okengine 0.21.1 → 0.22.0

package/src/cli/competitor-mention-removal.test.ts

@@ -11,8 +11,8 @@ import { join } from "node:path";
 
 const ROOT = join(import.meta.dir, "../..");
 
-/** Forbidden peer name — split so this file does not match itself. */
-const FORBIDDEN_HONO = ["Ho", "no"].join("");
+/** Word-boundary router peer — `-F` false-positives on `Honored` / `canHonor`. */
+const FORBIDDEN_HONO = ["\\b", "Ho", "no", "\\b"].join("");
 /** Forbidden peer name. */
 const FORBIDDEN_ELYSIA = ["Ely", "sia"].join("");
 /** Forbidden peer name (covers Enc + ore.ts). */
@@ -104,7 +104,7 @@ function assertZeroGitGrepRegex(pattern: string, ignorePrefixes: readonly string
 
 describe("named competitor mention removal gate", () => {
   test("tracked tree has zero mentions of the thin multi-runtime router peer", () => {
-    assertZeroGitGrepFixed(FORBIDDEN_HONO);
+    assertZeroGitGrepRegex(FORBIDDEN_HONO);
   });
 
   test("tracked tree has zero mentions of the Bun-first peer framework", () => {

package/src/cli/docker-cli.test.ts

@@ -72,7 +72,7 @@ describe("oke stack", () => {
     const code = await runStackPreview({
       cwd: dir,
       images: {
-        "channel.email": "axllent/mailpit:v1.31.1",
+        "channel.email": "axllent/mailpit:v1.31.2",
       },
       write: (t) => {
         out += t;

package/src/cli/index.ts

@@ -5,6 +5,7 @@
  * Bare `oke` (TTY) → interactive Ink TUI. `oke <command>` runs directly.
  */
 
+import type { VaultAuditConfig } from "../elements/vault/types.ts";
 import { aiCli } from "./ai.ts";
 import { branchCli } from "./branch.ts";
 import { buildCli } from "./build.ts";
@@ -28,6 +29,7 @@ import { stackCli } from "./stack.ts";
 import { startCli } from "./start.ts";
 import { testCli } from "./test.ts";
 import { upgradeCli } from "./upgrade.ts";
+import { loadOkeConfig } from "./load-config.ts";
 import { vaultCli } from "./vault-cmd.ts";
 
 const rawArgv = process.argv.slice(2);
@@ -90,7 +92,13 @@ if (cmd === "client" && sub === "add") {
 }
 
 if (cmd === "vault") {
-  process.exit(await vaultCli(sub ? [sub, ...rest] : rest));
+  let audit: VaultAuditConfig | undefined;
+  try {
+    audit = (await loadOkeConfig()).config.vault?.audit;
+  } catch {
+    audit = undefined;
+  }
+  process.exit(await vaultCli(sub ? [sub, ...rest] : rest, audit === undefined ? {} : { audit }));
 }
 
 if (cmd === "docker") {

package/src/cli/load-config.images.test.ts

@@ -18,19 +18,19 @@ describe("flattenImagesConfig", () => {
           sql: "postgres:18-alpine",
           kv: "redis:8-alpine",
           files: "rustfs/rustfs:1.0.0",
-          index: "getmeili/meilisearch:v1.53",
+          index: "getmeili/meilisearch:v1.54",
         },
-        channel: { email: "axllent/mailpit:v1.31.1" },
-        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
+        channel: { email: "axllent/mailpit:v1.31.2" },
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.59",
         proxy: "caddy:2-alpine",
       }),
     ).toEqual({
       "store.sql": "postgres:18-alpine",
       "store.kv": "redis:8-alpine",
       "store.files": "rustfs/rustfs:1.0.0",
-      "store.index": "getmeili/meilisearch:v1.53",
-      "channel.email": "axllent/mailpit:v1.31.1",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
+      "store.index": "getmeili/meilisearch:v1.54",
+      "channel.email": "axllent/mailpit:v1.31.2",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.59",
       proxy: "caddy:2-alpine",
     });
   });
@@ -53,7 +53,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.59",
       "store.kv": "redis:8-alpine",
     });
   });
@@ -68,7 +68,7 @@ describe("defaultImagesFromConfig", () => {
       },
     });
     expect(images["store.sql"]).toBe("pgvector/pgvector:pg17");
-    expect(images.pgdog).toBe("ghcr.io/pgdogdev/pgdog:v0.1.57");
+    expect(images.pgdog).toBe("ghcr.io/pgdogdev/pgdog:v0.1.59");
   });
 
   test("clock postgres alone pulls store.sql image", () => {
@@ -79,7 +79,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.59",
     });
   });
 
