okengine 0.13.0 → 0.15.2

package/src/console/server/flows.ts

@@ -27,12 +27,15 @@ import { maskPiiValue, maskWideEventForConsole, piiFieldNamesFromManifest } from
 import { ConsoleRunsQueryError, RUNS_QUERY_PII_GAP, RUNS_QUERY_TIMEOUT_MS } from "./runs-query.ts";
 import { DuckQueryTimeoutError } from "../../runs/duckdb.ts";
 import { ClockResourceNotFoundError, ScheduleNotOverridableError } from "./clock.ts";
+import { isoAt } from "./iso-at.ts";
 import { createFileDiff, emitStructuralDiff } from "./structural.ts";
 import type { ConsoleState } from "./state.ts";
 import { consoleFailureMessage } from "./i18n.ts";
 import { CONSOLE_PASSWORD_POLICY } from "../password-policy.ts";
 import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 import { resolveInvokeAs } from "./invoke-user-flow.ts";
+import { resolveRlsIdentity } from "../../elements/store.ts";
+import type { RlsIdentity } from "../../drivers/pg-rls.ts";
 import { isKnownConsoleSqlGate, StoreFileNotFoundError, tenancyDeclared } from "./store.ts";
 import {
   PG_STAT_STATEMENTS_NOT_CREATED,
@@ -152,7 +155,7 @@ const TracesReplayOut = z.object({
   ok: z.literal(true),
   rootId: z.string(),
   dryRun: z.boolean(),
-  at: z.number(),
+  at: z.string(),
   flow: z.string(),
 });
 
@@ -260,7 +263,7 @@ const SignalsReplayOut = z.object({
       messageId: z.string().optional(),
     }),
   ),
-  at: z.number(),
+  at: z.string(),
 });
 
 const SignalsDiscardIn = z.object({
@@ -273,7 +276,7 @@ const SignalsDiscardIn = z.object({
 const SignalsDiscardOut = z.object({
   ok: z.literal(true),
   discarded: z.number(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ActionPingIn = z.object({
@@ -283,7 +286,7 @@ const ActionPingIn = z.object({
 const ActionPingOut = z.object({
   ok: z.literal(true),
   note: z.string().optional(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StructuralIn = z.object({
@@ -354,6 +357,13 @@ const InvokeOut = z.object({
   durationMs: z.number().optional(),
   peakTier: z.enum(["none", "reads", "writes", "emits", "external", "capabilities"]),
   auditedAt: z.number(),
+  rls: z
+    .object({
+      gate: z.string().nullable(),
+      userId: z.string(),
+      applied: z.boolean(),
+    })
+    .optional(),
 });
 
 const SetupClosed = z.object({ reason: z.string() });
@@ -504,7 +514,7 @@ const ChannelRevealOut = z.object({
   ok: z.literal(true),
   id: z.string(),
   to: z.string(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ChannelSendTestIn = z.object({
@@ -521,7 +531,7 @@ const ChannelSendTestOut = z.object({
   messageId: z.string(),
   status: z.string(),
   chain: z.string(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const VaultNotFound = z.object({
@@ -634,7 +644,7 @@ const ClockRunNowOut = z.object({
   ok: z.literal(true),
   name: z.string(),
   ran: z.boolean(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ClockPauseIn = z.object({ name: z.string().min(1) });
@@ -642,7 +652,7 @@ const ClockPauseOut = z.object({
   ok: z.literal(true),
   name: z.string(),
   status: z.string(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ClockEditIn = z.object({
@@ -656,7 +666,7 @@ const ClockEditOut = z.object({
   name: z.string(),
   effectiveCron: z.string().optional(),
   effectiveEvery: z.string().optional(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ClockWakeEarlyIn = z.object({ runId: z.string().min(1) });
@@ -665,7 +675,7 @@ const ClockWakeEarlyOut = z.object({
   runId: z.string(),
   wakeAt: z.number(),
   resumed: z.boolean(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const VaultResolutionStepOut = z.object({
@@ -746,7 +756,7 @@ const VaultWriteOut = z.object({
   ok: z.literal(true),
   name: z.string(),
   fingerprint: z.string().nullable(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const VaultAuditRowOut = z.object({
@@ -780,7 +790,7 @@ const VaultRotateMasterOut = z.object({
   kekVersion: z.number(),
   remaining: z.number(),
   masterKey: z.string().nullable(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const AiMetricOut = z.object({
@@ -834,6 +844,7 @@ const AiListOut = z.object({
         ok: z.number(),
         provider_error: z.number(),
         schema_invalid: z.number(),
+        budget_exceeded: z.number(),
       }),
     }),
   ),
@@ -1421,6 +1432,7 @@ const StoreListOut = z.object({
           piiColumns: z.array(z.string()),
           columnDescriptions: z.record(z.string(), z.string()),
           rls: z.boolean().optional(),
+          rlsPolicyCount: z.number().int().nonnegative().optional(),
         }),
       ),
       replicaLagMs: z.number().nullable(),
@@ -1444,6 +1456,17 @@ const StoreListOut = z.object({
   ),
 });
 
