okengine 0.16.0 → 0.17.0

package/src/console/ui-next/src/features/units/lib/unit-tree.test.ts

@@ -63,7 +63,11 @@ const TREE: readonly UnitGroup[] = [
     }),
   ]),
   group("orders", [
-    row("orders.onPlaced", { trigger: { signal: "order-placed" }, live: true }, "once"),
+    row("orders.onPlaced", { trigger: { signal: "order-placed" } }, "once"),
+    row("orders.events", {
+      trigger: { http: { method: "GET", path: "/orders/:orderId/events" } },
+      live: "order-status",
+    }),
     row("orders.sync", { trigger: { cdc: { table: "orders" } }, plane: "operator" }),
     row("orders.helper", {}),
   ]),
@@ -100,14 +104,19 @@ describe("filterUnitsAdvanced", () => {
     const operators = filterUnitsAdvanced(TREE, { planes: ["operator"] });
     expect(flowIds(operators)).toEqual(["billing.reconcile", "orders.sync"]);
     const users = filterUnitsAdvanced(TREE, { planes: ["user"] });
-    expect(flowIds(users)).toEqual(["billing.charge", "orders.onPlaced", "orders.helper"]);
+    expect(flowIds(users)).toEqual([
+      "billing.charge",
+      "orders.onPlaced",
+      "orders.events",
+      "orders.helper",
+    ]);
   });
 
   test("durable / live flags keep only flagged flows", () => {
     expect(flowIds(filterUnitsAdvanced(TREE, { durableOnly: true }))).toEqual([
       "billing.reconcile",
     ]);
-    expect(flowIds(filterUnitsAdvanced(TREE, { liveOnly: true }))).toEqual(["orders.onPlaced"]);
+    expect(flowIds(filterUnitsAdvanced(TREE, { liveOnly: true }))).toEqual(["orders.events"]);
   });
 
   test("facet dimensions AND together", () => {
@@ -218,8 +227,9 @@ describe("bandUnitTree", () => {
   test("returns only populated trigger kind bands", () => {
     const bands = bandUnitTree(TREE);
     expect(bands.map((b) => b.id)).toEqual(["http", "signal", "cron", "cdc", "internal"]);
-    expect(bands[0]!.groups.map((g) => g.unit)).toEqual(["billing"]);
+    expect(bands[0]!.groups.map((g) => g.unit)).toEqual(["billing", "orders"]);
     expect(bands[0]!.groups[0]!.flows.map((f) => f.id)).toEqual(["billing.charge"]);
+    expect(bands[0]!.groups[1]!.flows.map((f) => f.id)).toEqual(["orders.events"]);
     expect(bands[1]!.groups.map((g) => g.unit)).toEqual(["orders"]);
     expect(bands[1]!.groups[0]!.flows.map((f) => f.id)).toEqual(["orders.onPlaced"]);
     expect(bands[2]!.groups.map((g) => g.unit)).toEqual(["billing"]);
@@ -254,6 +264,7 @@ describe("bandUnitTree", () => {
     expect(unitTreeOpenKeys(bands)).toEqual([
       "band:http",
       "unit:http:billing",
+      "unit:http:orders",
       "band:signal",
       "unit:signal:orders",
       "band:cron",

