okengine 0.14.1 → 0.16.0

package/src/console/ui-next/src/features/units/lib/contract-input.test.ts

@@ -3,7 +3,7 @@
  */
 
 import { describe, expect, test } from "bun:test";
-import { splitContractInput } from "./contract-input.ts";
+import { pickSeedFields, splitCallApiInput, splitContractInput } from "./contract-input.ts";
 import { fieldsFromSchema } from "./fields-from-schema.ts";
 
 const LIST_IN = fieldsFromSchema({
@@ -45,3 +45,208 @@ describe("splitContractInput", () => {
     expect(split.fields.map((f) => f.name)).toEqual(["title"]);
   });
 });
+
+describe("splitCallApiInput", () => {
+  const idOnly = fieldsFromSchema({
+    type: "object",
+    required: ["id"],
+    properties: { id: { type: "string", minLength: 1 } },
+  });
+  const list = LIST_IN;
+  const nestedList = fieldsFromSchema({
+    type: "object",
+    required: ["id"],
+    properties: {
+      id: { type: "string", minLength: 1 },
+      q: { type: "string" },
+      limit: { type: "integer" },
+    },
+  });
+  const create = fieldsFromSchema({
+    type: "object",
+    required: ["title"],
+    properties: { title: { type: "string" }, spaceKey: { type: "string" } },
+  });
+  const assign = fieldsFromSchema({
+    type: "object",
+    required: ["id", "assigneeEmail"],
+    properties: { id: { type: "string" }, assigneeEmail: { type: "string" } },
+  });
+  const patch = fieldsFromSchema({
+    type: "object",
+    required: ["id"],
+    properties: {
+      id: { type: "string" },
+      title: { type: "string" },
+      status: { type: "string" },
+    },
+  });
+  const putDraft = fieldsFromSchema({
+    type: "object",
+    required: ["id", "title"],
+    properties: { id: { type: "string" }, title: { type: "string" }, body: { type: "string" } },
+  });
+  const search = fieldsFromSchema({
+    type: "object",
+    required: ["q"],
+    properties: { q: { type: "string" }, limit: { type: "integer" } },
+  });
+
+  const cases: readonly {
+    readonly name: string;
+    readonly method: string;
+    readonly pathParams: readonly string[];
+    readonly fields: ReturnType<typeof fieldsFromSchema>;
+    readonly path: readonly string[];
+    readonly query: readonly string[];
+    readonly body: readonly string[];
+  }[] = [
+    {
+      name: "GET tasks.get",
+      method: "GET",
+      pathParams: ["id"],
+      fields: idOnly,
+      path: ["id"],
+      query: [],
+      body: [],
+    },
+    {
+      name: "GET tasks.list",
+      method: "GET",
+      pathParams: [],
+      fields: list,
+      path: [],
+      query: ["q", "teamKey", "limit", "offset", "cursor", "orderBy", "order"],
+      body: [],
+    },
+    {
+      name: "GET comments.list /tasks/:id/comments",
+      method: "GET",
+      pathParams: ["id"],
+      fields: nestedList,
+      path: ["id"],
+      query: ["q", "limit"],
+      body: [],
+    },
+    {
+      name: "HEAD main.health",
+      method: "HEAD",
+      pathParams: [],
+      fields: [],
+      path: [],
+      query: [],
+      body: [],
+    },
+    {
+      name: "DELETE tasks.delete",
+      method: "DELETE",
+      pathParams: ["id"],
+      fields: idOnly,
+      path: ["id"],
+      query: [],
+      body: [],
+    },
+    {
+      name: "POST tasks.create",
+      method: "POST",
+      pathParams: [],
+      fields: create,
+      path: [],
+      query: [],
+      body: ["title", "spaceKey"],
+    },
+    {
+      name: "POST tasks.assign /tasks/:id/assign",
+      method: "POST",
+      pathParams: ["id"],
+      fields: assign,
+      path: ["id"],
+      query: [],
+      body: ["assigneeEmail"],
+    },
+    {
+      name: "POST tasks.archive path-only",
+      method: "POST",
+      pathParams: ["id"],
+      fields: idOnly,
+      path: ["id"],
+      query: [],
+      body: [],
+    },
+    {
+      name: "PATCH tasks.update",
+      method: "PATCH",
+      pathParams: ["id"],
+      fields: patch,
+      path: ["id"],
+      query: [],
+      body: ["title", "status"],
+    },
+    {
+      name: "PUT drafts.save",
+      method: "PUT",
+      pathParams: ["id"],
+      fields: putDraft,
+      path: ["id"],
+      query: [],
+      body: ["title", "body"],
+    },
+    {
+      name: "QUERY search.query",
+      method: "QUERY",
+      pathParams: [],
+      fields: search,
+      path: [],
+      query: [],
+      body: ["q", "limit"],
+    },
+    {
+      name: "OPTIONS leftover stays body",
+      method: "OPTIONS",
+      pathParams: [],
+      fields: search,
+      path: [],
+      query: [],
+      body: ["q", "limit"],
+    },
+  ];
+
+  for (const row of cases) {
+    test(row.name, () => {
+      const split = splitCallApiInput(row.fields, {
+        http: true,
+        method: row.method,
+        pathParams: row.pathParams,
+      });
+      expect(split.path).toEqual([...row.path]);
+      expect(split.query.map((f) => f.name)).toEqual([...row.query]);
+      expect(split.body.map((f) => f.name)).toEqual([...row.body]);
+    });
+  }
+
+  test("non-HTTP keeps the full input as body", () => {
+    const split = splitCallApiInput(idOnly);
+    expect(split.path).toEqual([]);
+    expect(split.query).toEqual([]);
+    expect(split.body.map((f) => f.name)).toEqual(["id"]);
+  });
+
+  test("Signal / CDC / Call-only never grow Path params from an id field", () => {
+    for (const kind of ["signal", "cdc", "internal"] as const) {
+      const split = splitCallApiInput(idOnly, { http: false, method: kind });
+      expect(split.path).toEqual([]);
+      expect(split.query).toEqual([]);
+      expect(split.body.map((f) => f.name)).toEqual(["id"]);
+    }
+  });
+});
+
+describe("pickSeedFields", () => {
+  test("keeps only named section keys", () => {
+    const title = fieldsFromSchema({
+      type: "object",
+      properties: { title: { type: "string" } },
+    });
+    expect(pickSeedFields({ id: "x", title: "n" }, title)).toEqual({ title: "n" });
+  });
+});