+const StoreRlsAs = {
+  asGate: z.string().min(1).optional(),
+  asUserId: z.string().min(1).optional(),
+};
+
+const StoreRlsOut = z.object({
+  gate: z.string().nullable(),
+  userId: z.string(),
+  applied: z.boolean(),
+});
+
 const StoreQueryIn = z.object({
   ref: z.string().min(1),
   child: z.string().optional(),
@@ -1454,6 +1477,7 @@ const StoreQueryIn = z.object({
   q: z.string().optional(),
   topK: z.number().min(1).max(100).optional(),
   revealPii: z.boolean().optional(),
+  ...StoreRlsAs,
 });
 
 const StoreQueryOut = z.object({
@@ -1482,6 +1506,7 @@ const StoreQueryOut = z.object({
     .optional(),
   masked: z.boolean(),
   routedRole: z.enum(["primary", "replica"]).optional(),
+  rls: StoreRlsOut.optional(),
 });
 
 const StoreRevealIn = z.object({
@@ -1495,7 +1520,7 @@ const StoreRevealIn = z.object({
 const StoreRevealOut = z.object({
   ok: z.literal(true),
   value: z.unknown(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StoreFileGetIn = z.object({
@@ -1526,6 +1551,7 @@ const StoreEditIn = z.object({
   reason: z.string().optional(),
   /** When false/omitted, returns willNotFire without applying. */
   commit: z.boolean().optional(),
+  ...StoreRlsAs,
 });
 
 const StoreEditOut = z.object({
@@ -1539,7 +1565,8 @@ const StoreEditOut = z.object({
       resource: z.string(),
     }),
   ),
-  at: z.number(),
+  at: z.string(),
+  rls: StoreRlsOut.optional(),
 });
 
 const StoreDeleteIn = z.object({
@@ -1555,7 +1582,7 @@ const StoreDeleteIn = z.object({
 const StoreDeleteOut = z.object({
   ok: z.literal(true),
   deleted: z.number(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StorePurgeIn = z.object({
@@ -1567,7 +1594,7 @@ const StorePurgeIn = z.object({
 const StorePurgeOut = z.object({
   ok: z.literal(true),
   keys: z.array(z.string()),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StoreSqlIn = z.object({
@@ -1577,6 +1604,7 @@ const StoreSqlIn = z.object({
   allowWrite: z.boolean().optional(),
   revealPii: z.boolean().optional(),
   asGate: z.string().min(1).optional(),
+  asUserId: z.string().min(1).optional(),
 });
 
 const StoreSqlOut = z.object({
@@ -1584,7 +1612,9 @@ const StoreSqlOut = z.object({
   masked: z.boolean(),
   routedRole: z.enum(["primary", "replica"]),
   asGate: z.string().nullable(),
+  asUserId: z.string().nullable(),
   gateApplied: z.boolean(),
+  rls: StoreRlsOut.optional(),
 });
 
 const StoreSqlStatsIn = z.object({
@@ -1748,7 +1778,7 @@ const StorePreviewOut = z.object({
       resource: z.string(),
     }),
   ),
-  at: z.number(),
+  at: z.string(),
 });
 
