src/cli/drizzle-env.ts +78 -0
  96. package/src/cli/ensure-drizzle-config.ts +50 -0
  97. package/src/cli/eval.ts +4 -14
  98. package/src/cli/gates-list.ts +1 -4
  99. package/src/cli/hero-meta.test.ts +17 -19
  100. package/src/cli/hero-meta.ts +20 -30
  101. package/src/cli/images.ts +3 -8
  102. package/src/cli/index.ts +11 -2
  103. package/src/cli/load-config.images.test.ts +14 -14
  104. package/src/cli/load-config.ts +47 -47
  105. package/src/cli/mcp-from-console.ts +1 -4
  106. package/src/cli/mode.ts +65 -0
  107. package/src/cli/openbao-bootstrap.test.ts +147 -0
  108. package/src/cli/openbao-bootstrap.ts +280 -0
  109. package/src/cli/openbao-restart.integration.test.ts +136 -0
  110. package/src/cli/ports.test.ts +7 -14
  111. package/src/cli/ports.ts +7 -5
  112. package/src/cli/privacy-erase.ts +1 -3
  113. package/src/cli/registry.ts +75 -25
  114. package/src/cli/resolve-dev-sql-env.test.ts +48 -0
  115. package/src/cli/resolve-dev-sql-env.ts +42 -0
  116. package/src/cli/schema.ts +3 -10
  117. package/src/cli/stack.ts +8 -10
  118. package/src/cli/start.ts +4 -15
  119. package/src/cli/upgrade.ts +1 -4
  120. package/src/cli/vault-cmd.ts +63 -0
  121. package/src/client/budget-entry.ts +1 -6
  122. package/src/client/create.test.ts +6 -12
  123. package/src/client/create.ts +2 -8
  124. package/src/client/errors.ts +1 -4
  125. package/src/client/index.ts +1 -6
  126. package/src/client/notes-contract.test.ts +4 -13
  127. package/src/client/transport.ts +9 -30
  128. package/src/client/types.ts +15 -30
  129. package/src/compiler/aot.test.ts +2 -9
  130. package/src/compiler/aot.ts +1 -4
  131. package/src/compiler/differential.test.ts +3 -11
  132. package/src/compiler/dynamic.ts +1 -4
  133. package/src/compiler/effects-infer.ts +8 -34
  134. package/src/compiler/emit.ts +1 -3
  135. package/src/compiler/extract.test.ts +136 -30
  136. package/src/compiler/extract.ts +485 -157
  137. package/src/compiler/fixtures/skyport/oke.config.ts +3 -3
  138. package/src/compiler/fixtures/skyport/src/flows/bookings/index.ts +7 -3
  139. package/src/compiler/fixtures/skyport/src/flows/payments/index.ts +1 -3
  140. package/src/compiler/fixtures/skyport/src/flows/support/index.ts +4 -1
  141. package/src/compiler/fixtures/skyport.expected.json +24 -83
  142. package/src/compiler/fixtures/triggers/five-triggers.ts +1 -2
  143. package/src/compiler/http-parse.ts +2 -9
  144. package/src/compiler/index.ts +1 -5
  145. package/src/compiler/response.ts +16 -7
  146. package/src/compiler/sucrose.ts +11 -31
  147. package/src/config/define-config.test.ts +55 -34
  148. package/src/config/index.ts +177 -46
  149. package/src/config/resolve-driver.test.ts +28 -17
  150. package/src/console/budget.test.ts +1 -4
  151. package/src/console/index.ts +1 -4
  152. package/src/console/server/access.test.ts +15 -43
  153. package/src/console/server/access.ts +19 -49
  154. package/src/console/server/ai.test.ts +3 -11
  155. package/src/console/server/ai.ts +23 -46
  156. package/src/console/server/app.ts +16 -45
  157. package/src/console/server/auth-rate.test.ts +4 -12
  158. package/src/console/server/bind.ts +1 -5
  159. package/src/console/server/channels.test.ts +2 -6
  160. package/src/console/server/channels.ts +10 -35
  161. package/src/console/server/claim.ts +2 -8
  162. package/src/console/server/clock.test.ts +2 -6
  163. package/src/console/server/clock.ts +8 -26
  164. package/src/console/server/console.test.ts +1 -3
  165. package/src/console/server/diff.test.ts +5 -17
  166. package/src/console/server/diff.ts +10 -31
  167. package/src/console/server/dry-run.audit.test.ts +2 -8
  168. package/src/console/server/flows.ts +64 -233
  169. package/src/console/server/gates.test.ts +14 -50
  170. package/src/console/server/gates.ts +13 -48
  171. package/src/console/server/index.ts +2 -9
  172. package/src/console/server/live.ts +3 -12
  173. package/src/console/server/operator-db.test.ts +4 -15
  174. package/src/console/server/operator-db.ts +13 -32
  175. package/src/console/server/plugin.ts +50 -53
  176. package/src/console/server/plugins.test.ts +2 -6
  177. package/src/console/server/plugins.ts +17 -56
  178. package/src/console/server/runs-pii.ts +2 -7
  179. package/src/console/server/security.gate.test.ts +18 -40
  180. package/src/console/server/serve.ts +10 -25
  181. package/src/console/server/signals.test.ts +1 -3
  182. package/src/console/server/signals.ts +17 -40
  183. package/src/console/server/state.ts +21 -59
  184. package/src/console/server/store.test.ts +20 -22
  185. package/src/console/server/store.ts +31 -76
  186. package/src/console/server/vault.test.ts +12 -29
  187. package/src/console/server/vault.ts +44 -66
  188. package/src/console/ui/access/AccessA11yView.tsx +6 -21
  189. package/src/console/ui/access/a11y.test.tsx +3 -12
  190. package/src/console/ui/access/acknowledgement.test.ts +1 -4
  191. package/src/console/ui/access/acknowledgement.ts +1 -3
  192. package/src/console/ui/access/blast-radius.ts +1 -3
  193. package/src/console/ui/access/confirmation.test.ts +1 -5
  194. package/src/console/ui/access/confirmation.ts +1 -4
  195. package/src/console/ui/access/fixture.ts +1 -5
  196. package/src/console/ui/access/grantable.test.ts +1 -3
  197. package/src/console/ui/access/grantable.ts +2 -7
  198. package/src/console/ui/access/index.ts +2 -9
  199. package/src/console/ui/access/provenance.test.ts +1 -3
  200. package/src/console/ui/access/provenance.ts +2 -6
  201. package/src/console/ui/access/search.test.ts +1 -5
  202. package/src/console/ui/access/search.ts +2 -6
  203. package/src/console/ui/ai/AiA11yView.tsx +6 -17
  204. package/src/console/ui/ai/a11y.test.tsx +2 -5
  205. package/src/console/ui/ai/fixture.ts +2 -7
  206. package/src/console/ui/ai/format.ts +1 -3
  207. package/src/console/ui/ai/group.test.ts +1 -3
  208. package/src/console/ui/ai/group.ts +4 -12
  209. package/src/console/ui/ai/index.ts +2 -9
  210. package/src/console/ui/ai/promotion.test.ts +2 -7
  211. package/src/console/ui/ai/promotion.ts +4 -13
  212. package/src/console/ui/ai/search.test.ts +2 -11
  213. package/src/console/ui/ai/search.ts +3 -13
  214. package/src/console/ui/ai/types.ts +1 -8
  215. package/src/console/ui/architecture/ArchitectureA11yView.tsx +8 -29
  216. package/src/console/ui/architecture/a11y.test.tsx +1 -2
  217. package/src/console/ui/architecture/declared.ts +1 -5
  218. package/src/console/ui/architecture/index.ts +7 -35
  219. package/src/console/ui/architecture/layout.ts +1 -3
  220. package/src/console/ui/architecture/pathologies.ts +10 -19
  221. package/src/console/ui/architecture/search.ts +6 -15
  222. package/src/console/ui/architecture/traffic.ts +4 -14
  223. package/src/console/ui/architecture/types.ts +2 -10
  224. package/src/console/ui/architecture/view.test.ts +7 -19
  225. package/src/console/ui/architecture/view.ts +9 -36
  226. package/src/console/ui/channels/ChannelsA11yView.tsx +4 -13
  227. package/src/console/ui/channels/a11y.test.tsx +1 -2
  228. package/src/console/ui/channels/confirmation.test.ts +1 -4
  229. package/src/console/ui/channels/confirmation.ts +1 -4
  230. package/src/console/ui/channels/findings.ts +1 -5
  231. package/src/console/ui/channels/index.ts +2 -8
  232. package/src/console/ui/channels/locale.test.ts +1 -3
  233. package/src/console/ui/channels/locale.ts +2 -8
  234. package/src/console/ui/channels/search.ts +4 -13
  235. package/src/console/ui/channels/taxonomy.ts +1 -3
  236. package/src/console/ui/clock/ClockA11yView.tsx +9 -26
  237. package/src/console/ui/clock/a11y.test.tsx +2 -5
  238. package/src/console/ui/clock/confirmation.test.ts +1 -3
  239. package/src/console/ui/clock/confirmation.ts +1 -4
  240. package/src/console/ui/clock/findings.ts +1 -4
  241. package/src/console/ui/clock/health.ts +2 -7
  242. package/src/console/ui/clock/index.ts +2 -10
  243. package/src/console/ui/clock/search.test.ts +1 -3
  244. package/src/console/ui/clock/search.ts +2 -6
  245. package/src/console/ui/clock/timeline.test.ts +1 -3
  246. package/src/console/ui/clock/waiting-on.test.ts +1 -5
  247. package/src/console/ui/clock/waiting-on.ts +2 -7
  248. package/src/console/ui/diff/DiffA11yView.tsx +8 -17
  249. package/src/console/ui/diff/a11y.test.tsx +2 -5
  250. package/src/console/ui/diff/group.test.ts +3 -13
  251. package/src/console/ui/diff/group.ts +2 -8
  252. package/src/console/ui/diff/index.ts +2 -8
  253. package/src/console/ui/diff/search.test.ts +1 -5
  254. package/src/console/ui/diff/search.ts +4 -16
  255. package/src/console/ui/diff/summary.ts +1 -2
  256. package/src/console/ui/dist/assets/{index-Dy4jht9P.js → index-BWo8R7NR.js} +2 -2
  257. package/src/console/ui/dist/assets/{panel-access-Dd37LU2c.js → panel-access-C0J2D-a2.js} +1 -1
  258. package/src/console/ui/dist/assets/{panel-ai-CC7LR6-J.js → panel-ai-D_m6WQI8.js} +1 -1
  259. package/src/console/ui/dist/assets/{panel-architecture-B5b3iKCz.js → panel-architecture-CKnXFyUx.js} +1 -1
  260. package/src/console/ui/dist/assets/{panel-channels-CeNjTKXp.js → panel-channels-BOmQ-onL.js} +1 -1
  261. package/src/console/ui/dist/assets/{panel-clock-DgFTLoHV.js → panel-clock-giAq0Ccv.js} +1 -1
  262. package/src/console/ui/dist/assets/{panel-diff-DxehccqB.js → panel-diff-cdonmH8c.js} +1 -1
  263. package/src/console/ui/dist/assets/{panel-flows-BtrVn-Eg.js → panel-flows-DlCU5zjA.js} +2 -2
  264. package/src/console/ui/dist/assets/{panel-gates-Z9MKRGdH.js → panel-gates-XclZxWD5.js} +1 -1
  265. package/src/console/ui/dist/assets/{panel-overview-Dt_AeXgd.js → panel-overview-BznEOTnb.js} +1 -1
  266. package/src/console/ui/dist/assets/{panel-plugins-DWd0TowH.js → panel-plugins-CcGM1g64.js} +1 -1
  267. package/src/console/ui/dist/assets/{panel-runs-DGstFHeq.js → panel-runs-CGWNHLR4.js} +1 -1
  268. package/src/console/ui/dist/assets/{panel-signals-DzEa2Fnt.js → panel-signals-CNywkdak.js} +1 -1
  269. package/src/console/ui/dist/assets/{panel-store-BJkbNgxx.js → panel-store-KmTbFHMH.js} +1 -1
  270. package/src/console/ui/dist/assets/{panel-traces-BaRVO3gM.js → panel-traces-DBLx2ilD.js} +1 -1
  271. package/src/console/ui/dist/assets/panel-vault-CEnFc0dk.js +1 -0
  272. package/src/console/ui/dist/index.html +1 -1
  273. package/src/console/ui/flows/FlowsA11yView.tsx +7 -22
  274. package/src/console/ui/flows/a11y.test.tsx +2 -8
  275. package/src/console/ui/flows/buffer.test.ts +3 -11
  276. package/src/console/ui/flows/buffer.ts +4 -11
  277. package/src/console/ui/flows/confirmation.ts +1 -3
  278. package/src/console/ui/flows/contract.test.ts +3 -7
  279. package/src/console/ui/flows/contract.ts +12 -36
  280. package/src/console/ui/flows/graph.test.ts +3 -11
  281. package/src/console/ui/flows/graph.ts +5 -15
  282. package/src/console/ui/flows/index.ts +1 -6
  283. package/src/console/ui/flows/save-as-test.ts +1 -3
  284. package/src/console/ui/flows/search.ts +8 -25
  285. package/src/console/ui/flows/tiers.ts +2 -9
  286. package/src/console/ui/gates/GatesA11yView.tsx +4 -13
  287. package/src/console/ui/gates/a11y.test.tsx +2 -5
  288. package/src/console/ui/gates/audit.ts +1 -3
  289. package/src/console/ui/gates/denial.test.ts +1 -3
  290. package/src/console/ui/gates/denial.ts +4 -12
  291. package/src/console/ui/gates/findings.ts +1 -3
  292. package/src/console/ui/gates/group.test.ts +3 -3
  293. package/src/console/ui/gates/group.ts +3 -11
  294. package/src/console/ui/gates/index.ts +2 -10
  295. package/src/console/ui/gates/search.ts +3 -10
  296. package/src/console/ui/overview/OverviewA11yView.tsx +9 -27
  297. package/src/console/ui/overview/a11y.test.tsx +1 -2
  298. package/src/console/ui/overview/busiest.ts +1 -3
  299. package/src/console/ui/overview/compose.ts +1 -13
  300. package/src/console/ui/overview/cost.ts +34 -38
  301. package/src/console/ui/overview/fixture.ts +21 -26
  302. package/src/console/ui/overview/golden.ts +4 -14
  303. package/src/console/ui/overview/index.ts +2 -9
  304. package/src/console/ui/overview/rank.test.ts +3 -10
  305. package/src/console/ui/overview/rank.ts +2 -7
  306. package/src/console/ui/overview/slo.test.ts +5 -9
  307. package/src/console/ui/overview/slo.ts +6 -23
  308. package/src/console/ui/overview/verdict.ts +3 -10
  309. package/src/console/ui/plugins/PluginsA11yView.tsx +8 -18
  310. package/src/console/ui/plugins/a11y.test.tsx +1 -2
  311. package/src/console/ui/plugins/fixture.ts +2 -4
  312. package/src/console/ui/plugins/group.test.ts +1 -3
  313. package/src/console/ui/plugins/group.ts +1 -6
  314. package/src/console/ui/plugins/index.ts +3 -13
  315. package/src/console/ui/plugins/search.ts +7 -19
  316. package/src/console/ui/runs/RunsA11yView.tsx +5 -20
  317. package/src/console/ui/runs/a11y.test.tsx +2 -5
  318. package/src/console/ui/runs/explain.ts +2 -6
  319. package/src/console/ui/runs/group.ts +3 -12
  320. package/src/console/ui/runs/histogram.test.ts +2 -11
  321. package/src/console/ui/runs/histogram.ts +1 -4
  322. package/src/console/ui/runs/index.ts +4 -18
  323. package/src/console/ui/runs/project.ts +2 -6
  324. package/src/console/ui/runs/query.test.ts +1 -3
  325. package/src/console/ui/runs/query.ts +12 -35
  326. package/src/console/ui/runs/search.ts +5 -19
  327. package/src/console/ui/runs/trace-link.test.ts +2 -6
  328. package/src/console/ui/runs/trace-link.ts +4 -16
  329. package/src/console/ui/runs/types.ts +1 -3
  330. package/src/console/ui/shell/App.tsx +2 -10
  331. package/src/console/ui/shell/client.ts +22 -115
  332. package/src/console/ui/shell/components/ui.tsx +1 -4
  333. package/src/console/ui/shell/layout/Shell.tsx +2 -4
  334. package/src/console/ui/shell/main.tsx +31 -96
  335. package/src/console/ui/shell/panels/access/AccessPanel.tsx +34 -98
  336. package/src/console/ui/shell/panels/ai/AiPanel.tsx +35 -106
  337. package/src/console/ui/shell/panels/architecture/ArchitecturePanel.tsx +18 -66
  338. package/src/console/ui/shell/panels/channels/ChannelsPanel.tsx +20 -57
  339. package/src/console/ui/shell/panels/clock/ClockPanel.tsx +22 -54
  340. package/src/console/ui/shell/panels/diff/DiffPanel.tsx +20 -61
  341. package/src/console/ui/shell/panels/flows/ContractEditor.tsx +6 -23
  342. package/src/console/ui/shell/panels/flows/FlowDrawer.tsx +13 -28
  343. package/src/console/ui/shell/panels/flows/FlowsPanel.tsx +9 -29
  344. package/src/console/ui/shell/panels/gates/GatesPanel.tsx +24 -80
  345. package/src/console/ui/shell/panels/overview/OverviewPanel.tsx +20 -58
  346. package/src/console/ui/shell/panels/plugins/PluginsPanel.tsx +16 -41
  347. package/src/console/ui/shell/panels/runs/RunsPanel.tsx +31 -99
  348. package/src/console/ui/shell/panels/signals/SignalsPanel.tsx +38 -101
  349. package/src/console/ui/shell/panels/store/StorePanel.tsx +27 -66
  350. package/src/console/ui/shell/panels/traces/TracesPanel.tsx +28 -89
  351. package/src/console/ui/shell/panels/vault/VaultPanel.tsx +22 -53
  352. package/src/console/ui/shell/setup/Wizard.tsx +3 -5
  353. package/src/console/ui/shell/styles.css +1 -2
  354. package/src/console/ui/signals/SignalsA11yView.tsx +9 -33
  355. package/src/console/ui/signals/a11y.test.tsx +2 -5
  356. package/src/console/ui/signals/confirmation.test.ts +1 -5
  357. package/src/console/ui/signals/confirmation.ts +2 -6
  358. package/src/console/ui/signals/dry-run.ts +1 -3
  359. package/src/console/ui/signals/durable.ts +1 -3
  360. package/src/console/ui/signals/findings.ts +1 -3
  361. package/src/console/ui/signals/group.test.ts +2 -8
  362. package/src/console/ui/signals/group.ts +2 -10
  363. package/src/console/ui/signals/index.ts +1 -4
  364. package/src/console/ui/signals/monitor.ts +2 -7
  365. package/src/console/ui/signals/schema-form.test.ts +3 -14
  366. package/src/console/ui/signals/schema-form.ts +1 -4
  367. package/src/console/ui/signals/search.ts +4 -13
  368. package/src/console/ui/store/StoreA11yView.tsx +3 -9
  369. package/src/console/ui/store/a11y.test.tsx +2 -5
  370. package/src/console/ui/store/confirmation.test.ts +1 -3