package/src/console/ui-next/src/features/units/lib/contract-input.ts

@@ -2,6 +2,7 @@
  * Split flow input into query/path parameters vs body / filter fields.
  */
 
+import { httpMethodHasBody } from "@/features/flows/traces/http-method.ts";
 import type { FormField } from "./fields-from-schema.ts";
 
 /** List / page / sort keys — query parameters, not resource fields. */
@@ -66,3 +67,57 @@ function pathParamField(name: string): FormField {
     required: true,
   };
 }
+
+/** Call API request sections — path vs query vs JSON body. */
+export type CallApiInputSplit = {
+  readonly path: readonly string[];
+  readonly query: readonly FormField[];
+  readonly body: readonly FormField[];
+};
+
+/**
+ * Partition `flow.in` the way the typed client puts fields on the wire.
+ *
+ * Path tokens never appear in query or body. `GET` / `HEAD` / `DELETE`
+ * leftover fields are query. Other HTTP verbs and non-HTTP triggers keep a
+ * JSON body (minus path tokens).
+ *
+ * @param input - `flow.in` fields
+ * @param options - Route tokens + HTTP method
+ */
+export function splitCallApiInput(
+  input: readonly FormField[],
+  options: {
+    readonly pathParams?: readonly string[];
+    readonly method?: string | null;
+    readonly http?: boolean;
+  } = {},
+): CallApiInputSplit {
+  const pathParams = options.pathParams ?? [];
+  const pathSet = new Set(pathParams);
+  if (options.http !== true) {
+    return { path: [], query: [], body: input };
+  }
+  const leftover = input.filter((field) => !pathSet.has(field.name));
+  if (!httpMethodHasBody(options.method)) {
+    return { path: pathParams, query: leftover, body: [] };
+  }
+  return { path: pathParams, query: [], body: leftover };
+}
+
+/**
+ * Keep schema seed keys that belong to a Call API section.
+ *
+ * @param seed - Full `flow.in` seed
+ * @param fields - Section fields
+ */
+export function pickSeedFields(
+  seed: Record<string, unknown>,
+  fields: readonly FormField[],
+): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const field of fields) {
+    if (Object.hasOwn(seed, field.name)) out[field.name] = seed[field.name];
+  }
+  return out;
+}

package/src/console/ui-next/src/features/vault/lib/types.ts

@@ -110,5 +110,5 @@ export interface VaultRotateMasterResult {
   readonly kekVersion: number;
   readonly remaining: number;
   readonly masterKey: string | null;
-  readonly at: number;
+  readonly at: string;
 }

