okengine 0.1.4

package/src/console/server/index.ts

@@ -0,0 +1,141 @@
+/**
+ * Console server — flows, live channel, Manifest feed, security.
+ */
+
+export {
+  accessCreateKey,
+  accessRevokeKey,
+  accessRotateKey,
+  accessSetRoleGrants,
+  effectivePermissions,
+  expandAccessCeiling,
+  isKeyUnused90d,
+  keyBlastRadius,
+  KEY_UNUSED_MS,
+  projectAccessPanel,
+  residualAccessNote,
+  type AccessEffectivePermissions,
+  type AccessHygiene,
+  type AccessKeyBlastRadius,
+  type AccessKeyRow,
+  type AccessPanelProjection,
+  type AccessPlaneSection,
+  type AccessScopeProvenance,
+  type ProjectAccessOptions,
+} from "./access.ts";
+export {
+  bindManifestClockRuntime,
+  bindManifestSignalBus,
+  bindManifestStoreRuntime,
+  bindManifestVaultRuntime,
+  bootConsoleApp,
+  createConsoleApp,
+  type ConsoleApp,
+  type ConsoleAppHandle,
+  type CreateConsoleAppOptions,
+} from "./app.ts";
+export {
+  aggregateWaitingOn,
+  createManifestClockRuntime,
+  flowIdsForCronRow,
+  projectClocksList,
+  projectWaitingOn,
+  type ConsoleClockList,
+  type ConsoleClockRow,
+  type ConsoleTimelineEvent,
+  type ConsoleWaitingOnRow,
+  type ProjectClocksOptions,
+  type WaitingOnCount,
+} from "./clock.ts";
+export {
+  blastRadiusOf,
+  createManifestVaultRuntime,
+  projectVaultList,
+  readersOf,
+  rotateVaultValue,
+  setVaultValue,
+  type ConsoleVaultBlastRadius,
+  type ConsoleVaultRow,
+  type ProjectVaultOptions,
+  type VaultWriteInput,
+} from "./vault.ts";
+export {
+  CLAIM_RATE_LIMIT,
+  CLAIM_RATE_WINDOW_MS,
+  CLAIM_TTL_MS,
+  constantTimeEqual,
+  mintClaimCode,
+  printClaimCodeOnce,
+  verifyClaimCode,
+  type ClaimCodeState,
+  type ClaimVerifyResult,
+} from "./claim.ts";
+export {
+  createConsoleBindings,
+  PUBLIC_CONSOLE_FLOWS,
+} from "./flows.ts";
+export {
+  createLiveWebsocket,
+  feedManifest,
+  subscribeLive,
+  type ConsoleLiveData,
+} from "./live.ts";
+export { consolePlugin } from "./plugin.ts";
+export {
+  CONSOLE_COOKIES,
+  CONSOLE_CSP,
+  PLUGIN_FRAME_CSP,
+  PLUGIN_IFRAME_SANDBOX,
+  consoleSessionCookie,
+  withConsoleSecurityHeaders,
+} from "./security-headers.ts";
+export {
+  attachSessionCookies,
+  serveConsole,
+  startConsoleApp,
+  withCookieAuth,
+  type ConsoleServerHandle,
+  type ServeConsoleOptions,
+} from "./serve.ts";
+export {
+  createConsoleState,
+  publishLive,
+  setManifest,
+  type ConsoleIdentity,
+  type ConsoleLiveMessage,
+  type ConsoleState,
+  type CreateConsoleStateOptions,
+} from "./state.ts";
+export {
+  createFileDiff,
+  emitStructuralDiff,
+  type EmitStructuralDiffOptions,
+  type StructuralProposal,
+} from "./structural.ts";
+export {
+  countRunsByFlowLastWeek,
+  formatBlastLine,
+  formatRunCount,
+  formatWeeklyBill,
+  projectManifestDiff,
+  weeklyCostDeltaUsd,
+  WEEK_MS,
+  type ConsoleDiffChange,
+  type ConsoleDiffProjection,
+  type DiffCiGate,
+  type ProjectManifestDiffOptions,
+} from "./diff.ts";
+export {
+  filterCapabilityDiffForPlugin,
+  groupPluginChanges,
+  loadCapabilityDiffByPlugin,
+  PLUGIN_STATE_DERIVATION,
+  projectPluginsList,
+  type ConsolePluginRow,
+  type ConsolePluginsList,
+  type PluginCapabilityChange,
+  type PluginInterceptView,
+  type PluginScopeView,
+  type PluginState,
+  type ProjectPluginsOptions,
+} from "./plugins.ts";

package/src/console/server/live.test.ts

@@ -0,0 +1,30 @@
+/**
+ * Manifest live feed — subscribers receive snapshot + diff.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { Manifest } from "../../manifest/types.ts";
+import { feedManifest, subscribeLive } from "./live.ts";
+import { createConsoleState, type ConsoleLiveMessage } from "./state.ts";
+
+describe("console live Manifest feed", () => {
+  test("pushes manifest and diff to subscribers", () => {
+    const state = createConsoleState({ silentClaim: true, secret: "x" });
+    const messages: ConsoleLiveMessage[] = [];
+    const unsub = subscribeLive(state, (m) => messages.push(m));
+
+    const a: Manifest = { oke: "1.0", app: "demo" };
+    const b: Manifest = {
+      oke: "1.0",
+      app: "demo",
+      flows: { "demo.ping": { plane: "user" } },
+    };
+
+    feedManifest(state, a);
+    feedManifest(state, b);
+    unsub();
+
+    expect(messages.some((m) => m.type === "manifest")).toBe(true);
+    expect(messages.some((m) => m.type === "manifest.diff")).toBe(true);
+  });
+});

package/src/console/server/live.ts

@@ -0,0 +1,109 @@
+/**
+ * Console live channel — Manifest feed over WebSocket.
+ *
+ * Spec §5.1: code edit → oxc re-parses → Manifest → WebSocket → Console.
+ */
+
+import type { ConsoleLiveMessage, ConsoleState } from "./state.ts";
+import { publishLive } from "./state.ts";
+
+/** WebSocket data bag for Console live clients. */
+export interface ConsoleLiveData {
+  readonly kind: "console-live";
+}
+
+/**
+ * Minimal Bun `ServerWebSocket` surface used by the Console live channel.
+ *
+ * Declared locally so the public graph does not bare-import `"bun"` (JSR
+ * rejects that specifier; `bun:` is allowed, but there is no `bun:websocket`
+ * type entry). `send` matches Bun's signature so handlers remain assignable
+ * to `Bun.serve` websocket callbacks — not a public API change.
+ */
+export interface ConsoleServerWebSocket<T = undefined> {
+  readonly data: T;
+  send(
+    data: string | ArrayBuffer | Uint8Array,
+    compress?: boolean,
+  ): number;
+}
+
+/**
+ * Subscribe a push function to the live channel.
+ *
+ * @param state - Console state
+ * @param push - Message handler
+ * @returns Unsubscribe
+ */
+export function subscribeLive(
+  state: ConsoleState,
+  push: (msg: ConsoleLiveMessage) => void,
+): () => void {
+  state.liveSubscribers.add(push);
+  return () => {
+    state.liveSubscribers.delete(push);
+  };
+}
+
+/**
+ * Bun WebSocket handlers for `/console/live`.
+ *
+ * @param state - Console state
+ */
+export function createLiveWebsocket(state: ConsoleState): {
+  readonly open: (ws: ConsoleServerWebSocket<ConsoleLiveData>) => void;
+  readonly message: (
+    ws: ConsoleServerWebSocket<ConsoleLiveData>,
+    message: string | Buffer,
+  ) => void;
+  readonly close: (ws: ConsoleServerWebSocket<ConsoleLiveData>) => void;
+} {
+  const unsubs = new WeakMap<
+    ConsoleServerWebSocket<ConsoleLiveData>,
+    () => void
+  >();
+
+  return {
+    open(ws) {
+      const push = (msg: ConsoleLiveMessage) => {
+        try {
+          ws.send(JSON.stringify(msg));
+        } catch {
+          // closed
+        }
+      };
+      unsubs.set(ws, subscribeLive(state, push));
+      if (state.manifest) {
+        push({ type: "manifest", manifest: state.manifest });
+      }
+    },
+    message(ws, message) {
+      const text = typeof message === "string" ? message : message.toString();
+      if (text === "ping") {
+        ws.send(JSON.stringify({ type: "ping", at: state.now() }));
+      }
+    },
+    close(ws) {
+      unsubs.get(ws)?.();
+      unsubs.delete(ws);
+    },
+  };
+}
+
+/**
+ * Push a Manifest snapshot (used by `oke dev` file watcher).
+ *
+ * @param state - Console state
+ * @param manifest - Manifest
+ */
+export function feedManifest(
+  state: ConsoleState,
+  manifest: import("../../manifest/types.ts").Manifest,
+): void {
+  const before = state.manifest;
+  state.manifest = manifest;
+  publishLive(state, { type: "manifest", manifest });
+  if (before) {
+    publishLive(state, { type: "manifest.diff", before, after: manifest });
+  }
+}

package/src/console/server/plugin.ts

@@ -0,0 +1,50 @@
+/**
+ * Builtin `console` plugin — panels, tables, operator-plane hooks.
+ *
+ * Uses only the public plugin API (unified-theory §14).
+ */
+
+import {
+  fail,
+  plugin,
+  type Fx,
+  type PluginDef,
+} from "../../kernel/index.ts";
+import { PUBLIC_CONSOLE_FLOWS } from "./flows.ts";
+
+/**
+ * Builtin Console plugin.
+ *
+ * @returns Plugin definition
+ */
+export function consolePlugin(): PluginDef {
+  return plugin("console", { version: "0.0.1" })
+    .consolePanel({
+      id: "overview",
+      title: "Overview",
+      entry: "./panels/overview.js",
+    })
+    .consolePanel({
+      id: "traces",
+      title: "Traces",
+      entry: "./panels/traces.js",
+    })
+    .table("oke_console_prefs", { plane: "operator" })
+    .hook("beforeHandle", (ctx, fxOrErr) => {
+      const fx = fxOrErr as Fx;
+      const name = ctx.flow.name;
+      const plane = ctx.flow.plane ?? "user";
+
+      // Application principals never reach operator-plane flows.
+      if (plane === "operator" && fx.auth.userId && !fx.operator.id) {
+        return fail("Forbidden", {
+          reason: "application principal cannot reach a console flow",
+        });
+      }
+
+      if (PUBLIC_CONSOLE_FLOWS.has(name)) return;
+      if (plane === "operator" && !fx.operator.id) {
+        return fail("Unauthorized", {});
+      }
+    });
+}

package/src/console/server/plugins.test.ts

@@ -0,0 +1,131 @@
+/**
+ * Plugins panel projection (console §9.15).
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { Manifest } from "../../manifest/types.ts";
+import {
+  filterCapabilityDiffForPlugin,
+  groupPluginChanges,
+  PLUGIN_STATE_DERIVATION,
+  projectPluginsList,
+} from "./plugins.ts";
+
+const NOW = 1_700_000_000_000;
+
+const MANIFEST: Manifest = {
+  oke: "1.0",
+  app: "plugins-test",
+  plugins: {
+    auth: {
+      origin: "core",
+      version: "0.0.1",
+      declares: ["table:oke_identities"],
+      intercepts: ["onAuth"],
+    },
+    console: {
+      origin: "core",
+      version: "0.0.1",
+      declares: ["consolePanel:overview"],
+      intercepts: ["beforeHandle"],
+    },
+    audit: {
+      origin: "local",
+      version: "1.0.0",
+      declares: ["consolePanel:audit"],
+      intercepts: ["afterHandle"],
+    },
+    "oke-slack": {
+      origin: "community",
+      version: "2.0.0",
+      declares: ["channel:slack"],
+      intercepts: [],
+    },
+  },
+};
+
+describe("projectPluginsList", () => {
+  test("CORE always listed; local/community only when plugged; config state for tenancy/privacy", async () => {
+    const list = await projectPluginsList({
+      manifest: MANIFEST,
+      config: { tenancy: { isolation: "row" } },
+      cwd: process.cwd(),
+      now: () => NOW,
+      resolveCapabilityDiff: false,
+      syncSupplyChain: true,
+      fetchNpm: false,
+      capabilityDiffByPlugin: {
+        audit: [
+          {
+            path: "/plugins/audit",
+            category: "permission-widening",
+            kind: "changed",
+            summary: "plugin capabilities widened: afterHandle",
+          },
+        ],
+      },
+      packageJsonByPlugin: {
+        "oke-slack": { name: "oke-slack", scripts: {} },
+      },
+      sourcesByPlugin: {
+        "oke-slack": [],
+      },
+    });
+
+    expect(list.stateDerivation).toBe(PLUGIN_STATE_DERIVATION);
+    const byId = Object.fromEntries(list.plugins.map((p) => [p.id, p]));
+
+    expect(byId.auth?.state).toBe("on");
+    expect(byId.console?.state).toBe("on");
+    expect(byId["rate-limit"]?.state).toBe("off");
+    expect(byId.tenancy?.state).toBe("on"); // config.tenancy
+    expect(byId.privacy?.state).toBe("off");
+
+    expect(byId.audit?.origin).toBe("local");
+    expect(byId["oke-slack"]?.origin).toBe("community");
+    expect(byId["oke-slack"]?.installCommand).toBe("bun add oke-slack");
+    expect(byId.auth?.installCommand).toBeNull();
+
+    expect(byId.audit?.capabilityDiff[0]?.summary).toContain("widened");
+    expect(byId.auth?.supplyChain.lifecycleScripts.state).toBe("not-applicable");
+    expect(byId["oke-slack"]?.supplyChain.releaseCooldown.state).not.toBe(
+      "not-applicable",
+    );
+  });
+
+  test("privacy on from runs.redact", async () => {
+    const list = await projectPluginsList({
+      manifest: { oke: "1.0", app: "x" },
+      config: { runs: { redact: { email: "7y" } } },
+      cwd: process.cwd(),
+      now: () => NOW,
+      resolveCapabilityDiff: false,
+      syncSupplyChain: true,
+      fetchNpm: false,
+    });
+    expect(list.plugins.find((p) => p.id === "privacy")?.state).toBe("on");
+  });
+});
+
+describe("capability diff filter", () => {
+  test("groupPluginChanges and filter reuse diffManifest paths", () => {
+    const grouped = groupPluginChanges([
+      {
+        path: "/plugins/audit",
+        category: "permission-widening",
+        kind: "changed",
+        summary: "widened",
+      },
+      {
+        path: "/flows/x",
+        category: "no-impact",
+        kind: "changed",
+        summary: "other",
+      },
+    ]);
+    expect(grouped.audit).toHaveLength(1);
+    expect(
+      filterCapabilityDiffForPlugin(grouped.audit!, "audit"),
+    ).toHaveLength(1);
+  });
+});