  371. package/src/console/ui/store/confirmation.ts +1 -4
  372. package/src/console/ui/store/dry-run.ts +2 -5
  373. package/src/console/ui/store/fixture.ts +1 -2
  374. package/src/console/ui/store/group.test.ts +1 -6
  375. package/src/console/ui/store/group.ts +1 -4
  376. package/src/console/ui/store/index.ts +1 -5
  377. package/src/console/ui/store/search.ts +2 -6
  378. package/src/console/ui/store/will-not-fire.ts +1 -2
  379. package/src/console/ui/traces/TracesA11yView.tsx +10 -29
  380. package/src/console/ui/traces/a11y.test.tsx +1 -2
  381. package/src/console/ui/traces/chain.test.ts +5 -19
  382. package/src/console/ui/traces/chain.ts +1 -3
  383. package/src/console/ui/traces/critical-path.test.ts +1 -3
  384. package/src/console/ui/traces/critical-path.ts +2 -6
  385. package/src/console/ui/traces/filter.test.ts +2 -6
  386. package/src/console/ui/traces/filter.ts +5 -13
  387. package/src/console/ui/traces/fold.test.ts +4 -12
  388. package/src/console/ui/traces/fold.ts +1 -3
  389. package/src/console/ui/traces/mini.ts +1 -3
  390. package/src/console/ui/traces/replay.test.ts +1 -3
  391. package/src/console/ui/traces/replay.ts +1 -3
  392. package/src/console/ui/traces/sampling.ts +1 -4
  393. package/src/console/ui/traces/search.ts +4 -17
  394. package/src/console/ui/traces/tier.ts +1 -3
  395. package/src/console/ui/vault/VaultA11yView.tsx +5 -17
  396. package/src/console/ui/vault/a11y.test.tsx +1 -2
  397. package/src/console/ui/vault/blast-radius.ts +1 -3
  398. package/src/console/ui/vault/confirmation.test.ts +1 -5
  399. package/src/console/ui/vault/confirmation.ts +1 -4
  400. package/src/console/ui/vault/dormant.test.ts +1 -4
  401. package/src/console/ui/vault/export-safe.test.ts +1 -5
  402. package/src/console/ui/vault/export-safe.ts +1 -4
  403. package/src/console/ui/vault/fixture.ts +3 -3
  404. package/src/console/ui/vault/group.ts +1 -2
  405. package/src/console/ui/vault/index.ts +2 -10
  406. package/src/console/ui/vault/search.ts +2 -6
  407. package/src/console/ui/vault/types.ts +1 -1
  408. package/src/console/xss.gate.test.ts +1 -3
  409. package/src/docker/compose.ts +215 -27
  410. package/src/docker/derive.ts +6 -14
  411. package/src/docker/docker.test.ts +118 -15
  412. package/src/docker/dockerfile.integration.test.ts +12 -21
  413. package/src/docker/helpers.ts +5 -4
  414. package/src/docker/index.ts +9 -6
  415. package/src/docker/pin.ts +1 -9
  416. package/src/docker/recipes/index.ts +6 -6
  417. package/src/docker/recipes/mailpit.ts +22 -0
  418. package/src/docker/recipes/openbao.ts +47 -0
  419. package/src/docker/recipes/postgres.ts +17 -6
  420. package/src/docker/recipes/redis.ts +11 -2
  421. package/src/docker/recipes/rustfs.ts +32 -0
  422. package/src/docker/stack-id.test.ts +73 -5
  423. package/src/docker/stack-id.ts +124 -33
  424. package/src/docker/stack.integration.test.ts +6 -21
  425. package/src/docker/stack.ts +36 -4
  426. package/src/docker/types.ts +16 -4
  427. package/src/docs-origin.ts +4 -4
  428. package/src/drivers/ai-anthropic.ts +5 -14
  429. package/src/drivers/ai-mock.ts +2 -5
  430. package/src/drivers/ai-openai-compatible.ts +4 -10
  431. package/src/drivers/ai-providers.test.ts +6 -13
  432. package/src/drivers/bun-native-completeness.test.ts +6 -15
  433. package/src/drivers/channel-console.ts +6 -7
  434. package/src/drivers/channel-fcm.ts +20 -30
  435. package/src/drivers/channel-resend.ts +1 -3
  436. package/src/drivers/channel-smtp.ts +2 -6
  437. package/src/drivers/channel-types.ts +2 -12
  438. package/src/drivers/channel-unifonic.ts +2 -6
  439. package/src/drivers/channel-wa-cloud.ts +2 -6
  440. package/src/drivers/channel-webpush.ts +21 -60
  441. package/src/drivers/conformance.test.ts +2 -10
  442. package/src/drivers/conformance.ts +8 -21
  443. package/src/drivers/drizzle-dialect.test.ts +20 -0
  444. package/src/drivers/drizzle-dialect.ts +37 -0
  445. package/src/drivers/fs.ts +2 -8
  446. package/src/drivers/index.ts +12 -57
  447. package/src/drivers/memory.ts +287 -75
  448. package/src/drivers/pgvector.ts +7 -11
  449. package/src/drivers/postgres.ts +7 -13
  450. package/src/drivers/redis.ts +13 -37
  451. package/src/drivers/s3.ts +15 -18
  452. package/src/drivers/signal-engine.ts +12 -49
  453. package/src/drivers/signal-memory.ts +2 -8
  454. package/src/drivers/signal-nats.ts +4 -9
  455. package/src/drivers/signal-postgres.ts +62 -129
  456. package/src/drivers/signal-redis.ts +7 -21
  457. package/src/drivers/signal-types.ts +1 -4
  458. package/src/drivers/sqlite.ts +3 -12
  459. package/src/drivers/types.ts +4 -23
  460. package/src/drivers/vault-driver-removal.test.ts +55 -0
  461. package/src/drivers/vault-env.ts +2 -6
  462. package/src/drivers/vault-infisical.ts +1 -5
  463. package/src/drivers/vault-managed.ts +1 -5
  464. package/src/drivers/vault-memory.ts +1 -5
  465. package/src/drivers/vault-openbao.test.ts +97 -0
  466. package/src/drivers/vault-openbao.ts +103 -40
  467. package/src/drivers/vault-types.ts +3 -16
  468. package/src/elements/ai/declare.ts +4 -14
  469. package/src/elements/ai/eval.ts +2 -6
  470. package/src/elements/ai/pii.ts +1 -3
  471. package/src/elements/ai/runtime.ts +12 -50
  472. package/src/elements/ai/schema.ts +4 -15
  473. package/src/elements/ai.test.ts +13 -24
  474. package/src/elements/ai.ts +1 -5
  475. package/src/elements/channel/consent.ts +3 -12
  476. package/src/elements/channel/costs.ts +4 -15
  477. package/src/elements/channel/declare.ts +1 -4
  478. package/src/elements/channel/email-auth.ts +1 -4
  479. package/src/elements/channel/locale.ts +2 -10
  480. package/src/elements/channel/mask.ts +1 -3
  481. package/src/elements/channel/mime.ts +2 -12
  482. package/src/elements/channel/outcomes.test.ts +1 -5
  483. package/src/elements/channel/outcomes.ts +5 -15
  484. package/src/elements/channel/receipts.ts +2 -7
  485. package/src/elements/channel/runtime.ts +28 -74
  486. package/src/elements/channel/suppression.ts +8 -14
  487. package/src/elements/channel.test.ts +8 -31
  488. package/src/elements/channel.ts +3 -14
  489. package/src/elements/clock/actions.ts +6 -18
  490. package/src/elements/clock/declare.ts +1 -3
  491. package/src/elements/clock/dst.ts +1 -5
  492. package/src/elements/clock/durable.ts +4 -16
  493. package/src/elements/clock/health.ts +2 -7
  494. package/src/elements/clock/leader.ts +2 -9
  495. package/src/elements/clock/reconcile.ts +4 -15
  496. package/src/elements/clock/runtime.ts +2 -5
  497. package/src/elements/clock/schedule.ts +4 -20
  498. package/src/elements/clock.test.ts +2 -7
  499. package/src/elements/clock.ts +5 -23
  500. package/src/elements/gate/permissions.ts +1 -4
  501. package/src/elements/gate/runtime.ts +7 -28
  502. package/src/elements/gate.ts +1 -5
  503. package/src/elements/index.ts +9 -7
  504. package/src/elements/signal/declare.ts +2 -7
  505. package/src/elements/signal/reconcile.test.ts +1 -4
  506. package/src/elements/signal/runtime.ts +1 -3
  507. package/src/elements/signal.test.ts +3 -15
  508. package/src/elements/signal.ts +2 -8
  509. package/src/elements/store/cache.test.ts +46 -0
  510. package/src/elements/store/cache.ts +3 -11
  511. package/src/elements/store/classify.ts +5 -22
  512. package/src/elements/store/declare.ts +11 -17
  513. package/src/elements/store/domain-ddl.test.ts +86 -0
  514. package/src/elements/store/emit-drizzle.ts +363 -0
  515. package/src/elements/store/files-policy.test.ts +1 -5
  516. package/src/elements/store/files-policy.ts +4 -12
  517. package/src/elements/store/load-plugin-tables.ts +103 -0
  518. package/src/elements/store/missing-relation.test.ts +83 -0
  519. package/src/elements/store/missing-relation.ts +38 -0
  520. package/src/elements/store/replica.ts +1 -4
  521. package/src/elements/store/resource-list-docs.fixture.ts +56 -0
  522. package/src/elements/store/resource-list-docs.test.ts +79 -0
  523. package/src/elements/store/resource.test.ts +253 -0
  524. package/src/elements/store/resource.ts +786 -0
  525. package/src/elements/store/runtime.ts +25 -28
  526. package/src/elements/store/schema-decl.test.ts +227 -0
  527. package/src/elements/store/schema-decl.ts +516 -0
  528. package/src/elements/store/sql-condition.test.ts +132 -0
  529. package/src/elements/store/sql-condition.ts +293 -65
  530. package/src/elements/store/sql-session.test.ts +135 -0
  531. package/src/elements/store/sql-session.ts +241 -84
  532. package/src/elements/store/table.ts +69 -23
  533. package/src/elements/store.test.ts +17 -39
  534. package/src/elements/store.ts +53 -31
  535. package/src/elements/vault/chain.ts +34 -0
  536. package/src/elements/vault/declare.ts +22 -32
  537. package/src/elements/vault/fingerprint.ts +2 -7
  538. package/src/elements/vault/redact.ts +2 -6
  539. package/src/elements/vault/runtime.ts +19 -33
  540. package/src/elements/vault.test.ts +12 -55
  541. package/src/elements/vault.ts +9 -13
  542. package/src/index.ts +5 -2
  543. package/src/kernel/adopt-routes.ts +15 -29
  544. package/src/kernel/app.ts +92 -118
  545. package/src/kernel/auth-resolve.ts +2 -9
  546. package/src/kernel/boot-bind/ai.ts +1 -4
  547. package/src/kernel/boot-bind/channel.test.ts +60 -0
  548. package/src/kernel/boot-bind/channel.ts +61 -5
  549. package/src/kernel/boot-bind/clock.ts +2 -6
  550. package/src/kernel/boot-bind/gate.ts +2 -8
  551. package/src/kernel/boot-bind/runs.ts +1 -3
  552. package/src/kernel/boot-bind/signal.ts +3 -10
  553. package/src/kernel/boot-bind/store.test.ts +27 -18
  554. package/src/kernel/boot-bind/store.ts +93 -52
  555. package/src/kernel/boot-bind/vault.ts +2 -8
  556. package/src/kernel/boot.test.ts +4 -10
  557. package/src/kernel/boot.ts +30 -77
  558. package/src/kernel/budget.test.ts +1 -3
  559. package/src/kernel/capability.ts +3 -10
  560. package/src/kernel/dry-run.test.ts +1 -4
  561. package/src/kernel/dry-run.ts +3 -11
  562. package/src/kernel/edge.test.ts +68 -0
  563. package/src/kernel/effects.test.ts +1 -5
  564. package/src/kernel/effects.ts +4 -11
  565. package/src/kernel/errors.registry.test.ts +2 -8
  566. package/src/kernel/errors.ts +23 -32
  567. package/src/kernel/flow.test.ts +12 -25
  568. package/src/kernel/flow.ts +13 -25
  569. package/src/kernel/fx.test.ts +31 -40
  570. package/src/kernel/fx.ts +135 -90
  571. package/src/kernel/hook-timing.test.ts +3 -6
  572. package/src/kernel/hook-timing.ts +5 -14
  573. package/src/kernel/hooks.test.ts +43 -10
  574. package/src/kernel/hooks.ts +25 -12
  575. package/src/kernel/index.ts +11 -17
  576. package/src/kernel/journal.ts +7 -31
  577. package/src/kernel/on.ts +45 -9
  578. package/src/kernel/pipeline.test.ts +10 -19
  579. package/src/kernel/pipeline.ts +5 -17
  580. package/src/kernel/plug.ts +4 -11
  581. package/src/kernel/plugin/conflicts.test.ts +13 -25
  582. package/src/kernel/plugin/decorate.test.ts +8 -13
  583. package/src/kernel/plugin/scoping.test.ts +4 -11
  584. package/src/kernel/plugin.ts +81 -27
  585. package/src/kernel/registry-isolation.test.ts +74 -0
  586. package/src/kernel/registry.ts +102 -30
  587. package/src/kernel/router.test.ts +15 -13
  588. package/src/kernel/router.ts +9 -29
  589. package/src/kernel/routing-budget.test.ts +1 -3
  590. package/src/kernel/run-telemetry.ts +1 -3
  591. package/src/kernel/triggers.ts +63 -21
  592. package/src/manifest/diff.test.ts +26 -91
  593. package/src/manifest/diff.ts +95 -225
  594. package/src/manifest/fixtures/skyport.excerpt.json +1 -1
  595. package/src/manifest/fixtures/skyport.manifest.json +1 -1
  596. package/src/manifest/index.ts +3 -10
  597. package/src/manifest/types.ts +30 -6
  598. package/src/manifest/undeclared.test.ts +4 -12
  599. package/src/manifest/undeclared.ts +1 -2
  600. package/src/manifest/validate.test.ts +2 -6
  601. package/src/manifest/validate.ts +5 -15
  602. package/src/mcp/authorization.ts +8 -27
  603. package/src/mcp/confirmation.ts +3 -10
  604. package/src/mcp/data.ts +2 -6
  605. package/src/mcp/docs-index.ts +4 -7
  606. package/src/mcp/docs-mcp.test.ts +3 -12
  607. package/src/mcp/docs-server.ts +7 -27
  608. package/src/mcp/docs-tools.ts +2 -6
  609. package/src/mcp/index.ts +1 -6
  610. package/src/mcp/injection.gate.test.ts +4 -18
  611. package/src/mcp/mcp.test.ts +18 -49
  612. package/src/mcp/protocol.ts +3 -10
  613. package/src/mcp/server.ts +11 -52
  614. package/src/mcp/session.ts +4 -14
  615. package/src/mcp/tools.ts +14 -50
  616. package/src/plugins/catalogue.test.ts +3 -7
  617. package/src/plugins/catalogue.ts +1 -3
  618. package/src/plugins/compression.test.ts +127 -0
  619. package/src/plugins/compression.ts +94 -0
  620. package/src/plugins/config-source.test.ts +204 -0
  621. package/src/plugins/config-source.ts +209 -0
  622. package/src/plugins/cors.test.ts +138 -0
  623. package/src/plugins/cors.ts +129 -0
  624. package/src/plugins/csrf.test.ts +102 -0
  625. package/src/plugins/csrf.ts +86 -0
  626. package/src/plugins/headers.ts +54 -0
  627. package/src/plugins/index.ts +26 -0
  628. package/src/plugins/ip-allowlist.test.ts +105 -0
  629. package/src/plugins/ip-allowlist.ts +76 -0
  630. package/src/plugins/maintenance-mode.test.ts +91 -0
  631. package/src/plugins/maintenance-mode.ts +85 -0
  632. package/src/plugins/node-import-scan.ts +2 -5
  633. package/src/plugins/security-headers.test.ts +243 -0
  634. package/src/plugins/security-headers.ts +255 -0
  635. package/src/plugins/supply-chain.ts +5 -17
  636. package/src/release/exports.ts +3 -8
  637. package/src/release/measure.exports.test.ts +1 -3
  638. package/src/release/measure.ts +16 -45
  639. package/src/runs/bench.test.ts +1 -3
  640. package/src/runs/collect.ts +8 -25
  641. package/src/runs/drivers/clickhouse.ts +2 -9
  642. package/src/runs/drivers/files.ts +9 -31
  643. package/src/runs/drivers/memory.ts +5 -22
  644. package/src/runs/drivers/postgres.ts +8 -20
  645. package/src/runs/duckdb.ts +2 -8
  646. package/src/runs/index.ts +3 -14
  647. package/src/runs/outlier.ts +3 -10
  648. package/src/runs/parquet.ts +8 -26
  649. package/src/runs/privacy.ts +2 -8
  650. package/src/runs/runs.test.ts +3 -9
  651. package/src/runs/runtime.ts +7 -32
  652. package/src/runs/shred.ts +10 -29
  653. package/src/runs/types.ts +1 -4
  654. package/src/runtime/bun.ts +4 -15
  655. package/src/runtime/cold-start.bench.ts +1 -3
  656. package/src/runtime/dev-request-log.test.ts +1 -4
  657. package/src/runtime/dev-request-log.ts +1 -4
  658. package/src/runtime/index.ts +1 -6
  659. package/src/runtime/primitives.ts +5 -4
  660. package/src/runtime/security.ts +3 -13
  661. package/src/runtime/serve.test.ts +4 -7
  662. package/src/runtime/types.ts +1 -4
  663. package/src/runtime/web-standard.ts +3 -15
  664. package/src/term.test.ts +4 -6
  665. package/src/term.ts +49 -98
  666. package/src/test/create-test-app.test.ts +4 -14
  667. package/src/test/create-test-app.ts +27 -33
  668. package/src/test/provisions.integration.test.ts +3 -11
  669. package/src/upgrade/codemods.test.ts +25 -6
  670. package/src/upgrade/codemods.ts +116 -3
  671. package/src/validation/standard-schema.test.ts +2 -5
  672. package/src/validation/standard-schema.ts +13 -33
  673. package/docs/spec/console.md +0 -739
  674. package/docs/spec/example.md +0 -1196
  675. package/docs/spec/four-applications.md +0 -1195
  676. package/docs/spec/unified-theory.md +0 -489
  677. package/src/cli/doc-drift.test.ts +0 -146
  678. package/src/cli/doc-drift.ts +0 -430
  679. package/src/cli/doctor-diff-examples.ts +0 -92
  680. package/src/console/ui/dist/assets/panel-vault-BbfWdox0.js +0 -1
  681. package/src/drivers/vault-sops.ts +0 -271
package/src/cli/ports.ts CHANGED
@@ -48,13 +48,11 @@ export async function findFreePort(
48
48
  if (occupied.has(port)) continue;
49
49
  if (!(await probe(port))) return port;
50
50
  }
51
- throw new Error(
52
- `oke: no free port near ${preferred} after ${MAX_PORT_ATTEMPTS} attempts`,
53
- );
51
+ throw new Error(`oke: no free port near ${preferred} after ${MAX_PORT_ATTEMPTS} attempts`);
54
52
  }
55
53
 