@@ -91,7 +91,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.59",
     });
   });
 

package/src/cli/load-config.ts

@@ -15,7 +15,7 @@ import type { Manifest } from "../manifest/types.ts";
 /** Default image pins when `images` is omitted but prod drivers need containers. */
 const DEFAULT_SQL_IMAGE = "postgres:18-alpine";
 const DEFAULT_PGVECTOR_IMAGE = "pgvector/pgvector:pg17";
-const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.57";
+const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.59";
 const DEFAULT_KV_IMAGE = "redis:8-alpine";
 
 /**

package/src/cli/vault-cmd.test.ts

@@ -282,6 +282,29 @@ describe("oke vault audit", () => {
       await h.close();
     }
   });
+
+  test("audit verify refuses a webhook sink", async () => {
+    const sql = createMemoryVaultSql();
+    const errors: string[] = [];
+    const original = console.error;
+    console.error = (...args: unknown[]) => {
+      errors.push(args.map((part) => String(part)).join(" "));
+    };
+    try {
+      const code = await vaultCli(["audit", "verify"], {
+        sql,
+        env: {},
+        stdinIsTTY: false,
+        audit: { sink: "webhook", webhookUrl: "https://audit.example/hook" },
+        write: () => undefined,
+      });
+      expect(code).toBe(1);
+      expect(errors.join("\n")).toContain('audit.sink "db"');
+    } finally {
+      console.error = original;
+      await sql.close();
+    }
+  });
 });
 
 describe("oke vault backup / restore", () => {

package/src/cli/vault-cmd.ts

@@ -24,6 +24,7 @@ import type { SqlConnection } from "../drivers/types.ts";
 import { openBuiltinVaultAdapter, VAULT_MASTER_KEY_ENV } from "../drivers/vault-builtin.ts";
 import { parseDotenv, formatDotenv } from "../drivers/vault-dotenv-parse.ts";
 import type { BuiltinVaultAdapter } from "../elements/vault/builtin-adapter.ts";
+import type { VaultAuditConfig } from "../elements/vault/types.ts";
 import { promptHidden, readStdinSecure } from "./vault-secure-input.ts";
 
 /** Env var for the *new* master key when resuming an interrupted `rotate-master`. */
@@ -70,6 +71,11 @@ export interface VaultCmdOptions {
    * closes a connection it did not open.
    */
   readonly sql?: SqlConnection;
+  /**
+   * `vault.audit` from `oke.config.ts`. The `oke` binary loads this; tests
+   * pass it directly. Omitted means the SQL hash chain.
+   */
+  readonly audit?: VaultAuditConfig;
 }
 
 /**
@@ -332,6 +338,7 @@ async function withVault<T>(
     masterKey,
     ...(flags.url === undefined ? {} : { url: flags.url }),
     ...(options.sql === undefined ? {} : { connection: options.sql }),
+    ...(options.audit === undefined ? {} : { audit: options.audit }),
   });
   try {
     return await run(opened.adapter);

package/src/client/create.ts

@@ -338,11 +338,28 @@ function isCallOpts(value: unknown): value is CallOpts {
   if ("signal" in v) {
     return v.signal === undefined || v.signal instanceof AbortSignal;
   }
+  const keyOk =
+    "idempotencyKey" in v && (typeof v.idempotencyKey === "string" || v.idempotencyKey === false);
+  if (("retry" in v && typeof v.retry === "boolean") || keyOk) {
+    return Object.keys(v).every(
+      (k) => k === "response" || k === "signal" || k === "retry" || k === "idempotencyKey",
+    );
+  }
   return false;
 }
 
-/** Per-call options on a Flow invoke (binary decode / abort). */
+/** Per-call options on a Flow invoke (binary decode, abort, retry opt-in). */
 export interface CallOpts {
   readonly response?: "json" | "blob" | "arrayBuffer";
   readonly signal?: AbortSignal;
+  /**
+   * Repeat this call under the client `retry` policy even when it sends
+   * no idempotency key.
+   */
+  readonly retry?: boolean;
+  /**
+   * Stable `Idempotency-Key`, or `false` to send none.
+   * See {@link ClientCallOpts.idempotencyKey}.
+   */
+  readonly idempotencyKey?: string | false;
 }

package/src/client/transport.test.ts

@@ -3,7 +3,9 @@
  */
 
 import { describe, expect, test } from "bun:test";
+import { OKID_ALPHABET } from "../okid-shared.ts";
 import { createClient } from "./create.ts";
+import { IDEMPOTENCY_KEY_ALPHABET } from "./transport.ts";
 import type { AppOf } from "./types.ts";
 
 type PingApp = AppOf<{
@@ -15,11 +17,16 @@ type PingApp = AppOf<{
   };
 }>;
 
