okengine 0.3.6 → 0.5.0

package/src/elements/gate/config.ts

@@ -0,0 +1,69 @@
+/**
+ * `oke({ gate })` — nested Gate bag (auth · policies · rate · posture).
+ */
+
+import { resolveGateAuth, type GateAuthOptions, type ResolvedGateAuth } from "../../auth/config.ts";
+import type { GateDecl } from "./declare.ts";
+
+/** Rate-limit defaults under Gate. */
+export interface GateRateLimitOptions {
+  /** When true, auth Flows attach stricter rate presets (default true when auth enabled). */
+  readonly enabled?: boolean;
+}
+
+/**
+ * Nested Gate options for {@link oke}.
+ *
+ * Replaces root `auth` / `gates` / `unguardedHttp`.
+ */
+export interface GateOptions {
+  /** Builtin hybrid-session auth + core Flows under `basePath`. */
+  readonly auth?: GateAuthOptions;
+  /** Named policy / rate declarations for the Gate runtime. */
+  readonly policies?: readonly GateDecl[];
+  /** Global rate-limit posture (auth path presets). */
+  readonly rateLimit?: GateRateLimitOptions;
+  /**
+   * HTTP auth-posture enforcement at boot.
+   * Default `"deny"`. `"allow"` is honoured only when `env === "test"`.
+   */
+  readonly unguardedHttp?: "deny" | "allow";
+}
+
+/** Fully resolved Gate config consumed by `oke` / boot. */
+export interface ResolvedGateConfig {
+  readonly auth: ResolvedGateAuth | undefined;
+  readonly policies: readonly GateDecl[];
+  readonly rateLimitEnabled: boolean;
+  readonly unguardedHttp: "deny" | "allow";
+}
+
+/** Options for {@link resolveGateConfig}. */
+export interface ResolveGateConfigOptions {
+  readonly gate?: GateOptions;
+  readonly env?: string;
+}
+
+/**
+ * Resolve the nested `gate` bag for construction / boot.
+ *
+ * @param options - Gate bag + env (for auth secret rules)
+ */
+export function resolveGateConfig(options: ResolveGateConfigOptions = {}): ResolvedGateConfig {
+  const bag = options.gate ?? {};
+  const auth =
+    bag.auth !== undefined ? resolveGateAuth({ auth: bag.auth, env: options.env }) : undefined;
+  const rateLimitEnabled =
+    bag.rateLimit?.enabled !== undefined
+      ? bag.rateLimit.enabled
+      : auth !== undefined
+        ? true
+        : false;
+
+  return {
+    auth,
+    policies: bag.policies ?? [],
+    rateLimitEnabled,
+    unguardedHttp: bag.unguardedHttp ?? "deny",
+  };
+}

package/src/elements/gate/declare.ts

@@ -63,6 +63,11 @@ export interface PolicyGateDecl {
   readonly name: string;
   readonly check: (ctx: GatePolicyContext) => boolean | Promise<boolean>;
   readonly description?: string;
+  /**
+   * Scope strings this policy requires (set by {@link GateNamespace.scope}).
+   * Same string is the policy id and the scope checked on `auth.scopes`.
+   */
+  readonly scopes?: readonly string[];
 }
 
 /** Rate gate declaration. */
@@ -94,6 +99,19 @@ export interface GateNamespace {
     name: string,
     checkOrOptions: ((ctx: GatePolicyContext) => boolean | Promise<boolean>) | PolicyGateOptions,
   ): PolicyGateDecl;
+  /**
+   * Shorthand for a scope check — single source of truth for the scope string.
+   *
+   * Equivalent to `gate.policy(name, ({ auth }) => auth.scopes.has(name))`.
+   *
+   * @param name - Scope id (also the policy name / Module:Action when it contains `:`)
+   */
+  scope(name: string): PolicyGateDecl;
+  /**
+   * Explicit public sentinel — intentionally unauthenticated HTTP surface.
+   * Counts as declared auth posture for boot (see gate boot audit).
+   */
+  readonly public: PolicyGateDecl;
   /**
    * Declare a rate limit (atomic Lua on the kv driver).
    *
@@ -102,8 +120,11 @@ export interface GateNamespace {
   rate(options: RateOptions): RateGateDecl;
 }
 