package/src/console/ui-next/src/lib/document-meta.test.ts

@@ -25,6 +25,7 @@ describe("consoleDocumentTitle", () => {
       `Observability · ${CONSOLE_DOCUMENT_TITLE}`,
     );
     expect(consoleDocumentTitle("/vault")).toBe(`Vault · ${CONSOLE_DOCUMENT_TITLE}`);
+    expect(consoleDocumentTitle("/access")).toBe(`Access · ${CONSOLE_DOCUMENT_TITLE}`);
     expect(consoleDocumentTitle("/monitoring")).toBe(`Observability · ${CONSOLE_DOCUMENT_TITLE}`);
   });
 

package/src/console/ui-next/src/lib/document-meta.ts

@@ -7,7 +7,7 @@ export const CONSOLE_DOCUMENT_TITLE = "okengine Console";
 
 /** Operator-facing `meta name="description"` / Open Graph copy. */
 export const CONSOLE_DOCUMENT_DESCRIPTION =
-  "Operator Console for okengine — Flows, Store, Observability, and Vault.";
+  "Operator Console for okengine — Flows, Store, Observability, Vault, and Access.";
 
 const PAGE_TITLES: Record<string, string> = {
   "/overview": "Overview",
@@ -15,6 +15,7 @@ const PAGE_TITLES: Record<string, string> = {
   "/store": "Store",
   "/observability": "Observability",
   "/vault": "Vault",
+  "/access": "Access",
   "/monitoring": "Observability",
 };
 

package/src/console/ui-next/src/lib/last-module-search.test.ts

@@ -12,6 +12,7 @@ describe("last-module-search", () => {
     expect(isConsoleModulePath("/overview")).toBe(true);
     expect(isConsoleModulePath("/flows")).toBe(true);
     expect(isConsoleModulePath("/observability")).toBe(true);
+    expect(isConsoleModulePath("/access")).toBe(true);
     expect(isConsoleModulePath("/monitoring")).toBe(false);
     expect(isConsoleModulePath("/units")).toBe(false);
     expect(isConsoleModulePath("/")).toBe(false);

package/src/console/ui-next/src/lib/last-module-search.ts

@@ -1,6 +1,6 @@
 /**
  * Remember each Console module's last URL search so sidebar hops
- * restore Overview / Flows / Store / Observability / Vault instead of wiping them.
+ * restore Overview / Flows / Store / Observability / Vault / Access instead of wiping them.
  */
 
 /** Authenticated Console modules that own URL search. */
@@ -10,6 +10,7 @@ export const CONSOLE_MODULE_PATHS = [
   "/store",
   "/observability",
   "/vault",
+  "/access",
 ] as const;
 
 /** Pathname for a Console module. */

package/src/console/ui-next/src/lib/shortcut.test.ts

@@ -21,6 +21,7 @@ describe("consoleShortcut", () => {
     expect(consoleShortcut("store")).toEqual(modChord("3"));
     expect(consoleShortcut("observability")).toEqual(modChord("4"));
     expect(consoleShortcut("vault")).toEqual(modChord("5"));
+    expect(consoleShortcut("access")).toEqual(modChord("6"));
   });
 
   test("digits map to module paths", () => {
@@ -29,6 +30,7 @@ describe("consoleShortcut", () => {
     expect(MODULE_DIGIT_PATH["3"]).toBe("/store");
     expect(MODULE_DIGIT_PATH["4"]).toBe("/observability");
     expect(MODULE_DIGIT_PATH["5"]).toBe("/vault");
+    expect(MODULE_DIGIT_PATH["6"]).toBe("/access");
   });
 });
 

package/src/console/ui-next/src/lib/shortcut.ts

@@ -63,6 +63,7 @@ export type ConsoleShortcutId =
   | "flows"
   | "store"
   | "vault"
+  | "access"
   | "observability";
 
 const MODULE_DIGIT: Readonly<
@@ -73,6 +74,7 @@ const MODULE_DIGIT: Readonly<
   store: "3",
   observability: "4",
   vault: "5",
+  access: "6",
 };
 
 /**
@@ -94,6 +96,7 @@ export const MODULE_DIGIT_PATH: Readonly<Record<string, ConsoleModulePath>> = {
   "3": "/store",
   "4": "/observability",
   "5": "/vault",
+  "6": "/access",
 };
 