 /**
@@ -2361,7 +2391,7 @@ function createTracesReplay(state: ConsoleState) {
         ok: true as const,
         rootId: input.rootId,
         dryRun,
-        at: Date.now(),
+        at: isoAt(Date.now()),
         flow: root.flow,
       };
     },
@@ -2442,7 +2472,7 @@ function createSignalsDiscard(state: ConsoleState) {
       return {
         ok: true as const,
         discarded: result.discarded,
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -2516,7 +2546,7 @@ async function runSignalReplay(
     dryRun: result.dryRun,
     results: [...result.results],
     wouldHaveFired: [...result.wouldHaveFired],
-    at: state.now(),
+    at: isoAt(state.now()),
   };
 }
 
@@ -2561,7 +2591,7 @@ function createActionPing(state: ConsoleState) {
         operatorId: fx.operator.id,
         note: input.note,
       });
-      return { ok: true as const, note: input.note, at: state.now() };
+      return { ok: true as const, note: input.note, at: isoAt(state.now()) };
     },
   });
 }
@@ -2663,6 +2693,7 @@ function createFlowsInvoke(state: ConsoleState) {
         ...(assumed.bypassGates ? { bypassGates: true } : {}),
         ...(input.reason !== undefined ? { reason: input.reason } : {}),
         ...(input.revealPii === true ? { revealPii: true } : {}),
+        ...(assumed.rls ? { rls: assumed.rls } : {}),
       });
 
       const reveal = input.revealPii === true;
@@ -2715,6 +2746,11 @@ function createFlowsInvoke(state: ConsoleState) {
         ...(host.durationMs !== undefined ? { durationMs: host.durationMs } : {}),
         peakTier,
         auditedAt: state.now(),
+        rls: {
+          gate: assumed.rls?.gate ?? null,
+          userId: assumed.rls?.userId ?? "",
+          applied: assumed.rls !== null,
+        },
       };
     },
   });
@@ -2805,6 +2841,32 @@ function createStoreList(state: ConsoleState) {
   });
 }
 
+function consoleStoreRls(
+  state: ConsoleState,
+  input: { readonly asGate?: string; readonly asUserId?: string },
+):
+  | { readonly ok: true; readonly rls: RlsIdentity | null }
+  | { readonly ok: false; readonly reason: string } {
+  if (input.asGate !== undefined && !isKnownConsoleSqlGate(state.manifest, input.asGate)) {
+    return { ok: false, reason: `unknown gate: ${input.asGate}` };
+  }
+  if (input.asUserId !== undefined) {
+    const identity = state.identities.find((row) => row.id === input.asUserId);
+    if (!identity || identity.status === "disabled") {
+      return { ok: false, reason: `unknown identity: ${input.asUserId}` };
+    }
+  }
+  return {
+    ok: true,
+    rls: resolveRlsIdentity({
+      asGate: input.asGate,
+      asUserId: input.asUserId,
+      identities: state.identities,
+      manifest: state.manifest,
+    }),
+  };
+}
+
 function createStoreQuery(state: ConsoleState) {
   return flow("console.store.query", {
     plane: "operator",
@@ -2823,6 +2885,8 @@ function createStoreQuery(state: ConsoleState) {
           tenant: input.tenant,
         });
       }
+      const assumed = consoleStoreRls(state, input);
+      if (!assumed.ok) return fail("StoreNotFound", { ref: assumed.reason });
       return state.queryStore({
         ref: input.ref as ResourceRef,
         child: input.child,
@@ -2833,6 +2897,9 @@ function createStoreQuery(state: ConsoleState) {
         q: input.q,
         topK: input.topK,
         revealPii: input.revealPii === true,
+        ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+        ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+        ...(assumed.rls ? { rls: assumed.rls } : {}),
       });
     },
   });
@@ -2868,7 +2935,7 @@ function createStoreReveal(state: ConsoleState) {
       return {
         ok: true as const,
         value: row[input.column],
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -2921,6 +2988,14 @@ function createStoreEdit(state: ConsoleState) {
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
       if (tenantFail) return tenantFail;
 
