okengine 0.14.1 → 0.16.0

package/src/console/server/flows.ts

@@ -27,12 +27,16 @@ import { maskPiiValue, maskWideEventForConsole, piiFieldNamesFromManifest } from
 import { ConsoleRunsQueryError, RUNS_QUERY_PII_GAP, RUNS_QUERY_TIMEOUT_MS } from "./runs-query.ts";
 import { DuckQueryTimeoutError } from "../../runs/duckdb.ts";
 import { ClockResourceNotFoundError, ScheduleNotOverridableError } from "./clock.ts";
+import { isoAt } from "./iso-at.ts";
 import { createFileDiff, emitStructuralDiff } from "./structural.ts";
 import type { ConsoleState } from "./state.ts";
 import { consoleFailureMessage } from "./i18n.ts";
 import { CONSOLE_PASSWORD_POLICY } from "../password-policy.ts";
 import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 import { resolveInvokeAs } from "./invoke-user-flow.ts";
+import { resolveRlsIdentity } from "../../elements/store.ts";
+import type { RlsIdentity } from "../../drivers/pg-rls.ts";
+import { accessUserCeiling } from "./access.ts";
 import { isKnownConsoleSqlGate, StoreFileNotFoundError, tenancyDeclared } from "./store.ts";
 import {
   PG_STAT_STATEMENTS_NOT_CREATED,
@@ -152,7 +156,7 @@ const TracesReplayOut = z.object({
   ok: z.literal(true),
   rootId: z.string(),
   dryRun: z.boolean(),
-  at: z.number(),
+  at: z.string(),
   flow: z.string(),
 });
 
@@ -260,7 +264,7 @@ const SignalsReplayOut = z.object({
       messageId: z.string().optional(),
     }),
   ),
-  at: z.number(),
+  at: z.string(),
 });
 
 const SignalsDiscardIn = z.object({
@@ -273,7 +277,7 @@ const SignalsDiscardIn = z.object({
 const SignalsDiscardOut = z.object({
   ok: z.literal(true),
   discarded: z.number(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ActionPingIn = z.object({
@@ -283,7 +287,7 @@ const ActionPingIn = z.object({
 const ActionPingOut = z.object({
   ok: z.literal(true),
   note: z.string().optional(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StructuralIn = z.object({
@@ -354,6 +358,13 @@ const InvokeOut = z.object({
   durationMs: z.number().optional(),
   peakTier: z.enum(["none", "reads", "writes", "emits", "external", "capabilities"]),
   auditedAt: z.number(),
+  rls: z
+    .object({
+      gate: z.string().nullable(),
+      userId: z.string(),
+      applied: z.boolean(),
+    })
+    .optional(),
 });
 
 const SetupClosed = z.object({ reason: z.string() });
@@ -504,7 +515,7 @@ const ChannelRevealOut = z.object({
   ok: z.literal(true),
   id: z.string(),
   to: z.string(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ChannelSendTestIn = z.object({
@@ -521,7 +532,7 @@ const ChannelSendTestOut = z.object({
   messageId: z.string(),
   status: z.string(),
   chain: z.string(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const VaultNotFound = z.object({
@@ -634,7 +645,7 @@ const ClockRunNowOut = z.object({
   ok: z.literal(true),
   name: z.string(),
   ran: z.boolean(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ClockPauseIn = z.object({ name: z.string().min(1) });
@@ -642,7 +653,7 @@ const ClockPauseOut = z.object({
   ok: z.literal(true),
   name: z.string(),
   status: z.string(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ClockEditIn = z.object({
@@ -656,7 +667,7 @@ const ClockEditOut = z.object({
   name: z.string(),
   effectiveCron: z.string().optional(),
   effectiveEvery: z.string().optional(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const ClockWakeEarlyIn = z.object({ runId: z.string().min(1) });
@@ -665,7 +676,7 @@ const ClockWakeEarlyOut = z.object({
   runId: z.string(),
   wakeAt: z.number(),
   resumed: z.boolean(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const VaultResolutionStepOut = z.object({
@@ -746,7 +757,7 @@ const VaultWriteOut = z.object({
   ok: z.literal(true),
   name: z.string(),
   fingerprint: z.string().nullable(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const VaultAuditRowOut = z.object({
@@ -780,7 +791,7 @@ const VaultRotateMasterOut = z.object({
   kekVersion: z.number(),
   remaining: z.number(),
   masterKey: z.string().nullable(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const AiMetricOut = z.object({
@@ -1154,6 +1165,22 @@ const GatesPowersOut = z.object({
   deniedFlowIds: z.array(z.string()),
 });
 