+/** Reserved policy name for {@link gate.public}. */
+export const GATE_PUBLIC_NAME = "public";
+
 /**
- * Gate element namespace — `gate.policy` · `gate.rate`.
+ * Gate element namespace — `gate.policy` · `gate.scope` · `gate.public` · `gate.rate`.
  */
 export const gate: GateNamespace = {
   /**
@@ -116,6 +137,11 @@ export const gate: GateNamespace = {
     name: string,
     checkOrOptions: ((ctx: GatePolicyContext) => boolean | Promise<boolean>) | PolicyGateOptions,
   ): PolicyGateDecl {
+    if (name === GATE_PUBLIC_NAME) {
+      throw new TypeError(
+        'gate.policy: name "public" is reserved — use gate.public for intentionally unauthenticated surfaces',
+      );
+    }
     if (typeof checkOrOptions === "function") {
       return { kind: "policy", name, check: checkOrOptions };
     }
@@ -129,6 +155,30 @@ export const gate: GateNamespace = {
     };
   },
 
+  /**
+   * Shorthand for a scope check — single source of truth for the scope string.
+   *
+   * @param name - Scope id (also the policy name)
+   */
+  scope(name: string): PolicyGateDecl {
+    if (name === GATE_PUBLIC_NAME) {
+      throw new TypeError('gate.scope: name "public" is reserved — use gate.public');
+    }
+    return {
+      kind: "policy",
+      name,
+      check: ({ auth }) => auth.scopes.has(name),
+      scopes: [name],
+    };
+  },
+
+  public: {
+    kind: "policy",
+    name: GATE_PUBLIC_NAME,
+    check: () => true,
+    description: "Intentionally unauthenticated (public) surface",
+  },
+
   /**
    * Declare a rate limit (atomic Lua on the kv driver).
    *

package/src/elements/gate/runtime.ts

@@ -3,7 +3,7 @@
  */
 
 import { parseDurationMs } from "../clock/duration.ts";
-import type { GateDecl, GatePolicyContext, RateGateDecl } from "./declare.ts";
+import { gate, type GateDecl, type GatePolicyContext, type RateGateDecl } from "./declare.ts";
 import { takeRate } from "./strategies.ts";
 
 /** KV surface required for rate gates. */
@@ -58,6 +58,8 @@ export interface GateRuntime {
  */
 export function createGateRuntime(options: CreateGateRuntimeOptions = {}): GateRuntime {
   const map = new Map<string, GateDecl>();
+  // Built-in sentinel — `.gate(gate.public)` works without listing it in `oke({ gates })`.
+  map.set(gate.public.name, gate.public);
   for (const g of options.gates ?? []) {
     map.set(g.name, g);
   }

package/src/elements/gate.test.ts

@@ -11,10 +11,12 @@ import { createRedisFakeClient, redisDriver } from "../drivers/redis.ts";
 import type { Manifest } from "../manifest/types.ts";
 import {
   ALL_RATE_STRATEGIES,
+  assertHttpGatePosture,
   createGateRuntime,
   deriveModuleActions,
   formatGatesList,
   gate,
+  GateBootError,
   takeRate,
 } from "./gate.ts";
 
@@ -35,6 +37,37 @@ describe("gate declaration", () => {
     expect(fair.strategy).toBe("sliding-window-counter");
   });
 
