okengine 0.3.6 → 0.4.3

package/src/elements/store/runtime.ts

@@ -18,7 +18,12 @@ import type {
   SqlDriver,
   SqlRole,
   SqlRow,
+  TextIndexSearchOptions,
+  TextIndexSearchResult,
+  VectorIndexDriver,
+  VectorIndexStore,
 } from "../../drivers/types.ts";
+import { indexDriverNeedsSql } from "../../drivers/types.ts";
 import { buildClassificationMap, type MaskRowsOptions } from "./classify.ts";
 import {
   createStoreCache,
@@ -64,7 +69,15 @@ export interface CreateStoreRuntimeOptions {
   readonly files?: Readonly<Record<string, { readonly root?: string; readonly client?: unknown }>>;
   /** Index open options keyed by store name. */
   readonly index?: Readonly<
-    Record<string, { readonly dims?: number; readonly url?: string; readonly sql?: SqlConnection }>
+    Record<
+      string,
+      {
+        readonly dims?: number;
+        readonly url?: string;
+        readonly apiKey?: string;
+        readonly sql?: SqlConnection;
+      }
+    >
   >;
   /** Clock for cache TTLs. */
   readonly now?: () => number;
@@ -115,18 +128,30 @@ export interface FilesStoreFxHandle {
   list(prefix?: string): Promise<string[]>;
 }
 
-/** Index handle on `fx.store`. */
-export interface IndexStoreFxHandle {
+/** Vector index handle on `fx.store`. */
+export interface VectorIndexStoreFxHandle {
   readonly ref: `index:${string}`;
   readonly driverId: "memory" | "pgvector" | "libsql";
   upsert(id: string, vector: readonly number[], meta?: Record<string, unknown>): Promise<void>;
   search(
     vector: readonly number[],
     topK?: number,
-  ): Promise<Array<{ id: string; score: number; meta?: Record<string, unknown> }>>;
+  ): Promise<ReadonlyArray<{ id: string; score: number; meta?: Record<string, unknown> }>>;
   delete(id: string): Promise<boolean>;
 }
 
+/** Full-text index handle on `fx.store`. */
+export interface TextIndexStoreFxHandle {
+  readonly ref: `index:${string}`;
+  readonly driverId: "meilisearch";
+  upsert(id: string, document: Record<string, unknown>): Promise<void>;
+  search(q: string, opts?: TextIndexSearchOptions): Promise<TextIndexSearchResult>;
+  delete(id: string): Promise<boolean>;
+}
+
+/** Index handle on `fx.store` — discriminated by `driverId`. */
+export type IndexStoreFxHandle = VectorIndexStoreFxHandle | TextIndexStoreFxHandle;
+
 /** Store runtime. */
 export interface StoreRuntime {
   /** Shared multi-tier cache. */
@@ -259,9 +284,9 @@ export function createStoreRuntime(options: CreateStoreRuntimeOptions): StoreRun
     return conn;
   }
 
-  /** Index drivers backed by a SQL engine borrow the sql facet's connection. */
+  /** SQL-backed index drivers borrow the sql facet's connection. */
   async function sqlConnForIndex(
-    driver: IndexDriver,
+    driver: VectorIndexDriver & { id: "pgvector" | "libsql" },
     url: string | undefined,
   ): Promise<SqlConnection> {
     const sqlDriver = options.drivers.sql;
@@ -338,24 +363,34 @@ export function createStoreRuntime(options: CreateStoreRuntimeOptions): StoreRun
     let idx = indexes.get(decl.name);
     if (!idx) {
       const binding = options.index?.[decl.name] ?? {};
-      let sql = binding.sql;
-      if (!sql && driver.id !== "memory") {
-        sql = await sqlConnForIndex(driver, binding.url);
-      }
       idx = await driver.open({
         name: decl.name,
         dims: binding.dims ?? decl.dims ?? 3,
         url: binding.url,
-        sql,
+        apiKey: binding.apiKey,
+        sql: indexDriverNeedsSql(driver)
+          ? (binding.sql ?? (await sqlConnForIndex(driver, binding.url)))
+          : undefined,
       });
       indexes.set(decl.name, idx);
     }
+    if (idx.driverId === "meilisearch") {
+      const text = idx;
+      return {
+        ref: `index:${decl.name}`,
+        driverId: text.driverId,
+        upsert: (id, document) => text.upsert(id, document),
+        search: (q, opts) => text.search(q, opts),
+        delete: (id) => text.delete(id),
+      };
+    }
+    const vector = idx as VectorIndexStore;
     return {
       ref: `index:${decl.name}`,
-      driverId: idx.driverId,
-      upsert: (id, vector, meta) => idx!.upsert(id, vector, meta),
-      search: (vector, topK) => idx!.search(vector, topK),
-      delete: (id) => idx!.delete(id),
+      driverId: vector.driverId,
+      upsert: (id, vec, meta) => vector.upsert(id, vec, meta),
+      search: (vec, topK) => vector.search(vec, topK),
+      delete: (id) => vector.delete(id),
     };
   }
 