+const AccessKeyRowOut = z.object({
+  id: z.string(),
+  name: z.string(),
+  plane: z.enum(["user", "operator"]),
+  creatorId: z.string(),
+  creatorScopes: z.array(z.string()),
+  scopes: z.array(z.string()),
+  createdAt: z.number(),
+  lastUsedAt: z.number().nullable(),
+  expiresAt: z.number().nullable(),
+  revokedAt: z.number().nullable(),
+  rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
+  ipAllowlist: z.array(z.string()),
+  unused90d: z.boolean(),
+});
+
 const AccessPlaneSection = z.object({
   plane: z.enum(["user", "operator"]),
   operators: z
@@ -1192,21 +1219,7 @@ const AccessPlaneSection = z.object({
       memberCount: z.number(),
     }),
   ),
-  keys: z.array(
-    z.object({
-      id: z.string(),
-      name: z.string(),
-      plane: z.enum(["user", "operator"]),
-      scopes: z.array(z.string()),
-      createdAt: z.number(),
-      lastUsedAt: z.number().nullable(),
-      expiresAt: z.number().nullable(),
-      revokedAt: z.number().nullable(),
-      rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-      ipAllowlist: z.array(z.string()),
-      unused90d: z.boolean(),
-    }),
-  ),
+  keys: z.array(AccessKeyRowOut),
   invites: z
     .array(
       z.object({
@@ -1226,21 +1239,7 @@ const AccessListOut = z.object({
   operatorPlane: AccessPlaneSection,
   userPlane: AccessPlaneSection,
   hygiene: z.object({
-    unusedKeys: z.array(
-      z.object({
-        id: z.string(),
-        name: z.string(),
-        plane: z.enum(["user", "operator"]),
-        scopes: z.array(z.string()),
-        createdAt: z.number(),
-        lastUsedAt: z.number().nullable(),
-        expiresAt: z.number().nullable(),
-        revokedAt: z.number().nullable(),
-        rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-        ipAllowlist: z.array(z.string()),
-        unused90d: z.boolean(),
-      }),
-    ),
+    unusedKeys: z.array(AccessKeyRowOut),
     neverSignedInOperators: z.array(
       z.object({
         id: z.string(),
@@ -1307,25 +1306,28 @@ const AccessCreateKeyIn = z.object({
   plane: z.enum(["user", "operator"]),
   name: z.string().min(1),
   scopes: z.array(z.string()),
+  /** Required for user-plane keys — issuer whose grants are the ceiling. */
+  creatorUserId: z.string().min(1).optional(),
+  expiresAt: z.number().nullable().optional(),
+  rateLimit: z.object({ max: z.number(), per: z.string() }).nullable().optional(),
+  ipAllowlist: z.array(z.string()).optional(),
+});
+
+const AccessUpdateKeyIn = z.object({
+  keyId: z.string().min(1),
+  name: z.string().min(1).optional(),
+  scopes: z.array(z.string()).optional(),
   expiresAt: z.number().nullable().optional(),
   rateLimit: z.object({ max: z.number(), per: z.string() }).nullable().optional(),
   ipAllowlist: z.array(z.string()).optional(),
 });
 
