okengine 0.3.6 → 0.5.0

package/src/auth/secondary-storage.ts

@@ -0,0 +1,37 @@
+/**
+ * Optional secondary storage for hot auth data (Phase 1a) — `store.kv`.
+ */
+
+import type { ResolvedGateAuth } from "./config.ts";
+
+/** Minimal kv surface used by auth secondary storage. */
+export interface AuthKv {
+  get(key: string): Promise<unknown>;
+  set(key: string, value: unknown, opts?: { readonly ttlMs?: number }): Promise<void>;
+  delete(key: string): Promise<void>;
+}
+
+/**
+ * Create a namespaced kv helper for session / challenge hot paths.
+ *
+ * @param kv - Kv handle
+ * @param config - Resolved auth
+ */
+export function createAuthSecondaryStorage(
+  kv: AuthKv,
+  config: ResolvedGateAuth,
+): AuthKv | undefined {
+  if (!config.secondaryStorage.enabled) return undefined;
+  const prefix = config.secondaryStorage.prefix;
+  return {
+    async get(key) {
+      return kv.get(`${prefix}${key}`);
+    },
+    async set(key, value, opts) {
+      await kv.set(`${prefix}${key}`, value, opts);
+    },
+    async delete(key) {
+      await kv.delete(`${prefix}${key}`);
+    },
+  };
+}

package/src/auth/sessions.ts

@@ -52,6 +52,21 @@ export interface SessionCrypto {
   readonly now?: () => number;
   readonly accessTtlMs?: number;
   readonly refreshTtlMs?: number;
+  /**
+   * Idle timeout — reject refresh when `now - lastActiveAt > idleTtlMs`.
+   * Opt-in (undefined = disabled).
+   */
+  readonly idleTtlMs?: number;
+  /**
+   * Absolute lifetime from `session.createdAt` (hard stop even if refresh would extend).
+   * Opt-in; when set should be ≤ refreshTtlMs.
+   */
+  readonly absoluteTtlMs?: number;
+  /**
+   * When true, issuing a session revokes other active families for the same principal.
+   * Opt-in (default false).
+   */
+  readonly singleSessionPerUser?: boolean;
   /**
    * Audience stamped on issued access tokens.
    * MCP tokens must use `"oke-mcp"` (console §10.3 — never accept another aud).
@@ -97,9 +112,15 @@ export async function issueSession(
   const t = now();
   const accessTtl = crypto.accessTtlMs ?? ACCESS_TTL_MS;
   const refreshTtl = crypto.refreshTtlMs ?? REFRESH_TTL_MS;
+  const absoluteCap =
+    crypto.absoluteTtlMs !== undefined ? Math.min(refreshTtl, crypto.absoluteTtlMs) : refreshTtl;
   const sessionId = cryptoRandomId();
   const familyId = cryptoRandomId();
 
+  if (crypto.singleSessionPerUser) {
+    revokePrincipalSessions(store, principal.plane, principal.id, t);
+  }
+
   const session: SessionRow = {
     id: sessionId,
     plane: principal.plane,
@@ -107,7 +128,8 @@ export async function issueSession(
     familyId,
     revokedAt: null,
     createdAt: t,
-    expiresAt: t + refreshTtl,
+    expiresAt: t + absoluteCap,
+    lastActiveAt: t,
   };
   store.sessions.set(sessionId, session);
   if (crypto.audience !== undefined) {
@@ -174,9 +196,17 @@ export async function rotateRefresh(
   if (existing.expiresAt <= t || session.expiresAt <= t) {
     throw new SessionError("refresh token expired");
   }
+  if (crypto.absoluteTtlMs !== undefined && session.createdAt + crypto.absoluteTtlMs <= t) {
+    throw new SessionError("session absolute lifetime exceeded");
+  }
+  const lastActive = session.lastActiveAt ?? session.createdAt;
+  if (crypto.idleTtlMs !== undefined && lastActive + crypto.idleTtlMs <= t) {
+    throw new SessionError("session idle timeout exceeded");
+  }
 
   existing.usedAt = t;
   existing.revokedAt = t;
+  session.lastActiveAt = t;
 
   const accessTtl = crypto.accessTtlMs ?? ACCESS_TTL_MS;
   const refreshTtl = crypto.refreshTtlMs ?? REFRESH_TTL_MS;
@@ -305,6 +335,8 @@ export async function verifyAccess(
   if (session.principalId !== claims.sub) {
     throw new SessionError("session does not belong to requester");
   }
+  // Touch idle clock on successful access verify.
+  session.lastActiveAt = now();
   return claims;
 }
 