 /**

package/src/console/ui-next/src/router.tsx

@@ -1,6 +1,6 @@
 /**
  * Console router — code-based TanStack Router (Vite SPA).
- * Pre-auth `/` and authenticated shell `/overview` | `/flows` | `/store` | `/vault` | `/observability`.
+ * Pre-auth `/` and authenticated shell `/overview` | `/flows` | `/store` | `/vault` | `/access` | `/observability`.
  * `/monitoring` is a one-shot search-preserving redirect to `/observability`.
  * Authenticated pages are `lazyRouteComponent` so Vite splits them out of the entry.
  * Any other path is a 404 — no legacy rewrites.
@@ -30,6 +30,7 @@ import { validateStoreSearch } from "./features/store/state/store-selection.ts";
 import { validateUnitsSearch } from "./features/units/state/units-selection.ts";
 import { validateObservabilitySearch } from "./features/observability/state/observability-selection.ts";
 import { validateVaultSearch } from "./features/vault/state/vault-selection.ts";
+import { validateAccessSearch } from "./features/access/state/access-selection.ts";
 import { DocumentTitle } from "./components/document-title.tsx";
 import { ShellLayout } from "./components/shell/shell-layout.tsx";
 
@@ -120,6 +121,13 @@ const vaultRoute = createRoute({
   component: lazyRouteComponent(() => import("./features/vault/vault-page.tsx"), "VaultPage"),
 });
 
+const accessRoute = createRoute({
+  getParentRoute: () => authenticatedRoute,
+  path: "/access",
+  validateSearch: validateAccessSearch,
+  component: lazyRouteComponent(() => import("./features/access/access-page.tsx"), "AccessPage"),
+});
+
 const observabilityRoute = createRoute({
   getParentRoute: () => authenticatedRoute,
   path: "/observability",
@@ -146,6 +154,7 @@ const routeTree = rootRoute.addChildren([
     flowsRoute,
     storeRoute,
     vaultRoute,
+    accessRoute,
     observabilityRoute,
     monitoringRedirectRoute,
   ]),

package/src/console/ui-next/ui-next-seed-app-schema.ts

@@ -7,6 +7,7 @@
 import { AUTH_TABLES } from "../../auth/tables.ts";
 import { resolveAuthSchema } from "../../auth/schema.ts";
 import type { DeclaredColumn, Table } from "../../manifest/types.ts";
+import { KEEL_LADDER_GRANTS, KEEL_SCOPES } from "../server/dev-identities.ts";
 
 const PII_COLUMNS = new Set([
   "email",
@@ -163,9 +164,63 @@ export const UI_NEXT_SEED_APP_SYSTEM_TABLES: Record<string, Table> = {
 const NOW = 1_723_622_400_000;
 const LATER = NOW + 30 * 24 * 60 * 60 * 1000;
 
-const PEOPLE = [
-  { id: "user_demo", email: "demo@example.com", name: "Demo User", status: "active" },
-  { id: "user_member", email: "member@example.com", name: "Member", status: "active" },
+/** Ten-rung owner → guest ladder (demo + member keep historic ids). */
+const LADDER = [
+  {
+    id: "user_demo",
+    email: "demo@example.com",
+    name: "Demo User",
+    status: "active",
+    role: "owner",
+  },
+  { id: "user_admin", email: "admin@example.com", name: "Admin", status: "active", role: "admin" },
+  {
+    id: "user_workspace",
+    email: "workspace@example.com",
+    name: "Workspace Admin",
+    status: "active",
+    role: "workspace_admin",
+  },
+  {
+    id: "user_pm",
+    email: "pm@example.com",
+    name: "Project Manager",
+    status: "active",
+    role: "project_manager",
+  },
+  { id: "user_lead", email: "lead@example.com", name: "Lead", status: "active", role: "lead" },
+  {
+    id: "user_dev",
+    email: "developer@example.com",
+    name: "Developer",
+    status: "active",
+    role: "developer",
+  },
+  {
+    id: "user_writer",
+    email: "writer@example.com",
+    name: "Contributor",
+    status: "active",
+    role: "contributor",
+  },
+  {
+    id: "user_member",
+    email: "member@example.com",
+    name: "Member",
+    status: "active",
+    role: "member",
+  },
+  {
+    id: "user_commenter",
+    email: "commenter@example.com",
+    name: "Commenter",
+    status: "active",
+    role: "commenter",
+  },
+  { id: "user_guest", email: "guest@example.com", name: "Guest", status: "active", role: "guest" },
+] as const;
+
+const STORY = [
   { id: "idn_aria", email: "aria@keel.dev", name: "Aria Chen", status: "active" },
   { id: "idn_ben", email: "ben@keel.dev", name: "Ben Okonkwo", status: "active" },
   { id: "idn_cai", email: "cai@keel.dev", name: "Cai Moreno", status: "active" },
@@ -185,6 +240,8 @@ const PEOPLE = [
   { id: "idn_zio", email: "zio@keel.dev", name: "Zio Hart", status: "active" },
 ] as const;
 
