okengine 0.2.8 → 0.3.2

package/src/drivers/memory.ts

@@ -45,28 +45,42 @@ function createMemorySqlConnection(role: "primary" | "replica"): SqlConnection {
     async query(sql, params = []) {
       const text = sql.trim();
 
+      const countStar =
+        /^SELECT\s+COUNT\(\*\)\s+AS\s+"?[a-zA-Z_][a-zA-Z0-9_]*"?\s+FROM\s+("?[a-zA-Z_][a-zA-Z0-9_]*"?)\s*(?:WHERE\s+(.+?))?\s*$/i.exec(
+          text,
+        );
+      if (countStar) {
+        const table = getTable(parseIdent(countStar[1]!));
+        const whereClause = countStar[2]?.trim();
+        let rows = table.rows;
+        if (whereClause) {
+          const ast = parseWhere(whereClause);
+          rows = rows.filter((r) => evalWhere(ast, r, params, { i: 0 }));
+        }
+        return [{ count: rows.length }];
+      }
+
       const selectGeneric =
-        /^SELECT\s+(.+?)\s+FROM\s+("?[a-zA-Z_][a-zA-Z0-9_]*"?)\s*(?:WHERE\s+(.+?))?(?:\s+ORDER\s+BY\s+("?[a-zA-Z_][a-zA-Z0-9_]*"?))?(?:\s+LIMIT\s+(\d+))?\s*$/i.exec(
+        /^SELECT\s+(.+?)\s+FROM\s+("?[a-zA-Z_][a-zA-Z0-9_]*"?)\s*(?:WHERE\s+(.+?))?(?:\s+ORDER\s+BY\s+(.+?))?(?:\s+LIMIT\s+(\d+))?(?:\s+OFFSET\s+(\d+))?\s*$/i.exec(
           text,
         );
       if (selectGeneric && !/^\s*1\s+AS\s+/i.test(selectGeneric[1]!)) {
         const table = getTable(parseIdent(selectGeneric[2]!));
         const selectList = selectGeneric[1]!.trim();
         const whereClause = selectGeneric[3]?.trim();
-        const orderCol = selectGeneric[4] ? parseIdent(selectGeneric[4]) : undefined;
+        const orderClause = selectGeneric[4]?.trim();
         const limit = selectGeneric[5] ? Number(selectGeneric[5]) : undefined;
+        const offset = selectGeneric[6] ? Number(selectGeneric[6]) : undefined;
         let rows = table.rows.map((r) => ({ ...r }));
         if (whereClause) {
-          const preds = parseWherePredicates(whereClause);
-          rows = rows.filter((r) =>
-            preds.every((p, i) => compareRow(r[p.column], params[i], p.op)),
-          );
+          const ast = parseWhere(whereClause);
+          rows = rows.filter((r) => evalWhere(ast, r, params, { i: 0 }));
         }
-        if (orderCol) {
-          rows = [...rows].sort((a, b) =>
-            String(a[orderCol] ?? "").localeCompare(String(b[orderCol] ?? "")),
-          );
+        if (orderClause) {
+          const terms = parseOrderTerms(orderClause);
+          rows = [...rows].sort((a, b) => compareByTerms(a, b, terms));
         }
+        if (offset !== undefined) rows = rows.slice(offset);
         if (limit !== undefined) rows = rows.slice(0, limit);
         if (selectList === "*") return rows;
         const cols = selectList.split(",").map((part) => {
@@ -224,10 +238,8 @@ function createMemorySqlConnection(role: "primary" | "replica"): SqlConnection {
           if (!m) throw new Error(`memory sql: unsupported SET: ${part}`);
           return parseIdent(m[1]!);
         });
-        const preds = parseWherePredicates(updateSet[3]!);
-        const row = table.rows.find((r) =>
-          preds.every((p, i) => compareRow(r[p.column], params[setCols.length + i], p.op)),
-        );
+        const ast = parseWhere(updateSet[3]!);
+        const row = table.rows.find((r) => evalWhere(ast, r, params, { i: setCols.length }));
         if (!row) return { changes: 0 };
         setCols.forEach((col, i) => {
           row[col] = params[i];
@@ -243,52 +255,279 @@ function createMemorySqlConnection(role: "primary" | "replica"): SqlConnection {
   };
 }
 