+const getPing = {
+  "sys.ping": { method: "GET", path: "/ping" },
+} as const;
+
 describe("transport — retry", () => {
   test("retries 5xx then succeeds", async () => {
     let n = 0;
     const api = createClient<PingApp>("http://app.test", {
       retry: { retries: 2, delay: 1, backoff: 1 },
+      routes: getPing,
       fetch: async () => {
         n += 1;
         if (n < 3) return new Response("nope", { status: 503 });
@@ -37,6 +44,7 @@ describe("transport — retry", () => {
     let n = 0;
     const api = createClient<PingApp>("http://app.test", {
       retry: { retries: 1, delay: 1, backoff: 1 },
+      routes: getPing,
       fetch: async () => {
         n += 1;
         return new Response("nope", { status: 502 });
@@ -73,6 +81,223 @@ describe("transport — retry", () => {
     expect(error?.code).toBe("InternalError");
     expect(error?.message).toMatch(/password policy/i);
   });
+
+  test("POST retries when it carries an idempotency key", async () => {
+    let handled = 0;
+    const keys: string[] = [];
+    const api = createClient<PingApp>("http://app.test", {
+      retry: { retries: 2, delay: 1, backoff: 1 },
+      fetch: async (_input, init) => {
+        handled += 1;
+        keys.push(new Headers(init?.headers).get("idempotency-key") ?? "");
+        throw new TypeError("Failed to fetch");
+      },
+    });
+
+    const lost = await api.sys.ping();
+    expect(lost.error?.code).toBe("TransportError");
+    expect(handled).toBe(3);
+    expect(keys[0]).toBe(keys[1]);
+    expect(keys[1]).toBe(keys[2]);
+    expect(keys[0]!.length).toBeGreaterThanOrEqual(16);
+  });
+
+  test("idempotencyKey false runs once unless retry is opted in", async () => {
+    let handled = 0;
+    const api = createClient<PingApp>("http://app.test", {
+      retry: { retries: 2, delay: 1, backoff: 1 },
+      fetch: async (_input, init) => {
+        handled += 1;
+        expect(new Headers(init?.headers).get("idempotency-key")).toBeNull();
+        throw new TypeError("Failed to fetch");
+      },
+    });
+
+    const lost = await api.sys.ping({ idempotencyKey: false });
+    expect(lost.error?.code).toBe("TransportError");
+    expect(handled).toBe(1);
+
+    handled = 0;
+    const opted = await api.sys.ping({ idempotencyKey: false, retry: true });
+    expect(opted.error?.code).toBe("TransportError");
+    expect(handled).toBe(3);
+  });
+
+  test("two calls mint two keys; a string key is reused", async () => {
+    const keys: string[] = [];
+    const api = createClient<PingApp>("http://app.test", {
+      fetch: async (_input, init) => {
+        keys.push(new Headers(init?.headers).get("idempotency-key") ?? "");
+        return Response.json({ data: { ok: true }, error: null });
+      },
+    });
+    await api.sys.ping();
+    await api.sys.ping();
+    expect(keys[0]).not.toBe(keys[1]);
+    keys.length = 0;
+    await api.sys.ping({ idempotencyKey: "form-key-0123456789" });
+    expect(keys).toEqual(["form-key-0123456789"]);
+  });
+
+  test("inlined idempotency alphabet matches OKID_ALPHABET", () => {
+    expect(IDEMPOTENCY_KEY_ALPHABET).toBe(OKID_ALPHABET);
+    expect(IDEMPOTENCY_KEY_ALPHABET).toHaveLength(64);
+  });
+
+  test("missing crypto sends no idempotency key", async () => {
+    const original = globalThis.crypto;
+    Object.defineProperty(globalThis, "crypto", {
+      value: undefined,
+      configurable: true,
+      writable: true,
+    });
+    try {
+      const api = createClient<PingApp>("http://app.test", {
+        fetch: async (_input, init) => {
+          expect(new Headers(init?.headers).get("idempotency-key")).toBeNull();
+          return Response.json({ data: { ok: true }, error: null });
+        },
+      });
+      const { error } = await api.sys.ping();
+      expect(error).toBeNull();
+    } finally {
+      Object.defineProperty(globalThis, "crypto", {
+        value: original,
+        configurable: true,
+        writable: true,
+      });
+    }
+  });
+
+  test("GET sends no idempotency key", async () => {
+    const api = createClient<PingApp>("http://app.test", {
+      routes: getPing,
+      fetch: async (_input, init) => {