@@ -324,6 +356,31 @@ export function revokeFamily(store: SessionStore, familyId: string, at: number =
   }
 }
 
+/**
+ * Revoke all active sessions for a principal (single-session-per-user).
+ *
+ * @param store - Session store
+ * @param plane - Auth plane
+ * @param principalId - Subject id
+ * @param at - Timestamp
+ */
+export function revokePrincipalSessions(
+  store: SessionStore,
+  plane: AuthPlane,
+  principalId: string,
+  at: number = Date.now(),
+): void {
+  for (const session of store.sessions.values()) {
+    if (
+      session.plane === plane &&
+      session.principalId === principalId &&
+      session.revokedAt === null
+    ) {
+      revokeFamily(store, session.familyId, at);
+    }
+  }
+}
+
 /** Session / token error. */
 export class SessionError extends Error {
   /** @param message - Diagnostic */

package/src/auth/tables.ts

@@ -23,6 +23,8 @@ export const AUTH_TABLES = {
   // Session tables (auth element owns these)
   sessions: "oke_sessions",
   refreshTokens: "oke_refresh_tokens",
+  // Challenges / OTP / magic-link (Gate auth + method plugins)
+  verifications: "oke_verifications",
 } as const;
 
 /** Plane column values stored on shared tables. */
@@ -117,6 +119,8 @@ export interface SessionRow {
   revokedAt: number | null;
   createdAt: number;
   expiresAt: number;
+  /** Last activity epoch-ms (idle timeout). Updated on refresh / access touch. */
+  lastActiveAt: number;
 }
 
 /** Refresh token (hashed at rest); rotation with reuse detection. */

package/src/auth/verification.ts

@@ -0,0 +1,78 @@
+/**
+ * Shared verification / challenge store for magic-link, OTP, phone, etc.
+ */
+
+/** One pending challenge. */
+export interface VerificationRow {
+  id: string;
+  identifier: string;
+  value: string;
+  expiresAt: number;
+  createdAt: number;
+  consumedAt: number | null;
+  attempts: number;
+}
+
+/** In-memory verification store. */
+export interface VerificationStore {
+  rows: Map<string, VerificationRow>;
+}
+
+/**
+ * Create an empty verification store.
+ */
+export function createVerificationStore(): VerificationStore {
+  return { rows: new Map() };
+}
+
+/**
+ * Store a challenge (hashed value recommended by callers).
+ *
+ * @param store - Store
+ * @param row - Challenge row
+ */
+export function putVerification(store: VerificationStore, row: VerificationRow): void {
+  store.rows.set(row.id, row);
+}
+
+/**
+ * Find a non-consumed, non-expired challenge by identifier.
+ *
+ * @param store - Store
+ * @param identifier - Email / phone / username key
+ * @param now - Clock
+ */
+export function findActiveVerification(
+  store: VerificationStore,
+  identifier: string,
+  now: number,
+): VerificationRow | undefined {
+  for (const row of store.rows.values()) {
+    if (row.identifier !== identifier) continue;
+    if (row.consumedAt !== null) continue;
+    if (row.expiresAt <= now) continue;
+    return row;
+  }
+  return undefined;
+}
+
+/**
+ * SHA-256 hex hash for challenge secrets / OTPs.
+ *
+ * @param raw - Raw secret
+ */
+export async function hashChallenge(raw: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/**
+ * Generate a numeric OTP of `digits` length.
+ *
+ * @param digits - Length (default 6)
+ */
+export function generateOtp(digits = 6): string {
+  const max = 10 ** digits;
+  const n = crypto.getRandomValues(new Uint32Array(1))[0]! % max;
+  return n.toString().padStart(digits, "0");
+}

