okengine 0.3.6 → 0.5.0

package/src/cli/schema.ts

@@ -1,10 +1,16 @@
 /**
- * `oke schema generate` — core + plugin tables → `schema/oke.ts`.
+ * `oke schema generate` — core + auth + plugin tables → `schema/oke.ts`.
  */
 
 import { createHash } from "node:crypto";
 import { mkdir } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
+import {
+  resolveAuthSchema,
+  type AuthSchemaOptions,
+  type ResolvedAuthModel,
+  type ResolvedAuthSchema,
+} from "../auth/schema.ts";
 import type { Manifest } from "../manifest/types.ts";
 import { loadManifest } from "./load-config.ts";
 
@@ -25,10 +31,12 @@ export interface SchemaGenerateOptions {
   readonly write?: (text: string) => void;
   /** Extra table names (plugins / tests). */
   readonly extraTables?: readonly string[];
+  /** Auth schema customization (from `gate.auth` / tests). */
+  readonly authSchema?: AuthSchemaOptions | false;
 }
 
 /**
- * Generate `schema/oke.ts` from Manifest store tables + core Console tables.
+ * Generate `schema/oke.ts` from Manifest store tables + core auth columns.
  *
  * @param options - Manifest / check flag
  */
@@ -42,23 +50,41 @@ export async function runSchemaGenerate(options: SchemaGenerateOptions = {}): Pr
     if (await file.exists()) manifest = await loadManifest(path);
   }
 
+  const authSchema =
+    options.authSchema === false
+      ? undefined
+      : resolveAuthSchema(options.authSchema ?? loadAuthSchemaFromManifest(manifest));
+
   const tables = new Set<string>([
-    "oke_roles",
-    "oke_role_grants",
-    "oke_api_keys",
     "oke_overrides",
     "oke_crons",
     "oke_signal_config",
     "oke_console_prefs",
     ...(options.extraTables ?? []),
   ]);
+  if (authSchema) {
+    for (const name of authSchema.tableNames) tables.add(name);
+  } else {
+    for (const name of [
+      "oke_roles",
+      "oke_role_grants",
+      "oke_api_keys",
+      "oke_identities",
+      "oke_credentials",
+      "oke_sessions",
+      "oke_refresh_tokens",
+      "oke_verifications",
+    ]) {
+      tables.add(name);
+    }
+  }
   if (manifest?.stores) {
     for (const store of Object.values(manifest.stores)) {
       for (const t of Object.keys(store.tables ?? {})) tables.add(t);
     }
   }
 
-  const source = emitSchemaSource([...tables].sort());
+  const source = emitSchemaSource([...tables].sort(), authSchema);
   const out = resolve(cwd, options.out ?? SCHEMA_OUT);
   const fp = hashSource(source);
 
@@ -91,26 +117,25 @@ export async function runSchemaGenerate(options: SchemaGenerateOptions = {}): Pr
  * @param manifest - Optional manifest
  */
 export async function schemaFingerprint(cwd: string, manifest?: Manifest): Promise<string> {
+  let m = manifest;
+  if (!m) {
+    const path = resolve(cwd, "oke.manifest.json");
+    if (await Bun.file(path).exists()) m = await loadManifest(path);
+  }
+  const authSchema = resolveAuthSchema(loadAuthSchemaFromManifest(m));
   const tables = new Set<string>([
-    "oke_roles",
-    "oke_role_grants",
-    "oke_api_keys",
     "oke_overrides",
     "oke_crons",
     "oke_signal_config",
     "oke_console_prefs",
+    ...authSchema.tableNames,
   ]);
-  let m = manifest;
-  if (!m) {
-    const path = resolve(cwd, "oke.manifest.json");
-    if (await Bun.file(path).exists()) m = await loadManifest(path);
-  }
   if (m?.stores) {
     for (const store of Object.values(m.stores)) {
       for (const t of Object.keys(store.tables ?? {})) tables.add(t);
     }
   }
-  return hashSource(emitSchemaSource([...tables].sort()));
+  return hashSource(emitSchemaSource([...tables].sort(), authSchema));
 }
 
 /**
@@ -150,7 +175,7 @@ export async function schemaCli(args: readonly string[]): Promise<number> {
     else if (a === "--help" || a === "-h") {
       console.log(`oke schema generate [--check|-c] [--out|-o schema/oke.ts]
 