56
54
  /**
57
- * Resolve distinct free ports for app · Console · MCP (dev only).
55
+ * Resolve distinct free ports for app · Console · MCP · docs MCP (dev only).
58
56
  *
59
57
  * @param preferred - Preferred ports
60
58
  * @param probe - Injectable busy check (tests)
@@ -64,12 +62,14 @@ export async function resolveDevPorts(
64
62
  readonly app: number;
65
63
  readonly console: number;
66
64
  readonly mcp: number;
65
+ readonly docsMcp: number;
67
66
  },
68
67
  probe: (port: number) => Promise<boolean> = isPortInUse,
69
68
  ): Promise<{
70
69
  readonly app: number;
71
70
  readonly console: number;
72
71
  readonly mcp: number;
72
+ readonly docsMcp: number;
73
73
  }> {
74
74
  const occupied = new Set<number>();
75
75
  const app = await findFreePort(preferred.app, occupied, probe);
@@ -77,5 +77,7 @@ export async function resolveDevPorts(
77
77
  const consolePort = await findFreePort(preferred.console, occupied, probe);
78
78
  if (consolePort !== 0) occupied.add(consolePort);
79
79
  const mcp = await findFreePort(preferred.mcp, occupied, probe);
80
- return { app, console: consolePort, mcp };
80
+ if (mcp !== 0) occupied.add(mcp);
81
+ const docsMcp = await findFreePort(preferred.docsMcp, occupied, probe);
82
+ return { app, console: consolePort, mcp, docsMcp };
81
83
  }
@@ -24,9 +24,7 @@ export interface RunPrivacyEraseOptions {
24
24
  *
25
25
  * @param options - Subject + vault
26
26
  */
27
- export function runPrivacyErase(
28
- options: RunPrivacyEraseOptions,
29
- ): PrivacyEraseResult {
27
+ export function runPrivacyErase(options: RunPrivacyEraseOptions): PrivacyEraseResult {
30
28
  const keys = options.subjectKeys ?? createMemorySubjectKeys();
31
29
  return privacyErase({
32
30
  subjectId: options.subjectId,
@@ -6,7 +6,7 @@
6
6
 