-/** Parse `col = ? AND col2 = ?` into ordered column names. */
+/** One comparison operator for the memory SQL driver. */
+type WhereOp =
+  | "="
+  | "<"
+  | ">"
+  | "<="
+  | ">="
+  | "!="
+  | "like"
+  | "ilike"
+  | "in"
+  | "is null"
+  | "is not null";
+
+/** WHERE condition AST node — leaf comparison or AND/OR group. */
+type WhereNode =
+  | { readonly kind: "cmp"; readonly column: string; readonly op: WhereOp; readonly arity: number }
+  | { readonly kind: "and"; readonly children: readonly WhereNode[] }
+  | { readonly kind: "or"; readonly children: readonly WhereNode[] };
+
+/** One `ORDER BY` term. */
+interface OrderTerm {
+  readonly column: string;
+  readonly direction: "ASC" | "DESC";
+}
+
+/**
+ * Parse a WHERE clause into an AST. Supports parenthesized groups, `AND` /
+ * `OR`, binary comparisons, and `like` / `ilike` — the shapes the store
+ * session compiler emits. Anything else throws.
+ *
+ * @param clause - WHERE text (without the `WHERE` keyword)
+ */
+function parseWhere(clause: string): WhereNode {
+  const tokens = tokenizeWhere(clause);
+  const unsupported = (): Error => new Error(`memory sql: unsupported WHERE: ${clause}`);
+  let pos = 0;
+
+  const peek = (): string | undefined => tokens[pos];
+  const parseLevel = (keyword: "AND" | "OR", down: () => WhereNode): WhereNode => {
+    const first = down();
+    if (peek()?.toUpperCase() !== keyword) return first;
+    const rest: WhereNode[] = [];
+    do {
+      pos++;
+      rest.push(down());
+    } while (peek()?.toUpperCase() === keyword);
+    const children = [first, ...rest];
+    return keyword === "AND" ? { kind: "and", children } : { kind: "or", children };
+  };
+  const parseFactor = (): WhereNode => {
+    if (peek() === "(") {
+      pos++;
+      const node = parseLevel("OR", () => parseLevel("AND", parseFactor));
+      if (peek() !== ")") throw unsupported();
+      pos++;
+      return node;
+    }
+    const colTok = tokens[pos++];
+    const opTok = tokens[pos++];
+    if (colTok === undefined || opTok === undefined) throw unsupported();
+    if (opTok.toLowerCase() === "is") {
+      const second = tokens[pos++]?.toLowerCase();
+      const nullOp =
+        second === "null"
+          ? "is null"
+          : second === "not" && tokens[pos++]?.toLowerCase() === "null"
+            ? "is not null"
+            : undefined;
+      if (nullOp === undefined) throw unsupported();
+      return { kind: "cmp", column: colTok.replaceAll('"', "").trim(), op: nullOp, arity: 0 };
+    }
+    if (opTok.toLowerCase() === "in") {
+      if (peek() !== "(") throw unsupported();
+      pos++;
+      let arity = 0;
+      while (peek() === "?") {
+        arity++;
+        pos++;
+        if (peek() === ",") pos++;
+      }
+      if (arity === 0 || peek() !== ")") throw unsupported();
+      pos++;
+      return { kind: "cmp", column: colTok.replaceAll('"', "").trim(), op: "in", arity };
+    }
+    const paramTok = tokens[pos++];
+    if (paramTok !== "?") throw unsupported();
+    const op = asWhereOp(opTok);
+    if (op === undefined) throw unsupported();
+    return { kind: "cmp", column: colTok.replaceAll('"', "").trim(), op, arity: 1 };
+  };
+
+  const node = parseLevel("OR", () => parseLevel("AND", parseFactor));
+  if (pos !== tokens.length) throw unsupported();
+  return node;
+}
+
+function tokenizeWhere(clause: string): string[] {
+  const out: string[] = [];
+  let i = 0;
+  while (i < clause.length) {
+    const ch = clause[i]!;
+    if (/\s/.test(ch)) {
+      i++;
+      continue;
+    }
+    if (ch === "(" || ch === ")" || ch === "?" || ch === ",") {
+      out.push(ch);
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      const end = clause.indexOf('"', i + 1);
+      if (end === -1) throw new Error(`memory sql: unsupported WHERE: ${clause}`);
+      out.push(clause.slice(i, end + 1));
+      i = end + 1;
+      continue;
+    }
+    const two = clause.slice(i, i + 2);
+    if (two === "<=" || two === ">=" || two === "<>" || two === "!=") {
+      out.push(two);
+      i += 2;
+      continue;
+    }
+    if (ch === "=" || ch === "<" || ch === ">") {
+      out.push(ch);
+      i++;
+      continue;
+    }
+    const word = /^[a-zA-Z_][a-zA-Z0-9_]*/.exec(clause.slice(i));
+    if (word) {
+      out.push(word[0]);
+      i += word[0].length;
+      continue;
+    }
+    throw new Error(`memory sql: unsupported WHERE: ${clause}`);
+  }
+  return out;
+}
+
+function asWhereOp(token: string): WhereOp | undefined {
+  switch (token.toLowerCase()) {
+    case "=":
+      return "=";
+    case "<":
+      return "<";
+    case ">":
+      return ">";
+    case "<=":
+      return "<=";
+    case ">=":
+      return ">=";
+    case "!=":
+    case "<>":
+      return "!=";
+    case "like":
+      return "like";
+    case "ilike":
+      return "ilike";
+    default:
+      return undefined;
+  }
+}
+
+/** Evaluate a WHERE AST against a row, consuming `?` params in order. */
+function evalWhere(
+  node: WhereNode,
+  row: SqlRow,
+  params: readonly unknown[],
+  state: { i: number },
+): boolean {
+  if (node.kind === "and") {
+    return node.children.every((c) => evalWhere(c, row, params, state));
+  }
+  if (node.kind === "or") {
+    return node.children.some((c) => evalWhere(c, row, params, state));
+  }
+  if (node.op === "is null") {
+    return row[node.column] === null || row[node.column] === undefined;
+  }
+  if (node.op === "is not null") {
+    return row[node.column] !== null && row[node.column] !== undefined;
+  }
+  if (node.op === "in") {
+    const wants = params.slice(state.i, state.i + node.arity);
+    state.i += node.arity;
+    return wants.some((w) => compareRow(row[node.column], w, "="));
+  }
+  const want = params[state.i++];
+  return compareRow(row[node.column], want, node.op);
+}
+
+/** Parse `col = ? AND col2 = ?` into ordered column names (equality-only). */
 function parseEqualityWhere(clause: string): string[] {
-  return parseWherePredicates(clause).map((p) => {
-    if (p.op !== "=") {
+  const node = parseWhere(clause);
+  const cols: string[] = [];
+  const walk = (n: WhereNode): void => {
+    if (n.kind === "and") {
+      n.children.forEach(walk);
+      return;
+    }
+    if (n.kind === "or" || n.op !== "=") {
       throw new Error(`memory sql: unsupported WHERE: ${clause}`);
     }
-    return p.column;
-  });
+    cols.push(n.column);
+  };
+  walk(node);
+  return cols;
 }
 