-Emit core + plugin tables. Use --check in CI to fail on drift.
+Emit core auth columns + Manifest store tables. Use --check in CI to fail on drift.
 `);
       return 0;
     }
@@ -159,20 +184,33 @@ Emit core + plugin tables. Use --check in CI to fail on drift.
 }
 
 /**
- * Emit a Drizzle-compatible stub schema module.
+ * Emit a schema module with real auth columns when resolved.
  *
  * @param tables - Table names
+ * @param authSchema - Resolved auth schema (optional)
  */
-export function emitSchemaSource(tables: readonly string[]): string {
+export function emitSchemaSource(
+  tables: readonly string[],
+  authSchema?: ResolvedAuthSchema,
+): string {
+  const byTable = new Map<string, ResolvedAuthModel>();
+  if (authSchema) {
+    for (const model of Object.values(authSchema.models)) {
+      byTable.set(model.tableName, model);
+    }
+  }
+
   const decls = tables
-    .map(
-      (name) =>
-        `/** Generated table handle — wire columns in your app schema. */\nexport const ${camel(name)} = { name: "${name}" } as const;\n`,
-    )
+    .map((name) => {
+      const model = byTable.get(name);
+      if (model) return emitAuthTable(model);
+      return `/** Generated table handle — wire columns in your app schema. */\nexport const ${camel(name)} = { name: "${name}" } as const;\n`;
+    })
     .join("\n");
+
   return `/**
  * Generated by \`oke schema generate\` — do not edit.
- * Core Console tables + Manifest store tables.
+ * Core Gate auth tables + Manifest store tables.
  */
 
 ${decls}
@@ -180,6 +218,40 @@ export const okeTables = [${tables.map((t) => `"${t}"`).join(", ")}] as const;
 `;
 }
 
+function emitAuthTable(model: ResolvedAuthModel): string {
+  const cols = model.columns
+    .map((c) => {
+      const extras: string[] = [`sqlType: "${c.sqlType}"`];
+      if (c.primary) extras.push("primary: true");
+      if (c.required) extras.push("required: true");
+      if (c.defaultValue !== undefined) {
+        extras.push(`defaultValue: ${JSON.stringify(c.defaultValue)}`);
+      }
+      return `    ${c.logical}: { name: "${c.sqlName}", ${extras.join(", ")} }`;
+    })
+    .join(",\n");
+  return `/** Auth model \`${model.model}\` → \`${model.tableName}\`. */
+export const ${camel(model.tableName)} = {
+  name: "${model.tableName}",
+  model: "${model.model}",
+  columns: {
+${cols}
+  },
+} as const;
+`;
+}
+
+/**
+ * Read optional auth schema customization from Manifest extensions.
+ *
+ * @param manifest - Loaded Manifest
+ */
+function loadAuthSchemaFromManifest(manifest: Manifest | undefined): AuthSchemaOptions {
+  if (!manifest) return {};
+  const ext = (manifest as { authSchema?: AuthSchemaOptions }).authSchema;
+  return ext ?? {};
+}
+
 function hashSource(source: string): string {
   return createHash("sha256").update(source).digest("hex");
 }