+      const assumed = consoleStoreRls(state, input);
+      if (!assumed.ok) return fail("StoreNotFound", { ref: assumed.reason });
+      const rlsFields = {
+        ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+        ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+        ...(assumed.rls ? { rls: assumed.rls } : {}),
+      };
+
       if (!input.commit) {
         // Return will-not-fire payload without applying — informational confirm.
         const preview = await state.editStore(
@@ -2931,6 +3006,7 @@ function createStoreEdit(state: ConsoleState) {
             id: input.id,
             key: input.key,
             patch: input.patch,
+            ...rlsFields,
           },
           { dryRun: true },
         );
@@ -2940,7 +3016,8 @@ function createStoreEdit(state: ConsoleState) {
           applied: false,
           willNotFire: preview.willNotFire,
           wouldHaveFired: [...preview.wouldHaveFired],
-          at: state.now(),
+          at: isoAt(state.now()),
+          ...(preview.rls ? { rls: preview.rls } : {}),
         };
       }
 
@@ -2961,6 +3038,7 @@ function createStoreEdit(state: ConsoleState) {
           id: input.id,
           key: input.key,
           patch: input.patch,
+          ...rlsFields,
         },
         { dryRun: false },
       );
@@ -2977,7 +3055,8 @@ function createStoreEdit(state: ConsoleState) {
         applied: result.applied,
         willNotFire: result.willNotFire,
         wouldHaveFired: [...result.wouldHaveFired],
-        at: state.now(),
+        at: isoAt(state.now()),
+        ...(result.rls ? { rls: result.rls } : {}),
       };
     },
   });
@@ -3017,7 +3096,7 @@ function createStoreDelete(state: ConsoleState) {
       return {
         ok: true as const,
         deleted: result.deleted,
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -3049,7 +3128,7 @@ function createStorePurgeCache(state: ConsoleState) {
       return {
         ok: true as const,
         keys: [...result.keys],
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -3073,9 +3152,8 @@ function createStoreSql(state: ConsoleState) {
             tenant: input.tenant,
           });
         }
-        if (input.asGate !== undefined && !isKnownConsoleSqlGate(state.manifest, input.asGate)) {
-          return fail("StoreNotFound", { ref: `unknown gate: ${input.asGate}` });
-        }
+        const assumed = consoleStoreRls(state, input);
+        if (!assumed.ok) return fail("StoreNotFound", { ref: assumed.reason });
         if (input.asGate !== undefined) {
           fx.log.info("console.store.sql.asGate", {
             operatorId: fx.operator.id,
@@ -3089,6 +3167,8 @@ function createStoreSql(state: ConsoleState) {
           revealPii: input.revealPii === true,
           tenant: input.tenant,
           ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+          ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+          ...(assumed.rls ? { rls: assumed.rls } : {}),
         });
         fx.log.info("console.store.sql", {
           operatorId: fx.operator.id,
@@ -3096,6 +3176,7 @@ function createStoreSql(state: ConsoleState) {
           allowWrite: input.allowWrite === true,
           revealPii: input.revealPii === true,
           asGate: input.asGate ?? null,
+          asUserId: input.asUserId ?? null,
           rowCount: result.rows.length,
         });
         return result;
@@ -3311,7 +3392,7 @@ function createStorePreview(state: ConsoleState) {
           dryRun: true as const,
           willNotFire: preview.willNotFire,
           wouldHaveFired: [...preview.wouldHaveFired],
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof DryRunWriteIsolationError) {
@@ -3367,7 +3448,7 @@ function createVaultCreate(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           fingerprint: result.fingerprint,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -3407,7 +3488,7 @@ function createVaultSet(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           fingerprint: result.fingerprint,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return fail("VaultNotFound", {
@@ -3445,7 +3526,7 @@ function createVaultRotate(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           fingerprint: result.fingerprint,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return fail("VaultNotFound", {
@@ -3491,7 +3572,7 @@ function createVaultRotateMaster(state: ConsoleState) {
           kekVersion: result.kekVersion,
           remaining: result.remaining,
           masterKey: result.masterKey,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return mapVaultOperatorError(err);
@@ -4009,7 +4090,7 @@ function createClockRunNow(state: ConsoleState) {
           ok: true as const,
           name: input.name,
           ran: result.ran,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ClockResourceNotFoundError) {
@@ -4039,7 +4120,7 @@ function createClockPause(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           status: result.status,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ClockResourceNotFoundError) {
@@ -4074,7 +4155,7 @@ function createClockEditSchedule(state: ConsoleState) {
           name: result.name,
           effectiveCron: result.effectiveCron,
           effectiveEvery: result.effectiveEvery,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ScheduleNotOverridableError) {
@@ -4109,7 +4190,7 @@ function createClockWakeEarly(state: ConsoleState) {
           runId: result.runId,
           wakeAt: result.wakeAt,
           resumed: result.resumed,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ClockResourceNotFoundError) {
@@ -4186,7 +4267,7 @@ function createChannelReveal(state: ConsoleState) {
         ok: true as const,
         id: revealed.id,
         to: revealed.to,
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -4233,7 +4314,7 @@ function createChannelSendTest(state: ConsoleState) {
         });
         return {
           ...result,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return fail("ChannelNotFound", {