-/** One WHERE predicate for the memory SQL driver. */
-interface WherePred {
-  readonly column: string;
-  readonly op: "=" | "<" | ">" | "<=" | ">=" | "!=";
+/** Parse `"a" DESC, "b"` into ordered terms (default ASC). */
+function parseOrderTerms(clause: string): OrderTerm[] {
+  return clause.split(",").map((part) => {
+    const m = /^\s*("?[a-zA-Z_][a-zA-Z0-9_]*"?)(?:\s+(ASC|DESC))?\s*$/i.exec(part);
+    if (!m) throw new Error(`memory sql: unsupported ORDER BY: ${clause}`);
+    return {
+      column: m[1]!.replaceAll('"', "").trim(),
+      direction: (m[2]?.toUpperCase() ?? "ASC") as OrderTerm["direction"],
+    };
+  });
 }
 
-/** Parse `col = ? AND col2 < ?` into ordered predicates. */
-function parseWherePredicates(clause: string): WherePred[] {
-  return clause.split(/\s+AND\s+/i).map((part) => {
-    const m = /^("?[a-zA-Z_][a-zA-Z0-9_]*"?)\s*(=|<=|>=|<>|!=|<|>)\s*\?$/.exec(part.trim());
-    if (!m) throw new Error(`memory sql: unsupported WHERE: ${clause}`);
-    const opRaw = m[2]!;
-    const op: WherePred["op"] = opRaw === "<>" ? "!=" : (opRaw as WherePred["op"]);
-    return { column: m[1]!.replaceAll('"', "").trim(), op };
-  });
+function compareByTerms(a: SqlRow, b: SqlRow, terms: readonly OrderTerm[]): number {
+  for (const term of terms) {
+    const av = a[term.column];
+    const bv = b[term.column];
+    let cmp: number;
+    if (typeof av === "number" && typeof bv === "number") {
+      cmp = av - bv;
+    } else {
+      cmp = String(av ?? "").localeCompare(String(bv ?? ""));
+    }
+    if (cmp !== 0) return term.direction === "DESC" ? -cmp : cmp;
+  }
+  return 0;
 }
 