+  test("scope is sugar over policy with auth.scopes.has(name)", async () => {
+    const canBook = gate.scope("booking:create");
+    expect(canBook.kind).toBe("policy");
+    expect(canBook.name).toBe("booking:create");
+    expect(canBook.scopes).toEqual(["booking:create"]);
+    expect(
+      await canBook.check({
+        auth: { userId: "u1", scopes: new Set(["booking:create"]), verified: true },
+        operator: { id: null },
+      }),
+    ).toBe(true);
+    expect(
+      await canBook.check({
+        auth: { userId: "u1", scopes: new Set(), verified: true },
+        operator: { id: null },
+      }),
+    ).toBe(false);
+  });
+
+  test("public sentinel always allows and reserves the name", async () => {
+    expect(gate.public.name).toBe("public");
+    expect(
+      await gate.public.check({
+        auth: { userId: null, scopes: new Set() },
+        operator: { id: null },
+      }),
+    ).toBe(true);
+    expect(() => gate.policy("public", () => true)).toThrow(/reserved/);
+    expect(() => gate.scope("public")).toThrow(/reserved/);
+  });
+
   test("defaults strategy to sliding-window-counter", () => {
     const r = gate.rate({ max: 10, per: "1s" });
     expect(r.strategy).toBe("sliding-window-counter");
@@ -117,7 +150,51 @@ describe("five rate strategies — concurrency", () => {
   });
 });
 
+describe("gate boot posture", () => {
+  const unguarded = [
+    {
+      trigger: { kind: "http" as const, method: "GET", path: "/health", gates: [] as const },
+      flow: { name: "health.ping" },
+    },
+  ];
+
+  test("GateBootError lists every unguarded HTTP trigger", () => {
+    expect(() =>
+      assertHttpGatePosture([
+        ...unguarded,
+        {
+          trigger: { kind: "http", method: "POST", path: "/x", gates: [gate.public] },
+          flow: { name: "x.public" },
+        },
+      ]),
+    ).toThrow(GateBootError);
+  });
+
+  test("unguardedHttp allow skips audit only when env is test", () => {
+    expect(() =>
+      assertHttpGatePosture(unguarded, { unguardedHttp: "allow", env: "test" }),
+    ).not.toThrow();
+  });
+
+  test("unguardedHttp allow has no effect outside env === test", () => {
+    for (const env of ["local", "prod", "docker"] as const) {
+      expect(() => assertHttpGatePosture(unguarded, { unguardedHttp: "allow", env })).toThrow(
+        GateBootError,
+      );
+    }
+  });
+});
+
 describe("gate runtime", () => {
+  test("public sentinel is always registered", async () => {
+    const rt = createGateRuntime();
+    const ok = await rt.allow(["public"], {
+      auth: { userId: null, scopes: new Set() },
+      operator: { id: null },
+    });
+    expect(ok).toBe(true);
+  });
+
   test("policy then rate — evaluation order", async () => {
     const kv = await memoryKvDriver.open({ name: "gate-rt" });
     const member = gate.policy("member", ({ auth }) => !!auth.verified);

package/src/elements/gate.ts

@@ -8,7 +8,7 @@
  * @module
  */
 
-export { gate } from "./gate/declare.ts";
+export { gate, GATE_PUBLIC_NAME } from "./gate/declare.ts";
 export type {
   GateDecl,
   GatePolicyContext,
@@ -18,6 +18,25 @@ export type {
   RateOptions,
 } from "./gate/declare.ts";
 
+export {
+  resolveGateConfig,
+  type GateOptions,
+  type GateRateLimitOptions,
+  type ResolvedGateConfig,
+  type ResolveGateConfigOptions,
+} from "./gate/config.ts";
+
+export {
+  GateBootError,
+  assertHttpGatePosture,
+  collectUnguardedHttpGaps,
+  hasHttpGatePosture,
+  isPublicGateRef,
+  unguardedHttpAllowActive,
+  type AssertHttpGatePostureOptions,
+  type GatePostureGap,
+} from "./gate/boot.ts";
+
 export {
   createGateRuntime,
   type CreateGateRuntimeOptions,

package/src/elements/index.ts

@@ -62,6 +62,13 @@ export type { ClockDecl, ClockOptions, ClockRuntime, TimeTravel, DurableResult }
 
 export {
   gate,
+  GATE_PUBLIC_NAME,
+  GateBootError,
+  assertHttpGatePosture,
+  collectUnguardedHttpGaps,
+  hasHttpGatePosture,
+  isPublicGateRef,
+  unguardedHttpAllowActive,
   createGateRuntime,
   takeRate,
   deriveModuleActions,
@@ -72,6 +79,7 @@ export {
 export type {
   GateDecl,
   GatePolicyContext,
+  GatePostureGap,
   GateRuntime,
   RateOptions,
   RateTakeResult,