package/src/cli/competitor-mention-removal.test.ts

@@ -0,0 +1,117 @@
+/**
+ * Gate: named competitor comparisons stay gone from the tracked tree.
+ *
+ * Mirrors {@link ./doc-staleness.test.ts} — `git grep` must find zero hits
+ * (the security-headers decoy header fixture may still use a common
+ * `X-Powered-By` value; that path is allow-listed).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dir, "../..");
+
+/** Forbidden peer name — split so this file does not match itself. */
+const FORBIDDEN_HONO = ["Ho", "no"].join("");
+/** Forbidden peer name. */
+const FORBIDDEN_ELYSIA = ["Ely", "sia"].join("");
+/** Forbidden peer name (covers Enc + ore.ts). */
+const FORBIDDEN_ENCORE = ["Enc", "ore"].join("");
+/** Forbidden peer name. */
+const FORBIDDEN_NESTJS = ["Nest", "JS"].join("");
+/** Forbidden peer name. */
+const FORBIDDEN_FASTIFY = ["Fast", "ify"].join("");
+/** Forbidden peer site — avoid bare `iii` (matches lockfile hashes). */
+const FORBIDDEN_III_DEV = ["iii", ".", "dev"].join("");
+/** Deleted Comparison page path residue. */
+const FORBIDDEN_COMPARISON_PATH = ["get-started/", "comparison"].join("");
+/** Word-boundary classic Node framework — `-F` false-positives on `CallExpression`. */
+const FORBIDDEN_EXPRESS = ["\\b", "Ex", "press", "\\b"].join("");
+
+/** Decoy `X-Powered-By` fixture value in the security-headers plugin tests. */
+const EXPRESS_ALLOW = ["src/plugins/security-headers.test.ts:"];
+
+/**
+ * Run `git grep -F` and assert zero matches after ignoring allow-listed paths.
+ *
+ * @param pattern - Fixed-string pattern
+ * @param ignorePrefixes - Path prefixes to ignore (`path:line:` hits)
+ */
+function assertZeroGitGrepFixed(pattern: string, ignorePrefixes: readonly string[] = []): void {
+  const proc = Bun.spawnSync(["git", "grep", "-F", "-n", "-e", pattern, "--"], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  // git grep exits 1 when there are no matches.
+  if (proc.exitCode === 1) {
+    expect(proc.stdout.toString()).toBe("");
+    return;
+  }
+  const hits = proc.stdout
+    .toString()
+    .trim()
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .filter((line) => !ignorePrefixes.some((prefix) => line.startsWith(prefix)));
+  expect(hits.join("\n")).toBe("");
+}
+
+/**
+ * Run `git grep` with a basic regex and assert zero matches after allow-list.
+ *
+ * @param pattern - Basic regex (no `-F`)
+ * @param ignorePrefixes - Path prefixes to ignore (`path:line:` hits)
+ */
+function assertZeroGitGrepRegex(pattern: string, ignorePrefixes: readonly string[] = []): void {
+  const proc = Bun.spawnSync(["git", "grep", "-n", "-e", pattern, "--"], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  if (proc.exitCode === 1) {
+    expect(proc.stdout.toString()).toBe("");
+    return;
+  }
+  const hits = proc.stdout
+    .toString()
+    .trim()
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .filter((line) => !ignorePrefixes.some((prefix) => line.startsWith(prefix)));
+  expect(hits.join("\n")).toBe("");
+}
+
+describe("named competitor mention removal gate", () => {
+  test("tracked tree has zero mentions of the thin multi-runtime router peer", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_HONO);
+  });
+
+  test("tracked tree has zero mentions of the Bun-first peer framework", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_ELYSIA);
+  });
+
+  test("tracked tree has zero mentions of the Rust-core peer platform", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_ENCORE);
+  });
+
+  test("tracked tree has zero mentions of the decorator DI peer", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_NESTJS);
+  });
+
+  test("tracked tree has zero mentions of the Node HTTP peer", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_FASTIFY);
+  });
+
+  test("tracked tree has zero mentions of the polyglot peer site host", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_III_DEV);
+  });
+
+  test("tracked tree has zero deleted Comparison path residue", () => {
+    assertZeroGitGrepFixed(FORBIDDEN_COMPARISON_PATH);
+  });
+
+  test("tracked tree has zero classic Node framework peer mentions outside decoy fixture", () => {
+    assertZeroGitGrepRegex(FORBIDDEN_EXPRESS, EXPRESS_ALLOW);
+  });
+});

