okengine 0.2.6 → 0.3.2

package/src/runs/runs.test.ts

@@ -184,9 +184,7 @@ describe("locality — local + object storage", () => {
     expect(localKeys.some((k) => k.endsWith(".parquet"))).toBe(true);
     expect(remoteKeys.some((k) => k.endsWith(".parquet"))).toBe(true);
 
-    const rows = await runs.query(
-      "SELECT id, dim_locality AS locality FROM runs ORDER BY id",
-    );
+    const rows = await runs.query("SELECT id, dim_locality AS locality FROM runs ORDER BY id");
     expect(rows.length).toBe(2);
     const ids = rows.map((r) => String(r.id)).sort();
     expect(ids).toEqual(["archived", "recent"]);
@@ -242,9 +240,7 @@ describe("crypto-shredding erasure", () => {
 
     // Snapshot partition bytes before erase
     const bucket = await fsDriver.open({ name: "snap", root: root });
-    const keysBefore = (await bucket.list("runs/")).filter((k) =>
-      k.endsWith(".parquet"),
-    );
+    const keysBefore = (await bucket.list("runs/")).filter((k) => k.endsWith(".parquet"));
     expect(keysBefore.length).toBeGreaterThan(0);
     const bytesBefore = await bucket.get(keysBefore[0]!);
     expect(bytesBefore).toBeTruthy();
@@ -262,9 +258,7 @@ describe("crypto-shredding erasure", () => {
     expect(bytesAfter).toEqual(bytesBefore);
 
     // Query still returns the row (operational dims intact)
-    const rows = await runs.query(
-      "SELECT id, subject_id FROM runs WHERE id = 'run_erase'",
-    );
+    const rows = await runs.query("SELECT id, subject_id FROM runs WHERE id = 'run_erase'");
     expect(rows.length).toBe(1);
     expect(rows[0]!.subject_id).toBe(subjectId);
 

package/src/runs/runtime.ts

@@ -7,17 +7,8 @@ import { clickhouseRunsDriver } from "./drivers/clickhouse.ts";
 import { filesRunsDriver } from "./drivers/files.ts";
 import { memoryRunsDriver } from "./drivers/memory.ts";
 import { postgresRunsDriver } from "./drivers/postgres.ts";
-import {
-  explainOutliers,
-  type ExplainOutliersOptions,
-  type OutlierFinding,
-} from "./outlier.ts";
-import {
-  archiveFields,
-  eraseSubject,
-  revealArchived,
-  type SubjectKeyVault,
-} from "./shred.ts";
+import { explainOutliers, type ExplainOutliersOptions, type OutlierFinding } from "./outlier.ts";
+import { archiveFields, eraseSubject, revealArchived, type SubjectKeyVault } from "./shred.ts";
 import type {
   RunsDriver,
   RunsDriverId,
@@ -114,9 +105,7 @@ const DRIVER_BY_ID: Record<RunsDriverId, RunsDriver> = {
  *
  * @param driver - Id or driver
  */
-export function resolveRunsDriver(
-  driver?: RunsDriverId | RunsDriver,
-): RunsDriver {
+export function resolveRunsDriver(driver?: RunsDriverId | RunsDriver): RunsDriver {
   if (!driver) return filesRunsDriver;
   if (typeof driver === "string") {
     const d = DRIVER_BY_ID[driver];
@@ -131,9 +120,7 @@ export function resolveRunsDriver(
  *
  * @param options - Driver + locality + subject keys
  */
-export function createRunsRuntime(
-  options: CreateRunsRuntimeOptions = {},
-): RunsRuntime {
+export function createRunsRuntime(options: CreateRunsRuntimeOptions = {}): RunsRuntime {
   const driver = resolveRunsDriver(options.driver);
   let store: RunsStore | undefined;
   const subjectKeys = options.subjectKeys;
@@ -156,21 +143,14 @@ export function createRunsRuntime(
       const s = await ensureStore();
       let archived = input.archived;
       const subjectId =
-        input.telemetry.subjectId ??
-        input.fx.auth.userId ??
-        input.fx.tenant.id ??
-        null;
+        input.telemetry.subjectId ?? input.fx.auth.userId ?? input.fx.tenant.id ?? null;
       if (
         archiveCleartext &&
         subjectId &&
         subjectKeys &&
         Object.keys(archiveCleartext).length > 0
       ) {
-        archived = await archiveFields(
-          subjectKeys,
-          subjectId,
-          archiveCleartext,
-        );
+        archived = await archiveFields(subjectKeys, subjectId, archiveCleartext);
       }
       const event = collectWideEvent({
         ...input,
@@ -221,9 +201,4 @@ export function createRunsRuntime(
   };
 }
 