package/src/elements/store/index-boot.test.ts

@@ -22,8 +22,8 @@ import {
   createStoreRuntime,
   index as declareIndex,
   sql as declareSql,
-  type IndexStoreFxHandle,
   type SqlStoreHandle,
+  type VectorIndexStoreFxHandle,
 } from "../store.ts";
 
 const WRITE_CTX = (name: string) => ({
@@ -67,7 +67,7 @@ describe("store.index boot wiring — memory", () => {
   test("boot with no configured index driver resolves memory end to end", async () => {
     const kb = declareIndex("kb", { dims: 3 });
     const runtime = bindStore({ stores: [kb] }, "local", () => Date.now());
-    const handle = (await runtime.open(kb, WRITE_CTX("kb"))) as IndexStoreFxHandle;
+    const handle = (await runtime.open(kb, WRITE_CTX("kb"))) as VectorIndexStoreFxHandle;
     expect(handle.driverId).toBe("memory");
     await handle.upsert("near", [1, 0, 0]);
     await handle.upsert("far", [0, 1, 0]);
@@ -89,14 +89,14 @@ describe("store.index boot wiring — libsql", () => {
       "local",
       () => Date.now(),
     );
-    const handle = (await runtime.open(kb, WRITE_CTX("kb"))) as IndexStoreFxHandle;
+    const handle = (await runtime.open(kb, WRITE_CTX("kb"))) as VectorIndexStoreFxHandle;
     expect(handle.driverId).toBe("libsql");
 
     await handle.upsert("near", [1, 0.1, 0], { label: "near" });
     await handle.upsert("far", [0, 1, 0]);
     await handle.upsert("farther", [-1, 0, 0]);
     const hits = await handle.search([1, 0, 0], 3);
-    expect(hits.map((h) => h.id)).toEqual(["near", "far", "farther"]);
+    expect(hits.map((h: { id: string }) => h.id)).toEqual(["near", "far", "farther"]);
     expect(hits[0]!.score).toBeGreaterThan(hits[1]!.score);
     expect(hits[0]!.meta).toEqual({ label: "near" });
     expect(await handle.delete("farther")).toBe(true);
@@ -120,7 +120,7 @@ describe("store.index boot wiring — libsql", () => {
       index: { kb: { url: ":memory:" } },
     });
     // Index first: it must open the connection the sql facet then reuses.
-    const idxHandle = (await runtime.open(kb, WRITE_CTX("kb"))) as IndexStoreFxHandle;
+    const idxHandle = (await runtime.open(kb, WRITE_CTX("kb"))) as VectorIndexStoreFxHandle;
     await idxHandle.upsert("a", [1, 0, 0]);
     const sqlHandle = (await runtime.open(docs, {
       effects: { reads: ["sql:docs"], writes: ["sql:docs"] },
@@ -161,14 +161,14 @@ describe("store.index boot wiring — pglite + pgvector", () => {
       "local",
       () => Date.now(),
     );
-    const handle = (await runtime.open(kb, WRITE_CTX("kb"))) as IndexStoreFxHandle;
+    const handle = (await runtime.open(kb, WRITE_CTX("kb"))) as VectorIndexStoreFxHandle;
     expect(handle.driverId).toBe("pgvector");
 