+const AccessUpdateKeyOut = z.object({
+  key: AccessKeyRowOut,
+});
+
 const AccessCreateKeyOut = z.object({
-  key: z.object({
-    id: z.string(),
-    name: z.string(),
-    plane: z.enum(["user", "operator"]),
-    scopes: z.array(z.string()),
-    createdAt: z.number(),
-    lastUsedAt: z.number().nullable(),
-    expiresAt: z.number().nullable(),
-    revokedAt: z.number().nullable(),
-    rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-    ipAllowlist: z.array(z.string()),
-    unused90d: z.boolean(),
-  }),
+  key: AccessKeyRowOut,
   /** Raw secret — returned exactly once. */
   secret: z.string(),
 });
@@ -1337,19 +1339,7 @@ const AccessRevokeKeyIn = z.object({
 });
 
 const AccessRevokeKeyOut = z.object({
-  key: z.object({
-    id: z.string(),
-    name: z.string(),
-    plane: z.enum(["user", "operator"]),
-    scopes: z.array(z.string()),
-    createdAt: z.number(),
-    lastUsedAt: z.number().nullable(),
-    expiresAt: z.number().nullable(),
-    revokedAt: z.number().nullable(),
-    rateLimit: z.object({ max: z.number(), per: z.string() }).nullable(),
-    ipAllowlist: z.array(z.string()),
-    unused90d: z.boolean(),
-  }),
+  key: AccessKeyRowOut,
   blastRadius: AccessKeyBlastOut,
 });
 
@@ -1422,6 +1412,7 @@ const StoreListOut = z.object({
           piiColumns: z.array(z.string()),
           columnDescriptions: z.record(z.string(), z.string()),
           rls: z.boolean().optional(),
+          rlsPolicyCount: z.number().int().nonnegative().optional(),
         }),
       ),
       replicaLagMs: z.number().nullable(),
@@ -1445,6 +1436,17 @@ const StoreListOut = z.object({
   ),
 });
 
+const StoreRlsAs = {
+  asGate: z.string().min(1).optional(),
+  asUserId: z.string().min(1).optional(),
+};
+
+const StoreRlsOut = z.object({
+  gate: z.string().nullable(),
+  userId: z.string(),
+  applied: z.boolean(),
+});
+
 const StoreQueryIn = z.object({
   ref: z.string().min(1),
   child: z.string().optional(),
@@ -1455,6 +1457,7 @@ const StoreQueryIn = z.object({
   q: z.string().optional(),
   topK: z.number().min(1).max(100).optional(),
   revealPii: z.boolean().optional(),
+  ...StoreRlsAs,
 });
 
 const StoreQueryOut = z.object({
@@ -1483,6 +1486,7 @@ const StoreQueryOut = z.object({
     .optional(),
   masked: z.boolean(),
   routedRole: z.enum(["primary", "replica"]).optional(),
+  rls: StoreRlsOut.optional(),
 });
 
 const StoreRevealIn = z.object({
@@ -1496,7 +1500,7 @@ const StoreRevealIn = z.object({
 const StoreRevealOut = z.object({
   ok: z.literal(true),
   value: z.unknown(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StoreFileGetIn = z.object({
@@ -1527,6 +1531,7 @@ const StoreEditIn = z.object({
   reason: z.string().optional(),
   /** When false/omitted, returns willNotFire without applying. */
   commit: z.boolean().optional(),
+  ...StoreRlsAs,
 });
 
 const StoreEditOut = z.object({
@@ -1540,7 +1545,8 @@ const StoreEditOut = z.object({
       resource: z.string(),
     }),
   ),
-  at: z.number(),
+  at: z.string(),
+  rls: StoreRlsOut.optional(),
 });
 
 const StoreDeleteIn = z.object({
@@ -1556,7 +1562,7 @@ const StoreDeleteIn = z.object({
 const StoreDeleteOut = z.object({
   ok: z.literal(true),
   deleted: z.number(),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StorePurgeIn = z.object({
@@ -1568,7 +1574,7 @@ const StorePurgeIn = z.object({
 const StorePurgeOut = z.object({
   ok: z.literal(true),
   keys: z.array(z.string()),
-  at: z.number(),
+  at: z.string(),
 });
 
 const StoreSqlIn = z.object({
@@ -1578,6 +1584,7 @@ const StoreSqlIn = z.object({
   allowWrite: z.boolean().optional(),
   revealPii: z.boolean().optional(),
   asGate: z.string().min(1).optional(),
+  asUserId: z.string().min(1).optional(),
 });
 