package/src/cli/dev.test.ts

@@ -396,14 +396,14 @@ describe("oke dev docs MCP", () => {
 async function writePingApp(dir: string, version: string): Promise<void> {
   await Bun.write(
     join(dir, "src/flows/ping.ts"),
-    `import { on, flow, http } from ${JSON.stringify(OKE_INDEX)};
+    `import { on, flow, http, gate } from ${JSON.stringify(OKE_INDEX)};
 
-export const ping = on(http.get("/ping"), flow({
+export const ping = on(http.get("/ping").gate(gate.public), flow({
   name: "ping",
   do: () => ({ version: ${JSON.stringify(version)} as const }),
 }));
 
-export const slow = on(http.get("/slow"), flow({
+export const slow = on(http.get("/slow").gate(gate.public), flow({
   name: "slow",
   do: async () => {
     const started = ${JSON.stringify(version)};

package/src/cli/dev.ts

@@ -339,6 +339,24 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     loadedConfig = null;
   }
 
+  // Local mode + a configured `meilisearch` store.index: bring the server up
+  // as a fourth local process (binary on PATH — a documented prerequisite,
+  // like Docker for --docker). Docker mode instead relies on the recipe.
+  let meili: import("./meilisearch-local.ts").LocalMeilisearchHandle | null = null;
+  if (mode === "local") {
+    const indexId = resolveDriverId(loadedConfig?.drivers?.store?.index, "local") ?? "memory";
+    if (indexId === "meilisearch") {
+      try {
+        const { startLocalMeilisearch } = await import("./meilisearch-local.ts");
+        meili = await startLocalMeilisearch({ cwd });
+        write(formatStatusLine(`meilisearch local server on ${meili.url}`));
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return { code: 1 };
+      }
+    }
+  }
+
   if (mode === "docker") {
     let images = options.images;
     if (!images) {
@@ -567,6 +585,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
           OKE_KV_DRIVER: stackKvDriver,
         }
       : {}),
+    ...(meili?.overlay ?? {}),
   };
   process.env.OKE_DEV_REQUEST_LOG = "1";
 
@@ -755,6 +774,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     stopped = true;
     autoPushRunner.cancel();
     watcher.close();
+    meili?.stop();
     app.stop();
     consoleServer.stop();
     mcpServer?.stop();