     await handle.upsert("near", [1, 0.1, 0], { label: "near" });
     await handle.upsert("far", [0, 1, 0]);
     await handle.upsert("farther", [-1, 0, 0]);
     const hits = await handle.search([1, 0, 0], 3);
-    expect(hits.map((h) => h.id)).toEqual(["near", "far", "farther"]);
+    expect(hits.map((h: { id: string }) => h.id)).toEqual(["near", "far", "farther"]);
     expect(hits[0]!.score).toBeGreaterThan(hits[1]!.score);
     expect(hits[0]!.meta).toEqual({ label: "near" });
     expect(await handle.delete("farther")).toBe(true);
@@ -225,6 +225,48 @@ describe("store.index boot wiring — fail loud", () => {
     await expect(runtime.open(kb, WRITE_CTX("kb"))).rejects.toThrow(/cannot share sql driver/);
     await runtime.close();
   });
+
+  test("meilisearch without OKE_STORE_INDEX_URL throws at bind — never sqlUrl, never memory", () => {
+    const prev = process.env.OKE_STORE_INDEX_URL;
+    delete process.env.OKE_STORE_INDEX_URL;
+    try {
+      const kb = declareIndex("kb");
+      expect(() =>
+        bindStore(
+          { config: { drivers: { store: { index: { local: "meilisearch" } } } }, stores: [kb] },
+          "local",
+          () => Date.now(),
+        ),
+      ).toThrow(/OKE_STORE_INDEX_URL/);
+    } finally {
+      if (prev === undefined) delete process.env.OKE_STORE_INDEX_URL;
+      else process.env.OKE_STORE_INDEX_URL = prev;
+    }
+  });
+
+  test("meilisearch binds its own URL + key (never the sql connection)", async () => {
+    const prevUrl = process.env.OKE_STORE_INDEX_URL;
+    const prevKey = process.env.OKE_STORE_INDEX_KEY;
+    process.env.OKE_STORE_INDEX_URL = "http://127.0.0.1:7700";
+    process.env.OKE_STORE_INDEX_KEY = "master-key";
+    try {
+      const kb = declareIndex("kb");
+      const runtime = bindStore(
+        { config: { drivers: { store: { index: { local: "meilisearch" } } } }, stores: [kb] },
+        "local",
+        () => Date.now(),
+      );
+      // No live server in unit tests: opening must fail loud (unreachable),
+      // proving the binding pointed at HTTP, not silently degraded to memory.
+      await expect(runtime.open(kb, WRITE_CTX("kb"))).rejects.toThrow(/meilisearch index/);
+      await runtime.close();
+    } finally {
+      if (prevUrl === undefined) delete process.env.OKE_STORE_INDEX_URL;
+      else process.env.OKE_STORE_INDEX_URL = prevUrl;
+      if (prevKey === undefined) delete process.env.OKE_STORE_INDEX_KEY;
+      else process.env.OKE_STORE_INDEX_KEY = prevKey;
+    }
+  });
 });
 
 const PGVECTOR_URL = process.env.OKE_TEST_PGVECTOR_URL;

package/src/elements/store/runtime.ts

@@ -18,7 +18,12 @@ import type {
   SqlDriver,
   SqlRole,
   SqlRow,
+  TextIndexSearchOptions,
+  TextIndexSearchResult,
+  VectorIndexDriver,
+  VectorIndexStore,
 } from "../../drivers/types.ts";
+import { indexDriverNeedsSql } from "../../drivers/types.ts";
 import { buildClassificationMap, type MaskRowsOptions } from "./classify.ts";
 import {
   createStoreCache,
@@ -64,7 +69,15 @@ export interface CreateStoreRuntimeOptions {
   readonly files?: Readonly<Record<string, { readonly root?: string; readonly client?: unknown }>>;
   /** Index open options keyed by store name. */
   readonly index?: Readonly<
-    Record<string, { readonly dims?: number; readonly url?: string; readonly sql?: SqlConnection }>
+    Record<
+      string,
+      {
+        readonly dims?: number;
+        readonly url?: string;
+        readonly apiKey?: string;
+        readonly sql?: SqlConnection;
+      }
+    >
   >;
   /** Clock for cache TTLs. */
   readonly now?: () => number;
@@ -115,18 +128,30 @@ export interface FilesStoreFxHandle {
   list(prefix?: string): Promise<string[]>;
 }
 