package/src/console/ui-next/ui-next-seed-manifest-surface.ts

@@ -81,7 +81,7 @@ function httpFlow(spec: {
   path: string;
   gates?: readonly string[];
   plane?: "user" | "operator";
-  live?: boolean;
+  live?: string;
   durable?: boolean;
   cache?: boolean | string;
   in?: JsonSchema;
@@ -94,7 +94,7 @@ function httpFlow(spec: {
     trigger: { http: { method: spec.method, path: spec.path } },
     plane: spec.plane ?? "user",
     ...(spec.gates ? { gates: [...spec.gates] } : {}),
-    ...(spec.live ? { live: true } : {}),
+    ...(spec.live ? { live: spec.live } : {}),
     ...(spec.durable ? { durable: true } : {}),
     ...(spec.cache !== undefined ? { cache: spec.cache } : {}),
     ...(spec.in ? { in: spec.in } : {}),
@@ -118,7 +118,6 @@ function crud(spec: {
   readGates?: readonly string[];
   writeGates?: readonly string[];
   skip?: readonly ("list" | "get" | "create" | "update" | "delete")[];
-  liveList?: boolean;
   createIn?: JsonSchema;
   updateIn?: JsonSchema;
   createEmits?: readonly string[];
@@ -133,7 +132,6 @@ function crud(spec: {
       method: "GET",
       path: spec.collection,
       gates: read,
-      live: spec.liveList,
       in: KEEL_LIST_IN,
       out: KEEL_LIST_OUT,
       effects: { reads: [spec.table] },
@@ -365,7 +363,6 @@ export const KEEL_SURFACE_FLOWS: Record<string, Flow> = {
     readGates: MEMBER,
     writeGates: COMMENT_WRITE,
     skip: ["create"],
-    liveList: true,
     updateIn: COMMENT_IN,
     sourceDir: "src/flows/comments",
   }),
@@ -386,7 +383,6 @@ export const KEEL_SURFACE_FLOWS: Record<string, Flow> = {
     readGates: MEMBER,
     writeGates: PROJECT_ADMIN,
     skip: ["create"],
-    liveList: true,
     sourceDir: "src/flows/projects",
   }),
   "projects.archive": httpFlow({
@@ -491,7 +487,6 @@ export const KEEL_SURFACE_FLOWS: Record<string, Flow> = {
     item: "/spaces/:id",
     readGates: MEMBER,
     writeGates: PROJECT_ADMIN,
-    liveList: true,
     createIn: {
       type: "object",
       required: ["key", "name"],
@@ -610,7 +605,6 @@ export const KEEL_SURFACE_FLOWS: Record<string, Flow> = {
     readGates: MEMBER,
     writeGates: MEMBER,
     skip: ["create"],
-    liveList: true,
     sourceDir: "src/flows/inbox",
   }),
 
@@ -618,7 +612,6 @@ export const KEEL_SURFACE_FLOWS: Record<string, Flow> = {
     method: "GET",
     path: "/me/tasks",
     gates: MEMBER,
-    live: true,
     in: KEEL_LIST_IN,
     out: KEEL_LIST_OUT,
     effects: { reads: ["sql:tasks", "sql:task_assignees"] },

package/src/console/ui-next/ui-next-seed-manifest.ts

@@ -114,7 +114,6 @@ export const UI_NEXT_SEEDED_MANIFEST: Manifest = {
     },
     "tasks.list": {
       trigger: { http: { method: "GET", path: "/tasks" } },
-      live: true,
       plane: "user",
       gates: ["member"],
       in: KEEL_LIST_IN,

package/src/drivers/index.ts

@@ -40,6 +40,8 @@ export type {
   SignalDriverId,
   SignalDriver,
   SignalBus,
+  LiveEvent,
+  LiveSubscribeOptions,
   SignalMessage,
   SignalEmitOptions,
   SignalFailureReason,

package/src/drivers/journal-postgres.ts

@@ -36,6 +36,7 @@ interface JournalDbRow {
   lease_expires_at: number | null;
   created_at: number;
   updated_at: number;
+  tenant: string | null;
 }
 
 /** Minimal SQL + transaction surface for the postgres journal store. */
@@ -151,6 +152,9 @@ function rowToRun(row: Record<string, unknown>): JournalRun {
   if (r.locked_by !== null && r.locked_by !== undefined) run.lockedBy = String(r.locked_by);
   const leaseExpiresAt = numOrNull(r.lease_expires_at);
   if (leaseExpiresAt !== null) run.leaseExpiresAt = leaseExpiresAt;
+  if (r.tenant !== null && r.tenant !== undefined && String(r.tenant).length > 0) {
+    run.tenant = String(r.tenant);
+  }
   return run;
 }
 
@@ -168,6 +172,7 @@ function runToParams(run: JournalRun): unknown[] {
     run.leaseExpiresAt ?? null,
     run.createdAt,
     run.updatedAt,
+    run.tenant ?? null,
   ];
 }
 