package/src/console/server/invoke-user-flow.test.ts

@@ -181,7 +181,9 @@ describe("resolveInvokeAs", () => {
     const resolved = resolveInvokeAs({ asGate: "member" }, IDENTITIES, MANIFEST);
     expect(resolved.ok).toBe(true);
     if (!resolved.ok) return;
-    expect(resolved.asUserId).toBe("gate:member");
+    expect(resolved.asUserId).toBe("");
+    expect(resolved.principal.userId).toBe("");
+    expect(resolved.rls).toEqual({ gate: "member", userId: "", scopes: ["member"] });
     expect([...resolved.principal.scopes]).toEqual(["member"]);
     expect(resolved.principal.verified).toBe(true);
   });

package/src/console/server/invoke-user-flow.ts

@@ -14,6 +14,8 @@ import type { AnyFlowDef } from "../../kernel/flow.ts";
 import { isJsonResult } from "../../kernel/fx.ts";
 import { isFlowFailure } from "../../kernel/hooks.ts";
 import type { Trigger } from "../../kernel/triggers.ts";
+import type { RlsIdentity } from "../../drivers/pg-rls.ts";
+import { resolveRlsIdentity } from "../../elements/store.ts";
 import type { Manifest } from "../../manifest/types.ts";
 import type { ConsoleIdentity } from "./state.ts";
 
@@ -32,6 +34,8 @@ export interface InvokeUserFlowInput {
    * Envelope remask is skipped separately when this is true.
    */
   readonly revealPii?: boolean;
+  /** Same bag as SQL console / browse — stamped onto host `fx.store`. */
+  readonly rls?: RlsIdentity;
 }
 
 /** Resolved Call API invoke-as principal. */
@@ -42,6 +46,7 @@ export type ResolvedInvokeAs =
       readonly asUserId: string;
       readonly asGate: string | null;
       readonly bypassGates: boolean;
+      readonly rls: RlsIdentity | null;
     }
   | { readonly ok: false; readonly reason: string };
 