7
7
  /** One CLI flag (long form is canonical; short is convenience only). */
8
8
  export interface CliFlag {
9
- /** Canonical long form including leading dashes (e.g. `--stack`). */
9
+ /** Canonical long form including leading dashes (e.g. `--docker`). */
10
10
  readonly long: string;
11
11
  /** Optional short form including leading dash (e.g. `-s`). */
12
12
  readonly short?: string;
@@ -97,16 +97,31 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
97
97
  leaf: true,
98
98
  flags: [
99
99
  {
100
- long: "--stack",
101
- short: "-s",
100
+ long: "--local",
101
+ short: "-l",
102
+ summary: "Session-only local mode (in-memory; no compose)",
103
+ },
104
+ {
105
+ long: "--docker",
106
+ short: "-d",
102
107
  takesValue: true,
103
108
  valueName: "roles",
104
- summary: "Boot generated compose (optional role list)",
109
+ summary: "Session-only docker compose (optional role list)",
110
+ },
111
+ {
112
+ long: "--no-db-push",
113
+ summary: "Disable auto `oke db push` on schema change (local)",
105
114
  },
106
115
  ENTRY,
107
116
  HELP,
108
117
  ],
109
118
  },
119
+ {
120
+ name: "mode",
121
+ summary: "get/set default oke dev mode (local|docker)",
122
+ leaf: true,
123
+ flags: [HELP],
124
+ },
110
125
  {
111
126
  name: "start",
112
127
  summary: "production entry (Docker CMD)",
@@ -125,7 +140,7 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
125
140
  },
126
141
  {
127
142
  name: "doctor",
128
- summary: "secrets · ports · schema drift",
143
+ summary: "secrets · ports · stub/domain schema drift",
129
144
  leaf: true,
130
145
  flags: [
131
146
  MANIFEST,
@@ -185,6 +200,54 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
185
200
  },
186
201
  ],
187
202
  },
203
+ {
204
+ name: "db",
205
+ summary: "domain schema — push · generate · migrate",
206
+ subcommands: [
207
+ {
208
+ name: "push",
209
+ summary: "Sync schema.ts to the live local DB (dev)",
210
+ flags: [
211
+ {
212
+ long: "--config",
213
+ short: "-c",
214
+ takesValue: true,
215
+ valueName: "path",
216
+ summary: "drizzle.config.ts path",
217
+ },
218
+ HELP,
219
+ ],
220
+ },
221
+ {
222
+ name: "generate",
223
+ summary: "Write versioned SQL under drizzle/",
224
+ flags: [
225
+ {
226
+ long: "--config",
227
+ short: "-c",
228
+ takesValue: true,
229
+ valueName: "path",
230
+ summary: "drizzle.config.ts path",
231
+ },
232
+ HELP,
233
+ ],
234
+ },
235
+ {
236
+ name: "migrate",
237
+ summary: "Apply generated migrations (explicit)",
238
+ flags: [
239
+ {
240
+ long: "--config",
241
+ short: "-c",
242
+ takesValue: true,
243
+ valueName: "path",
244
+ summary: "drizzle.config.ts path",
245
+ },
246
+ HELP,
247
+ ],
248
+ },
249
+ ],
250
+ },
188
251
  {
189
252
  name: "client",
190
253
  summary: "ambient types for a separate frontend repo",
@@ -358,18 +421,12 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
358
421
  * @returns Help text (no trailing exit-code block)
359
422
  */
360
423
  export function formatOkeHelp(): string {
361
- const lines = [
362
- "oke — okengine CLI",
363
- "",
364
- "Commands:",
365
- ];
424
+ const lines = ["oke — okengine CLI", "", "Commands:"];
366
425
  for (const cmd of OKE_COMMANDS) {
367
426
  const usage = formatCommandUsage(cmd);
368
427
  lines.push(` ${pad(usage, 34)} ${cmd.summary}`);
369
428
  if (cmd.name === "doctor") {
370
- lines.push(
371
- ` ${pad("oke doctor --diff|-d", 34)} CI gate: undeclared contract breaks`,
372
- );
429
+ lines.push(` ${pad("oke doctor --diff|-d", 34)} CI gate: undeclared contract breaks`);
373
430
  }
374
431
  }
375
432
  lines.push("");
@@ -379,9 +436,7 @@ export function formatOkeHelp(): string {
379
436
  /**
380
437
  * Collect every top-level command name (for completion / tests).
381
438
  */
382
- export function commandNames(
383
- commands: readonly CliCommand[] = OKE_COMMANDS,
384
- ): readonly string[] {
439
+ export function commandNames(commands: readonly CliCommand[] = OKE_COMMANDS): readonly string[] {
385
440
  return commands.map((c) => c.name);
386
441
  }
387
442
 