@@ -184,8 +189,10 @@ async function ensureSchema(sql: PostgresJournalSql): Promise<void> {
     locked_by TEXT,
     lease_expires_at BIGINT,
     created_at BIGINT NOT NULL,
-    updated_at BIGINT NOT NULL
+    updated_at BIGINT NOT NULL,
+    tenant TEXT
   )`);
+  await sql.exec(`ALTER TABLE oke_journal_runs ADD COLUMN IF NOT EXISTS tenant TEXT`);
   await sql.exec(
     `CREATE INDEX IF NOT EXISTS oke_journal_runs_wake ON oke_journal_runs (status, wake_at)`,
   );
@@ -308,7 +315,8 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
       const text = sql.trim();
       const state = view();
 
-      if (/^CREATE\s+(TABLE|INDEX)/i.test(text)) return { changes: 0 };
+      if (/^CREATE\s+(TABLE|INDEX)/i.test(text) || /^ALTER\s+TABLE/i.test(text))
+        return { changes: 0 };
 
       const upsert =
         /^INSERT\s+INTO\s+oke_journal_runs\s*\(([^)]+)\)\s*VALUES\s*\(([^)]+)\)\s*ON\s+CONFLICT\s*\(\s*id\s*\)\s*DO\s+UPDATE\s+SET\s+.+$/i.exec(
@@ -337,6 +345,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
               : Number(record.lease_expires_at),
           created_at: Number(record.created_at ?? 0),
           updated_at: Number(record.updated_at ?? 0),
+          tenant: (record.tenant as string | null) ?? null,
         };
         const idx = state.rows.findIndex((r) => r.id === next.id);
         if (idx >= 0) state.rows[idx] = next;
@@ -423,7 +432,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
   return api;
 }
 
-const UPSERT_SQL = `INSERT INTO oke_journal_runs (id, flow, input, status, entries, wake_at, error, output, locked_by, lease_expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET flow = EXCLUDED.flow, input = EXCLUDED.input, status = EXCLUDED.status, entries = EXCLUDED.entries, wake_at = EXCLUDED.wake_at, error = EXCLUDED.error, output = EXCLUDED.output, locked_by = EXCLUDED.locked_by, lease_expires_at = EXCLUDED.lease_expires_at, created_at = EXCLUDED.created_at, updated_at = EXCLUDED.updated_at`;
+const UPSERT_SQL = `INSERT INTO oke_journal_runs (id, flow, input, status, entries, wake_at, error, output, locked_by, lease_expires_at, created_at, updated_at, tenant) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET flow = EXCLUDED.flow, input = EXCLUDED.input, status = EXCLUDED.status, entries = EXCLUDED.entries, wake_at = EXCLUDED.wake_at, error = EXCLUDED.error, output = EXCLUDED.output, locked_by = EXCLUDED.locked_by, lease_expires_at = EXCLUDED.lease_expires_at, created_at = EXCLUDED.created_at, updated_at = EXCLUDED.updated_at, tenant = EXCLUDED.tenant`;
 
 /** Postgres journal store with run-level lease coordination. */
 export type PostgresJournalStore = JournalStore &

package/src/drivers/pg-rls.ts

@@ -3,6 +3,8 @@
  * Drizzle emit, and Gate identity helpers (`oke.gate` / `oke.user` / `oke.has_scope`).
  */
 
+import { lazyRequire } from "../kernel/lazy-require.ts";
+
 /** Policy command (`FOR`). */
 export type SqlPolicyCommand = "ALL" | "SELECT" | "INSERT" | "UPDATE" | "DELETE";
 
@@ -49,6 +51,11 @@ export type RlsIdentity = {
   readonly gate: string;
   readonly userId: string;
   readonly scopes: readonly string[];
+  /**
+   * When set, the prelude stamps `oke.tenant` (fourth GUC).
+   * Omit entirely when tenancy is off so the prelude stays three params.
+   */
+  readonly tenantId?: string;
 };
 
 /**
@@ -98,6 +105,8 @@ LANGUAGE sql STABLE AS $$
     ELSE jsonb_exists(current_setting('oke.scopes', true)::jsonb, p_scope)
   END
 $$`,
+  `CREATE OR REPLACE FUNCTION oke.tenant() RETURNS text
+LANGUAGE sql STABLE AS $$ SELECT current_setting('oke.tenant', true) $$`,
   `DO $oke_rls_role$
 BEGIN
   CREATE ROLE ${OKE_RLS_ROLE} NOSUPERUSER NOBYPASSRLS NOLOGIN;
@@ -122,6 +131,7 @@ $oke_app_search_path$`,
 