package/src/elements/store.ts

@@ -116,6 +116,8 @@ export type {
   KvStoreFxHandle,
   FilesStoreFxHandle,
   IndexStoreFxHandle,
+  VectorIndexStoreFxHandle,
+  TextIndexStoreFxHandle,
 } from "./store/runtime.ts";
 
 export { fileKeyWarnings, contentAddressedKey, projectFileKeys } from "./store/files-policy.ts";

package/src/elements/vault.test.ts

@@ -9,6 +9,7 @@
 import { describe, expect, test } from "bun:test";
 import { envVaultDriver, memoryVaultDriver } from "../drivers/index.ts";
 import { createFx } from "../kernel/fx.ts";
+import { REDACTED_PLACEHOLDER, Redacted } from "../kernel/redacted.ts";
 import {
   createVaultRuntime,
   fingerprintSecretSync,
@@ -200,17 +201,39 @@ describe("redaction + fingerprints", () => {
     const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
     const { fx } = createFxContextWithVault(runtime, lines);
 
-    const value = fx.vault("STRIPE_KEY");
-    expect(value).toBe(secret);
+    const wrapped = fx.vault("STRIPE_KEY");
+    expect(wrapped.reveal()).toBe(secret);
 
-    fx.log.info(`charging with ${value}`, { key: value, nested: { k: value } });
+    fx.log.info(`charging with ${wrapped}`, { key: wrapped, nested: { k: wrapped } });
+    // Revealed cleartext still hits the known-value substring scrub.
     fx.log.error(secret, { stripe: secret });
 
     for (const line of lines) {
       expect(line.message).not.toContain(secret);
       expect(JSON.stringify(line.data ?? {})).not.toContain(secret);
-      expect(line.message).toContain(SECRET_MASK);
     }
+    expect(lines[0]!.message).toContain(REDACTED_PLACEHOLDER);
+    expect(lines[1]!.message).toContain(SECRET_MASK);
+  });
+
+  test("Redacted from fx.vault is masked in fx.log without a vault runtime", () => {
+    const secret = "sk_no_vault_runtime";
+    const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
+    const fx = createFx({
+      flow: "test.redacted",
+      secrets: { STRIPE_KEY: secret },
+      onLog: (_level, message, data) => lines.push({ message, data }),
+    });
+
+    const wrapped = fx.vault("STRIPE_KEY");
+    expect(wrapped).toBeInstanceOf(Redacted);
+    expect(String(wrapped)).toBe(REDACTED_PLACEHOLDER);
+    expect(`${wrapped}`).toBe(REDACTED_PLACEHOLDER);
+    expect(JSON.stringify({ v: wrapped })).toBe(`{"v":"${REDACTED_PLACEHOLDER}"}`);
+
+    fx.log.info("paying", { key: wrapped, nested: { k: [wrapped] } });
+    expect(JSON.stringify(lines[0]!.data)).not.toContain(secret);
+    expect(lines[0]!.data?.key).toBe(REDACTED_PLACEHOLDER);
   });
 
   test("fingerprint is stable and not the value", async () => {

package/src/elements/vault.ts

@@ -2,7 +2,7 @@
  * Vault element — protected knowledge.
  *
  * Physics: secrets · config · environment.
- * Drivers: `env` · `openbao` · `infisical` · `managed`.
+ * Drivers: `env` · `openbao` · `managed`.
  *
  * A declaration is a contract, never a value. Boot validates every contract
  * and lists all gaps at once. Logs/traces receive fingerprints and redaction

package/src/index.ts

@@ -34,6 +34,10 @@ export {
   journey,
   unit,
   rateLimit,
+  Redacted,
+  isRedacted,
+  maskRedactedDeep,
+  REDACTED_PLACEHOLDER,
   type OkeApp,
   type OkeOptions,
   type FlowDef,

package/src/kernel/boot-bind/store.test.ts

@@ -114,6 +114,15 @@ describe("bindStore index driver resolution", () => {
     expect(indexDriverFor("libsql").id).toBe("libsql");
   });
 