@@ -391,10 +446,7 @@ export function commandNames(
391
446
  * @param command - Top-level command
392
447
  * @param sub - Optional subcommand name
393
448
  */
394
- export function flagTokensFor(
395
- command: CliCommand,
396
- sub?: string,
397
- ): readonly string[] {
449
+ export function flagTokensFor(command: CliCommand, sub?: string): readonly string[] {
398
450
  const flags = sub
399
451
  ? (command.subcommands?.find((s) => s.name === sub)?.flags ?? [])
400
452
  : (command.flags ?? []);
@@ -420,9 +472,7 @@ function formatCommandUsage(cmd: CliCommand): string {
420
472
  if (cmd.subcommands && cmd.subcommands.length > 1) {
421
473
  const subs = cmd.subcommands.map((s) => s.name).join("|");
422
474
  // Prefer shared JSON flag hint when every list-like sub supports it.
423
- const jsonHint = cmd.subcommands.some((s) =>
424
- s.flags?.some((f) => f.long === "--json"),
425
- )
475
+ const jsonHint = cmd.subcommands.some((s) => s.flags?.some((f) => f.long === "--json"))
426
476
  ? " [--json|-j]"
427
477
  : "";
428
478
  return `oke ${cmd.name} ${subs}${jsonHint}`;
@@ -439,8 +489,8 @@ function formatCommandUsage(cmd: CliCommand): string {
439
489
  function formatFlagHint(f: CliFlag): string {
440
490
  const name = f.short ? `${f.long}|${f.short}` : f.long;
441
491
  if (f.takesValue) {
442
- // Optional value (e.g. --stack [roles]) when valueName is roles-like.
443
- if (f.long === "--stack") return `[${name} [${f.valueName}]]`;
492
+ // Optional value (e.g. --docker [roles]) when valueName is roles-like.
493
+ if (f.long === "--docker") return `[${name} [${f.valueName}]]`;
444
494
  return `[${name} ${f.valueName}]`;
445
495
  }
446
496
  return `[${name}]`;
@@ -0,0 +1,48 @@
1
+ /**
2
+ * Active SQL env resolution from `.oke/mode` / session overrides.
3
+ */
4
+
5
+ import { afterEach, describe, expect, test } from "bun:test";
6
+ import { mkdtemp, rm } from "node:fs/promises";
7
+ import { tmpdir } from "node:os";
8
+ import { join } from "node:path";
9
+ import { writeDevMode } from "./dev-mode.ts";
10
+ import { resolveDevSqlEnv } from "./resolve-dev-sql-env.ts";
11
+
12
+ const dirs: string[] = [];
13
+
14
+ afterEach(async () => {
15
+ await Promise.all(dirs.splice(0).map((d) => rm(d, { recursive: true, force: true })));
16
+ });
17
+
18
+ async function tempDir(): Promise<string> {
19
+ const dir = await mkdtemp(join(tmpdir(), "oke-sqlenv-"));
20
+ dirs.push(dir);
21
+ return dir;
22
+ }
23
+
24
+ describe("resolveDevSqlEnv", () => {
25
+ test("defaults to local when nothing set", async () => {
26
+ const dir = await tempDir();
27
+ expect(await resolveDevSqlEnv(dir)).toBe("local");
28
+ });
29
+
30
+ test("explicit env override wins", async () => {
31
+ const dir = await tempDir();
32
+ await writeDevMode(dir, "local");
33
+ expect(await resolveDevSqlEnv(dir, { env: "docker" })).toBe("docker");
34
+ });
35
+
36
+ test("session docker flag wins over saved mode", async () => {
37
+ const dir = await tempDir();
38
+ await writeDevMode(dir, "local");
39
+ expect(await resolveDevSqlEnv(dir, { docker: true })).toBe("docker");
40
+ expect(await resolveDevSqlEnv(dir, { docker: false })).toBe("local");
41
+ });
42
+
43
+ test("reads saved .oke/mode", async () => {
44
+ const dir = await tempDir();
45
+ await writeDevMode(dir, "docker");
46
+ expect(await resolveDevSqlEnv(dir)).toBe("docker");
47
+ });
48
+ });
@@ -0,0 +1,42 @@
1
+ /**
2
+ * Resolve the active SQL env for schema tooling (`oke db`, `oke mode`,
3
+ * `oke dev` one-shot sync) from session overrides and the saved dev mode.
4
+ */
5
+
6
+ import type { ConfigEnv } from "../config/index.ts";
7
+ import { readDevMode } from "./dev-mode.ts";
8
+
9
+ /** Options for {@link resolveDevSqlEnv}. */
10
+ export interface ResolveDevSqlEnvOptions {
11
+ /**
12
+ * Session override — `true` means docker (e.g. `OKE_DOCKER=1` or
13
+ * `oke dev --docker`). `false` means local. `undefined` → auto-resolve.
14
+ */
15
+ readonly docker?: boolean;
16
+ /**
17
+ * Explicit env override (e.g. `oke db --env docker`). Wins over `.oke/mode`.
18
+ */
19
+ readonly env?: ConfigEnv;
20
+ }
21
+
22
+ /**
23
+ * Resolve the SQL env (`local` | `docker` for dev tooling) without prompting.
24
+ *
25
+ * Order:
26
+ * 1. Explicit `options.env` (CLI flag)
27
+ * 2. Session docker flag (`options.docker`)
28
+ * 3. `.oke/mode` persisted preference
29
+ * 4. Default `local`
30
+ *
31
+ * @param cwd - Project root
32
+ * @param options - Session / CLI overrides
33
+ */
34
+ export async function resolveDevSqlEnv(
35
+ cwd: string,
36
+ options: ResolveDevSqlEnvOptions = {},
37
+ ): Promise<ConfigEnv> {
38
+ if (options.env !== undefined) return options.env;
39
+ if (options.docker !== undefined) return options.docker ? "docker" : "local";
40
+ const saved = await readDevMode(cwd);
41
+ return saved ?? "local";
42
+ }
package/src/cli/schema.ts CHANGED
@@ -32,9 +32,7 @@ export interface SchemaGenerateOptions {
32
32
  *
33
33
  * @param options - Manifest / check flag
34
34
  */
35
- export async function runSchemaGenerate(
36
- options: SchemaGenerateOptions = {},
37
- ): Promise<number> {
35
+ export async function runSchemaGenerate(options: SchemaGenerateOptions = {}): Promise<number> {
38
36
  const write = options.write ?? ((t) => process.stdout.write(t));
39
37
  const cwd = options.cwd ?? process.cwd();
40
38
  let manifest = options.manifest;
@@ -92,10 +90,7 @@ export async function runSchemaGenerate(
92
90
  * @param cwd - Project root
93
91
  * @param manifest - Optional manifest
94
92
  */
95
- export async function schemaFingerprint(
96
- cwd: string,
97
- manifest?: Manifest,
98
- ): Promise<string> {
93
+ export async function schemaFingerprint(cwd: string, manifest?: Manifest): Promise<string> {
99
94
  const tables = new Set<string>([
100
95
  "oke_roles",
101
96
  "oke_role_grants",
@@ -123,9 +118,7 @@ export async function schemaFingerprint(
123
118
  *
124
119
  * @param cwd - Project root
125
120
  */
126
- export async function readSchemaFingerprint(
127
- cwd: string,
128
- ): Promise<string | null> {
121
+ export async function readSchemaFingerprint(cwd: string): Promise<string | null> {
129
122
  const fpFile = Bun.file(resolve(cwd, SCHEMA_FINGERPRINT_FILE));
130
123
  if (await fpFile.exists()) {
131
124
  return (await fpFile.text()).trim();
package/src/cli/stack.ts CHANGED
@@ -2,7 +2,7 @@
2
2
  * `oke stack` — preview resolved images/tags/ports (writes nothing).
3
3
  */
4
4
 