-/** Index handle on `fx.store`. */
-export interface IndexStoreFxHandle {
+/** Vector index handle on `fx.store`. */
+export interface VectorIndexStoreFxHandle {
   readonly ref: `index:${string}`;
   readonly driverId: "memory" | "pgvector" | "libsql";
   upsert(id: string, vector: readonly number[], meta?: Record<string, unknown>): Promise<void>;
   search(
     vector: readonly number[],
     topK?: number,
-  ): Promise<Array<{ id: string; score: number; meta?: Record<string, unknown> }>>;
+  ): Promise<ReadonlyArray<{ id: string; score: number; meta?: Record<string, unknown> }>>;
   delete(id: string): Promise<boolean>;
 }
 
+/** Full-text index handle on `fx.store`. */
+export interface TextIndexStoreFxHandle {
+  readonly ref: `index:${string}`;
+  readonly driverId: "meilisearch";
+  upsert(id: string, document: Record<string, unknown>): Promise<void>;
+  search(q: string, opts?: TextIndexSearchOptions): Promise<TextIndexSearchResult>;
+  delete(id: string): Promise<boolean>;
+}
+
+/** Index handle on `fx.store` — discriminated by `driverId`. */
+export type IndexStoreFxHandle = VectorIndexStoreFxHandle | TextIndexStoreFxHandle;
+
 /** Store runtime. */
 export interface StoreRuntime {
   /** Shared multi-tier cache. */
@@ -259,9 +284,9 @@ export function createStoreRuntime(options: CreateStoreRuntimeOptions): StoreRun
     return conn;
   }
 
-  /** Index drivers backed by a SQL engine borrow the sql facet's connection. */
+  /** SQL-backed index drivers borrow the sql facet's connection. */
   async function sqlConnForIndex(
-    driver: IndexDriver,
+    driver: VectorIndexDriver & { id: "pgvector" | "libsql" },
     url: string | undefined,
   ): Promise<SqlConnection> {
     const sqlDriver = options.drivers.sql;
@@ -338,24 +363,34 @@ export function createStoreRuntime(options: CreateStoreRuntimeOptions): StoreRun
     let idx = indexes.get(decl.name);
     if (!idx) {
       const binding = options.index?.[decl.name] ?? {};
-      let sql = binding.sql;
-      if (!sql && driver.id !== "memory") {
-        sql = await sqlConnForIndex(driver, binding.url);
-      }
       idx = await driver.open({
         name: decl.name,
         dims: binding.dims ?? decl.dims ?? 3,
         url: binding.url,
-        sql,
+        apiKey: binding.apiKey,
+        sql: indexDriverNeedsSql(driver)
+          ? (binding.sql ?? (await sqlConnForIndex(driver, binding.url)))
+          : undefined,
       });
       indexes.set(decl.name, idx);
     }
+    if (idx.driverId === "meilisearch") {
+      const text = idx;
+      return {
+        ref: `index:${decl.name}`,
+        driverId: text.driverId,
+        upsert: (id, document) => text.upsert(id, document),
+        search: (q, opts) => text.search(q, opts),
+        delete: (id) => text.delete(id),
+      };
+    }
+    const vector = idx as VectorIndexStore;
     return {
       ref: `index:${decl.name}`,
-      driverId: idx.driverId,
-      upsert: (id, vector, meta) => idx!.upsert(id, vector, meta),
-      search: (vector, topK) => idx!.search(vector, topK),
-      delete: (id) => idx!.delete(id),
+      driverId: vector.driverId,
+      upsert: (id, vec, meta) => vector.upsert(id, vec, meta),
+      search: (vec, topK) => vector.search(vec, topK),
+      delete: (id) => vector.delete(id),
     };
   }
 

package/src/elements/store.ts

@@ -116,6 +116,8 @@ export type {
   KvStoreFxHandle,
   FilesStoreFxHandle,
   IndexStoreFxHandle,
+  VectorIndexStoreFxHandle,
+  TextIndexStoreFxHandle,
 } from "./store/runtime.ts";
 
 export { fileKeyWarnings, contentAddressedKey, projectFileKeys } from "./store/files-policy.ts";

package/src/elements/vault.test.ts

@@ -9,6 +9,7 @@
 import { describe, expect, test } from "bun:test";
 import { envVaultDriver, memoryVaultDriver } from "../drivers/index.ts";
 import { createFx } from "../kernel/fx.ts";
+import { REDACTED_PLACEHOLDER, Redacted } from "../kernel/redacted.ts";
 import {
   createVaultRuntime,
   fingerprintSecretSync,
@@ -200,17 +201,39 @@ describe("redaction + fingerprints", () => {
     const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
     const { fx } = createFxContextWithVault(runtime, lines);
 