+  test("meilisearch resolves from config as a fourth id", () => {
+    const options = {
+      config: { drivers: { store: { index: { local: "meilisearch", docker: "meilisearch" } } } },
+    };
+    expect(resolveIndexDriverId(options, "local", false)).toBe("meilisearch");
+    expect(resolveIndexDriverId(options, "docker", true)).toBe("meilisearch");
+    expect(indexDriverFor("meilisearch").id).toBe("meilisearch");
+  });
+
   test("docker mode honours OKE_INDEX_DRIVER override", () => {
     process.env.OKE_INDEX_DRIVER = "pgvector";
     expect(resolveIndexDriverId({}, "docker", true)).toBe("pgvector");

package/src/kernel/boot-bind/store.ts

@@ -5,6 +5,7 @@
 import { resolveDomainDdlMode, resolveDriverId, type ConfigEnv } from "../../config/index.ts";
 import { fsDriver } from "../../drivers/fs.ts";
 import { libsqlDriver, libsqlIndexDriver } from "../../drivers/libsql.ts";
+import { meilisearchDriver } from "../../drivers/meilisearch.ts";
 import { memoryDrivers } from "../../drivers/memory.ts";
 import { pgliteDriver } from "../../drivers/pglite.ts";
 import { pgvectorDriver } from "../../drivers/pgvector.ts";
@@ -45,7 +46,7 @@ export function bindStore(
   const sqlBindings: Record<string, { name: string; primary: { url: string } }> = {};
   const kvBindings: Record<string, { url?: string }> = {};
   const filesBindings: Record<string, { root?: string }> = {};
-  const indexBindings: Record<string, { url?: string }> = {};
+  const indexBindings: Record<string, { url?: string; apiKey?: string }> = {};
 
   for (const decl of options.stores ?? []) {
     if (isSqlDecl(decl)) {
@@ -60,7 +61,14 @@ export function bindStore(
     } else if (isIndexDecl(decl)) {
       // SQL-backed index drivers share the sql facet's URL — the runtime opens
       // one connection and hands it to both (never a second, redundant one).
-      indexBindings[decl.name] = indexId === "memory" ? {} : { url: sqlUrl };
+      // Meilisearch is a standalone HTTP service: its own URL + key, never sqlUrl.
+      if (indexId === "memory") {
+        indexBindings[decl.name] = {};
+      } else if (indexId === "meilisearch") {
+        indexBindings[decl.name] = { url: indexUrlFor(docker), apiKey: indexApiKeyFor() };
+      } else {
+        indexBindings[decl.name] = { url: sqlUrl };
+      }
     }
   }
 
@@ -216,6 +224,8 @@ export function indexDriverFor(id: string): IndexDriver {
       return pgvectorDriver;
     case "libsql":
       return libsqlIndexDriver;
+    case "meilisearch":
+      return meilisearchDriver;
     default:
       throw new Error(`oke boot: unknown index driver "${id}"`);
   }
@@ -263,6 +273,24 @@ function filesRootFor(filesId: string): string | undefined {
   return process.env.S3_BUCKET ?? process.env.OKE_STORE_FILES_DB ?? undefined;
 }
 
+/** Meilisearch base URL — standalone HTTP service, fail loud when missing. */
+function indexUrlFor(docker: boolean): string {
+  const url = process.env.OKE_STORE_INDEX_URL ?? undefined;
+  if (!url) {
+    throw new Error(
+      docker
+        ? "oke boot: meilisearch index needs OKE_STORE_INDEX_URL (did `oke dev -d` write docker/.env.docker?)"
+        : "oke boot: meilisearch index needs OKE_STORE_INDEX_URL",
+    );
+  }
+  return url;
+}
+
+/** Meilisearch API / master key. */
+function indexApiKeyFor(): string | undefined {
+  return process.env.OKE_STORE_INDEX_KEY ?? process.env.MEILI_MASTER_KEY ?? undefined;
+}
+
 function isSqlDecl(decl: StoreDecl): decl is Extract<StoreDecl, { facet: "sql" }> {
   return decl.facet === "sql";
 }

package/src/kernel/concurrency.test.ts

@@ -92,6 +92,64 @@ describe("fx.race — structured concurrency", () => {
   });
 });
 