+const PEOPLE = [...LADDER, ...STORY];
+
 /**
  * Seeded rows for app-plane system tables (never secret values).
  */
@@ -209,49 +266,43 @@ export const UI_NEXT_SEED_APP_SYSTEM_ROWS: Readonly<Record<string, readonly obje
     updated_at: NOW,
   })),
   [AUTH_TABLES.identityRoles]: [
-    ...PEOPLE.map((p) => ({
+    ...LADDER.filter((p) => p.role !== "guest").map((p) => ({
+      id: `ir_${p.id}_${p.role}`,
+      identity_id: p.id,
+      role_id: `role_${p.role}`,
+    })),
+    ...STORY.map((p) => ({
       id: `ir_${p.id}_member`,
       identity_id: p.id,
       role_id: "role_member",
     })),
-    { id: "ir_idn_aria_staff", identity_id: "idn_aria", role_id: "role_staff" },
-    { id: "ir_user_demo_staff", identity_id: "user_demo", role_id: "role_staff" },
-  ],
-  [AUTH_TABLES.roles]: [
-    { id: "role_member", name: "member", plane: "user", description: "Signed-in workspace member" },
-    { id: "role_staff", name: "staff", plane: "user", description: "May accept triage" },
-    {
-      id: "role_issue_write",
-      name: "issue:write",
-      plane: "user",
-      description: "May create and update issues",
-    },
-    {
-      id: "role_team_admin",
-      name: "team:admin",
-      plane: "user",
-      description: "May create teams and close cycles",
-    },
-  ],
-  [AUTH_TABLES.roleGrants]: [
-    { id: "rg_1", role_id: "role_member", action: "member" },
-    { id: "rg_2", role_id: "role_staff", action: "member" },
-    { id: "rg_3", role_id: "role_staff", action: "triage:accept" },
-    { id: "rg_4", role_id: "role_issue_write", action: "issue:write" },
-    { id: "rg_5", role_id: "role_issue_write", action: "project:admin" },
-    { id: "rg_6", role_id: "role_issue_write", action: "comment:write" },
-    { id: "rg_7", role_id: "role_issue_write", action: "files:write" },
-    { id: "rg_8", role_id: "role_team_admin", action: "team:admin" },
-    { id: "rg_9", role_id: "role_team_admin", action: "member:admin" },
-    { id: "rg_10", role_id: "role_team_admin", action: "webhook:admin" },
+    { id: "ir_idn_aria_pm", identity_id: "idn_aria", role_id: "role_project_manager" },
   ],
+  [AUTH_TABLES.roles]: Object.keys(KEEL_LADDER_GRANTS).map((role) => ({
+    id: `role_${role}`,
+    name: role,
+    plane: "user",
+    description:
+      role === "owner"
+        ? "Full workspace authorization"
+        : role === "guest"
+          ? "Least authorization — no write scopes"
+          : `Keel ${role.replaceAll("_", " ")}`,
+  })),
+  [AUTH_TABLES.roleGrants]: Object.entries(KEEL_LADDER_GRANTS).flatMap(([role, actions]) =>
+    actions.map((action, i) => ({
+      id: `rg_${role}_${i + 1}`,
+      role_id: `role_${role}`,
+      action,
+    })),
+  ),
   [AUTH_TABLES.apiKeys]: [
     {
       id: "key_keel_ci",
       plane: "user",
       hash: "sha256$keel_ci",
       name: "Keel CI",
-      scopes: "member,issue:write",
+      scopes: "member,task:write",
       expires_at: null,
       created_at: NOW,
       last_used_at: NOW - 3_600_000,
@@ -279,7 +330,7 @@ export const UI_NEXT_SEED_APP_SYSTEM_ROWS: Readonly<Record<string, readonly obje
       created_at: NOW,
       expires_at: LATER,
       last_active_at: NOW,
-      scopes: "member,issue:write",
+      scopes: KEEL_LADDER_GRANTS.project_manager.join(","),
       audience: "oke-app",
     },
     {
@@ -291,7 +342,7 @@ export const UI_NEXT_SEED_APP_SYSTEM_ROWS: Readonly<Record<string, readonly obje
       created_at: NOW,
       expires_at: LATER,
       last_active_at: NOW,
-      scopes: "member,issue:write",
+      scopes: KEEL_SCOPES.join(","),
       audience: "oke-app",
     },
   ],