okengine 0.15.2 → 0.17.0

package/src/console/ui-next/ui-next-seed-store.ts

@@ -41,6 +41,20 @@ const SEED_SPACES = [
 ] as const;
 
 const SEED_MEMBERS = [
+  {
+    id: "mem_demo",
+    space_id: "space_eng",
+    name: "Demo User",
+    email: "demo@example.com",
+    role: "owner",
+  },
+  {
+    id: "mem_admin",
+    space_id: "space_eng",
+    name: "Avery Cole",
+    email: "admin@keel.dev",
+    role: "admin",
+  },
   {
     id: "mem_aria",
     space_id: "space_eng",
@@ -48,6 +62,13 @@ const SEED_MEMBERS = [
     email: "aria@keel.dev",
     role: "project_manager",
   },
+  {
+    id: "mem_lead",
+    space_id: "space_eng",
+    name: "Jules Hart",
+    email: "jules@keel.dev",
+    role: "lead",
+  },
   {
     id: "mem_ben",
     space_id: "space_eng",
@@ -55,6 +76,13 @@ const SEED_MEMBERS = [
     email: "ben@keel.dev",
     role: "developer",
   },
+  {
+    id: "mem_eli",
+    space_id: "space_eng",
+    name: "Eli Park",
+    email: "eli@keel.dev",
+    role: "contributor",
+  },
   {
     id: "mem_cai",
     space_id: "space_des",
@@ -62,6 +90,20 @@ const SEED_MEMBERS = [
     email: "cai@keel.dev",
     role: "member",
   },
+  {
+    id: "mem_member",
+    space_id: "space_des",
+    name: "Member",
+    email: "member@example.com",
+    role: "member",
+  },
+  {
+    id: "mem_commenter",
+    space_id: "space_gtm",
+    name: "Kit Rowe",
+    email: "kit@keel.dev",
+    role: "commenter",
+  },
   {
     id: "mem_dia",
     space_id: "space_gtm",
@@ -69,13 +111,6 @@ const SEED_MEMBERS = [
     email: "dia@keel.dev",
     role: "guest",
   },
-  {
-    id: "mem_eli",
-    space_id: "space_eng",
-    name: "Eli Park",
-    email: "eli@keel.dev",
-    role: "developer",
-  },
 ] as const;
 
 const SEED_GOALS = [
@@ -640,14 +675,7 @@ function generateKeelVolume(): {
     email: `${p.id}@keel.dev`,
     role: "member",
   }));
-  const emails = [
-    "aria@keel.dev",
-    "ben@keel.dev",
-    "cai@keel.dev",
-    "dia@keel.dev",
-    "eli@keel.dev",
-    ...members.map((m) => m.email),
-  ];
+  const emails = [...SEED_MEMBERS.map((m) => m.email), ...members.map((m) => m.email)];
 
   const projects = Array.from({ length: GENERATED.projects }, (_, i) => ({
     id: `proj_g_${String(i + 1).padStart(2, "0")}`,

package/src/console/xss.gate.test.ts

@@ -21,6 +21,7 @@ const FEATURES_ROOT = `${UI_ROOT}/features`;
  * already covers it; the list makes coverage explicit in CI output.
  */
 export const CONSOLE_UI_FEATURE_DIRS = [
+  "access",
   "auth",
   "flows",
   "not-found",

package/src/drivers/index.ts

@@ -40,6 +40,8 @@ export type {
   SignalDriverId,
   SignalDriver,
   SignalBus,
+  LiveEvent,
+  LiveSubscribeOptions,
   SignalMessage,
   SignalEmitOptions,
   SignalFailureReason,

package/src/drivers/journal-postgres.ts

@@ -36,6 +36,7 @@ interface JournalDbRow {
   lease_expires_at: number | null;
   created_at: number;
   updated_at: number;
+  tenant: string | null;
 }
 
 /** Minimal SQL + transaction surface for the postgres journal store. */
@@ -151,6 +152,9 @@ function rowToRun(row: Record<string, unknown>): JournalRun {
   if (r.locked_by !== null && r.locked_by !== undefined) run.lockedBy = String(r.locked_by);
   const leaseExpiresAt = numOrNull(r.lease_expires_at);
   if (leaseExpiresAt !== null) run.leaseExpiresAt = leaseExpiresAt;
+  if (r.tenant !== null && r.tenant !== undefined && String(r.tenant).length > 0) {
+    run.tenant = String(r.tenant);
+  }
   return run;
 }
 