+describe("fx.using — scoped cleanup", () => {
+  test("release runs on success and on thrown error", async () => {
+    const fx = createFx({ flow: "t", effects: {} });
+    const released: string[] = [];
+
+    const ok = await fx.using(
+      async () => "res-a",
+      (r) => {
+        released.push(`ok:${r}`);
+      },
+      async (r) => r.toUpperCase(),
+    );
+    expect(ok).toBe("RES-A");
+    expect(released).toEqual(["ok:res-a"]);
+
+    await expect(
+      fx.using(
+        async () => "res-b",
+        async (r) => {
+          released.push(`err:${r}`);
+        },
+        async () => {
+          throw new Error("boom");
+        },
+      ),
+    ).rejects.toThrow("boom");
+    expect(released).toEqual(["ok:res-a", "err:res-b"]);
+  });
+
+  test("release runs when a sibling fx.race winner aborts mid-use", async () => {
+    const fx = createFx({ flow: "t", effects: {} });
+    let released = false;
+
+    const winner = await fx.race([
+      () =>
+        fx.using(
+          async () => "lock",
+          () => {
+            released = true;
+          },
+          () =>
+            new Promise<never>(() => {
+              // Stay pending until ambient abort releases us.
+            }),
+        ),
+      async () => {
+        await new Promise((r) => setTimeout(r, 5));
+        return "fast";
+      },
+    ]);
+
+    expect(winner).toBe("fast");
+    // Let the abort listener settle.
+    await new Promise((r) => setTimeout(r, 20));
+    expect(released).toBe(true);
+  });
+});
+
 describe("fx.retry", () => {
   test("retries then succeeds", async () => {
     const fx = createFx({ flow: "t", effects: {} });

package/src/kernel/concurrency.ts

@@ -8,6 +8,7 @@
 import { parseDurationMs } from "../elements/clock/duration.ts";
 import {
   abortableSleep,
+  abortError,
   currentAbortSignal,
   isAbortError,
   linkAbort,
@@ -144,6 +145,53 @@ export async function fxRace<T>(thunks: ReadonlyArray<FxThunk<T>>): Promise<T> {
   });
 }
 
+/**
+ * Scope a resource to a unit of work — `release` runs exactly once when
+ * `use` settles or when the ambient abort signal fires, whichever comes
+ * first. Uses the same AbortSignal as {@link Fx.signal}; no second
+ * cancellation channel.
+ *
+ * Process-local only: do not journal acquire/release, and do not hold
+ * handles across durable park/resume — journal replay returns values and
+ * never re-enters step bodies.
+ *
+ * @param acquire - Open the resource
+ * @param release - Cleanup, always run
+ * @param use - Work with the resource
+ */
+export async function fxUsing<A, T>(
+  acquire: () => A | Promise<A>,
+  release: (resource: A) => void | Promise<void>,
+  use: (resource: A) => T | Promise<T>,
+): Promise<T> {
+  const resource = await acquire();
+  const signal = currentAbortSignal();
+  let released = false;
+
+  const releaseOnce = async (): Promise<void> => {
+    if (released) return;
+    released = true;
+    await release(resource);
+  };
+
+  const onAbort = (): void => {
+    void releaseOnce();
+  };
+
+  if (signal.aborted) {
+    await releaseOnce();
+    throw abortError(signal.reason);
+  }
+  signal.addEventListener("abort", onAbort);
+
+  try {
+    return await use(resource);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    await releaseOnce();
+  }
+}
+
 /**
  * Retry a thunk with exponential backoff and optional full jitter.
  *

package/src/kernel/fx.test.ts

@@ -9,6 +9,7 @@ import {
   type Fx,
   type FxStubStoreHandle,
 } from "./fx.ts";
+import { Redacted } from "./redacted.ts";
 
