okengine 0.1.4

package/src/console/ui/plugins/fixture.ts

@@ -0,0 +1,233 @@
+/**
+ * Fixture Plugins projection for unit tests and the axe gate.
+ */
+
+import type { PluginsListResponse, SupplyChainRecord } from "./types.ts";
+
+/** N/A supply-chain strip for core/local. */
+export const SUPPLY_CHAIN_CORE_NA: SupplyChainRecord = {
+  lifecycleScripts: {
+    state: "not-applicable",
+    scripts: [],
+    detail: "Lifecycle scripts apply to community packages only (core)",
+  },
+  releaseCooldown: {
+    state: "not-applicable",
+    publishedAt: null,
+    holdUntil: null,
+    detail: "Release cooldown applies to community registry packages only (core)",
+  },
+  nodeImportScan: {
+    state: "pass",
+    findings: [],
+    detail: "No direct node:/bun: imports detected",
+  },
+  npmProvenance: {
+    state: "not-applicable",
+    detail: "npm provenance applies to community registry packages only (core)",
+  },
+  bootConflicts: {
+    state: "clean",
+    conflicts: [],
+    detail: "No boot-time naming conflicts detected",
+  },
+};
+
+/** Community supply-chain with mixed real signals. */
+export const SUPPLY_CHAIN_COMMUNITY: SupplyChainRecord = {
+  lifecycleScripts: {
+    state: "pass",
+    scripts: [],
+    detail: "No install/prepare lifecycle scripts",
+  },
+  releaseCooldown: {
+    state: "hold",
+    publishedAt: 1_700_000_000_000,
+    holdUntil: 1_700_259_200_000,
+    detail: "Published within cooldown — held until 2023-11-18T00:00:00.000Z",
+  },
+  nodeImportScan: {
+    state: "fail",
+    findings: [
+      {
+        source: "index.ts",
+        specifier: "node:fs",
+        line: 2,
+      },
+    ],
+    detail: "1 direct node:/bun: import(s) bypassing fx",
+  },
+  npmProvenance: {
+    state: "unknown",
+    detail: "Provenance unknown (offline or non-npm)",
+  },
+  bootConflicts: {
+    state: "clean",
+    conflicts: [],
+    detail: "No boot-time naming conflicts detected",
+  },
+};
+
+/** Full list fixture — CORE catalogue + one local + one community. */
+export const PLUGINS_LIST_FIXTURE: PluginsListResponse = {
+  stateDerivation:
+    "CORE auth/console/rate-limit: on iff `.plug()`-ed (Manifest/registry). CORE tenancy: on iff oke.config.ts has `tenancy: {…}` (or Manifest.tenancy). CORE privacy: on iff oke.config.ts has `privacy` or top-level `runs.redact`. local/community: listed only when present via `.plug()` / Manifest.plugins.",
+  plugins: [
+    {
+      id: "auth",
+      origin: "core",
+      state: "on",
+      version: "0.0.1",
+      summary: "Hybrid session, two planes, roles as data",
+      scopes: [{ kind: "app" }],
+      declares: ["table:oke_identities", "table:oke_operators"],
+      intercepts: [{ stage: "onAuth", meanMs: 0.4, count: 12 }],
+      hookCost: {
+        count: 12,
+        meanMs: 0.4,
+        p50Ms: 0.35,
+        p95Ms: 0.9,
+        lastMs: 0.42,
+      },
+      supplyChain: SUPPLY_CHAIN_CORE_NA,
+      capabilityDiff: [],
+      installCommand: null,
+      enableHint: null,
+      packageName: null,
+    },
+    {
+      id: "console",
+      origin: "core",
+      state: "on",
+      version: "0.0.1",
+      summary: "Operator Console on :6533",
+      scopes: [{ kind: "app" }],
+      declares: ["consolePanel:overview", "consolePanel:traces", "table:oke_console_prefs"],
+      intercepts: [{ stage: "beforeHandle", meanMs: 0.2, count: 40 }],
+      hookCost: {
+        count: 40,
+        meanMs: 0.2,
+        p50Ms: 0.18,
+        p95Ms: 0.5,
+        lastMs: 0.21,
+      },
+      supplyChain: SUPPLY_CHAIN_CORE_NA,
+      capabilityDiff: [],
+      installCommand: null,
+      enableHint: null,
+      packageName: null,
+    },
+    {
+      id: "rate-limit",
+      origin: "core",
+      state: "off",
+      version: null,
+      summary: "Attachment-scoped request rate limits",
+      scopes: [],
+      declares: [],
+      intercepts: [],
+      hookCost: null,
+      supplyChain: SUPPLY_CHAIN_CORE_NA,
+      capabilityDiff: [],
+      installCommand: null,
+      enableHint: "app.plug(rateLimit({ max: 30 }))  // or unit.plug / flow.plug",
+      packageName: null,
+    },
+    {
+      id: "tenancy",
+      origin: "core",
+      state: "off",
+      version: null,
+      summary: "Multi-tenant isolation (row · schema · database)",
+      scopes: [],
+      declares: [],
+      intercepts: [],
+      hookCost: null,
+      supplyChain: SUPPLY_CHAIN_CORE_NA,
+      capabilityDiff: [],
+      installCommand: null,
+      enableHint: 'oke.config.ts → tenancy: { isolation: "row", resolve: … }',
+      packageName: null,
+    },
+    {
+      id: "privacy",
+      origin: "core",
+      state: "off",
+      version: null,
+      summary: "PII classification, redact, export/erase tooling",
+      scopes: [],
+      declares: [],
+      intercepts: [],
+      hookCost: null,
+      supplyChain: SUPPLY_CHAIN_CORE_NA,
+      capabilityDiff: [],
+      installCommand: null,
+      enableHint: "oke.config.ts → privacy: { … }  // or runs: { redact: { … } }",
+      packageName: null,
+    },
+    {
+      id: "audit",
+      origin: "local",
+      state: "on",
+      version: "1.0.0",
+      summary: null,
+      scopes: [{ kind: "app" }],
+      declares: ["consolePanel:audit", "table:oke_audit"],
+      intercepts: [{ stage: "afterHandle", meanMs: 1.2, count: 8 }],
+      hookCost: {
+        count: 8,
+        meanMs: 1.2,
+        p50Ms: 1.1,
+        p95Ms: 2.0,
+        lastMs: 1.3,
+      },
+      supplyChain: {
+        ...SUPPLY_CHAIN_CORE_NA,
+        lifecycleScripts: {
+          state: "not-applicable",
+          scripts: [],
+          detail: "Lifecycle scripts apply to community packages only (local)",
+        },
+        releaseCooldown: {
+          state: "not-applicable",
+          publishedAt: null,
+          holdUntil: null,
+          detail:
+            "Release cooldown applies to community registry packages only (local)",
+        },
+        npmProvenance: {
+          state: "not-applicable",
+          detail:
+            "npm provenance applies to community registry packages only (local)",
+        },
+      },
+      capabilityDiff: [
+        {
+          path: "/plugins/audit",
+          category: "permission-widening",
+          kind: "changed",
+          summary: "plugin capabilities widened: afterHandle",
+        },
+      ],
+      installCommand: null,
+      enableHint: null,
+      packageName: null,
+    },
+    {
+      id: "oke-slack",
+      origin: "community",
+      state: "on",
+      version: "2.1.0",
+      summary: null,
+      scopes: [{ kind: "app" }],
+      declares: ["channel:slack"],
+      intercepts: [{ stage: "onResponse", meanMs: null, count: 0 }],
+      hookCost: null,
+      supplyChain: SUPPLY_CHAIN_COMMUNITY,
+      capabilityDiff: [],
+      installCommand: "bun add oke-slack",
+      enableHint: null,
+      packageName: "oke-slack",
+    },
+  ],
+};

package/src/console/ui/plugins/group.test.ts

@@ -0,0 +1,38 @@
+/**
+ * Plugins grouping — origin × state dimensions.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { PLUGINS_LIST_FIXTURE } from "./fixture.ts";
+import { groupPlugins } from "./group.ts";
+
+describe("groupPlugins", () => {
+  test("CORE always listed including off; local/community only when present", () => {
+    const groups = groupPlugins(PLUGINS_LIST_FIXTURE.plugins, {});
+    const core = groups.find((g) => g.id === "core");
+    expect(core).toBeDefined();
+    const ids = core!.items.map((p) => p.id);
+    expect(ids).toContain("auth");
+    expect(ids).toContain("rate-limit");
+    expect(ids).toContain("tenancy");
+    expect(ids).toContain("privacy");
+    expect(core!.items.some((p) => p.id === "rate-limit" && p.state === "off")).toBe(
+      true,
+    );
+
+    const local = groups.find((g) => g.id === "local");
+    expect(local?.items.map((p) => p.id)).toEqual(["audit"]);
+    const community = groups.find((g) => g.id === "community");
+    expect(community?.items.map((p) => p.id)).toEqual(["oke-slack"]);
+  });
+
+  test("filters by origin and state", () => {
+    const off = groupPlugins(PLUGINS_LIST_FIXTURE.plugins, { state: "off" });
+    expect(off.every((g) => g.items.every((p) => p.state === "off"))).toBe(true);
+    const community = groupPlugins(PLUGINS_LIST_FIXTURE.plugins, {
+      origin: "community",
+    });
+    expect(community).toHaveLength(1);
+    expect(community[0]!.id).toBe("community");
+  });
+});

package/src/console/ui/plugins/group.ts

@@ -0,0 +1,67 @@
+/**
+ * Group Plugins by origin × state (console §9.15).
+ */
+
+import type { PluginsSearch } from "./search.ts";
+import type {
+  PluginOrigin,
+  PluginRecord,
+  PluginState,
+  PluginsListGroup,
+} from "./types.ts";
+
+const ORIGIN_LABEL: Record<PluginOrigin, string> = {
+  core: "Core",
+  local: "Local",
+  community: "Community",
+};
+
+/**
+ * Filter plugins by search, then group by origin (core → local → community).
+ *
+ * @param plugins - Rows
+ * @param search - Filters
+ */
+export function groupPlugins(
+  plugins: readonly PluginRecord[],
+  search: PluginsSearch,
+): readonly PluginsListGroup[] {
+  const q = (search.q ?? "").trim().toLowerCase();
+  const filtered = plugins.filter((p) => {
+    if (search.origin && p.origin !== search.origin) return false;
+    if (search.state && p.state !== search.state) return false;
+    if (!q) return true;
+    return (
+      p.id.toLowerCase().includes(q) ||
+      (p.summary?.toLowerCase().includes(q) ?? false) ||
+      (p.packageName?.toLowerCase().includes(q) ?? false) ||
+      p.declares.some((d) => d.toLowerCase().includes(q)) ||
+      p.intercepts.some((i) => i.stage.toLowerCase().includes(q))
+    );
+  });
+
+  const order: PluginOrigin[] = ["core", "local", "community"];
+  const groups: PluginsListGroup[] = [];
+  for (const origin of order) {
+    const items = filtered
+      .filter((p) => p.origin === origin)
+      .sort((a, b) => compareStateThenId(a.state, b.state, a.id, b.id));
+    if (items.length === 0) continue;
+    groups.push({
+      id: origin,
+      label: ORIGIN_LABEL[origin],
+      items,
+    });
+  }
+  return groups;
+}
+
+function compareStateThenId(
+  aState: PluginState,
+  bState: PluginState,
+  aId: string,
+  bId: string,
+): number {
+  if (aState !== bState) return aState === "on" ? -1 : 1;
+  return aId.localeCompare(bId);
+}

package/src/console/ui/plugins/index.ts

@@ -0,0 +1,40 @@
+/**
+ * Plugins panel pure modules (console §9.15).
+ */
+
+export {
+  pluginCapabilityFindings,
+  type PluginCapabilityFinding,
+} from "./findings.ts";
+export {
+  copyCommandLabel,
+  copyableCommand,
+} from "./command.ts";
+export { groupPlugins } from "./group.ts";
+export {
+  openPlugin,
+  parsePluginsSearch,
+  serializePluginsSearch,
+  type PluginsSearch,
+} from "./search.ts";
+export {
+  PLUGINS_LIST_FIXTURE,
+  SUPPLY_CHAIN_COMMUNITY,
+  SUPPLY_CHAIN_CORE_NA,
+} from "./fixture.ts";
+export type {
+  BootConflictSignal,
+  LifecycleScriptsSignal,
+  NodeImportScanSignal,
+  NpmProvenanceSignal,
+  PluginCapabilityChangeRecord,
+  PluginInterceptRecord,
+  PluginOrigin,
+  PluginRecord,
+  PluginScopeRecord,
+  PluginState,
+  PluginsListGroup,
+  PluginsListResponse,
+  ReleaseCooldownSignal,
+  SupplyChainRecord,
+} from "./types.ts";

package/src/console/ui/plugins/search.ts

@@ -0,0 +1,67 @@
+/**
+ * URL search params for the Plugins panel (console §9.15).
+ */
+
+import type { PluginOrigin, PluginState } from "./types.ts";
+
+/** Typed search for `/plugins`. */
+export interface PluginsSearch {
+  readonly q?: string;
+  readonly origin?: PluginOrigin;
+  readonly state?: PluginState;
+  readonly plugin?: string;
+}
+
+/**
+ * Parse router search into {@link PluginsSearch}.
+ *
+ * @param search - Raw search
+ */
+export function parsePluginsSearch(
+  search: Record<string, unknown>,
+): PluginsSearch {
+  const q = typeof search.q === "string" && search.q.length > 0
+    ? search.q
+    : undefined;
+  const origin = isOrigin(search.origin) ? search.origin : undefined;
+  const state = search.state === "on" || search.state === "off"
+    ? search.state
+    : undefined;
+  const plugin = typeof search.plugin === "string" && search.plugin.length > 0
+    ? search.plugin
+    : undefined;
+  return { q, origin, state, plugin };
+}
+
+/**
+ * Serialize search for the router (omit empties).
+ *
+ * @param search - Typed search
+ */
+export function serializePluginsSearch(
+  search: PluginsSearch,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (search.q) out.q = search.q;
+  if (search.origin) out.origin = search.origin;
+  if (search.state) out.state = search.state;
+  if (search.plugin) out.plugin = search.plugin;
+  return out;
+}
+
+/**
+ * Open a plugin in the detail pane (URL).
+ *
+ * @param search - Current search
+ * @param pluginId - Plugin to open
+ */
+export function openPlugin(
+  search: PluginsSearch,
+  pluginId: string,
+): PluginsSearch {
+  return { ...search, plugin: pluginId };
+}
+
+function isOrigin(v: unknown): v is PluginOrigin {
+  return v === "core" || v === "local" || v === "community";
+}

package/src/console/ui/plugins/types.ts

@@ -0,0 +1,115 @@
+/**
+ * Plugins panel view types (console §9.15).
+ */
+
+/** Supply-chain origin. */
+export type PluginOrigin = "core" | "local" | "community";
+
+/** Derived on/off. */
+export type PluginState = "on" | "off";
+
+/** Attachment scope. */
+export interface PluginScopeRecord {
+  readonly kind: "app" | "unit" | "flow";
+  readonly name?: string;
+}
+
+/** Intercept with measured cost. */
+export interface PluginInterceptRecord {
+  readonly stage: string;
+  readonly meanMs: number | null;
+  readonly count: number;
+}
+
+/** Capability diff line from `diffManifest` (merge-base). */
+export interface PluginCapabilityChangeRecord {
+  readonly path: string;
+  readonly category: string;
+  readonly kind: string;
+  readonly summary: string;
+}
+
+/** Lifecycle scripts signal. */
+export interface LifecycleScriptsSignal {
+  readonly state: "pass" | "fail" | "not-applicable" | "unknown";
+  readonly scripts: readonly string[];
+  readonly detail: string;
+}
+
+/** Release cooldown signal. */
+export interface ReleaseCooldownSignal {
+  readonly state: "pass" | "hold" | "not-applicable" | "unknown";
+  readonly publishedAt: number | null;
+  readonly holdUntil: number | null;
+  readonly detail: string;
+}
+
+/** Node-import scan signal. */
+export interface NodeImportScanSignal {
+  readonly state: "pass" | "fail" | "not-applicable" | "unknown";
+  readonly findings: readonly {
+    readonly source: string;
+    readonly specifier: string;
+    readonly line: number | null;
+  }[];
+  readonly detail: string;
+}
+
+/** npm provenance signal. */
+export interface NpmProvenanceSignal {
+  readonly state: "pass" | "fail" | "not-applicable" | "unknown";
+  readonly detail: string;
+}
+
+/** Boot conflict signal. */
+export interface BootConflictSignal {
+  readonly state: "clean" | "conflict" | "not-applicable";
+  readonly conflicts: readonly string[];
+  readonly detail: string;
+}
+
+/** Supply-chain strip. */
+export interface SupplyChainRecord {
+  readonly lifecycleScripts: LifecycleScriptsSignal;
+  readonly releaseCooldown: ReleaseCooldownSignal;
+  readonly nodeImportScan: NodeImportScanSignal;
+  readonly npmProvenance: NpmProvenanceSignal;
+  readonly bootConflicts: BootConflictSignal;
+}
+
+/** One plugin row. */
+export interface PluginRecord {
+  readonly id: string;
+  readonly origin: PluginOrigin;
+  readonly state: PluginState;
+  readonly version: string | null;
+  readonly summary: string | null;
+  readonly scopes: readonly PluginScopeRecord[];
+  readonly declares: readonly string[];
+  readonly intercepts: readonly PluginInterceptRecord[];
+  readonly hookCost: {
+    readonly count: number;
+    readonly meanMs: number;
+    readonly p50Ms: number;
+    readonly p95Ms: number;
+    readonly lastMs: number | null;
+  } | null;
+  readonly supplyChain: SupplyChainRecord;
+  readonly capabilityDiff: readonly PluginCapabilityChangeRecord[];
+  readonly installCommand: string | null;
+  readonly enableHint: string | null;
+  readonly packageName: string | null;
+}
+
+/** `console.plugin.list` response. */
+export interface PluginsListResponse {
+  readonly plugins: readonly PluginRecord[];
+  readonly stateDerivation: string;
+}
+
+/** Grouped list section. */
+export interface PluginsListGroup {
+  readonly id: string;
+  readonly label: string;
+  readonly items: readonly PluginRecord[];
+}