 /**
  * All {@link OKE_RLS_HELPER_STATEMENTS} as one script (PGlite `exec` / `oke db push`).
+ * Vault table RLS is attached by {@link installOkeRlsHelpers} after helpers exist.
  */
 export const OKE_RLS_HELPER_SQL = `${OKE_RLS_HELPER_STATEMENTS.join(";\n")};`;
 
@@ -134,6 +144,10 @@ export async function installOkeRlsHelpers(exec: (sql: string) => Promise<unknow
   for (const stmt of OKE_RLS_HELPER_STATEMENTS) {
     await exec(stmt);
   }
+  const { attach } = lazyRequire<{
+    attach: (exec: (sql: string) => Promise<unknown>) => Promise<void>;
+  }>(import.meta.dir, ["pg", "vault", "rls"].join("-"));
+  await attach(exec);
 }
 
 /**
@@ -449,12 +463,22 @@ export type RlsPreludeStatement = {
  * @param identity - Gate principal
  */
 export function buildRlsIdentityPreludeSql(identity: RlsIdentity): readonly RlsPreludeStatement[] {
+  const configs = [
+    "set_config('oke.gate', ?, true)",
+    "set_config('oke.user', ?, true)",
+    "set_config('oke.scopes', ?, true)",
+  ];
+  const params: string[] = [identity.gate, identity.userId, rlsScopesJson(identity.scopes)];
+  if (identity.tenantId !== undefined) {
+    configs.push("set_config('oke.tenant', ?, true)");
+    params.push(identity.tenantId);
+  }
   return [
     { sql: `SET LOCAL ROLE ${OKE_RLS_ROLE}` },
     { sql: "SET LOCAL row_security = on" },
     {
-      sql: `SELECT set_config('oke.gate', ?, true), set_config('oke.user', ?, true), set_config('oke.scopes', ?, true)`,
-      params: [identity.gate, identity.userId, rlsScopesJson(identity.scopes)],
+      sql: `SELECT ${configs.join(", ")}`,
+      params,
     },
   ];
 }

package/src/drivers/pg-vault-rls.ts

@@ -0,0 +1,68 @@
+/**
+ * Tenant RLS on `oke_vault_secrets` — kept off the Store-only `oke()` graph.
+ *
+ * Same `oke.tenant()` helper as domain tables. Loaded from helper install
+ * and Vault DDL via a computed require.
+ */
+
+/** Same role as `OKE_RLS_ROLE` (`oke_app`) — duplicated so this module stays off `pg-rls`. */
+const VAULT_RLS_ROLE = "oke_app";
+
+/**
+ * Built-in Vault ciphertext table. Global rows (`tenant_id IS NULL`) stay
+ * visible; per-tenant rows are isolated. No-op until `oke_vault_secrets`
+ * and `oke.tenant()` exist.
+ *
+ * ENABLE without FORCE: the Vault adapter (table owner) still sees every
+ * row; Console / `oke_app` stamped SQL cannot list another tenant's
+ * ciphertext.
+ */
+export const OKE_VAULT_SECRETS_TENANT_RLS_SQL = `DO $oke_vault_rls$
+BEGIN
+  IF to_regclass('public.oke_vault_secrets') IS NULL THEN
+    RETURN;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = 'oke' AND p.proname = 'tenant' AND p.pronargs = 0
+  ) THEN
+    RETURN;
+  END IF;
+  EXECUTE 'ALTER TABLE oke_vault_secrets ENABLE ROW LEVEL SECURITY';
+  BEGIN
+    EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON oke_vault_secrets TO ${VAULT_RLS_ROLE}';
+  EXCEPTION
+    WHEN undefined_object THEN NULL;
+  END;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = 'public'
+      AND tablename = 'oke_vault_secrets'
+      AND policyname = 'oke_vault_secrets_tenant'
+  ) THEN
+    EXECUTE $p$
+      CREATE POLICY oke_vault_secrets_tenant ON oke_vault_secrets
+        AS PERMISSIVE FOR ALL TO public
+        USING (tenant_id = oke.tenant() OR tenant_id IS NULL)
+        WITH CHECK (tenant_id = oke.tenant() OR tenant_id IS NULL)
+    $p$;
+  END IF;
+END
+$oke_vault_rls$`;
+
+/**
+ * Attach tenant RLS to `oke_vault_secrets` when the table and `oke.tenant()`
+ * are both present. Safe to call from Vault DDL and from helper install
+ * (either boot order).
+ *
+ * @param exec - Statement runner
+ */
+export async function ensureVaultSecretsTenantRls(
+  exec: (sql: string) => Promise<unknown>,
+): Promise<void> {
+  await exec(OKE_VAULT_SECRETS_TENANT_RLS_SQL);
+}
+
+/** Short name for the Store-only `oke()` helper-install path. */
+export { ensureVaultSecretsTenantRls as attach };