 /** Narrow stub handle for tests that exercise the in-memory store. */
 function stub(fx: Fx, ref: string): FxStubStoreHandle {
@@ -99,7 +100,7 @@ describe("fx — effect ledger", () => {
     await fx.emit("order-placed", {});
     await fx.send("order-confirmed", { to: "u1" });
     await fx.ask("triage@1", {});
-    expect(fx.vault("STRIPE_KEY")).toBe("sk_test");
+    expect(fx.vault("STRIPE_KEY").reveal()).toBe("sk_test");
     await fx.call("payments.charge", {});
 
     expect(ledger.entries).toHaveLength(7);
@@ -130,7 +131,7 @@ describe("fx — wholesale swap", () => {
         sleep: async () => undefined,
       },
       vault() {
-        return "";
+        return new Redacted("");
       },
       cache: {
         get: async () => undefined,
@@ -193,6 +194,14 @@ describe("fx — wholesale swap", () => {
       retry(fn) {
         return Promise.resolve().then(fn);
       },
+      async using(acquire, release, use) {
+        const resource = await acquire();
+        try {
+          return await use(resource);
+        } finally {
+          await release(resource);
+        }
+      },
     };
 
     // Any code that accepts `Fx` can run against a total replacement.

package/src/kernel/fx.ts

@@ -33,7 +33,15 @@ import {
 } from "./dry-run.ts";
 import { fail, type FailOptions, type FlowFailure } from "./errors.ts";
 import { currentAbortSignal } from "./abort-scope.ts";
-import { fxAll, fxRace, fxRetry, type FxRetryOptions, type FxThunk } from "./concurrency.ts";
+import {
+  fxAll,
+  fxRace,
+  fxRetry,
+  fxUsing,
+  type FxRetryOptions,
+  type FxThunk,
+} from "./concurrency.ts";
+import { maskRedactedDeep, Redacted } from "./redacted.ts";
 import type { JournalSession } from "./journal.ts";
 import type { RunTelemetry } from "./run-telemetry.ts";
 
@@ -262,9 +270,13 @@ export interface Fx {
   /**
    * Read a vault secret (records `secret`).
    *
+   * Returns a {@link Redacted} — printing / logging / serializing it yields a
+   * placeholder, never the value. Call `.reveal()` at the one boundary that
+   * needs the real value (e.g. passing a credential to a driver).
+   *
    * @param secret - Secret name or handle
    */
-  vault(secret: NamedRef): string;
+  vault(secret: NamedRef): Redacted<string>;
   /** Cache surface. */
   readonly cache: FxCache;
   /**
@@ -369,6 +381,20 @@ export interface Fx {
    * @param opts - Retry policy
    */
   retry<T>(fn: FxThunk<T>, opts?: FxRetryOptions): Promise<T>;
+  /**
+   * Scope a resource to `use` — `release` runs exactly once when `use`
+   * settles or the ambient abort signal fires (e.g. a sibling `fx.race`
+   * winner). Same-attempt cleanup; not journaled.
+   *
+   * @param acquire - Open the resource
+   * @param release - Cleanup, always run
+   * @param use - Work with the resource
+   */
+  using<A, T>(
+    acquire: () => A | Promise<A>,
+    release: (resource: A) => void | Promise<void>,
+    use: (resource: A) => T | Promise<T>,
+  ): Promise<T>;
 }
 
 /**
@@ -850,9 +876,12 @@ export function createFxContext(options: CreateFxOptions): FxContext {
     data?: Record<string, unknown>,
   ): { message: string; data?: Record<string, unknown> } {
     const vault = options.vaultRuntime;
-    if (!vault) return { message, data };
+    // Redacted<T> never yields the real value, but replace instances with a
+    // placeholder so payloads stay plain JSON (and never re-wrap on replay).
+    const maskedData = data ? maskRedactedDeep(data) : undefined;
+    if (!vault) return { message, data: maskedData };
     const safeMessage = vault.redactString(message);
-    const safeData = data ? (vault.redact(data) as Record<string, unknown>) : undefined;
+    const safeData = maskedData ? (vault.redact(maskedData) as Record<string, unknown>) : undefined;
     return { message: safeMessage, data: safeData };
   }
 
@@ -925,7 +954,7 @@ export function createFxContext(options: CreateFxOptions): FxContext {
         duration: Math.max(0, now() - timestamp),
         reversibility: reversibilityOf("secret"),
       });
-      return value;
+      return new Redacted(value);
     },
     cache,
     send(template, opts) {
@@ -1079,6 +1108,9 @@ export function createFxContext(options: CreateFxOptions): FxContext {
     retry(fn, opts) {
       return fxRetry(fn, opts);
     },
+    using(acquire, release, use) {
+      return fxUsing(acquire, release, use);
+    },
   };
 
   return { fx, ledger, capability };

package/src/kernel/index.ts

@@ -137,7 +137,16 @@ export {
   withAbortSignal,
 } from "./abort-scope.ts";
 