-    const value = fx.vault("STRIPE_KEY");
-    expect(value).toBe(secret);
+    const wrapped = fx.vault("STRIPE_KEY");
+    expect(wrapped.reveal()).toBe(secret);
 
-    fx.log.info(`charging with ${value}`, { key: value, nested: { k: value } });
+    fx.log.info(`charging with ${wrapped}`, { key: wrapped, nested: { k: wrapped } });
+    // Revealed cleartext still hits the known-value substring scrub.
     fx.log.error(secret, { stripe: secret });
 
     for (const line of lines) {
       expect(line.message).not.toContain(secret);
       expect(JSON.stringify(line.data ?? {})).not.toContain(secret);
-      expect(line.message).toContain(SECRET_MASK);
     }
+    expect(lines[0]!.message).toContain(REDACTED_PLACEHOLDER);
+    expect(lines[1]!.message).toContain(SECRET_MASK);
+  });
+
+  test("Redacted from fx.vault is masked in fx.log without a vault runtime", () => {
+    const secret = "sk_no_vault_runtime";
+    const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
+    const fx = createFx({
+      flow: "test.redacted",
+      secrets: { STRIPE_KEY: secret },
+      onLog: (_level, message, data) => lines.push({ message, data }),
+    });
+
+    const wrapped = fx.vault("STRIPE_KEY");
+    expect(wrapped).toBeInstanceOf(Redacted);
+    expect(String(wrapped)).toBe(REDACTED_PLACEHOLDER);
+    expect(`${wrapped}`).toBe(REDACTED_PLACEHOLDER);
+    expect(JSON.stringify({ v: wrapped })).toBe(`{"v":"${REDACTED_PLACEHOLDER}"}`);
+
+    fx.log.info("paying", { key: wrapped, nested: { k: [wrapped] } });
+    expect(JSON.stringify(lines[0]!.data)).not.toContain(secret);
+    expect(lines[0]!.data?.key).toBe(REDACTED_PLACEHOLDER);
   });
 
   test("fingerprint is stable and not the value", async () => {

package/src/elements/vault.ts

@@ -2,7 +2,7 @@
  * Vault element — protected knowledge.
  *
  * Physics: secrets · config · environment.
- * Drivers: `env` · `openbao` · `infisical` · `managed`.
+ * Drivers: `env` · `openbao` · `managed`.
  *
  * A declaration is a contract, never a value. Boot validates every contract
  * and lists all gaps at once. Logs/traces receive fingerprints and redaction

package/src/index.ts

@@ -34,12 +34,20 @@ export {
   journey,
   unit,
   rateLimit,
+  Redacted,
+  isRedacted,
+  maskRedactedDeep,
+  REDACTED_PLACEHOLDER,
+  PluginNeedsError,
+  assertPluginNeeds,
+  freezePrincipal,
   type OkeApp,
   type OkeOptions,
   type FlowDef,
   type FlowFailure,
   type FlowErrorValue,
   type Fx,
+  type FxPrincipal,
   type Binding,
   type PluginDef,
   type PluginCapabilities,
@@ -90,13 +98,20 @@ export {
 
 export {
   gate,
+  GATE_PUBLIC_NAME,
+  GateBootError,
+  assertHttpGatePosture,
   createGateRuntime,
+  resolveGateConfig,
   takeRate,
   deriveModuleActions,
   ALL_RATE_STRATEGIES,
   type GateDecl,
+  type GateOptions,
+  type GatePostureGap,
   type GateRuntime,
   type RateOptions,
+  type ResolvedGateConfig,
 } from "./elements/gate.ts";
 
 export {