-function compareRow(cell: unknown, want: unknown, op: WherePred["op"]): boolean {
+function compareRow(cell: unknown, want: unknown, op: WhereOp): boolean {
   if (op === "=") return cell === want;
   if (op === "!=") return cell !== want;
-  const a = Number(cell ?? 0);
-  const b = Number(want ?? 0);
+  // sqlite parity: LIKE is case-insensitive for ASCII; ILIKE matches it.
+  if (op === "like" || op === "ilike") return likeMatch(cell, want);
+  let cmp: number;
+  if (typeof cell === "number" && typeof want === "number") {
+    cmp = cell - want;
+  } else if (typeof cell === "string" && typeof want === "string") {
+    cmp = cell.localeCompare(want);
+  } else {
+    cmp = Number(cell ?? 0) - Number(want ?? 0);
+  }
   switch (op) {
     case "<":
-      return a < b;
+      return cmp < 0;
     case ">":
-      return a > b;
+      return cmp > 0;
     case "<=":
-      return a <= b;
+      return cmp <= 0;
     case ">=":
-      return a >= b;
+      return cmp >= 0;
     default:
       return false;
   }
 }
 
+function likeMatch(cell: unknown, pattern: unknown): boolean {
+  const text = String(cell ?? "");
+  const source = String(pattern ?? "")
+    .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    .replace(/%/g, ".*")
+    .replace(/_/g, ".");
+  return new RegExp(`^${source}$`, "i").test(text);
+}
+
 /** Memory SQL driver. */
 export const memorySqlDriver: SqlDriver = {
   id: "memory",

package/src/drivers/s3.ts

@@ -46,7 +46,16 @@ export async function openS3Bucket(options: FilesOpenOptions): Promise<FilesBuck
 }
 
 function createBunS3Client(bucket: string): S3ClientLike {
-  const s3 = new Bun.S3Client({ bucket });
+  const s3 = new Bun.S3Client({
+    bucket,
+    ...(process.env.S3_ENDPOINT ? { endpoint: process.env.S3_ENDPOINT } : {}),
+    ...(process.env.S3_ACCESS_KEY_ID ? { accessKeyId: process.env.S3_ACCESS_KEY_ID } : {}),
+    ...(process.env.S3_SECRET_ACCESS_KEY
+      ? { secretAccessKey: process.env.S3_SECRET_ACCESS_KEY }
+      : {}),
+    ...(process.env.S3_REGION ? { region: process.env.S3_REGION } : {}),
+    ...(process.env.S3_SESSION_TOKEN ? { sessionToken: process.env.S3_SESSION_TOKEN } : {}),
+  });
   return {
     file(key: string) {
       const f = s3.file(key);

package/src/drivers/vault-driver-removal.test.ts

@@ -0,0 +1,55 @@
+/**
+ * Gate: the removed vault driver id stays gone from the tracked tree.
+ *
+ * Mirrors {@link ../cli/doc-staleness.test.ts} — `git grep` must find zero
+ * hits (this file splits the token so it never matches itself).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dir, "../..");
+
+/** Forbidden driver id, split so this file does not match itself. */
+const FORBIDDEN_DRIVER = ["so", "ps"].join("");
+/** Forbidden optional peer, split so this file does not match itself. */
+const FORBIDDEN_AGE = ["age", "-", "encryption"].join("");
+
+/** Lockfiles regenerated by `bun install` — not source residue. */
+const LOCKFILE_PREFIXES = ["bun.lock:", "packages/create-oke/template/bun.lock:"];
+
+/**
+ * Run `git grep -F` and assert zero matches outside allow-listed prefixes.
+ *
+ * @param pattern - Fixed-string pattern
+ * @param ignorePrefixes - `path:line:` prefixes to ignore
+ */
+function assertZeroGitGrep(pattern: string, ignorePrefixes: readonly string[] = []): void {
+  const proc = Bun.spawnSync(["git", "grep", "-F", "-i", "-n", "-e", pattern, "--"], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  // git grep exits 1 when there are no matches.
+  if (proc.exitCode === 1) {
+    expect(proc.stdout.toString()).toBe("");
+    return;
+  }
+  const hits = proc.stdout
+    .toString()
+    .trim()
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .filter((line) => !ignorePrefixes.some((prefix) => line.startsWith(prefix)));
+  expect(hits.join("\n")).toBe("");
+}
+
+describe("removed vault driver gate", () => {
+  test("tracked tree has zero matches for the removed driver id", () => {
+    assertZeroGitGrep(FORBIDDEN_DRIVER);
+  });
+
+  test("tracked tree has zero matches for the removed age peer outside lockfiles", () => {
+    assertZeroGitGrep(FORBIDDEN_AGE, LOCKFILE_PREFIXES);
+  });
+});