package/src/client/auth.ts

@@ -0,0 +1,120 @@
+/**
+ * Optional auth helpers for {@link createClient} — not a second client factory.
+ *
+ * @module
+ */
+
+/** Common auth Flow error codes (server `fail` codes). */
+export const AUTH_ERROR_CODES = {
+  AuthFailed: "AuthFailed",
+  AuthRateLimited: "AuthRateLimited",
+  Unauthorized: "Unauthorized",
+  Forbidden: "Forbidden",
+} as const;
+
+/** In-memory session token bag for SPA / Node clients. */
+export interface MemorySession {
+  accessToken: string | null;
+  refreshToken: string | null;
+  accessExpiresAt: number | null;
+  userId: string | null;
+  set(tokens: {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly accessExpiresAt?: number;
+    readonly userId?: string;
+  }): void;
+  clear(): void;
+  /** Wire into `createClient` `auth.getToken`. */
+  getToken(): string | null;
+  /**
+   * Wire into `createClient` `auth.refresh` — calls the refresh Flow via the client.
+   *
+   * @param api - Client with `auth.refresh` route (or custom path)
+   */
+  refresh(api: {
+    auth: {
+      refresh: (input: { refreshToken: string }) => Promise<{
+        data: {
+          accessToken: string;
+          refreshToken: string;
+          accessExpiresAt?: number;
+          userId?: string;
+        } | null;
+        error: unknown;
+      }>;
+    };
+  }): Promise<string | null>;
+}
+
+/**
+ * Create an in-memory session helper for Bearer `createClient` wiring.
+ */
+export function memorySession(): MemorySession {
+  const state: {
+    accessToken: string | null;
+    refreshToken: string | null;
+    accessExpiresAt: number | null;
+    userId: string | null;
+  } = {
+    accessToken: null,
+    refreshToken: null,
+    accessExpiresAt: null,
+    userId: null,
+  };
+
+  return {
+    get accessToken() {
+      return state.accessToken;
+    },
+    set accessToken(v) {
+      state.accessToken = v;
+    },
+    get refreshToken() {
+      return state.refreshToken;
+    },
+    set refreshToken(v) {
+      state.refreshToken = v;
+    },
+    get accessExpiresAt() {
+      return state.accessExpiresAt;
+    },
+    set accessExpiresAt(v) {
+      state.accessExpiresAt = v;
+    },
+    get userId() {
+      return state.userId;
+    },
+    set userId(v) {
+      state.userId = v;
+    },
+    set(tokens) {
+      state.accessToken = tokens.accessToken;
+      state.refreshToken = tokens.refreshToken;
+      state.accessExpiresAt = tokens.accessExpiresAt ?? null;
+      state.userId = tokens.userId ?? null;
+    },
+    clear() {
+      state.accessToken = null;
+      state.refreshToken = null;
+      state.accessExpiresAt = null;
+      state.userId = null;
+    },
+    getToken() {
+      return state.accessToken;
+    },
+    async refresh(api) {
+      if (!state.refreshToken) return null;
+      const { data, error } = await api.auth.refresh({ refreshToken: state.refreshToken });
+      if (error || !data) {
+        state.accessToken = null;
+        return null;
+      }
+      state.accessToken = data.accessToken;
+      state.refreshToken = data.refreshToken;
+      state.accessExpiresAt = data.accessExpiresAt ?? null;
+      if (data.userId) state.userId = data.userId;
+      return data.accessToken;
+    },
+  };
+}

package/src/client-react/index.ts

@@ -0,0 +1,93 @@
+/**
+ * React helpers for okengine clients — `useSession` over {@link createClient}.
+ *
+ * @module
+ */
+
+import { useCallback, useEffect, useState, useSyncExternalStore } from "react";
+import type { MemorySession } from "../client/auth.ts";
+
+/** Minimal client surface for session reading. */
+export interface SessionClient {
+  auth: {
+    me: (input?: unknown) => Promise<{
+      data: {
+        userId: string;
+        email: string;
+        name: string;
+        emailVerified?: boolean;
+      } | null;
+      error: unknown;
+    }>;
+  };
+}
+
+/** Session snapshot returned by {@link useSession}. */
+export interface SessionState {
+  readonly status: "loading" | "authenticated" | "unauthenticated";
+  readonly user: {
+    readonly userId: string;
+    readonly email: string;
+    readonly name: string;
+    readonly emailVerified?: boolean;
+  } | null;
+  readonly accessToken: string | null;
+  refresh(): Promise<void>;
+  signOut(): void;
+}
+
+/**
+ * React hook: read session via `auth.me` + optional {@link memorySession} helper.
+ *
+ * @param api - Typed client from `createClient`
+ * @param session - Optional memory session (Bearer storage)
+ */
+export function useSession(api: SessionClient, session?: MemorySession): SessionState {
+  const token = useSyncExternalStore(
+    (onStoreChange) => {
+      if (!session) return () => {};
+      const id = setInterval(onStoreChange, 250);
+      return () => clearInterval(id);
+    },
+    () => session?.accessToken ?? null,
+    () => session?.accessToken ?? null,
+  );
+
+  const [user, setUser] = useState<SessionState["user"]>(null);
+  const [status, setStatus] = useState<SessionState["status"]>("loading");
+
+  const refresh = useCallback(async () => {
+    if (!token) {
+      setUser(null);
+      setStatus("unauthenticated");
+      return;
+    }
+    setStatus("loading");
+    const { data, error } = await api.auth.me({});
+    if (error || !data) {
+      setUser(null);
+      setStatus("unauthenticated");
+      return;
+    }
+    setUser(data);
+    setStatus("authenticated");
+  }, [api, token]);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  const signOut = useCallback(() => {
+    session?.clear();
+    setUser(null);
+    setStatus("unauthenticated");
+  }, [session]);
+
+  return {
+    status,
+    user,
+    accessToken: token,
+    refresh,
+    signOut,
+  };
+}