-export {
-  filesRunsDriver,
-  memoryRunsDriver,
-  postgresRunsDriver,
-  clickhouseRunsDriver,
-};
+export { filesRunsDriver, memoryRunsDriver, postgresRunsDriver, clickhouseRunsDriver };

package/src/runs/shred.ts

@@ -83,9 +83,7 @@ export function subjectKeysFromVault(vault: VaultRuntime): SubjectKeyVault {
 /**
  * In-memory subject-key vault (tests / when no Vault element is wired).
  */
-export function createMemorySubjectKeys(
-  seed?: Readonly<Record<string, string>>,
-): SubjectKeyVault {
+export function createMemorySubjectKeys(seed?: Readonly<Record<string, string>>): SubjectKeyVault {
   const map = new Map<string, string>(Object.entries(seed ?? {}));
   return {
     read(name) {
@@ -181,26 +179,16 @@ export async function revealArchived(
  * @param subjectId - Subject id
  * @returns Whether a key was deleted
  */
-export function eraseSubject(
-  keys: SubjectKeyVault,
-  subjectId: string,
-): boolean {
+export function eraseSubject(keys: SubjectKeyVault, subjectId: string): boolean {
   return keys.delete(subjectKeyName(subjectId));
 }
 
-async function encryptAesGcm(
-  plaintext: string,
-  keyBytes: Uint8Array,
-): Promise<string> {
+async function encryptAesGcm(plaintext: string, keyBytes: Uint8Array): Promise<string> {
   const iv = crypto.getRandomValues(new Uint8Array(12));
   const keyBuf = toArrayBuffer(keyBytes);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyBuf,
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"],
-  );
+  const cryptoKey = await crypto.subtle.importKey("raw", keyBuf, { name: "AES-GCM" }, false, [
+    "encrypt",
+  ]);
   const cipher = await crypto.subtle.encrypt(
     { name: "AES-GCM", iv },
     cryptoKey,
@@ -212,21 +200,14 @@ async function encryptAesGcm(
   return Buffer.from(packed).toString("base64");
 }
 
-async function decryptAesGcm(
-  blob: string,
-  keyBytes: Uint8Array,
-): Promise<string> {
+async function decryptAesGcm(blob: string, keyBytes: Uint8Array): Promise<string> {
   const packed = Buffer.from(blob, "base64");
   const iv = toArrayBuffer(packed.subarray(0, 12));
   const data = toArrayBuffer(packed.subarray(12));
   const keyBuf = toArrayBuffer(keyBytes);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyBuf,
-    { name: "AES-GCM" },
-    false,
-    ["decrypt"],
-  );
+  const cryptoKey = await crypto.subtle.importKey("raw", keyBuf, { name: "AES-GCM" }, false, [
+    "decrypt",
+  ]);
   const plain = await crypto.subtle.decrypt(
     { name: "AES-GCM", iv: new Uint8Array(iv) },
     cryptoKey,

package/src/runs/types.ts

@@ -26,10 +26,7 @@ export interface RunError {
  * Declared / observed dimensions available without manual instrumentation.
  * Extra keys are allowed for outlier analysis.
  */
-export type RunDimensions = Record<
-  string,
-  string | number | boolean | null | undefined
->;
+export type RunDimensions = Record<string, string | number | boolean | null | undefined>;
 
 /**
  * One wide event — the atomic observability record.

package/src/runtime/bun.ts

@@ -26,10 +26,7 @@ export interface BunRuntime extends Runtime {
    * @param filename - Path, `":memory:"`, or omit for memory
    * @param options - `bun:sqlite` open options
    */
-  sqlite(
-    filename?: string,
-    options?: ConstructorParameters<typeof Database>[1],
-  ): Database;
+  sqlite(filename?: string, options?: ConstructorParameters<typeof Database>[1]): Database;
 }
 
 /**
@@ -43,9 +40,7 @@ export function createBunRuntime(): BunRuntime {
     env: createEnv(),
     files: createFiles(),
     sqlite(filename = ":memory:", options) {
-      return options === undefined
-        ? new Database(filename)
-        : new Database(filename, options);
+      return options === undefined ? new Database(filename) : new Database(filename, options);
     },
     serve(app, options) {
       return listenBun(app, options);
@@ -67,9 +62,7 @@ export function isBunNativePath(path: string): boolean {
   return true;
 }
 
-type MethodHandlers = Partial<
-  Record<string, (req: Request) => Response | Promise<Response>>
->;
+type MethodHandlers = Partial<Record<string, (req: Request) => Response | Promise<Response>>>;
 