+        expect(new Headers(init?.headers).get("idempotency-key")).toBeNull();
+        return Response.json({ data: { ok: true }, error: null });
+      },
+    });
+    const { error } = await api.sys.ping();
+    expect(error).toBeNull();
+  });
+
+  test("401 resend reuses the idempotency key", async () => {
+    const keys: string[] = [];
+    let token = "old";
+    const api = createClient<PingApp>("http://app.test", {
+      auth: {
+        getToken: () => token,
+        refresh: async () => {
+          token = "new";
+          return token;
+        },
+      },
+      fetch: async (_input, init) => {
+        const headers = new Headers(init?.headers);
+        keys.push(headers.get("idempotency-key") ?? "");
+        if (headers.get("authorization") === "Bearer old") {
+          return new Response("unauthorized", { status: 401 });
+        }
+        return Response.json({ data: { ok: true }, error: null });
+      },
+    });
+    const { error } = await api.sys.ping();
+    expect(error).toBeNull();
+    expect(keys).toHaveLength(2);
+    expect(keys[0]).toBe(keys[1]);
+  });
+
+  test("IdempotencyInProgress waits for Retry-After then replays", async () => {
+    let n = 0;
+    const api = createClient<PingApp>("http://app.test", {
+      retry: { retries: 2, delay: 1, backoff: 1 },
+      timeout: 30,
+      fetch: async (_input, init) => {
+        n += 1;
+        const signal = init?.signal;
+        if (n === 1) {
+          await new Promise<void>((_resolve, reject) => {
+            if (signal?.aborted) {
+              reject(new DOMException("Aborted", "AbortError"));
+              return;
+            }
+            signal?.addEventListener("abort", () => {
+              reject(new DOMException("Aborted", "AbortError"));
+            });
+          });
+        }
+        if (n === 2) {
+          return Response.json(
+            { data: null, error: { code: "IdempotencyInProgress", data: {} } },
+            { status: 409, headers: { "retry-after": "0.01" } },
+          );
+        }
+        return Response.json(
+          { data: { ok: true }, error: null },
+          { headers: { "idempotent-replayed": "true" } },
+        );
+      },
+    });
+
+    const result = await api.sys.ping();
+    expect(result.error).toBeNull();
+    expect(result.data).toEqual({ ok: true });
+    expect(result.meta?.idempotentReplayed).toBe(true);
+    expect(n).toBe(3);
+  });
+
+  test("other 409 envelopes are not retried", async () => {
+    let n = 0;
+    const api = createClient<PingApp>("http://app.test", {
+      retry: { retries: 2, delay: 1, backoff: 1 },
+      fetch: async () => {
+        n += 1;
+        return Response.json(
+          { data: null, error: { code: "Conflict", data: {} } },
+          { status: 409 },
+        );
+      },
+    });
+    const { error } = await api.sys.ping();
+    expect(error?.code).toBe("Conflict");
+    expect(n).toBe(1);
+  });
+
+  test("GET still retries a network error", async () => {
+    let n = 0;
+    const api = createClient<PingApp>("http://app.test", {
+      retry: { retries: 1, delay: 1, backoff: 1 },
+      routes: getPing,
+      fetch: async () => {
+        n += 1;
+        if (n < 2) throw new TypeError("Failed to fetch");
+        return Response.json({ data: { ok: true }, error: null });
+      },
+    });
+
+    const { data, error } = await api.sys.ping();
+    expect(error).toBeNull();
+    expect(data).toEqual({ ok: true });
+    expect(n).toBe(2);
+  });
+
+  test("QUERY still retries a network error", async () => {
+    let n = 0;
+    const api = createClient<PingApp>("http://app.test", {
+      retry: { retries: 1, delay: 1, backoff: 1 },
+      routes: { "sys.ping": { method: "QUERY", path: "/ping" } },
+      fetch: async () => {
+        n += 1;
+        if (n < 2) throw new TypeError("Failed to fetch");
+        return Response.json({ data: { ok: true }, error: null });
+      },
+    });
+
+    const { data, error } = await api.sys.ping();
+    expect(error).toBeNull();
+    expect(data).toEqual({ ok: true });
+    expect(n).toBe(2);
+  });
 });
 
 describe("transport — timeout", () => {