5
- import { formatStackPreview, resolveStack } from "../docker/index.ts";
5
+ import { formatStackPreview, resolveStack, stackInstanceId } from "../docker/index.ts";
6
6
  import { wantsJson } from "./args.ts";
7
7
  import { EXIT_OK, EXIT_RUNTIME } from "./exit.ts";
8
8
  import { loadOkeConfig, resolveImages } from "./load-config.ts";
@@ -22,19 +22,15 @@ export interface StackCliOptions {
22
22
  *
23
23
  * @param options - Config / images
24
24
  */
25
- export async function runStackPreview(
26
- options: StackCliOptions = {},
27
- ): Promise<number> {
25
+ export async function runStackPreview(options: StackCliOptions = {}): Promise<number> {
28
26
  const write = options.write ?? ((t) => process.stdout.write(t));
29
27
  const writeErr = options.writeErr ?? ((t) => process.stderr.write(t));
30
28
  const json = options.json ?? false;
29
+ const cwd = options.cwd ?? process.cwd();
31
30
  let images = options.images;
32
31
  if (!images) {
33
32
  try {
34
- const loaded = await loadOkeConfig(
35
- options.cwd ?? process.cwd(),
36
- options.configPath,
37
- );
33
+ const loaded = await loadOkeConfig(cwd, options.configPath);
38
34
  images = resolveImages(loaded.config);
39
35
  } catch (err) {
40
36
  const msg = err instanceof Error ? err.message : String(err);
@@ -46,7 +42,8 @@ export async function runStackPreview(
46
42
  return EXIT_RUNTIME;
47
43
  }
48
44
  }
49
- const rows = resolveStack({ images });
45
+ // Match `oke dev --docker` host ports (stable per-project offsets).
46
+ const rows = resolveStack({ images, instanceId: stackInstanceId(cwd) });
50
47
  if (json) {
51
48
  write(`${JSON.stringify({ ok: true, rows }, null, 2)}\n`);
52
49
  if (rows.length === 0) {
@@ -72,7 +69,8 @@ export async function stackCli(args: readonly string[]): Promise<number> {
72
69
  else if (a === "--help" || a === "-h") {
73
70
  console.log(`oke stack [--config|-c oke.config.ts] [--json|-j]
74
71
 