@@ -168,6 +172,7 @@ function runToParams(run: JournalRun): unknown[] {
     run.leaseExpiresAt ?? null,
     run.createdAt,
     run.updatedAt,
+    run.tenant ?? null,
   ];
 }
 
@@ -184,8 +189,10 @@ async function ensureSchema(sql: PostgresJournalSql): Promise<void> {
     locked_by TEXT,
     lease_expires_at BIGINT,
     created_at BIGINT NOT NULL,
-    updated_at BIGINT NOT NULL
+    updated_at BIGINT NOT NULL,
+    tenant TEXT
   )`);
+  await sql.exec(`ALTER TABLE oke_journal_runs ADD COLUMN IF NOT EXISTS tenant TEXT`);
   await sql.exec(
     `CREATE INDEX IF NOT EXISTS oke_journal_runs_wake ON oke_journal_runs (status, wake_at)`,
   );
@@ -308,7 +315,8 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
       const text = sql.trim();
       const state = view();
 
-      if (/^CREATE\s+(TABLE|INDEX)/i.test(text)) return { changes: 0 };
+      if (/^CREATE\s+(TABLE|INDEX)/i.test(text) || /^ALTER\s+TABLE/i.test(text))
+        return { changes: 0 };
 
       const upsert =
         /^INSERT\s+INTO\s+oke_journal_runs\s*\(([^)]+)\)\s*VALUES\s*\(([^)]+)\)\s*ON\s+CONFLICT\s*\(\s*id\s*\)\s*DO\s+UPDATE\s+SET\s+.+$/i.exec(
@@ -337,6 +345,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
               : Number(record.lease_expires_at),
           created_at: Number(record.created_at ?? 0),
           updated_at: Number(record.updated_at ?? 0),
+          tenant: (record.tenant as string | null) ?? null,
         };
         const idx = state.rows.findIndex((r) => r.id === next.id);
         if (idx >= 0) state.rows[idx] = next;
@@ -423,7 +432,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
   return api;
 }
 
-const UPSERT_SQL = `INSERT INTO oke_journal_runs (id, flow, input, status, entries, wake_at, error, output, locked_by, lease_expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET flow = EXCLUDED.flow, input = EXCLUDED.input, status = EXCLUDED.status, entries = EXCLUDED.entries, wake_at = EXCLUDED.wake_at, error = EXCLUDED.error, output = EXCLUDED.output, locked_by = EXCLUDED.locked_by, lease_expires_at = EXCLUDED.lease_expires_at, created_at = EXCLUDED.created_at, updated_at = EXCLUDED.updated_at`;
+const UPSERT_SQL = `INSERT INTO oke_journal_runs (id, flow, input, status, entries, wake_at, error, output, locked_by, lease_expires_at, created_at, updated_at, tenant) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET flow = EXCLUDED.flow, input = EXCLUDED.input, status = EXCLUDED.status, entries = EXCLUDED.entries, wake_at = EXCLUDED.wake_at, error = EXCLUDED.error, output = EXCLUDED.output, locked_by = EXCLUDED.locked_by, lease_expires_at = EXCLUDED.lease_expires_at, created_at = EXCLUDED.created_at, updated_at = EXCLUDED.updated_at, tenant = EXCLUDED.tenant`;
 
 /** Postgres journal store with run-level lease coordination. */
 export type PostgresJournalStore = JournalStore &

package/src/drivers/pg-rls.ts

@@ -3,6 +3,8 @@
  * Drizzle emit, and Gate identity helpers (`oke.gate` / `oke.user` / `oke.has_scope`).
  */
 
+import { lazyRequire } from "../kernel/lazy-require.ts";
+
 /** Policy command (`FOR`). */
 export type SqlPolicyCommand = "ALL" | "SELECT" | "INSERT" | "UPDATE" | "DELETE";
 
@@ -49,6 +51,11 @@ export type RlsIdentity = {
   readonly gate: string;
   readonly userId: string;
   readonly scopes: readonly string[];
+  /**
+   * When set, the prelude stamps `oke.tenant` (fourth GUC).
+   * Omit entirely when tenancy is off so the prelude stays three params.
+   */
+  readonly tenantId?: string;
 };
 