 const StoreSqlOut = z.object({
@@ -1585,7 +1592,9 @@ const StoreSqlOut = z.object({
   masked: z.boolean(),
   routedRole: z.enum(["primary", "replica"]),
   asGate: z.string().nullable(),
+  asUserId: z.string().nullable(),
   gateApplied: z.boolean(),
+  rls: StoreRlsOut.optional(),
 });
 
 const StoreSqlStatsIn = z.object({
@@ -1749,7 +1758,7 @@ const StorePreviewOut = z.object({
       resource: z.string(),
     }),
   ),
-  at: z.number(),
+  at: z.string(),
 });
 
 /**
@@ -1826,6 +1835,7 @@ export function createConsoleBindings(state: ConsoleState): {
       readonly createKey: AnyFlowDef;
       readonly revokeKey: AnyFlowDef;
       readonly rotateKey: AnyFlowDef;
+      readonly updateKey: AnyFlowDef;
       readonly setRoleGrants: AnyFlowDef;
     };
     readonly diff: {
@@ -1899,6 +1909,7 @@ export function createConsoleBindings(state: ConsoleState): {
   const accessCreateKeyFlow = createAccessCreateKey(state);
   const accessRevokeKeyFlow = createAccessRevokeKey(state);
   const accessRotateKeyFlow = createAccessRotateKey(state);
+  const accessUpdateKeyFlow = createAccessUpdateKey(state);
   const accessSetRoleGrantsFlow = createAccessSetRoleGrants(state);
   const diffList = createDiffList(state);
   const pluginsList = createPluginsList(state);
@@ -1961,6 +1972,7 @@ export function createConsoleBindings(state: ConsoleState): {
     bindHttp(http.post("/console/access/keys"), accessCreateKeyFlow),
     bindHttp(http.post("/console/access/keys/revoke"), accessRevokeKeyFlow),
     bindHttp(http.post("/console/access/keys/rotate"), accessRotateKeyFlow),
+    bindHttp(http.post("/console/access/keys/update"), accessUpdateKeyFlow),
     bindHttp(http.post("/console/access/roles/grants"), accessSetRoleGrantsFlow),
     bindHttp(http.get("/console/diff"), diffList),
     bindHttp(http.get("/console/plugins"), pluginsList),
@@ -2030,6 +2042,7 @@ export function createConsoleBindings(state: ConsoleState): {
         createKey: accessCreateKeyFlow,
         revokeKey: accessRevokeKeyFlow,
         rotateKey: accessRotateKeyFlow,
+        updateKey: accessUpdateKeyFlow,
         setRoleGrants: accessSetRoleGrantsFlow,
       },
       diff: { list: diffList },
@@ -2362,7 +2375,7 @@ function createTracesReplay(state: ConsoleState) {
         ok: true as const,
         rootId: input.rootId,
         dryRun,
-        at: Date.now(),
+        at: isoAt(Date.now()),
         flow: root.flow,
       };
     },
@@ -2443,7 +2456,7 @@ function createSignalsDiscard(state: ConsoleState) {
       return {
         ok: true as const,
         discarded: result.discarded,
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -2517,7 +2530,7 @@ async function runSignalReplay(
     dryRun: result.dryRun,
     results: [...result.results],
     wouldHaveFired: [...result.wouldHaveFired],
-    at: state.now(),
+    at: isoAt(state.now()),
   };
 }
 