75
- Preview resolved images, recipes, and ports. Writes nothing.
72
+ Preview resolved images, recipes, and ports (same per-project host ports as
73
+ oke dev --docker). Writes nothing.
76
74
  --json Machine-parseable JSON on stdout; hints on stderr.
77
75
  `);
78
76
  return EXIT_OK;
package/src/cli/start.ts CHANGED
@@ -17,10 +17,7 @@ export interface StartOptions {
17
17
  * @param entry - Absolute entry path
18
18
  * @param env - Process env overlay
19
19
  */
20
- readonly runEntry?: (
21
- entry: string,
22
- env: Record<string, string>,
23
- ) => Promise<void>;
20
+ readonly runEntry?: (entry: string, env: Record<string, string>) => Promise<void>;
24
21
  }
25
22
 
26
23
  /**
@@ -29,10 +26,7 @@ export interface StartOptions {
29
26
  * @param cwd - Project root
30
27
  * @param explicit - Optional `--entry`
31
28
  */
32
- export async function resolveStartEntry(
33
- cwd: string,
34
- explicit?: string,
35
- ): Promise<string> {
29
+ export async function resolveStartEntry(cwd: string, explicit?: string): Promise<string> {
36
30
  if (explicit) return resolve(cwd, explicit);
37
31
  const pkgPath = resolve(cwd, "package.json");
38
32
  if (await Bun.file(pkgPath).exists()) {
@@ -47,9 +41,7 @@ export async function resolveStartEntry(
47
41
  const path = resolve(cwd, candidate);
48
42
  if (await Bun.file(path).exists()) return path;
49
43
  }
50
- throw new Error(
51
- "oke start: no entry found — set package.json okengine.entry or pass --entry",
52
- );
44
+ throw new Error("oke start: no entry found — set package.json okengine.entry or pass --entry");
53
45
  }
54
46
 
55
47
  /**
@@ -63,10 +55,7 @@ export async function runStart(options: StartOptions = {}): Promise<number> {
63
55
  try {
64
56
  const entry = await resolveStartEntry(cwd, options.entry);
65
57
  const port = String(options.port ?? Number(Bun.env.PORT ?? APP_PORT));
66
- const env = { ...process.env, NODE_ENV: "production", PORT: port } as Record<
67
- string,
68
- string
69
- >;
58
+ const env = { ...process.env, NODE_ENV: "production", PORT: port } as Record<string, string>;
70
59
  write(`oke start: ${entry} (port ${port})\n`);
71
60
  if (options.runEntry) {
72
61
  await options.runEntry(entry, env);
@@ -2,10 +2,7 @@
2
2
  * `oke upgrade` — run codemods for a breaking change, print the diff.
3
3
  */
4
4
 
5
- import {
6
- runCodemods,
7
- type CodemodChange,
8
- } from "../upgrade/codemods.ts";
5
+ import { runCodemods, type CodemodChange } from "../upgrade/codemods.ts";
9
6
 