@@ -75,6 +80,12 @@ export function resolveInvokeAs(
       asUserId: identity.id,
       asGate: asGate ?? null,
       bypassGates: false,
+      rls: resolveRlsIdentity({
+        asUserId: identity.id,
+        asGate: asGate ?? null,
+        identities,
+        manifest,
+      }),
     };
   }
 
@@ -89,6 +100,7 @@ export function resolveInvokeAs(
       asUserId: "console:operator",
       asGate: null,
       bypassGates: true,
+      rls: null,
     };
   }
 
@@ -103,6 +115,7 @@ export function resolveInvokeAs(
       asUserId: "public",
       asGate: "public",
       bypassGates: false,
+      rls: resolveRlsIdentity({ asGate: "public", manifest }),
     };
   }
 
@@ -114,13 +127,14 @@ export function resolveInvokeAs(
   return {
     ok: true,
     principal: userPrincipal({
-      userId: `gate:${asGate}`,
+      userId: "",
       scopes,
       verified: true,
     }),
-    asUserId: `gate:${asGate}`,
+    asUserId: "",
     asGate,
     bypassGates: false,
+    rls: resolveRlsIdentity({ asGate, manifest }),
   };
 }
 
@@ -353,6 +367,7 @@ export function bindHostInvokeUserFlow(app: InvokeHostApp): ConsoleInvokeUserFlo
       runId,
       ...(input.bypassGates === true ? { bypassGates: true } : {}),
       ...(input.revealPii === true ? { revealPii: true } : {}),
+      ...(input.rls ? { rls: input.rls } : {}),
       principal: {
         plane: "user",
         userId: input.principal.userId.length > 0 ? input.principal.userId : null,

package/src/console/server/iso-at.test.ts

@@ -0,0 +1,9 @@
+import { describe, expect, test } from "bun:test";
+
+import { isoAt } from "./iso-at.ts";
+
+describe("isoAt", () => {
+  test("formats epoch ms as UTC ISO-8601", () => {
+    expect(isoAt(1_787_305_011_525)).toBe("2026-08-21T09:36:51.525Z");
+  });
+});

package/src/console/server/iso-at.ts

@@ -0,0 +1,11 @@
+/**
+ * ISO-8601 UTC instant from a Console clock reading (epoch ms).
+ *
+ * Mutation receipts (`clock.run-now`, store edit, vault write, …) return
+ * this instead of a raw millisecond number so Call API JSON is readable.
+ *
+ * @param ms - Epoch milliseconds from `state.now()` / `Date.now()`
+ */
+export function isoAt(ms: number): string {
+  return new Date(ms).toISOString();
+}

package/src/console/server/security-headers.ts

@@ -7,14 +7,16 @@ export const CONSOLE_CSP: string = [
   "default-src 'self'",
   "script-src 'self'",
   "style-src 'self' 'unsafe-inline'",
-  "img-src 'self' data:",
+  "img-src 'self' data: blob:",
+  "media-src 'self' blob:",
   "font-src 'self'",
   "connect-src 'self' ws: wss:",
   "object-src 'none'",
   "base-uri 'self'",
   "form-action 'self'",
   "frame-ancestors 'none'",
-  "frame-src 'self'",
+  // Files preview mints blob: URLs for PDF iframes, images, and A/V.
+  "frame-src 'self' blob:",
 ].join("; ");
 
 /**
@@ -27,13 +29,14 @@ export const CONSOLE_VITE_DEV_CSP: string = [
   "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
+  "media-src 'self' blob:",
   "font-src 'self'",
   "connect-src 'self' ws: wss: http://127.0.0.1:* ws://127.0.0.1:*",
   "object-src 'none'",
   "base-uri 'self'",
   "form-action 'self'",
   "frame-ancestors 'none'",
-  "frame-src 'self'",
+  "frame-src 'self' blob:",
 ].join("; ");
 
 /** CSP for sandboxed plugin panel iframes (no operator session reach). */