@@ -2562,7 +2575,7 @@ function createActionPing(state: ConsoleState) {
         operatorId: fx.operator.id,
         note: input.note,
       });
-      return { ok: true as const, note: input.note, at: state.now() };
+      return { ok: true as const, note: input.note, at: isoAt(state.now()) };
     },
   });
 }
@@ -2664,6 +2677,7 @@ function createFlowsInvoke(state: ConsoleState) {
         ...(assumed.bypassGates ? { bypassGates: true } : {}),
         ...(input.reason !== undefined ? { reason: input.reason } : {}),
         ...(input.revealPii === true ? { revealPii: true } : {}),
+        ...(assumed.rls ? { rls: assumed.rls } : {}),
       });
 
       const reveal = input.revealPii === true;
@@ -2716,6 +2730,11 @@ function createFlowsInvoke(state: ConsoleState) {
         ...(host.durationMs !== undefined ? { durationMs: host.durationMs } : {}),
         peakTier,
         auditedAt: state.now(),
+        rls: {
+          gate: assumed.rls?.gate ?? null,
+          userId: assumed.rls?.userId ?? "",
+          applied: assumed.rls !== null,
+        },
       };
     },
   });
@@ -2806,6 +2825,32 @@ function createStoreList(state: ConsoleState) {
   });
 }
 
+function consoleStoreRls(
+  state: ConsoleState,
+  input: { readonly asGate?: string; readonly asUserId?: string },
+):
+  | { readonly ok: true; readonly rls: RlsIdentity | null }
+  | { readonly ok: false; readonly reason: string } {
+  if (input.asGate !== undefined && !isKnownConsoleSqlGate(state.manifest, input.asGate)) {
+    return { ok: false, reason: `unknown gate: ${input.asGate}` };
+  }
+  if (input.asUserId !== undefined) {
+    const identity = state.identities.find((row) => row.id === input.asUserId);
+    if (!identity || identity.status === "disabled") {
+      return { ok: false, reason: `unknown identity: ${input.asUserId}` };
+    }
+  }
+  return {
+    ok: true,
+    rls: resolveRlsIdentity({
+      asGate: input.asGate,
+      asUserId: input.asUserId,
+      identities: state.identities,
+      manifest: state.manifest,
+    }),
+  };
+}
+
 function createStoreQuery(state: ConsoleState) {
   return flow("console.store.query", {
     plane: "operator",
@@ -2824,6 +2869,8 @@ function createStoreQuery(state: ConsoleState) {
           tenant: input.tenant,
         });
       }
+      const assumed = consoleStoreRls(state, input);
+      if (!assumed.ok) return fail("StoreNotFound", { ref: assumed.reason });
       return state.queryStore({
         ref: input.ref as ResourceRef,
         child: input.child,
@@ -2834,6 +2881,9 @@ function createStoreQuery(state: ConsoleState) {
         q: input.q,
         topK: input.topK,
         revealPii: input.revealPii === true,
+        ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+        ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+        ...(assumed.rls ? { rls: assumed.rls } : {}),
       });
     },
   });
@@ -2869,7 +2919,7 @@ function createStoreReveal(state: ConsoleState) {
       return {
         ok: true as const,
         value: row[input.column],
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -2922,6 +2972,14 @@ function createStoreEdit(state: ConsoleState) {
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
       if (tenantFail) return tenantFail;
 
+      const assumed = consoleStoreRls(state, input);
+      if (!assumed.ok) return fail("StoreNotFound", { ref: assumed.reason });
+      const rlsFields = {
+        ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+        ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+        ...(assumed.rls ? { rls: assumed.rls } : {}),
+      };
+
       if (!input.commit) {
         // Return will-not-fire payload without applying — informational confirm.
         const preview = await state.editStore(
@@ -2932,6 +2990,7 @@ function createStoreEdit(state: ConsoleState) {
             id: input.id,
             key: input.key,
             patch: input.patch,
+            ...rlsFields,
           },
           { dryRun: true },
         );
@@ -2941,7 +3000,8 @@ function createStoreEdit(state: ConsoleState) {
           applied: false,
           willNotFire: preview.willNotFire,
           wouldHaveFired: [...preview.wouldHaveFired],
-          at: state.now(),
+          at: isoAt(state.now()),
+          ...(preview.rls ? { rls: preview.rls } : {}),
         };
       }
 