package/src/drivers/vault-openbao.test.ts

@@ -0,0 +1,97 @@
+/**
+ * OpenBao vault driver — KV v2 read + write/delete + fail-loud semantics.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { OpenBaoUnavailableError, openbaoVaultDriver } from "./vault-openbao.ts";
+
+/** Scripted fetch: LIST + per-key GET, then capture writes/deletes. */
+function fakeKv(
+  seed: Record<string, string>,
+  calls: { method: string; path: string; body?: string }[],
+) {
+  return (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = new URL(String(input));
+    const method = init?.method ?? "GET";
+    calls.push({
+      method,
+      path: url.pathname + url.search,
+      body: typeof init?.body === "string" ? init.body : undefined,
+    });
+    const mount = "/v1/secret";
+    if (method === "GET" && url.pathname === `${mount}/metadata`) {
+      return Response.json({ data: { keys: Object.keys(seed) } });
+    }
+    if (method === "GET" && url.pathname.startsWith(`${mount}/data/`)) {
+      const name = decodeURIComponent(url.pathname.slice(`${mount}/data/`.length));
+      if (!(name in seed)) return new Response("{}", { status: 404 });
+      return Response.json({ data: { data: { value: seed[name] } } });
+    }
+    if (method === "POST" && url.pathname.startsWith(`${mount}/data/`)) {
+      return new Response(null, { status: 204 });
+    }
+    if (method === "DELETE" && url.pathname.startsWith(`${mount}/data/`)) {
+      return new Response(null, { status: 204 });
+    }
+    return new Response("{}", { status: 404 });
+  }) as typeof globalThis.fetch;
+}
+
+describe("openbao vault driver", () => {
+  test("LIST + GET loads all keys", async () => {
+    const calls: { method: string; path: string; body?: string }[] = [];
+    const bag = await openbaoVaultDriver.open({
+      url: "http://127.0.0.1:8200",
+      token: "app-tok",
+      fetch: fakeKv({ STRIPE_KEY: "sk_live", DATABASE_URL: "postgres://x" }, calls),
+    });
+    expect(bag.get("STRIPE_KEY")).toBe("sk_live");
+    expect([...bag.names()].sort()).toEqual(["DATABASE_URL", "STRIPE_KEY"]);
+  });
+
+  test("set POSTs KV v2 data payload", async () => {
+    const calls: { method: string; path: string; body?: string }[] = [];
+    const bag = await openbaoVaultDriver.open({
+      url: "http://127.0.0.1:8200",
+      token: "app-tok",
+      fetch: fakeKv({ STRIPE_KEY: "sk_live" }, calls),
+    });
+    bag.set?.("STRIPE_KEY", "sk_rotated");
+    await Bun.sleep(0);
+    const writeCall = calls.find((c) => c.method === "POST");
+    expect(writeCall?.path).toBe("/v1/secret/data/STRIPE_KEY");
+    expect(writeCall?.body).toBe(JSON.stringify({ data: { value: "sk_rotated" } }));
+    expect(bag.get("STRIPE_KEY")).toBe("sk_rotated");
+  });
+
+  test("unreachable remote fails loud (no soft-empty bag)", async () => {
+    let failed: unknown;
+    try {
+      await openbaoVaultDriver.open({
+        url: "http://127.0.0.1:9",
+        token: "app-tok",
+        fetch: (async () => {
+          throw new Error("connect ECONNREFUSED");
+        }) as unknown as typeof globalThis.fetch,
+      });
+    } catch (err) {
+      failed = err;
+    }
+    expect(failed).toBeInstanceOf(OpenBaoUnavailableError);
+  });
+
+  test("sealed / 5xx on GET fails loud", async () => {
+    const fetchFn = (async (input: string | URL | Request) => {
+      const url = String(input);
+      if (url.includes("metadata")) return Response.json({ data: { keys: ["STRIPE_KEY"] } });
+      return new Response("sealed", { status: 503 });
+    }) as typeof globalThis.fetch;
+    let failed: unknown;
+    try {
+      await openbaoVaultDriver.open({ url: "http://127.0.0.1:8200", token: "t", fetch: fetchFn });
+    } catch (err) {
+      failed = err;
+    }
+    expect(failed).toBeInstanceOf(OpenBaoUnavailableError);
+  });
+});