package/src/compiler/aot.test.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, test } from "bun:test";
 import { z } from "zod";
+import { gate } from "../elements/gate.ts";
 import { oke } from "../kernel/app.ts";
 import { flow, resetFlowSeq } from "../kernel/flow.ts";
 import { on, resetBindings } from "../kernel/on.ts";
@@ -118,7 +119,7 @@ describe("typed error narrowing end-to-end", () => {
     const FlightFull = z.object({ seatsLeft: z.number() });
 
     on(
-      http.post("/bookings"),
+      http.post("/bookings").gate(gate.public),
       flow({
         name: "bookings.create",
         in: Booking,

package/src/compiler/extract.ts

@@ -671,6 +671,25 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
       }
     }
 
+    if (obj === "gate" && prop === "scope") {
+      const scopeName = stringArg(call.arguments[0]);
+      if (scopeName) {
+        scope.gates[scopeName] = {
+          kind: "policy",
+          roles: [scopeName],
+          scopes: [scopeName],
+        };
+        const bindingName = enclosingConstName(call, program);
+        if (bindingName) {
+          scope.gateIds.set(bindingName, scopeName);
+          scope.bindings.set(bindingName, {
+            kind: "unknown",
+            ref: scopeName,
+          });
+        }
+      }
+    }
+
     if (obj === "gate" && prop === "rate") {
       const opts = objectArg(call.arguments[0]);
       const strategy = (stringProp(opts, "strategy") ?? "sliding-window-counter") as RateStrategy;

package/src/compiler/fixtures/skyport/src/flows/payments/index.ts

@@ -5,7 +5,11 @@ export const chargeBooking = flow({
   name: "payments.chargeBooking",
   durable: true,
   do: async ({ orderId }, fx) => {
-    const intent = await fx.step("create-intent", () => fx.vault(stripeKey));
+    // Journal only serializable step values — a Redacted is not journaled.
+    const intent = await fx.step("create-intent", async () => ({
+      id: `pi_${orderId}`,
+      key: fx.vault(stripeKey).reveal(),
+    }));
     await fx.clock.sleep("verify-window", "2m");
     return fx.step("confirm", () => intent);
   },

package/src/compiler/response.ts

@@ -91,8 +91,22 @@ export function encodeExecuteResult(result: {
 }): Response {
   if (result.response) return result.response;
   if (result.failure) return encodeFailure(result.failure);
-  if (result.error !== undefined && isFlowFailure(result.error)) {
-    return encodeFailure(result.error);
+  if (result.error !== undefined) {
+    if (isFlowFailure(result.error)) {
+      return encodeFailure(result.error);
+    }
+    // Unhandled throws must never look like success (`undefined` → 204).
+    return Response.json(
+      {
+        data: null,
+        error: {
+          code: "InternalError",
+          data: {},
+          message: result.error instanceof Error ? result.error.message : "internal error",
+        },
+      } satisfies FailureEnvelope,
+      { status: 500 },
+    );
   }
   return encodeSuccess(result.output);
 }

package/src/console/server/app.ts

@@ -2,12 +2,12 @@
  * ConsoleApp — operator-plane app built on `createClient<ConsoleApp>`.
  */
 
-import { auth } from "../../auth/index.ts";
 import { memorySignalDriver } from "../../drivers/signal-memory.ts";
 import { signal as declareSignal } from "../../elements/signal/declare.ts";
 import { createSignalRuntime } from "../../elements/signal/runtime.ts";
 import { oke, type OkeApp } from "../../kernel/index.ts";
 import { createManifestAiRuntime } from "./ai.ts";
+import { CONSOLE_GATES } from "./console-gates.ts";
 import { createConsoleBindings } from "./flows.ts";
 import { consolePlugin } from "./plugin.ts";
 import {
@@ -61,14 +61,18 @@ export function createConsoleApp(options: CreateConsoleAppOptions = {}): Console
     bindings,
     autoBoot: false,
     fx: { now: state.now },
-    auth: {
-      secret: state.secret,
-      sessions: state.sessions,
-      now: state.now,
+    gate: {
+      auth: {
+        secret: state.secret,
+        sessions: state.sessions,
+        now: state.now,
+        // Console owns `/console/session/*` — no app `/auth/*` surfaces.
+        http: false,
+      },
+      policies: [...CONSOLE_GATES],
     },
     runs: { driver: "memory" },
   })
-    .plug(auth({ secret: state.secret }))
     .plug(consolePlugin())
     .adopt({
       console: {