@@ -2962,6 +3022,7 @@ function createStoreEdit(state: ConsoleState) {
           id: input.id,
           key: input.key,
           patch: input.patch,
+          ...rlsFields,
         },
         { dryRun: false },
       );
@@ -2978,7 +3039,8 @@ function createStoreEdit(state: ConsoleState) {
         applied: result.applied,
         willNotFire: result.willNotFire,
         wouldHaveFired: [...result.wouldHaveFired],
-        at: state.now(),
+        at: isoAt(state.now()),
+        ...(result.rls ? { rls: result.rls } : {}),
       };
     },
   });
@@ -3018,7 +3080,7 @@ function createStoreDelete(state: ConsoleState) {
       return {
         ok: true as const,
         deleted: result.deleted,
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -3050,7 +3112,7 @@ function createStorePurgeCache(state: ConsoleState) {
       return {
         ok: true as const,
         keys: [...result.keys],
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -3074,9 +3136,8 @@ function createStoreSql(state: ConsoleState) {
             tenant: input.tenant,
           });
         }
-        if (input.asGate !== undefined && !isKnownConsoleSqlGate(state.manifest, input.asGate)) {
-          return fail("StoreNotFound", { ref: `unknown gate: ${input.asGate}` });
-        }
+        const assumed = consoleStoreRls(state, input);
+        if (!assumed.ok) return fail("StoreNotFound", { ref: assumed.reason });
         if (input.asGate !== undefined) {
           fx.log.info("console.store.sql.asGate", {
             operatorId: fx.operator.id,
@@ -3090,6 +3151,8 @@ function createStoreSql(state: ConsoleState) {
           revealPii: input.revealPii === true,
           tenant: input.tenant,
           ...(input.asGate !== undefined ? { asGate: input.asGate } : {}),
+          ...(input.asUserId !== undefined ? { asUserId: input.asUserId } : {}),
+          ...(assumed.rls ? { rls: assumed.rls } : {}),
         });
         fx.log.info("console.store.sql", {
           operatorId: fx.operator.id,
@@ -3097,6 +3160,7 @@ function createStoreSql(state: ConsoleState) {
           allowWrite: input.allowWrite === true,
           revealPii: input.revealPii === true,
           asGate: input.asGate ?? null,
+          asUserId: input.asUserId ?? null,
           rowCount: result.rows.length,
         });
         return result;
@@ -3312,7 +3376,7 @@ function createStorePreview(state: ConsoleState) {
           dryRun: true as const,
           willNotFire: preview.willNotFire,
           wouldHaveFired: [...preview.wouldHaveFired],
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof DryRunWriteIsolationError) {
@@ -3368,7 +3432,7 @@ function createVaultCreate(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           fingerprint: result.fingerprint,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -3408,7 +3472,7 @@ function createVaultSet(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           fingerprint: result.fingerprint,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return fail("VaultNotFound", {
@@ -3446,7 +3510,7 @@ function createVaultRotate(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           fingerprint: result.fingerprint,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return fail("VaultNotFound", {
@@ -3492,7 +3556,7 @@ function createVaultRotateMaster(state: ConsoleState) {
           kekVersion: result.kekVersion,
           remaining: result.remaining,
           masterKey: result.masterKey,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return mapVaultOperatorError(err);
@@ -3774,6 +3838,46 @@ function actorScopesOf(state: ConsoleState, operatorId: string): string[] {
   return [...new Set([...fromRoles, "console:*"])];
 }
 