package/src/cli/meilisearch-local.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Local Meilisearch lifecycle — persisted master key material and fail-loud
+ * binary resolution. Never spawns a real server here.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  ensureMasterKey,
+  MEILISEARCH_STATE_DIR_REL,
+  MeilisearchLocalError,
+  startLocalMeilisearch,
+} from "./meilisearch-local.ts";
+
+const dirs: string[] = [];
+
+function tempStateDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "oke-meili-"));
+  dirs.push(dir);
+  return dir;
+}
+
+afterEach(() => {
+  while (dirs.length > 0) {
+    const dir = dirs.pop();
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("ensureMasterKey", () => {
+  test("generates once, persists 0600, reuses on next call", () => {
+    const stateDir = tempStateDir();
+    const first = ensureMasterKey(stateDir);
+    const second = ensureMasterKey(stateDir);
+    expect(first).toBe(second);
+    expect(first.length).toBeGreaterThanOrEqual(32);
+    const keyPath = join(stateDir, "master.key");
+    expect(statSync(keyPath).mode & 0o777).toBe(0o600);
+    expect(statSync(stateDir).mode & 0o777).toBe(0o700);
+    expect(readFileSync(keyPath, "utf8").trim()).toBe(first);
+    // No leftover temp files.
+    expect(readdirSync(stateDir).filter((f) => f.includes(".tmp-"))).toHaveLength(0);
+  });
+
+  test("a too-short persisted key fails loud", () => {
+    const stateDir = tempStateDir();
+    const keyPath = join(stateDir, "master.key");
+    // Write a weak key directly (bypasses the writer) to simulate corruption.
+    writeFileSync(keyPath, "short\n");
+    expect(() => ensureMasterKey(stateDir)).toThrow(MeilisearchLocalError);
+  });
+});
+
+describe("startLocalMeilisearch", () => {
+  test("missing binary fails loud with an install hint (never silent memory)", async () => {
+    await expect(
+      startLocalMeilisearch({
+        binary: "meilisearch-definitely-not-on-path-xyz",
+        stateDir: tempStateDir(),
+      }),
+    ).rejects.toThrow(/not found on PATH|never auto-downloads/i);
+  });
+
+  test("state dir rel lives under .oke", () => {
+    expect(MEILISEARCH_STATE_DIR_REL).toBe(join(".oke", "meilisearch"));
+  });
+});

package/src/cli/meilisearch-local.ts

@@ -0,0 +1,188 @@
+/**
+ * Local Meilisearch lifecycle for `oke dev` (local mode).
+ *
+ * A Meilisearch server is a fourth moving part only when the app actually
+ * opts into the `meilisearch` store.index driver. This module:
+ *
+ *  - generates the master key once and persists it under `.oke/meilisearch/`
+ *    (`0700` dir / `0600` file, atomic write — same material discipline as
+ *    OpenBao, minus the init/unseal ceremony: a single static key),
+ *  - resolves the `meilisearch` binary from `PATH` (a documented prerequisite,
+ *    like Docker for `--docker`; we never auto-download binaries),
+ *  - spawns it via `Bun.spawn` with its own data dir + port, polls `/health`,
+ *    and hands back an env overlay (`OKE_STORE_INDEX_URL` / `…_KEY`) plus a
+ *    `stop()` that kills the child alongside the app.
+ *
+ * Fail-loud: missing binary / unhealthy server / never-ready all throw
+ * {@link MeilisearchLocalError} — never a silent memory fallback.
+ */
+
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+/** Material directory relative to the project root. */
+export const MEILISEARCH_STATE_DIR_REL = join(".oke", "meilisearch");
+/** Default loopback port for the local server. */
+export const MEILISEARCH_LOCAL_PORT = 7700;
+
+/** Fail-loud local Meilisearch error (missing binary / never healthy). */
+export class MeilisearchLocalError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "MeilisearchLocalError";
+  }
+}
+
+/** Options for {@link startLocalMeilisearch}. */
+export interface LocalMeilisearchOptions {
+  readonly cwd?: string;
+  /** Loopback port (default {@link MEILISEARCH_LOCAL_PORT}). */
+  readonly port?: number;
+  /** Override state dir (tests). */
+  readonly stateDir?: string;
+  /** Binary name/path resolved via `Bun.which` (default `meilisearch`). */
+  readonly binary?: string;
+  /** Max ms to wait for `/health` to report available (default 30_000). */
+  readonly readyTimeoutMs?: number;
+  readonly fetch?: typeof globalThis.fetch;
+}
+
+/** A running local Meilisearch child. */
+export interface LocalMeilisearchHandle {
+  /** Base URL the app should talk to. */
+  readonly url: string;
+  /** Master key (also persisted on disk). */
+  readonly masterKey: string;
+  /** Env overlay for the app child. */
+  readonly overlay: Record<string, string>;
+  /** Kill the child (idempotent). */
+  readonly stop: () => void;
+}
+
+/** Env overlay for the app child. */
+export function meilisearchStackEnv(handle: LocalMeilisearchHandle): Record<string, string> {
+  return handle.overlay;
+}
+
+function writeMaterial(path: string, value: string): void {
+  mkdirSync(dirname(path), { recursive: true });
+  chmodSync(dirname(path), 0o700);
+  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync(tmp, `${value}\n`, { mode: 0o600 });
+  renameSync(tmp, path);
+  chmodSync(path, 0o600);
+  const back = readFileSync(path, "utf8").trim();
+  if (back !== value) {
+    throw new MeilisearchLocalError(`meilisearch local: verify failed reading ${path}`);
+  }
+}
+
+/** Read the persisted master key, or generate + persist a fresh one. */
+export function ensureMasterKey(stateDir: string): string {
+  const keyPath = join(stateDir, "master.key");
+  if (existsSync(keyPath)) {
+    const key = readFileSync(keyPath, "utf8").trim();
+    if (key.length >= 16) return key;
+    throw new MeilisearchLocalError(
+      `meilisearch local: ${keyPath} exists but is too short — delete it to regenerate`,
+    );
+  }
+  const key = randomBytes(32).toString("hex");
+  writeMaterial(keyPath, key);
+  return key;
+}
+
+/**
+ * Start a local Meilisearch server and wait for `/health`.
+ *
+ * @param options - cwd / port / binary / injected fetch
+ */
+export async function startLocalMeilisearch(
+  options: LocalMeilisearchOptions = {},
+): Promise<LocalMeilisearchHandle> {
+  const cwd = options.cwd ?? process.cwd();
+  const port = options.port ?? MEILISEARCH_LOCAL_PORT;
+  const stateDir = options.stateDir ?? resolve(cwd, MEILISEARCH_STATE_DIR_REL);
+  const dataDir = join(stateDir, "data");
+  const fetchFn = options.fetch ?? globalThis.fetch;
+  const readyTimeoutMs = options.readyTimeoutMs ?? 30_000;
+
+  const binary = options.binary ?? "meilisearch";
+  const resolved = Bun.which(binary);
+  if (!resolved) {
+    throw new MeilisearchLocalError(
+      "meilisearch local: `meilisearch` not found on PATH — install it to use the store.index FTS driver " +
+        "(brew install meilisearch · curl -L https://install.meilisearch.com | sh), " +
+        "or run `oke dev --docker` instead. OKE never auto-downloads binaries.",
+    );
+  }
+
+  const masterKey = ensureMasterKey(stateDir);
+  mkdirSync(dataDir, { recursive: true });
+
+  const url = `http://127.0.0.1:${port}`;
+  const proc = Bun.spawn(
+    [
+      resolved,
+      "--http-addr",
+      `127.0.0.1:${port}`,
+      "--master-key",
+      masterKey,
+      "--db-path",
+      dataDir,
+      "--env",
+      "development",
+      "--no-analytics",
+    ],
+    {
+      cwd,
+      stdout: "ignore",
+      stderr: "inherit",
+      env: { ...(process.env as Record<string, string>) },
+    },
+  );
+
+  let stopped = false;
+  const stop = () => {
+    if (stopped) return;
+    stopped = true;
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+      // Already gone.
+    }
+  };
+
+  const deadline = Date.now() + readyTimeoutMs;
+  for (;;) {
+    if (proc.exitCode !== null) {
+      throw new MeilisearchLocalError(
+        `meilisearch local: server exited (${proc.exitCode}) before becoming healthy`,
+      );
+    }
+    try {
+      const res = await fetchFn(`${url}/health`);
+      if (res.ok) break;
+    } catch {
+      // Not up yet.
+    }
+    if (Date.now() > deadline) {
+      stop();
+      throw new MeilisearchLocalError(
+        `meilisearch local: no /health from ${url} within ${readyTimeoutMs}ms`,
+      );
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+
+  return {
+    url,
+    masterKey,
+    overlay: {
+      OKE_STORE_INDEX_URL: url,
+      OKE_STORE_INDEX_KEY: masterKey,
+    },
+    stop,
+  };
+}