package/src/drivers/signal-engine.ts

@@ -12,10 +12,12 @@ import type { SignalDecl } from "../elements/signal/declare.ts";
 import type { SignalDelivery } from "../manifest/types.ts";
 import { DryRunWriteIsolationError, setDryRunMessageId, withDryRun } from "../kernel/dry-run.ts";
 import { OkeError, OKE_ERRORS } from "../kernel/errors.ts";
+import { LIVE_RESUME_GAP } from "../kernel/errors-live-resume.ts";
 import {
   SIGNAL_DEFAULT_LEASE_MS,
   validateSignalEmitPayload,
   type DeadLetter,
+  type LiveEvent,
   type LiveHandler,
   type SignalBus,
   type SignalDiscardOptions,
@@ -30,7 +32,10 @@ import {
   type SignalStats,
   type SignalTransaction,
   type SignalUnsubscribe,
+  type LiveSubscribeOptions,
 } from "./signal-types.ts";
+import { createLiveIterable } from "./signal-live-iter.ts";
+import { liveIdsToPrune, skipAfterId } from "./signal-retention.ts";
 
 /** Internal mutable message. */
 interface MutMessage {
@@ -313,26 +318,68 @@ export async function createSignalEngine(
     };
   }
 
-  async function live(signal: string, handler: LiveHandler): Promise<SignalUnsubscribe> {
+  function live(signal: string, opts?: LiveSubscribeOptions): AsyncIterable<LiveEvent> {
     const decl = requireDecl(signal);
     if (decl.delivery !== "live") {
       throw new Error(`signal "${signal}" is not delivery: "live"`);
     }
-    let set = liveHandlers.get(signal);
-    if (!set) {
-      set = new Set();
-      liveHandlers.set(signal, set);
-    }
-    set.add(handler);
-    // Replay retained live messages to late subscribers.
-    for (const m of messages) {
-      if (m.signal === signal && m.delivery === "live") {
-        await handler(m.payload);
+    const afterId = opts?.afterId;
+    return createLiveIterable((emit) => {
+      pruneLive(signal);
+      const history: LiveEvent[] = [];
+      for (const m of messages) {
+        if (m.signal === signal && m.delivery === "live") {
+          history.push({ id: m.id, payload: m.payload });
+        }
+      }
+      const skipped = skipAfterId(history, afterId);
+      if (afterId !== undefined && afterId.length > 0 && !skipped.found) {
+        throw new OkeError(LIVE_RESUME_GAP, { signal, afterId });
+      }
+      let set = liveHandlers.get(signal);
+      if (!set) {
+        set = new Set();
+        liveHandlers.set(signal, set);
       }
+      const handler: LiveHandler = (event) => {
+        emit(event);
+      };
+      set.add(handler);
+      for (const event of skipped.rest) {
+        emit(event);
+      }
+      return () => {
+        set.delete(handler);
+      };
+    });
+  }
+
+  async function checkLiveResume(signal: string, afterId: string): Promise<void> {
+    requireDecl(signal);
+    pruneLive(signal);
+    const found = messages.some(
+      (m) => m.signal === signal && m.delivery === "live" && m.id === afterId,
+    );
+    if (!found) {
+      throw new OkeError(LIVE_RESUME_GAP, { signal, afterId });
+    }
+  }
+
+  function pruneLive(signal: string): void {
+    const decl = signals.get(signal);
+    const drop = liveIdsToPrune(
+      messages
+        .filter((m) => m.signal === signal && m.delivery === "live")
+        .map((m) => ({ id: m.id, createdAt: m.createdAt })),
+      decl?.retention,
+      now(),
+    );
+    if (drop.length === 0) return;
+    const dropSet = new Set(drop);
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i]!;
+      if (m.delivery === "live" && dropSet.has(m.id)) messages.splice(i, 1);
     }
-    return () => {
-      set!.delete(handler);
-    };
   }
 