package/src/console/server/auth-rate.test.ts

@@ -53,18 +53,18 @@ describe("auth-rate strategy", () => {
     await createOperator(store, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
 
     const tMissing = performance.now();
-    expect(await authenticateOperator(store, "missing@example.com", "password123")).toBeNull();
+    expect(await authenticateOperator(store, "missing@example.com", "password1234")).toBeNull();
     const missingMs = performance.now() - tMissing;
 
     const tBad = performance.now();
     expect(await authenticateOperator(store, "ops@example.com", "wrong-password")).toBeNull();
     const badMs = performance.now() - tBad;
 
-    expect(await authenticateOperator(store, "ops@example.com", "password123")).not.toBeNull();
+    expect(await authenticateOperator(store, "ops@example.com", "password1234")).not.toBeNull();
 
     // Both paths pay an argon2 verify — neither should be near-instant.
     expect(missingMs).toBeGreaterThan(5);

package/src/console/server/bind.ts

@@ -2,18 +2,29 @@
  * Local HTTP bindings that do not touch the global {@link on} registry.
  */
 
+import { gate } from "../../elements/gate.ts";
 import type { AnyFlowDef } from "../../kernel/flow.ts";
 import type { Binding } from "../../kernel/on.ts";
 import { normalizeTrigger, type HttpTrigger, type Trigger } from "../../kernel/triggers.ts";
+import { consoleOperatorGate } from "./console-gates.ts";
+import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 
 /**
  * Bind an HTTP trigger to a flow without registering on the global `on` list.
+ * Attaches {@link gate.public} or {@link consoleOperatorGate} when the trigger
+ * has no declared auth posture yet.
  *
  * @param trigger - HTTP trigger
  * @param flowDef - Flow definition
  */
 export function bindHttp(trigger: HttpTrigger, flowDef: AnyFlowDef): Binding {
-  const normalized = normalizeTrigger(trigger);
+  const withPosture =
+    trigger.gates.length > 0
+      ? trigger
+      : PUBLIC_CONSOLE_FLOWS.has(flowDef.name)
+        ? trigger.gate(gate.public)
+        : trigger.gate(consoleOperatorGate);
+  const normalized = normalizeTrigger(withPosture);
   const list = flowDef.triggers as Trigger[];
   list.push(normalized);
   (flowDef as { $trigger: Trigger }).$trigger = normalized;

package/src/console/server/channels.test.ts

@@ -115,7 +115,7 @@ describe("console.channel.sendTest", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );

package/src/console/server/console-gates.ts

@@ -0,0 +1,14 @@
+/**
+ * Console HTTP auth-posture gates — public sentinel vs operator policy.
+ */
+
+import { gate, type PolicyGateDecl } from "../../elements/gate.ts";
+
+/** Operator must be present (Console plane). */
+export const consoleOperatorGate: PolicyGateDecl = gate.policy(
+  "console:operator",
+  ({ operator }) => operator.id !== null,
+);
+
+/** Gates registered on the Console app runtime. */
+export const CONSOLE_GATES = [gate.public, consoleOperatorGate] as const;

package/src/console/server/console.test.ts

@@ -69,7 +69,7 @@ describe("console kernel", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -89,7 +89,7 @@ describe("console kernel", () => {
             claimCode: code,
             email: "other@example.com",
             name: "Other",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -127,7 +127,7 @@ describe("console kernel", () => {
             claimCode: handle.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -175,7 +175,7 @@ describe("console kernel", () => {
             claimCode: handle.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -223,7 +223,7 @@ describe("console kernel", () => {
             claimCode: handle.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -317,7 +317,7 @@ describe("console serve security", () => {
           claimCode: server.console.state.claim.code,
           email: "ops@example.com",
           name: "Ops",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );

package/src/console/server/flows-invoke.test.ts

@@ -31,7 +31,7 @@ describe("console flows invoke", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -100,7 +100,7 @@ describe("console flows invoke", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );