okengine 0.11.1 → 0.12.0

package/src/console/server/state.ts

@@ -33,6 +33,7 @@ import {
 } from "../../elements/signal/reconcile.ts";
 import type { Manifest } from "../../manifest/types.ts";
 import type { WideEvent } from "../../runs/types.ts";
+import type { ConsoleRunsQueryResult } from "./runs-query.ts";
 import type { ConsoleAiProjection } from "./ai.ts";
 import { createLoginAttemptBag, type LoginAttemptBag } from "./auth-rate.ts";
 import { mintClaimCode, type ClaimCodeState } from "./claim.ts";
@@ -42,6 +43,8 @@ import type {
   StoreDeleteInput,
   StoreEditInput,
   StoreEditResult,
+  StoreFileGetInput,
+  StoreFileObject,
   StoreQueryInput,
   StoreQueryResult,
 } from "./store.ts";
@@ -49,6 +52,8 @@ import type { ClockRuntime, EditScheduleInput } from "../../elements/clock.ts";
 import type { StoreRuntime } from "../../elements/store.ts";
 import type { VaultRuntime } from "../../elements/vault.ts";
 import type { JournalStore } from "../../kernel/journal.ts";
+import type { InstanceStore, InstancesList } from "../../kernel/instances.ts";
+import type { CronStore } from "../../elements/clock/reconcile.ts";
 import type { ResourceRef } from "../../manifest/types.ts";
 import type { ConsoleClockList } from "./clock.ts";
 import {
@@ -58,7 +63,17 @@ import {
   type SimulateGatesInput,
   type SimulateGatesResult,
 } from "./gates.ts";
-import type { ConsoleVaultBackend, ConsoleVaultRow, VaultWriteInput } from "./vault.ts";
+import {
+  ConsoleVaultRotateBusyError,
+  type ConsoleVaultAuditVerifyResult,
+  type ConsoleVaultBackend,
+  type ConsoleVaultRotateHandle,
+  type ConsoleVaultRotateMasterResult,
+  type ConsoleVaultRow,
+  type VaultLayerSeed,
+  type VaultCreateInput,
+  type VaultWriteInput,
+} from "./vault.ts";
 import type { ChannelInbox } from "../../drivers/channel-types.ts";
 import type { ChannelRuntime, TemplateCatalog } from "../../elements/channel.ts";
 import type { ConsoleChannelPreview, ConsoleChannelsList, EmailAuthResult } from "./channels.ts";
@@ -67,6 +82,12 @@ import type { PluginRegistry } from "../../kernel/registry.ts";
 import type { ConsolePluginsList } from "./plugins.ts";
 import type { ConsoleDiffProjection } from "./diff.ts";
 import { loadConsolePanel, type ConsolePanelId } from "./panel-load.ts";
+import {
+  isConsoleAuthStoreRef,
+  queryConsoleAuthStore,
+  rejectConsoleAuthMutation,
+  requireConsoleAuthStore,
+} from "./auth-store.ts";
 
 /** How long a built-in Vault backend probe is reused across list polls. */
 const VAULT_BACKEND_TTL_MS = 15_000;
@@ -169,6 +190,37 @@ export interface ConsoleState {
   }>;
   /** Bound after Console app boot — reads the runs store. */
   listRuns: () => Promise<WideEvent[]>;
+  /**
+   * Sandboxed SQL over persisted `.oke/runs` Parquet.
+   * Bound after Console app boot; stub rejects until then.
+   */
+  queryPersistedRuns: (input: {
+    readonly sql: string;
+    readonly revealPii?: boolean;
+    readonly timeoutMs?: number;
+    readonly maxRows?: number;
+  }) => Promise<ConsoleRunsQueryResult>;
+  /**
+   * Shared secret for host → Console WideEvent ingest (`oke dev` bridge).
+   * `null` disables `POST /console/runs/ingest`.
+   */
+  readonly runsIngestSecret: string | null;
+  /**
+   * Optional host-app re-invoke for `console.traces.replay`.
+   * When unset, the flow falls back to CLI-equivalent {@link runReplay}
+   * against `cwd` (loads the app entry and re-executes with stored input).
+   */
+  replayTrace:
+    | ((input: {
+        readonly event: WideEvent;
+        readonly dryRun: boolean;
+      }) => Promise<{ readonly output: unknown; readonly failure?: unknown }>)
+    | null;
+  /**
+   * Optional host-app invoke-as for `console.flows.invoke`.
+   * When unset, invoke fails closed (`InvokeDenied`) — never stubs.
+   */
+  invokeUserFlow: import("./invoke-user-flow.ts").ConsoleInvokeUserFlow | null;
   /** Signal config store (`oke_signal_config`) — retains orphaned rows. */
   readonly signalConfig: SignalConfigStore;
   /**
@@ -195,6 +247,8 @@ export interface ConsoleState {
   }>;
   /** Browse a store facet. */
   queryStore: (input: StoreQueryInput) => Promise<StoreQueryResult>;
+  /** Read one files object (preview / download). */
+  getStoreFile: (input: StoreFileGetInput) => Promise<StoreFileObject>;
   /** Direct edit (not a flow execution). */
   editStore: (
     input: StoreEditInput,
@@ -212,12 +266,32 @@ export interface ConsoleState {
       readonly allowWrite: boolean;
       readonly revealPii?: boolean;
       readonly tenant?: string;
+      readonly asGate?: string;
     },
   ) => Promise<{
     readonly rows: readonly Record<string, unknown>[];
     readonly masked: boolean;
     readonly routedRole: "primary" | "replica";
+    readonly asGate: string | null;
+    readonly gateApplied: boolean;
   }>;
+  /** Engine-native pg_stat_statements + KPIs. */
+  queryStoreSqlStats: (ref: ResourceRef) => Promise<import("./store-stats.ts").StoreSqlStatsResult>;
+  /** Live lock blocking (query text collapsed unless reveal). */
+  queryStoreSqlLocks: (
+    ref: ResourceRef,
+    options?: { readonly revealPii?: boolean },
+  ) => Promise<import("./store-stats.ts").StoreSqlLocksResult>;
+  /** `index_advisor(query)` on a dedicated handle. */
+  adviseStoreSqlIndex: (
+    ref: ResourceRef,
+    query: string,
+  ) => Promise<import("./store-stats.ts").StoreSqlAdviseResult>;
+  /** Redis-wire KV INFO / COMMANDSTATS / SLOWLOG (args collapsed unless reveal). */
+  queryStoreKvStats: (
+    ref: ResourceRef,
+    options?: { readonly revealPii?: boolean },
+  ) => Promise<import("./store-kv-stats.ts").StoreKvStatsResult>;
   /**
    * Live Clock runtime. Bound after boot from Manifest clocks
    * or host injection (A — reuse reconciliation / lease / DST).
@@ -246,8 +320,16 @@ export interface ConsoleState {
    * or host injection.
    */
   vaultRuntime: VaultRuntime | null;
+  /** Per-layer seed bag for Manifest vault boot (seeded Console). */
+  vaultLayerSeed: VaultLayerSeed | null;
   /** Durable journal for rotation blast radius + Clock waiting-on. */
   journalStore: JournalStore | null;
+  /** Host fleet registry (read-only). Null until bound or confirmed absent. */
+  instanceStore: InstanceStore | null;
+  /** Host `oke_crons` for fleet lease join (not Console's memory clock). */
+  fleetCronStore: CronStore | null;
+  /** Project live instances + Clock / Journal lease snapshot. */
+  listInstances: () => Promise<InstancesList>;
   /** Current environment label for fingerprint columns. */
   vaultEnv: string;
   /** Project operator-plane vault rows (fingerprints only for secrets). */
@@ -260,10 +342,25 @@ export interface ConsoleState {
   setVault: (
     input: VaultWriteInput,
   ) => Promise<{ readonly name: string; readonly fingerprint: string | null }>;
+  /** Declare a contract from Console and write its value. */
+  createVault: (
+    input: VaultCreateInput,
+  ) => Promise<{ readonly name: string; readonly fingerprint: string | null }>;
   /** Rotate a vault value (write-only; distinct confirm phrase). */
   rotateVault: (
     input: VaultWriteInput,
   ) => Promise<{ readonly name: string; readonly fingerprint: string | null }>;
+  /** Verify the built-in audit chain (sealed). */
+  verifyVaultAudit: () => Promise<ConsoleVaultAuditVerifyResult>;
+  /**
+   * One batch of master-key rotation. Process-global handle — any operator
+   * in this process may continue. Overlapping batches fail busy.
+   */
+  rotateMaster: () => Promise<ConsoleVaultRotateMasterResult>;
+  /** In-flight rotate-master adapter (tests / process lifetime). */
+  vaultRotateHandle: ConsoleVaultRotateHandle | null;
+  /** True while the first rotate-master call is opening the adapter. */
+  vaultRotateStarting: boolean;
   /** User-plane identities available for invoke-as. */
   readonly identities: ConsoleIdentity[];
   /** Whether this process is treated as production (typed confirm). */
@@ -356,7 +453,73 @@ export type ConsoleLiveMessage =
       readonly before: Manifest;
       readonly after: Manifest;
     }
-  | { readonly type: "ping"; readonly at: number };
+  | { readonly type: "ping"; readonly at: number }
+  | { readonly type: "run"; readonly run: ConsoleLiveRun }
+  | { readonly type: "runs.batch"; readonly runs: readonly ConsoleLiveRun[] };
+
+/**
+ * Projected run pushed over the live channel.
+ *
+ * Kept structurally identical to the `GET /console/runs` row projection
+ * (`projectRun` in `flows.ts`) so the client can treat HTTP and WS rows
+ * interchangeably.
+ */
+export interface ConsoleLiveRun {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly flow: string;
+  readonly unit: string | null;
+  readonly trigger: string;
+  readonly plane: string;
+  readonly tenant: string | null;
+  readonly principal: string | null;
+  readonly gates: readonly string[];
+  readonly cache: "hit" | "miss" | "none";
+  readonly replica: "primary" | "replica" | null;
+  readonly replicaLagMs: number | null;
+  readonly cost: number | null;
+  readonly inputTokens: number | null;
+  readonly outputTokens: number | null;
+  readonly promptVersion: number | null;
+  readonly buildVersion: string | null;
+  readonly startedAt: number;
+  readonly endedAt: number;
+  readonly durationMs: number;
+  readonly error: string | null;
+  /** Optional human message paired with {@link error}. */
+  readonly errorMessage: string | null;
+  readonly sampled: "full" | "error" | "sample" | "boost";
+  readonly effects: readonly ConsoleLiveRunEffect[];
+  readonly logs: readonly ConsoleLiveRunLog[];
+  readonly dimensions: Record<string, string | number | boolean | null>;
+  /** Validated flow input snapshot — null when the run has no stored input. */
+  readonly input: unknown;
+  /** Flow return value snapshot — null when the run has no stored output. */
+  readonly output: unknown;
+}
+
+/** Effect entry on a live run row. */
+export interface ConsoleLiveRunEffect {
+  readonly kind: "read" | "write" | "emit" | "send" | "ask" | "secret" | "call";
+  readonly resource: string;
+  readonly timestamp: number;
+  readonly duration: number;
+  readonly reversibility:
+    | "none"
+    | "reversible"
+    | "deferred"
+    | "irreversible"
+    | "capability"
+    | "portal";
+}
+
+/** Log line on a live run row. */
+export interface ConsoleLiveRunLog {
+  readonly level: "debug" | "info" | "warn" | "error";
+  readonly message: string;
+  readonly data?: Record<string, unknown>;
+  readonly at: number;
+}
 
 /** Options for {@link createConsoleState}. */
 export interface CreateConsoleStateOptions {
@@ -364,7 +527,7 @@ export interface CreateConsoleStateOptions {
   readonly now?: () => number;
   readonly cwd?: string;
   readonly manifest?: Manifest | null;
-  /** Skip printing the claim code (tests). */
+  /** Skip stdout claim print (`oke dev` paints the board; tests). Artifact still written. */
   readonly silentClaim?: boolean;
   /** Seed identities for the invoke-as picker. */
   readonly identities?: readonly ConsoleIdentity[];
@@ -374,10 +537,22 @@ export interface CreateConsoleStateOptions {
   readonly accessTtlMs?: number;
   /** Injected vault runtime (tests / host). */
   readonly vaultRuntime?: VaultRuntime | null;
+  /** Per-layer seed bag for Manifest vault boot (seeded Console). */
+  readonly vaultLayerSeed?: VaultLayerSeed | null;
   /** Injected journal store for blast-radius / waiting-on queries. */
   readonly journalStore?: JournalStore | null;
+  /** Injected host fleet registry (tests / host). */
+  readonly instanceStore?: InstanceStore | null;
+  /** Injected host cron store for fleet lease join (tests / host). */
+  readonly fleetCronStore?: CronStore | null;
   /** Environment label for vault fingerprints. */
   readonly vaultEnv?: string;
+  /** Env map for builtin adapter open / probe (tests). */
+  readonly vaultProcessEnv?: Readonly<Record<string, string | undefined>>;
+  /** DEKs per rotate-master batch (tests). */
+  readonly vaultKekRewrapBatchSize?: number;
+  /** Test hook: awaited after claiming the batch slot, before adapter work. */
+  readonly rotateBatchHold?: () => Promise<void>;
   /** Injected GateRuntime (tests / host). */
   readonly gateRuntime?: GateRuntime | null;
   /** Injected ClockRuntime (tests / host). */
@@ -402,6 +577,11 @@ export interface CreateConsoleStateOptions {
   readonly persistOperator?: (operatorId: string) => void | Promise<void>;
   /** Persist hook after session issue / revoke. */
   readonly persistSessions?: () => void | Promise<void>;
+  /**
+   * Shared secret for host → Console runs ingest (`oke dev` bridge).
+   * When omitted, ingest is disabled (404).
+   */
+  readonly runsIngestSecret?: string | null;
 }
 
 /**
@@ -443,6 +623,7 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
     const value = await vault.probeVaultBackend({
       config: state.okeConfig,
       env: state.production ? "prod" : "dev",
+      ...(options.vaultProcessEnv !== undefined ? { processEnv: options.vaultProcessEnv } : {}),
     });
     backendMemo = { at, value };
     return value;
@@ -595,6 +776,12 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
       });
     },
     listRuns: async () => [],
+    queryPersistedRuns: async () => {
+      throw new Error("queryPersistedRuns is unbound until Console boot");
+    },
+    runsIngestSecret: options.runsIngestSecret ?? null,
+    replayTrace: null,
+    invokeUserFlow: null,
     signalConfig,
     signalBus: null,
     listSignals: async () => {
@@ -655,13 +842,36 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
       });
     },
     queryStore: async (input) => {
+      if (isConsoleAuthStoreRef(input.ref)) {
+        requireConsoleAuthStore();
+        return queryConsoleAuthStore(
+          {
+            operators: state.operators,
+            sessions: state.sessions,
+            roles: state.roles,
+            apiKeys: state.apiKeys,
+            invites: state.invites,
+            identities: state.identities,
+            roleMembers: state.roleMembers,
+          },
+          input,
+        );
+      }
       const store = await markPanel<typeof import("./store.ts")>("store");
       if (!state.storeRuntime) {
         return { facet: input.ref.split(":")[0] as "sql", rows: [], masked: true };
       }
       return store.queryStore(state.storeRuntime, state.manifest, input);
     },
+    getStoreFile: async (input) => {
+      const store = await markPanel<typeof import("./store.ts")>("store");
+      if (!state.storeRuntime) {
+        throw new Error("Store runtime not bound");
+      }
+      return store.getStoreFile(state.storeRuntime, input);
+    },
     editStore: async (input, opts) => {
+      rejectConsoleAuthMutation(input.ref);
       const store = await markPanel<typeof import("./store.ts")>("store");
       if (!state.storeRuntime) {
         throw new Error("Store runtime not bound");
@@ -672,9 +882,10 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
       });
     },
     deleteStore: async (input) => {
+      rejectConsoleAuthMutation(input.ref);
       const store = await markPanel<typeof import("./store.ts")>("store");
       if (!state.storeRuntime) return { deleted: 0 };
-      return store.deleteStore(state.storeRuntime, input);
+      return store.deleteStore(state.storeRuntime, input, state.manifest);
     },
     purgeStoreCache: async (resource) => {
       const store = await markPanel<typeof import("./store.ts")>("store");
@@ -682,12 +893,57 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
       return store.purgeStoreCache(state.storeRuntime, resource);
     },
     runStoreSql: async (ref, sqlText, options) => {
+      rejectConsoleAuthMutation(ref);
       const store = await markPanel<typeof import("./store.ts")>("store");
       if (!state.storeRuntime) {
         throw new Error("Store runtime not bound");
       }
       return store.runStoreSql(state.storeRuntime, ref, sqlText, options);
     },
+    queryStoreSqlStats: async (ref) => {
+      const stats = await import("./store-stats.ts");
+      await markPanel<typeof import("./store.ts")>("store");
+      if (!state.storeRuntime) {
+        throw new stats.StoreSqlStatsError(
+          stats.PG_STAT_STATEMENTS_UNSUPPORTED,
+          "Store runtime not bound",
+        );
+      }
+      return stats.queryStoreSqlStats(state.storeRuntime, ref);
+    },
+    queryStoreSqlLocks: async (ref, options) => {
+      const stats = await import("./store-stats.ts");
+      await markPanel<typeof import("./store.ts")>("store");
+      if (!state.storeRuntime) {
+        throw new stats.StoreSqlStatsError(
+          stats.PG_STAT_STATEMENTS_UNSUPPORTED,
+          "Store runtime not bound",
+        );
+      }
+      return stats.queryStoreSqlLocks(state.storeRuntime, ref, options);
+    },
+    adviseStoreSqlIndex: async (ref, query) => {
+      const stats = await import("./store-stats.ts");
+      await markPanel<typeof import("./store.ts")>("store");
+      if (!state.storeRuntime) {
+        throw new stats.StoreSqlStatsError(
+          stats.PG_STAT_STATEMENTS_UNSUPPORTED,
+          "Store runtime not bound",
+        );
+      }
+      return stats.adviseStoreSqlIndex(state.storeRuntime, ref, query);
+    },
+    queryStoreKvStats: async (ref, options) => {
+      const kvStats = await import("./store-kv-stats.ts");
+      await markPanel<typeof import("./store.ts")>("store");
+      if (!state.storeRuntime) {
+        throw new kvStats.StoreKvStatsError(
+          kvStats.KV_STATS_UNSUPPORTED,
+          "Store runtime not bound",
+        );
+      }
+      return kvStats.queryStoreKvStats(state.storeRuntime, ref, options);
+    },
     clockRuntime: options.clockRuntime ?? null,
     listClocks: async () => {
       const { ensureConsolePanelRuntimes } = await import("./app.ts");
@@ -742,7 +998,14 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
       };
     },
     vaultRuntime: options.vaultRuntime ?? null,
+    vaultLayerSeed: options.vaultLayerSeed ?? null,
     journalStore: options.journalStore ?? null,
+    instanceStore: options.instanceStore ?? null,
+    fleetCronStore: options.fleetCronStore ?? null,
+    listInstances: async () => {
+      const instances = await markPanel<typeof import("./instances.ts")>("instances");
+      return instances.listConsoleInstances(state);
+    },
     vaultEnv: options.vaultEnv ?? "dev",
     listVault: async () => {
       const { ensureConsolePanelRuntimes } = await import("./app.ts");
@@ -754,24 +1017,97 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
         journal: state.journalStore,
         env: state.vaultEnv,
         now: state.now,
+        cwd: state.cwd,
         backend: await vaultBackend(vault),
       });
     },
     setVault: async (input) => {
+      const { ensureConsolePanelRuntimes } = await import("./app.ts");
+      await ensureConsolePanelRuntimes(state, "vault");
       const vault = await markPanel<typeof import("./vault.ts")>("vault");
+      if (!state.vaultRuntime) {
+        state.vaultRuntime = await vault.createManifestVaultRuntime(
+          state.manifest ?? { oke: "1.0", app: "app" },
+          {
+            cwd: state.cwd,
+            env: state.production ? "prod" : "dev",
+            allowDevFallbacks: !state.production,
+            now: state.now,
+            driverId: vault.resolveVaultDriverId(
+              state.okeConfig,
+              state.production ? "prod" : "dev",
+            ),
+          },
+        );
+      }
       if (!state.vaultRuntime) {
         throw new Error("Vault runtime not bound");
       }
       return vault.setVaultValue(state.vaultRuntime, input);
     },
+    createVault: async (input) => {
+      const { ensureConsolePanelRuntimes } = await import("./app.ts");
+      await ensureConsolePanelRuntimes(state, "vault");
+      const vault = await markPanel<typeof import("./vault.ts")>("vault");
+      if (!state.vaultRuntime) {
+        state.vaultRuntime = await vault.createManifestVaultRuntime(
+          state.manifest ?? { oke: "1.0", app: "app" },
+          {
+            cwd: state.cwd,
+            env: state.production ? "prod" : "dev",
+            allowDevFallbacks: !state.production,
+            now: state.now,
+            driverId: vault.resolveVaultDriverId(
+              state.okeConfig,
+              state.production ? "prod" : "dev",
+            ),
+          },
+        );
+      }
+      if (!state.vaultRuntime) {
+        throw new Error("Vault runtime not bound");
+      }
+      return vault.createVaultContract(state.vaultRuntime, state.cwd, state.manifest, input);
+    },
     rotateVault: async (input) => {
+      const { ensureConsolePanelRuntimes } = await import("./app.ts");
+      await ensureConsolePanelRuntimes(state, "vault");
       const vault = await markPanel<typeof import("./vault.ts")>("vault");
+      if (!state.vaultRuntime) {
+        state.vaultRuntime = await vault.createManifestVaultRuntime(
+          state.manifest ?? { oke: "1.0", app: "app" },
+          {
+            cwd: state.cwd,
+            env: state.production ? "prod" : "dev",
+            allowDevFallbacks: !state.production,
+            now: state.now,
+            driverId: vault.resolveVaultDriverId(
+              state.okeConfig,
+              state.production ? "prod" : "dev",
+            ),
+          },
+        );
+      }
       if (!state.vaultRuntime) {
         throw new Error("Vault runtime not bound");
       }
       return vault.rotateVaultValue(state.vaultRuntime, input);
     },
-    identities: [...(options.identities ?? defaultDevIdentities())],
+    vaultRotateHandle: null,
+    vaultRotateStarting: false,
+    verifyVaultAudit: async () => {
+      const vault = await markPanel<typeof import("./vault.ts")>("vault");
+      return vault.verifyConsoleVaultAudit({
+        config: state.okeConfig,
+        env: state.production ? "prod" : "dev",
+        ...(options.vaultProcessEnv !== undefined ? { processEnv: options.vaultProcessEnv } : {}),
+      });
+    },
+    rotateMaster: async () => {
+      const vault = await markPanel<typeof import("./vault.ts")>("vault");
+      return runConsoleRotateMaster(state, vault, options);
+    },
+    identities: [...(options.identities ?? defaultDevIdentities(options.manifest))],
     production: options.production ?? process.env.NODE_ENV === "production",
     aiRuntime: null,
     evalResults: [],
@@ -924,6 +1260,97 @@ export function setManifest(state: ConsoleState, manifest: Manifest): void {
   }
 }
 
+/**
+ * One rotate-master batch on the process-global handle.
+ *
+ * @param state - Console state
+ * @param vault - Vault panel module
+ * @param options - Open / hold knobs
+ */
+async function runConsoleRotateMaster(
+  state: ConsoleState,
+  vault: typeof import("./vault.ts"),
+  options: CreateConsoleStateOptions,
+): Promise<ConsoleVaultRotateMasterResult> {
+  const openOpts = {
+    config: state.okeConfig,
+    env: state.production ? ("prod" as const) : ("dev" as const),
+    unseal: true as const,
+    ...(options.vaultProcessEnv !== undefined ? { processEnv: options.vaultProcessEnv } : {}),
+    ...(options.vaultKekRewrapBatchSize === undefined
+      ? {}
+      : { kekRewrapBatchSize: options.vaultKekRewrapBatchSize }),
+  };
+
+  if (state.vaultRotateHandle?.inFlight || state.vaultRotateStarting) {
+    throw new ConsoleVaultRotateBusyError("vault: a master rotation is already in progress");
+  }
+
+  if (state.vaultRotateHandle) {
+    state.vaultRotateHandle.inFlight = true;
+    try {
+      await options.rotateBatchHold?.();
+      const progress = await state.vaultRotateHandle.adapter.continueRotateMaster();
+      if (progress.remaining === 0) {
+        await state.vaultRotateHandle.close();
+        state.vaultRotateHandle = null;
+      }
+      return {
+        kekVersion: progress.kekVersion,
+        remaining: progress.remaining,
+        masterKey: null,
+      };
+    } catch (error) {
+      return vault.mapConsoleVaultError(error);
+    } finally {
+      if (state.vaultRotateHandle) state.vaultRotateHandle.inFlight = false;
+    }
+  }
+
+  state.vaultRotateStarting = true;
+  let opened: Awaited<ReturnType<typeof vault.openConsoleBuiltinAdapter>>;
+  try {
+    opened = await vault.openConsoleBuiltinAdapter(openOpts);
+  } catch (error) {
+    state.vaultRotateStarting = false;
+    return vault.mapConsoleVaultError(error);
+  }
+
+  try {
+    const status = await opened.adapter.status();
+    if (status.rewrapTargetKekVersion !== undefined) {
+      await opened.close();
+      throw new ConsoleVaultRotateBusyError(
+        "vault: resume rotate-master with the new master key (`oke vault rotate-master --new-key`)",
+      );
+    }
+
+    state.vaultRotateHandle = {
+      adapter: opened.adapter,
+      close: () => opened.close(),
+      inFlight: true,
+    };
+    await options.rotateBatchHold?.();
+    const progress = await opened.adapter.rotateMaster();
+    if (progress.remaining === 0) {
+      await opened.close();
+      state.vaultRotateHandle = null;
+    }
+    return {
+      kekVersion: progress.kekVersion,
+      remaining: progress.remaining,
+      masterKey: progress.masterKey ?? null,
+    };
+  } catch (error) {
+    await opened.close().catch(() => undefined);
+    state.vaultRotateHandle = null;
+    return vault.mapConsoleVaultError(error);
+  } finally {
+    state.vaultRotateStarting = false;
+    if (state.vaultRotateHandle) state.vaultRotateHandle.inFlight = false;
+  }
+}
+
 /**
  * Bind a live {@link GateRuntime} from the host app (preferred over Manifest
  * reconstruction).
@@ -953,15 +1380,26 @@ export async function bindManifestGateRuntime(state: ConsoleState): Promise<void
 
 /**
  * Default development identities for the invoke-as picker.
+ * Demo scopes follow Manifest gate `scopes` when present so Call API
+ * matches the seeded app (keel `issue:write`, skyport `booking:create`).
+ *
+ * @param manifest - Optional Manifest used to derive application scopes
  */
-function defaultDevIdentities(): ConsoleIdentity[] {
+function defaultDevIdentities(manifest?: Manifest | null): ConsoleIdentity[] {
+  const scopes = new Set<string>(["member"]);
+  for (const gate of Object.values(manifest?.gates ?? {})) {
+    for (const scope of gate.scopes ?? []) {
+      scopes.add(scope);
+    }
+  }
+  if (scopes.size === 1) scopes.add("booking:create");
   return [
     {
       id: "user_demo",
       email: "demo@example.com",
       name: "Demo User",
       status: "active",
-      scopes: ["booking:create", "member"],
+      scopes: [...scopes].sort(),
     },
     {
       id: "user_member",