10
7
  /** One file rewrite produced by a codemod. */
11
8
  export type UpgradeChange = CodemodChange;
@@ -2,9 +2,43 @@
2
2
  * `oke vault` — set · list · import · key rotate.
3
3
  */
4
4
 
5
+ import { existsSync, readFileSync } from "node:fs";
5
6
  import { resolve } from "node:path";
6
7
  import { parseDotenv, formatDotenv } from "../drivers/vault-dotenv-parse.ts";
7
8
 
9
+ /** Resolved OpenBao target for direct API writes (docker / prod vault). */
10
+ interface OpenBaoTarget {
11
+ readonly url: string;
12
+ readonly token: string;
13
+ readonly mount: string;
14
+ }
15
+
16
+ /**
17
+ * Resolve a live OpenBao target when the active vault is OpenBao.
18
+ *
19
+ * Sources, in order: `OKE_VAULT_*` env · persisted `.oke/openbao/` host
20
+ * material + `docker/.env.docker` URL. Returns `null` when neither resolves
21
+ * (local dotenv loop) so `oke vault set` keeps the file path.
22
+ *
23
+ * @param cwd - Project root
24
+ */
25
+ export async function resolveOpenBaoTarget(cwd: string): Promise<OpenBaoTarget | null> {
26
+ const mount = process.env.OKE_VAULT_MOUNT ?? "secret";
27
+ const envUrl = process.env.OKE_VAULT_URL;
28
+ const envToken = process.env.OKE_VAULT_TOKEN;
29
+ if (envUrl && envToken) {
30
+ return { url: envUrl.replace(/\/$/, ""), token: envToken, mount };
31
+ }
32
+ const appTokenPath = resolve(cwd, ".oke/openbao/app.token");
33
+ const composeEnvPath = resolve(cwd, "docker/.env.docker");
34
+ if (!existsSync(appTokenPath) || !existsSync(composeEnvPath)) return null;
35
+ const envFile = parseDotenv(readFileSync(composeEnvPath, "utf8"));
36
+ const url = envFile.get("OKE_VAULT_URL");
37
+ const token = readFileSync(appTokenPath, "utf8").trim();
38
+ if (!url || !token) return null;
39
+ return { url: url.replace(/\/$/, ""), token, mount };
40
+ }
41
+
8
42
  /** In-memory / file-backed vault bag for CLI (dotenv-shaped). */
9
43
  export interface VaultCliStore {
10
44
  get(name: string): string | undefined;
@@ -78,6 +112,35 @@ oke vault key rotate
78
112
  console.error("Usage: oke vault set <NAME> [value]");
79
113
  return 1;
80
114
  }
115
+ const ob = await resolveOpenBaoTarget(cwd);
116
+ if (ob && !options.store && !options.envFile) {
117
+ let value = rest[1];
118
+ if (value === undefined) {
119
+ const read =
120
+ options.readLine ??
121
+ (async () => {
122
+ write(`Enter value for ${name}: `);
123
+ const chunks: Buffer[] = [];
124
+ for await (const chunk of Bun.stdin.stream()) {
125
+ chunks.push(Buffer.from(chunk));
126
+ if (Buffer.concat(chunks).includes(0x0a)) break;
127
+ }
128
+ return Buffer.concat(chunks).toString("utf8").trim();
129
+ });
130
+ value = await read(`Enter value for ${name}: `);
131
+ }
132
+ const res = await fetch(`${ob.url}/v1/${ob.mount}/data/${encodeURIComponent(name)}`, {
133
+ method: "POST",
134
+ headers: { "X-Vault-Token": ob.token, "content-type": "application/json" },
135
+ body: JSON.stringify({ data: { value } }),
136
+ });
137
+ if (!res.ok) {
138
+ console.error(`oke vault: OpenBao write failed (${res.status}) — sealed / unauthorized?`);
139
+ return 1;
140
+ }
141
+ write(`oke vault: set ${name} (openbao)\n`);
142
+ return 0;
143
+ }
81
144
  let value = rest[1];
82
145
  if (value === undefined) {
83
146
  const read =
@@ -4,12 +4,7 @@
4
4
  */
5
5
 
6
6
  import { createClient } from "./create.ts";
7
- import {
8
- isErrorCode,
9
- isFail,
10
- isOk,
11
- isTransportError,
12
- } from "./errors.ts";
7
+ import { isErrorCode, isFail, isOk, isTransportError } from "./errors.ts";
13
8
  import { createTransport } from "./transport.ts";
14
9
 
15
10
  /**
@@ -26,10 +26,7 @@ type BookingsApp = AppOf<{
26
26
  }>;
27
27
 
28
28
  /** Compile-time equality. */
29
- type Eq<A, B> =
30
- (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2
31
- ? true
32
- : false;
29
+ type Eq<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
33
30
  type Assert<T extends true> = T;
34
31
 
35
32
  describe("createClient — same-repo <App>", () => {
@@ -73,9 +70,7 @@ describe("createClient — same-repo <App>", () => {
73
70
  if (error?.code === "FlightFull") {
74
71
  // Runtime + type-level: seatsLeft is number, not unknown.
75
72
  expect(error.data.seatsLeft).toBe(2);
76
- type _Narrow = Assert<
77
- Eq<typeof error.data, { seatsLeft: number }>
78
- >;
73
+ type _Narrow = Assert<Eq<typeof error.data, { seatsLeft: number }>>;
79
74
  const _keep: _Narrow = true;
80
75
  expect(_keep).toBe(true);
81
76
  } else {
@@ -135,11 +130,10 @@ describe("createClient — type helpers", () => {
135
130
  const ok: _Codes = true;
136
131
  expect(ok).toBe(true);
137
132
 
138
- const sample: ClientResult<{ id: string }, { FlightFull: { seatsLeft: number } }> =
139
- {
140
- data: null,
141
- error: { code: "FlightFull", data: { seatsLeft: 0 } },
142
- };
133
+ const sample: ClientResult<{ id: string }, { FlightFull: { seatsLeft: number } }> = {
134
+ data: null,
135
+ error: { code: "FlightFull", data: { seatsLeft: 0 } },
136
+ };
143
137
  if (sample.error?.code === "FlightFull") {
144
138
  type _D = Assert<Eq<typeof sample.error.data, { seatsLeft: number }>>;
145
139
  const d: _D = true;
@@ -13,12 +13,7 @@
13
13
  */
14
14
 
15
15
  import { createTransport, type Transport } from "./transport.ts";
16
- import type {
17
- Client,
18
- ClientOptions,
19
- ClientRouteMap,
20
- ResolveApp,
21
- } from "./types.ts";
16
+ import type { Client, ClientOptions, ClientRouteMap, ResolveApp } from "./types.ts";
22
17
 
23
18
  /** App-shaped value that carries a runtime `$routes` table from typed adopt. */
24
19
  export interface AppWithRoutes {
@@ -98,8 +93,7 @@ export function flattenRoutes(
98
93
  $routes: ClientRouteMap | undefined,
99
94
  ): ClientOptions["routes"] | undefined {
100
95
  if (!$routes) return undefined;
101
- const out: Record<string, { readonly method: string; readonly path: string }> =
102
- {};
96
+ const out: Record<string, { readonly method: string; readonly path: string }> = {};
103
97
  for (const [unit, flows] of Object.entries($routes)) {
104
98
  if (!flows || typeof flows !== "object") continue;
105
99
  for (const [flow, contract] of Object.entries(flows)) {
@@ -30,10 +30,7 @@ export function isTransportError(
30
30
  export function isErrorCode<
31
31
  Err extends { readonly code: string; readonly data: unknown },
32
32
  C extends Err["code"],
33
- >(
34
- error: Err | null | undefined,
35
- code: C,
36
- ): error is Extract<Err, { readonly code: C }> {
33
+ >(error: Err | null | undefined, code: C): error is Extract<Err, { readonly code: C }> {
37
34
  return error != null && error.code === code;
38
35
  }
39
36
 
@@ -7,12 +7,7 @@
7
7
 
8
8
  export { createClient, flattenRoutes } from "./create.ts";
9
9
  export type { AppWithRoutes } from "./create.ts";
10
- export {
11
- isErrorCode,
12
- isFail,
13
- isOk,
14
- isTransportError,
15
- } from "./errors.ts";
10
+ export { isErrorCode, isFail, isOk, isTransportError } from "./errors.ts";
16
11
  export { createTransport } from "./transport.ts";
17
12
  export type { Transport } from "./transport.ts";
18
13
  export type {