+/**
+ * Derive the issuer for a Console-minted key.
+ * Operator-plane: the acting operator. User-plane: required `creatorUserId`.
+ *
+ * @param state - Console state
+ * @param operatorId - Acting operator
+ * @param input - Create payload
+ */
+export function resolveAccessKeyIssuer(
+  state: ConsoleState,
+  operatorId: string,
+  input: { readonly plane: "user" | "operator"; readonly creatorUserId?: string },
+):
+  | { readonly creatorId: string; readonly creatorScopes: readonly string[] }
+  | { readonly error: string } {
+  if (input.plane === "operator") {
+    return { creatorId: operatorId, creatorScopes: actorScopesOf(state, operatorId) };
+  }
+  const userId = input.creatorUserId;
+  if (!userId) {
+    return { error: "creatorUserId is required for user-plane keys" };
+  }
+  const identity = state.identities.find((row) => row.id === userId);
+  const roleIds = [...state.roleMembers.entries()]
+    .filter(([, members]) => members.includes(userId))
+    .map(([id]) => id);
+  if (!identity && roleIds.length === 0) {
+    return { error: `unknown user: ${userId}` };
+  }
+  return {
+    creatorId: userId,
+    creatorScopes: accessUserCeiling({
+      userId,
+      identityScopes: identity?.scopes,
+      roles: state.roles,
+      roleMembers: state.roleMembers,
+    }),
+  };
+}
+
 function createAccessList(state: ConsoleState) {
   return flow("console.access.list", {
     plane: "operator",
@@ -3836,12 +3940,16 @@ function createAccessCreateKey(state: ConsoleState) {
     do: async (input: z.infer<typeof AccessCreateKeyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
+        const issued = resolveAccessKeyIssuer(state, fx.operator.id, input);
+        if ("error" in issued) {
+          return fail("AccessGrantDenied", { reason: issued.error });
+        }
         const created = await state.accessCreateKey({
           plane: input.plane,
           name: input.name,
           scopes: input.scopes,
-          creatorId: fx.operator.id,
-          creatorScopes: actorScopesOf(state, fx.operator.id),
+          creatorId: issued.creatorId,
+          creatorScopes: issued.creatorScopes,
           expiresAt: input.expiresAt,
           rateLimit: input.rateLimit,
           ipAllowlist: input.ipAllowlist,
@@ -3924,6 +4032,33 @@ function createAccessRotateKey(state: ConsoleState) {
   });
 }
 
+function createAccessUpdateKey(state: ConsoleState) {
+  return flow("console.access.updateKey", {
+    plane: "operator",
+    in: AccessUpdateKeyIn,
+    out: AccessUpdateKeyOut,
+    errors: { AuthFailed, AccessKeyNotFound, AccessGrantDenied },
+    do: async (input: z.infer<typeof AccessUpdateKeyIn>, fx) => {
+      if (!fx.operator.id) return fail("AuthFailed", {});
+      try {
+        const key = await state.accessUpdateKey(input);
+        if (!key) {
+          return fail("AccessKeyNotFound", { keyId: input.keyId });
+        }
+        fx.log.info("console.access.updateKey", {
+          keyId: key.id,
+          operatorId: fx.operator.id,
+        });
+        return { key: { ...key } };
+      } catch (err) {
+        return fail("AccessGrantDenied", {
+          reason: err instanceof Error ? err.message : "grant denied",
+        });
+      }
+    },
+  });
+}
+
 function createAccessSetRoleGrants(state: ConsoleState) {
   return flow("console.access.setRoleGrants", {
     plane: "operator",
@@ -4010,7 +4145,7 @@ function createClockRunNow(state: ConsoleState) {
           ok: true as const,
           name: input.name,
           ran: result.ran,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ClockResourceNotFoundError) {
@@ -4040,7 +4175,7 @@ function createClockPause(state: ConsoleState) {
           ok: true as const,
           name: result.name,
           status: result.status,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ClockResourceNotFoundError) {
@@ -4075,7 +4210,7 @@ function createClockEditSchedule(state: ConsoleState) {
           name: result.name,
           effectiveCron: result.effectiveCron,
           effectiveEvery: result.effectiveEvery,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ScheduleNotOverridableError) {
@@ -4110,7 +4245,7 @@ function createClockWakeEarly(state: ConsoleState) {
           runId: result.runId,
           wakeAt: result.wakeAt,
           resumed: result.resumed,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         if (err instanceof ClockResourceNotFoundError) {
@@ -4187,7 +4322,7 @@ function createChannelReveal(state: ConsoleState) {
         ok: true as const,
         id: revealed.id,
         to: revealed.to,
-        at: state.now(),
+        at: isoAt(state.now()),
       };
     },
   });
@@ -4234,7 +4369,7 @@ function createChannelSendTest(state: ConsoleState) {
         });
         return {
           ...result,
-          at: state.now(),
+          at: isoAt(state.now()),
         };
       } catch (err) {
         return fail("ChannelNotFound", {