-export { defaultRetryWhen, fxAll, fxRace, fxRetry, resolveRetryDelayMs } from "./concurrency.ts";
+export {
+  defaultRetryWhen,
+  fxAll,
+  fxRace,
+  fxRetry,
+  fxUsing,
+  resolveRetryDelayMs,
+} from "./concurrency.ts";
+
+export { isRedacted, maskRedactedDeep, REDACTED_PLACEHOLDER, Redacted } from "./redacted.ts";
 
 export {
   DryRunWriteIsolationError,

package/src/kernel/redacted.ts

@@ -0,0 +1,74 @@
+/**
+ * `Redacted<T>` — a plain value wrapper that keeps a secret value out of
+ * logs, traces, and accidental serialization.
+ *
+ * Not an effect type: effect tracking only records which secret *names* a
+ * flow touches. This is value hygiene inside a flow body.
+ */
+
+/** Placeholder used for any representation of a {@link Redacted}. */
+export const REDACTED_PLACEHOLDER = "[redacted]";
+
+/**
+ * Wrap a value so printing / logging / JSON serialization never yields the
+ * real value. The only way to read the wrapped value is {@link reveal}.
+ */
+export class Redacted<T> {
+  readonly #value: T;
+
+  constructor(value: T) {
+    this.#value = value;
+  }
+
+  /** The one explicit way to get the real value. */
+  reveal(): T {
+    return this.#value;
+  }
+
+  toString(): string {
+    return REDACTED_PLACEHOLDER;
+  }
+
+  toJSON(): string {
+    return REDACTED_PLACEHOLDER;
+  }
+
+  [Symbol.toPrimitive](): string {
+    return REDACTED_PLACEHOLDER;
+  }
+
+  /** `util.inspect` / `console.log` — never the real value. */
+  [Symbol.for("nodejs.util.inspect.custom")](): string {
+    return REDACTED_PLACEHOLDER;
+  }
+}
+
+/** Type guard for {@link Redacted}. */
+export function isRedacted(value: unknown): value is Redacted<unknown> {
+  return value instanceof Redacted;
+}
+
+/**
+ * Deep-walk a log/trace payload: replace every {@link Redacted} with the
+ * placeholder (never the wrapped value); leave everything else untouched.
+ *
+ * @param value - Arbitrary structured data
+ */
+export function maskRedactedDeep<T>(value: T): T {
+  return maskRedactedValue(value) as T;
+}
+
+function maskRedactedValue(value: unknown): unknown {
+  if (isRedacted(value)) return REDACTED_PLACEHOLDER;
+  if (value === null || value === undefined) return value;
+  if (Array.isArray(value)) return value.map(maskRedactedValue);
+  if (typeof value === "object") {
+    const obj = value as Record<string, unknown>;
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(obj)) {
+      out[k] = maskRedactedValue(v);
+    }
+    return out;
+  }
+  return value;
+}

package/src/kernel/router.ts

@@ -1,6 +1,6 @@
 /**
- * HTTP router — compiled RegExp matching with a Trie fallback
- * (Hono's SmartRouter idea), plus a linear preset for cold-start edge builds.
+ * HTTP router — compiled RegExp matching with a Trie fallback, plus a linear
+ * preset for cold-start edge builds.
  *
  * Chosen at build/startup: try RegExp first; on unsupported patterns fall
  * back to Trie. The `edge` preset uses LinearRouter for fast registration.
@@ -141,7 +141,7 @@ function matchCompiled<T>(dyn: CompiledDynamic<T>, path: string): RouteMatch<T>
 
 /**
  * Compiled RegExp router — O(1) static map, plus per-bucket compiled
- * regular expressions for parametric routes (Hono RegExpRouter idea).
+ * regular expressions for parametric routes.
  */
 export class RegExpRouter<T> implements Router<T> {
   readonly name = "RegExpRouter";

package/src/test/provisions.integration.test.ts

@@ -56,7 +56,7 @@ describe("Provisions integration", () => {
       effects: { secrets: ["STRIPE_KEY"], emits: ["order-news"] },
       do: async ({ orderId }, fx) => {
         const key = fx.vault(stripeKey);
-        expect(key.startsWith("sk_")).toBe(true);
+        expect(key.reveal().startsWith("sk_")).toBe(true);
 
         await fx.step("create-intent", async () => ({ id: `pi_${orderId}` }));
         await fx.clock.sleep("verify-window", "2m");