 /**
@@ -98,6 +105,8 @@ LANGUAGE sql STABLE AS $$
     ELSE jsonb_exists(current_setting('oke.scopes', true)::jsonb, p_scope)
   END
 $$`,
+  `CREATE OR REPLACE FUNCTION oke.tenant() RETURNS text
+LANGUAGE sql STABLE AS $$ SELECT current_setting('oke.tenant', true) $$`,
   `DO $oke_rls_role$
 BEGIN
   CREATE ROLE ${OKE_RLS_ROLE} NOSUPERUSER NOBYPASSRLS NOLOGIN;
@@ -122,6 +131,7 @@ $oke_app_search_path$`,
 
 /**
  * All {@link OKE_RLS_HELPER_STATEMENTS} as one script (PGlite `exec` / `oke db push`).
+ * Vault table RLS is attached by {@link installOkeRlsHelpers} after helpers exist.
  */
 export const OKE_RLS_HELPER_SQL = `${OKE_RLS_HELPER_STATEMENTS.join(";\n")};`;
 
@@ -134,6 +144,10 @@ export async function installOkeRlsHelpers(exec: (sql: string) => Promise<unknow
   for (const stmt of OKE_RLS_HELPER_STATEMENTS) {
     await exec(stmt);
   }
+  const { attach } = lazyRequire<{
+    attach: (exec: (sql: string) => Promise<unknown>) => Promise<void>;
+  }>(import.meta.dir, ["pg", "vault", "rls"].join("-"));
+  await attach(exec);
 }
 
 /**
@@ -449,12 +463,22 @@ export type RlsPreludeStatement = {
  * @param identity - Gate principal
  */
 export function buildRlsIdentityPreludeSql(identity: RlsIdentity): readonly RlsPreludeStatement[] {
+  const configs = [
+    "set_config('oke.gate', ?, true)",
+    "set_config('oke.user', ?, true)",
+    "set_config('oke.scopes', ?, true)",
+  ];
+  const params: string[] = [identity.gate, identity.userId, rlsScopesJson(identity.scopes)];
+  if (identity.tenantId !== undefined) {
+    configs.push("set_config('oke.tenant', ?, true)");
+    params.push(identity.tenantId);
+  }
   return [
     { sql: `SET LOCAL ROLE ${OKE_RLS_ROLE}` },
     { sql: "SET LOCAL row_security = on" },
     {
-      sql: `SELECT set_config('oke.gate', ?, true), set_config('oke.user', ?, true), set_config('oke.scopes', ?, true)`,
-      params: [identity.gate, identity.userId, rlsScopesJson(identity.scopes)],
+      sql: `SELECT ${configs.join(", ")}`,
+      params,
     },
   ];
 }

package/src/drivers/pg-vault-rls.ts

@@ -0,0 +1,68 @@
+/**
+ * Tenant RLS on `oke_vault_secrets` — kept off the Store-only `oke()` graph.
+ *
+ * Same `oke.tenant()` helper as domain tables. Loaded from helper install
+ * and Vault DDL via a computed require.
+ */
+
+/** Same role as `OKE_RLS_ROLE` (`oke_app`) — duplicated so this module stays off `pg-rls`. */
+const VAULT_RLS_ROLE = "oke_app";
+
+/**
+ * Built-in Vault ciphertext table. Global rows (`tenant_id IS NULL`) stay
+ * visible; per-tenant rows are isolated. No-op until `oke_vault_secrets`
+ * and `oke.tenant()` exist.
+ *
+ * ENABLE without FORCE: the Vault adapter (table owner) still sees every
+ * row; Console / `oke_app` stamped SQL cannot list another tenant's
+ * ciphertext.
+ */
+export const OKE_VAULT_SECRETS_TENANT_RLS_SQL = `DO $oke_vault_rls$
+BEGIN
+  IF to_regclass('public.oke_vault_secrets') IS NULL THEN
+    RETURN;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = 'oke' AND p.proname = 'tenant' AND p.pronargs = 0
+  ) THEN
+    RETURN;
+  END IF;
+  EXECUTE 'ALTER TABLE oke_vault_secrets ENABLE ROW LEVEL SECURITY';
+  BEGIN
+    EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON oke_vault_secrets TO ${VAULT_RLS_ROLE}';
+  EXCEPTION
+    WHEN undefined_object THEN NULL;
+  END;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = 'public'
+      AND tablename = 'oke_vault_secrets'
+      AND policyname = 'oke_vault_secrets_tenant'
+  ) THEN
+    EXECUTE $p$
+      CREATE POLICY oke_vault_secrets_tenant ON oke_vault_secrets
+        AS PERMISSIVE FOR ALL TO public
+        USING (tenant_id = oke.tenant() OR tenant_id IS NULL)
+        WITH CHECK (tenant_id = oke.tenant() OR tenant_id IS NULL)
+    $p$;
+  END IF;
+END
+$oke_vault_rls$`;
+
+/**
+ * Attach tenant RLS to `oke_vault_secrets` when the table and `oke.tenant()`
+ * are both present. Safe to call from Vault DDL and from helper install
+ * (either boot order).
+ *
+ * @param exec - Statement runner
+ */
+export async function ensureVaultSecretsTenantRls(
+  exec: (sql: string) => Promise<unknown>,
+): Promise<void> {
+  await exec(OKE_VAULT_SECRETS_TENANT_RLS_SQL);
+}
+
+/** Short name for the Store-only `oke()` helper-install path. */
+export { ensureVaultSecretsTenantRls as attach };