 /**
  * Build Bun.serve `routes` from app HTTP bindings.
@@ -99,11 +92,7 @@ export function buildBunRoutes(
 function listenBun(app: FetchApp, options?: ServeOptions): ServerHandle {
   const port = options?.port ?? APP_PORT;
   const hostname = options?.hostname ?? "127.0.0.1";
-  const fetchHandler = secureFetch(
-    (req) => app.fetch(req),
-    options,
-    hostname,
-  );
+  const fetchHandler = secureFetch((req) => app.fetch(req), options, hostname);
   const routes = buildBunRoutes(app, fetchHandler);
 
   const server = Bun.serve({

package/src/runtime/cold-start.bench.ts

@@ -12,9 +12,7 @@ import { measureColdStartMedianMs } from "../release/measure.ts";
 describe("cold start budget", () => {
   test(`Bun adapter ready in < ${COLD_START_BUDGET_MS} ms`, async () => {
     const median = await measureColdStartMedianMs();
-    console.log(
-      `cold-start median=${median.toFixed(2)} ms budget=${COLD_START_BUDGET_MS}`,
-    );
+    console.log(`cold-start median=${median.toFixed(2)} ms budget=${COLD_START_BUDGET_MS}`);
     expect(median).toBeLessThan(COLD_START_BUDGET_MS);
   });
 });

package/src/runtime/dev-request-log.test.ts

@@ -3,10 +3,7 @@
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
-import {
-  isSilentDevRequest,
-  shouldLogDevRequests,
-} from "./dev-request-log.ts";
+import { isSilentDevRequest, shouldLogDevRequests } from "./dev-request-log.ts";
 
 describe("dev-request-log", () => {
   const prev = process.env.OKE_DEV_REQUEST_LOG;

package/src/runtime/dev-request-log.ts

@@ -103,10 +103,7 @@ export async function timedDevFetch(
   handle: (request: Request) => Response | Promise<Response>,
   options: {
     readonly surface?: DevLogSurface;
-    readonly resolveFlow?: (
-      request: Request,
-      response: Response,
-    ) => string | undefined;
+    readonly resolveFlow?: (request: Request, response: Response) => string | undefined;
     /** Skip logging for this path/method. */
     readonly silent?: (request: Request) => boolean;
   } = {},

package/src/runtime/index.ts

@@ -2,12 +2,7 @@
  * Runtime adapters: Bun (primary) · Web Standards (Node / Deno / edge).
  */
 
-export {
-  createBunRuntime,
-  buildBunRoutes,
-  isBunNativePath,
-  type BunRuntime,
-} from "./bun.ts";
+export { createBunRuntime, buildBunRoutes, isBunNativePath, type BunRuntime } from "./bun.ts";
 
 export {
   createEnv,

package/src/runtime/primitives.ts

@@ -44,8 +44,8 @@ export function createTimers(): RuntimeTimers {
 export function createEnv(): RuntimeEnv {
   return {
     get(key) {
-      const bunEnv = (globalThis as { Bun?: { env?: Record<string, string | undefined> } })
-        .Bun?.env;
+      const bunEnv = (globalThis as { Bun?: { env?: Record<string, string | undefined> } }).Bun
+        ?.env;
       if (bunEnv && key in bunEnv) return bunEnv[key];
       const proc = (globalThis as { process?: { env?: Record<string, string | undefined> } })
         .process?.env;
@@ -70,8 +70,9 @@ export function createEnv(): RuntimeEnv {
 export function createFiles(): RuntimeFiles {
   return {
     async read(path) {
-      const bun = (globalThis as { Bun?: { file?(p: string): { arrayBuffer(): Promise<ArrayBuffer> } } })
-        .Bun;
+      const bun = (
+        globalThis as { Bun?: { file?(p: string): { arrayBuffer(): Promise<ArrayBuffer> } } }
+      ).Bun;
       if (bun?.file) {
         return new Uint8Array(await bun.file(path).arrayBuffer());
       }

package/src/runtime/security.ts

@@ -10,12 +10,7 @@
 import type { ServeOptions } from "./types.ts";
 
 /** Loopback names always accepted alongside the listen hostname. */
-const LOOPBACK_HOSTS: readonly string[] = [
-  "localhost",
-  "127.0.0.1",
-  "::1",
-  "[::1]",
-];
+const LOOPBACK_HOSTS: readonly string[] = ["localhost", "127.0.0.1", "::1", "[::1]"];
 