   function toPublic(m: MutMessage): SignalMessage {
@@ -469,8 +516,9 @@ export async function createSignalEngine(
       if (m.delivery !== "live" || m.status !== "pending") continue;
       const handlers = liveHandlers.get(m.signal);
       if (handlers && handlers.size > 0) {
+        const event: LiveEvent = { id: m.id, payload: m.payload };
         for (const h of handlers) {
-          await h(m.payload);
+          await h(event);
         }
       }
       pushLive(m.signal, m.payload);
@@ -478,6 +526,11 @@ export async function createSignalEngine(
       noteDelivered();
       progress = true;
     }
+    const touched = new Set<string>();
+    for (const m of messages) {
+      if (m.delivery === "live") touched.add(m.signal);
+    }
+    for (const name of touched) pruneLive(name);
     return progress;
   }
 
@@ -717,6 +770,7 @@ export async function createSignalEngine(
     begin,
     subscribe,
     live,
+    checkLiveResume,
     drain,
     deadLetters,
     inspect,

package/src/drivers/signal-live-iter.ts

@@ -0,0 +1,65 @@
+/**
+ * Callback-set → {@link AsyncIterable} adapter for {@link SignalBus.live}.
+ */
+
+import type { LiveEvent } from "./signal-types.ts";
+
+/**
+ * Turn a live subscriber (replay-then-push) into an async iterable.
+ *
+ * `start` must register `emit` and replay retained events into it before
+ * resolving; `drain` later pushes new events through the same `emit`.
+ *
+ * @param start - Register + replay; return unsubscribe
+ */
+export function createLiveIterable(
+  start: (emit: (event: LiveEvent) => void) => (() => void) | Promise<() => void>,
+): AsyncIterable<LiveEvent> {
+  return {
+    [Symbol.asyncIterator]() {
+      const queue: LiveEvent[] = [];
+      let notify: (() => void) | undefined;
+      let finished = false;
+      let unsub: (() => void) | undefined;
+      let started: Promise<void> | undefined;
+
+      const ensure = (): Promise<void> => {
+        if (started) return started;
+        const emit = (event: LiveEvent): void => {
+          queue.push(event);
+          notify?.();
+        };
+        const result = start(emit);
+        if (typeof result === "function") {
+          unsub = result;
+          started = Promise.resolve();
+          return started;
+        }
+        started = result.then((fn) => {
+          unsub = fn;
+        });
+        return started;
+      };
+
+      return {
+        async next() {
+          await ensure();
+          for (;;) {
+            const nextEvent = queue.shift();
+            if (nextEvent !== undefined) return { done: false, value: nextEvent };
+            if (finished) return { done: true, value: undefined };
+            await new Promise<void>((resolve) => {
+              notify = resolve;
+            });
+          }
+        },
+        async return() {
+          finished = true;
+          unsub?.();
+          notify?.();
+          return { done: true, value: undefined };
+        },
+      };
+    },
+  };
+}

package/src/drivers/signal-nats.ts

@@ -108,7 +108,8 @@ export async function openNatsSignal(options: SignalOpenOptions): Promise<Signal
       };
     },
     subscribe: (signal, subscriberId, handler) => outbox.subscribe(signal, subscriberId, handler),
-    live: (signal, handler) => outbox.live(signal, handler),
+    live: (signal, opts) => outbox.live(signal, opts),
+    checkLiveResume: (signal, afterId) => outbox.checkLiveResume(signal, afterId),
     drain: () => outbox.drain(),
     deadLetters: (s) => outbox.deadLetters(s),
     inspect: (s) => outbox.inspect(s),