package/src/drivers/signal-engine.ts

@@ -12,10 +12,12 @@ import type { SignalDecl } from "../elements/signal/declare.ts";
 import type { SignalDelivery } from "../manifest/types.ts";
 import { DryRunWriteIsolationError, setDryRunMessageId, withDryRun } from "../kernel/dry-run.ts";
 import { OkeError, OKE_ERRORS } from "../kernel/errors.ts";
+import { LIVE_RESUME_GAP } from "../kernel/errors-live-resume.ts";
 import {
   SIGNAL_DEFAULT_LEASE_MS,
   validateSignalEmitPayload,
   type DeadLetter,
+  type LiveEvent,
   type LiveHandler,
   type SignalBus,
   type SignalDiscardOptions,
@@ -30,7 +32,10 @@ import {
   type SignalStats,
   type SignalTransaction,
   type SignalUnsubscribe,
+  type LiveSubscribeOptions,
 } from "./signal-types.ts";
+import { createLiveIterable } from "./signal-live-iter.ts";
+import { liveIdsToPrune, skipAfterId } from "./signal-retention.ts";
 
 /** Internal mutable message. */
 interface MutMessage {
@@ -313,26 +318,68 @@ export async function createSignalEngine(
     };
   }
 
-  async function live(signal: string, handler: LiveHandler): Promise<SignalUnsubscribe> {
+  function live(signal: string, opts?: LiveSubscribeOptions): AsyncIterable<LiveEvent> {
     const decl = requireDecl(signal);
     if (decl.delivery !== "live") {
       throw new Error(`signal "${signal}" is not delivery: "live"`);
     }
-    let set = liveHandlers.get(signal);
-    if (!set) {
-      set = new Set();
-      liveHandlers.set(signal, set);
-    }
-    set.add(handler);
-    // Replay retained live messages to late subscribers.
-    for (const m of messages) {
-      if (m.signal === signal && m.delivery === "live") {
-        await handler(m.payload);
+    const afterId = opts?.afterId;
+    return createLiveIterable((emit) => {
+      pruneLive(signal);
+      const history: LiveEvent[] = [];
+      for (const m of messages) {
+        if (m.signal === signal && m.delivery === "live") {
+          history.push({ id: m.id, payload: m.payload });
+        }
+      }
+      const skipped = skipAfterId(history, afterId);
+      if (afterId !== undefined && afterId.length > 0 && !skipped.found) {
+        throw new OkeError(LIVE_RESUME_GAP, { signal, afterId });
+      }
+      let set = liveHandlers.get(signal);
+      if (!set) {
+        set = new Set();
+        liveHandlers.set(signal, set);
       }
+      const handler: LiveHandler = (event) => {
+        emit(event);
+      };
+      set.add(handler);
+      for (const event of skipped.rest) {
+        emit(event);
+      }
+      return () => {
+        set.delete(handler);
+      };
+    });
+  }
+
+  async function checkLiveResume(signal: string, afterId: string): Promise<void> {
+    requireDecl(signal);
+    pruneLive(signal);
+    const found = messages.some(
+      (m) => m.signal === signal && m.delivery === "live" && m.id === afterId,
+    );
+    if (!found) {
+      throw new OkeError(LIVE_RESUME_GAP, { signal, afterId });
+    }
+  }
+
+  function pruneLive(signal: string): void {
+    const decl = signals.get(signal);
+    const drop = liveIdsToPrune(
+      messages
+        .filter((m) => m.signal === signal && m.delivery === "live")
+        .map((m) => ({ id: m.id, createdAt: m.createdAt })),
+      decl?.retention,
+      now(),
+    );
+    if (drop.length === 0) return;
+    const dropSet = new Set(drop);
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i]!;
+      if (m.delivery === "live" && dropSet.has(m.id)) messages.splice(i, 1);
     }
-    return () => {
-      set!.delete(handler);
-    };
   }
 