 /**
  * Build the effective allow-list: loopback + listen hostname + user extras.
@@ -76,10 +71,7 @@ export function normalizeHost(raw: string): string {
  * @param host - Normalized host
  * @param allowed - Allow-list
  */
-export function isHostAllowed(
-  host: string,
-  allowed: ReadonlySet<string>,
-): boolean {
+export function isHostAllowed(host: string, allowed: ReadonlySet<string>): boolean {
   if (host.length === 0) return false;
   if (allowed.has(host)) return true;
   // Bracketed IPv6 sibling
@@ -138,9 +130,7 @@ export function checkRequestSecurity(
 /** 403 body for a failed Host / Origin check. */
 export function forbiddenResponse(reason: "host" | "origin"): Response {
   const message =
-    reason === "host"
-      ? "Forbidden: unexpected Host header"
-      : "Forbidden: unexpected Origin header";
+    reason === "host" ? "Forbidden: unexpected Host header" : "Forbidden: unexpected Origin header";
   return new Response(message, {
     status: 403,
     headers: { "content-type": "text/plain; charset=utf-8" },

package/src/runtime/serve.test.ts

@@ -107,13 +107,10 @@ describe("Bun.serve — real HTTP", () => {
     expect(await direct.text()).toContain("Host");
 
     // On the wire — the DNS-rebinding shape (CVE-2025-66414 class).
-    const wire = await rawHttp(handle.port, [
-      "GET /ping HTTP/1.1",
-      "Host: attacker.com",
-      "Connection: close",
-      "",
-      "",
-    ].join("\r\n"));
+    const wire = await rawHttp(
+      handle.port,
+      ["GET /ping HTTP/1.1", "Host: attacker.com", "Connection: close", "", ""].join("\r\n"),
+    );
     expect(wire).toContain("403");
     expect(wire).toContain("Host");
   });

package/src/runtime/types.ts

@@ -151,10 +151,7 @@ export interface RuntimeCrypto {
    * @param password - Plaintext
    * @param algorithm - Hash algorithm (Bun default `argon2id`)
    */
-  hashPassword(
-    password: string,
-    algorithm?: PasswordAlgorithm,
-  ): Promise<string>;
+  hashPassword(password: string, algorithm?: PasswordAlgorithm): Promise<string>;
   /**
    * Verify a password against a hash from {@link RuntimeCrypto.hashPassword}.
    *

package/src/runtime/web-standard.ts

@@ -13,12 +13,7 @@
  * Host / Origin validation is identical to the Bun adapter (console §10.1).
  */
 
-import {
-  createEnv,
-  createFiles,
-  createTimers,
-  createWebCrypto,
-} from "./primitives.ts";
+import { createEnv, createFiles, createTimers, createWebCrypto } from "./primitives.ts";
 import { secureFetch } from "./security.ts";
 import {
   APP_PORT,
@@ -50,17 +45,10 @@ export function createWebStandardRuntime(): Runtime {
  * @param app - Application
  * @param options - Port/hostname metadata + `allowedHosts`
  */
-function createFetchHandle(
-  app: FetchApp,
-  options?: ServeOptions,
-): ServerHandle {
+function createFetchHandle(app: FetchApp, options?: ServeOptions): ServerHandle {
   const port = options?.port ?? APP_PORT;
   const hostname = options?.hostname ?? "127.0.0.1";
-  const fetchHandler = secureFetch(
-    (req) => app.fetch(req),
-    options,
-    hostname,
-  );
+  const fetchHandler = secureFetch((req) => app.fetch(req), options, hostname);
   const url = new URL(
     `http://${hostname.includes(":") && !hostname.startsWith("[") ? `[${hostname}]` : hostname}:${port}/`,
   );

package/src/term.test.ts

@@ -34,7 +34,7 @@ describe("term", () => {
     const out = formatDevBanner({
       color: false,
       version: "0.2.4",
-      profile: "local-server",
+      profile: "docker",
       runtimeEnv: "local",
       system: "darwin 25.4.0 · bun 1.3.14",
       elements: [
@@ -45,7 +45,7 @@ describe("term", () => {
     });
     expect(out).toContain("oke dev  v0.2.4");
     expect(out).toContain("profile");
-    expect(out).toContain("local-server");
+    expect(out).toContain("docker");
     expect(out).toContain("env");
     expect(out).toContain("local");
     expect(out).toContain("system");
@@ -62,9 +62,7 @@ describe("term", () => {
     expect(formatServiceLine("Console", "http://127.0.0.1:6533", false)).toContain(
       "http://127.0.0.1:6533",
     );
-    expect(formatAppReadyLine("http://127.0.0.1:6530", false)).toContain(
-      "http://127.0.0.1:6530",
-    );
+    expect(formatAppReadyLine("http://127.0.0.1:6530", false)).toContain("http://127.0.0.1:6530");
   });
 
   test("formatDevHero keeps App Console MCP URLs", () => {
@@ -137,7 +135,7 @@ describe("term", () => {
       appDrivers: ["postgres", "redis"],
       color: false,
     });
-    expect(out).toContain("Stack");
+    expect(out).toContain("Docker");
     expect(out).toContain(":15975");
     expect(out).not.toMatch(/\u001b\[/);
   });