   function toPublic(m: MutMessage): SignalMessage {
@@ -469,8 +516,9 @@ export async function createSignalEngine(
       if (m.delivery !== "live" || m.status !== "pending") continue;
       const handlers = liveHandlers.get(m.signal);
       if (handlers && handlers.size > 0) {
+        const event: LiveEvent = { id: m.id, payload: m.payload };
         for (const h of handlers) {
-          await h(m.payload);
+          await h(event);
         }
       }
       pushLive(m.signal, m.payload);
@@ -478,6 +526,11 @@ export async function createSignalEngine(
       noteDelivered();
       progress = true;
     }
+    const touched = new Set<string>();
+    for (const m of messages) {
+      if (m.delivery === "live") touched.add(m.signal);
+    }
+    for (const name of touched) pruneLive(name);
     return progress;
   }
 
@@ -717,6 +770,7 @@ export async function createSignalEngine(
     begin,
     subscribe,
     live,
+    checkLiveResume,
     drain,
     deadLetters,
     inspect,

package/src/drivers/signal-live-iter.ts

@@ -0,0 +1,65 @@
+/**
+ * Callback-set → {@link AsyncIterable} adapter for {@link SignalBus.live}.
+ */
+
+import type { LiveEvent } from "./signal-types.ts";
+
+/**
+ * Turn a live subscriber (replay-then-push) into an async iterable.
+ *
+ * `start` must register `emit` and replay retained events into it before
+ * resolving; `drain` later pushes new events through the same `emit`.
+ *
+ * @param start - Register + replay; return unsubscribe
+ */
+export function createLiveIterable(
+  start: (emit: (event: LiveEvent) => void) => (() => void) | Promise<() => void>,
+): AsyncIterable<LiveEvent> {
+  return {
+    [Symbol.asyncIterator]() {
+      const queue: LiveEvent[] = [];
+      let notify: (() => void) | undefined;
+      let finished = false;
+      let unsub: (() => void) | undefined;
+      let started: Promise<void> | undefined;
+
+      const ensure = (): Promise<void> => {
+        if (started) return started;
+        const emit = (event: LiveEvent): void => {
+          queue.push(event);
+          notify?.();
+        };
+        const result = start(emit);
+        if (typeof result === "function") {
+          unsub = result;
+          started = Promise.resolve();
+          return started;
+        }
+        started = result.then((fn) => {
+          unsub = fn;
+        });
+        return started;
+      };
+
+      return {
+        async next() {
+          await ensure();
+          for (;;) {
+            const nextEvent = queue.shift();
+            if (nextEvent !== undefined) return { done: false, value: nextEvent };
+            if (finished) return { done: true, value: undefined };
+            await new Promise<void>((resolve) => {
+              notify = resolve;
+            });
+          }
+        },
+        async return() {
+          finished = true;
+          unsub?.();
+          notify?.();
+          return { done: true, value: undefined };
+        },
+      };
+    },
+  };
+}

package/src/drivers/signal-nats.ts

@@ -108,7 +108,8 @@ export async function openNatsSignal(options: SignalOpenOptions): Promise<Signal
       };
     },
     subscribe: (signal, subscriberId, handler) => outbox.subscribe(signal, subscriberId, handler),
-    live: (signal, handler) => outbox.live(signal, handler),
+    live: (signal, opts) => outbox.live(signal, opts),
+    checkLiveResume: (signal, afterId) => outbox.checkLiveResume(signal, afterId),
     drain: () => outbox.drain(),
     deadLetters: (s) => outbox.deadLetters(s),
     inspect: (s) => outbox.inspect(s),