okengine 0.17.2 → 0.18.3

package/src/plugins/two-factor.ts

@@ -5,6 +5,7 @@
  */
 
 import { constantTimeEqual } from "../auth/constant-time.ts";
+import { IdentityError, ensureUserExists } from "../auth/identity.ts";
 import { issueSessionWithScopes } from "../auth/sessions.ts";
 import { plugin, type PluginDef } from "../kernel/plugin.ts";
 import {
@@ -16,6 +17,7 @@ import {
   createMethodRuntime,
   fail,
   flow,
+  resolveSharedIdentities,
   z,
   type AuthMethodOptions,
 } from "./auth/shared.ts";
@@ -56,6 +58,7 @@ export interface TwoFactorOptions extends AuthMethodOptions {
  */
 export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
   const runtime = createMethodRuntime(opts);
+  const identities = resolveSharedIdentities(opts);
   const factors = opts.factors ?? createTwoFactorStore();
   const issuer = opts.issuer ?? "oke";
 
@@ -70,6 +73,14 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
     do: async (_input, fx) => {
       const userId = fx.auth.userId;
       if (!userId) return fail("AuthFailed", { reason: "unauthenticated" });
+      try {
+        await ensureUserExists(identities, userId, runtime.now());
+      } catch (err) {
+        if (err instanceof IdentityError) {
+          return fail("AuthFailed", { reason: "unauthenticated" });
+        }
+        throw err;
+      }
       const secret = generateBase32Secret(20);
       const recoveryCodes = Array.from({ length: 8 }, () => randomRecoveryCode());
       const recoveryHashes = new Set<string>();

package/src/plugins/username.ts

@@ -4,6 +4,7 @@
 
 import { assertNotBreached, BreachCheckError, type BreachCheckFn } from "../auth/breach-check.ts";
 import { getActiveGateAuthContext } from "../auth/method-context.ts";
+import { IdentityError, linkOrProvision } from "../auth/identity.ts";
 import {
   assertPasswordPolicy,
   PasswordPolicyError,
@@ -21,6 +22,7 @@ import {
   createMethodRuntime,
   fail,
   flow,
+  resolveSharedIdentities,
   z,
   type AuthMethodOptions,
 } from "./auth/shared.ts";
@@ -311,6 +313,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
   const runtime = createMethodRuntime(opts);
   const active = getActiveGateAuthContext();
   const usernames = opts.usernames ?? createUsernameStore();
+  const identities = resolveSharedIdentities(opts);
   const usernamePolicy = opts.usernamePolicy ?? {};
   const passwordPolicy = opts.passwordPolicy ?? active?.passwordPolicy ?? {};
   const passwordHash = opts.password ?? active?.password ?? { algorithm: "argon2id" };
@@ -359,18 +362,34 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
       if (usernames.byUsername.has(key)) {
         return fail("AuthFailed", { reason: "invalid_credentials" });
       }
-      const userId = crypto.randomUUID();
       const passwordHashValue = await crypto.hashPassword(input.password, passwordHash);
+      let user: { id: string };
+      try {
+        user = (
+          await linkOrProvision(identities, {
+            provider: "username",
+            providerAccountId: key,
+            name: key,
+            passwordHash: passwordHashValue,
+            now: runtime.now,
+          })
+        ).user;
+      } catch (err) {
+        if (err instanceof IdentityError) {
+          return fail("AuthFailed", { reason: "invalid_credentials" });
+        }
+        throw err;
+      }
       const row: UsernameRow = {
-        userId,
+        userId: user.id,
         username: key,
         passwordHash: passwordHashValue,
         createdAt: runtime.now(),
       };
       usernames.byUsername.set(key, row);
-      usernames.byUserId.set(userId, row);
+      usernames.byUserId.set(user.id, row);
       const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
-        id: userId,
+        id: user.id,
         plane: "user",
         scopes: [],
       });
@@ -378,7 +397,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
         accessToken: issued.accessToken,
         refreshToken: issued.refreshToken,
         accessExpiresAt: issued.accessExpiresAt,
-        userId,
+        userId: user.id,
       };
     },
   });
@@ -394,8 +413,22 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
       const hash = row?.passwordHash ?? (await dummyHash(crypto));
       const ok = await crypto.verifyPassword(input.password, hash);
       if (!ok || !row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      const userId = row.userId;
+      try {
+        await linkOrProvision(identities, {
+          provider: "username",
+          providerAccountId: key,
+          currentUserId: userId,
+          now: runtime.now,
+        });
+      } catch (err) {
+        if (err instanceof IdentityError) {
+          return fail("AuthFailed", { reason: "invalid_credentials" });
+        }
+        throw err;
+      }
       const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
-        id: row.userId,
+        id: userId,
         plane: "user",
         scopes: [],
       });
@@ -403,7 +436,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
         accessToken: issued.accessToken,
         refreshToken: issued.refreshToken,
         accessExpiresAt: issued.accessExpiresAt,
-        userId: row.userId,
+        userId,
       };
     },
   });

package/src/release/build-lib.ts

@@ -20,6 +20,7 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   { src: "src/kernel-entry.ts", out: "dist/kernel-entry.js" },
   { src: "src/full.ts", out: "dist/full.js" },
   { src: "src/i18n-entry.ts", out: "dist/i18n-entry.js" },
+  { src: "src/testing.ts", out: "dist/testing.js" },
   { src: "src/compiler-entry.ts", out: "dist/compiler-entry.js" },
   { src: "src/journal-entry.ts", out: "dist/journal-entry.js" },
   // Lazy sync chunks — loaded via requirePackageModule / computed require
@@ -44,6 +45,7 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   { src: "src/elements/store/cache.ts", out: "dist/store-cache.js" },
   { src: "src/i18n/messages.ts", out: "dist/messages.js" },
   { src: "src/i18n/failure-message.ts", out: "dist/failure-message.js" },
+  { src: "src/okid.ts", out: "dist/okid.js" },
 ];
 
 /**
@@ -63,7 +65,11 @@ export async function buildLib(): Promise<void> {
       naming: relative(DIST, absOut).replace(/\\/g, "/"),
       target: "bun",
       format: "esm",
-      minify: false,
+      // Non-Bun consumers ship this output; minify keeps `dist/` compact.
+      // Budgets measure a *separate* minified build (measure.ts), but the
+      // published artifact should not ship full-size sources when the compiler
+      // is available to minify at the same cost.
+      minify: true,
       sourcemap: "external",
       external: [...EXPORT_BUILD_EXTERNALS],
       splitting: false,

package/src/release/measure.ts

@@ -66,6 +66,7 @@ const GROUP_HEADINGS: Readonly<Record<BudgetGroup, string>> = {
 /** Docs category → markdown subheading under Plugins. */
 const PLUGIN_CATEGORY_HEADINGS: Readonly<Record<string, string>> = {
   auth: "Auth",
+  oauth: "OAuth",
   security: "Security",
   ops: "Ops",
   perf: "Perf",

package/src/release/official-plugins.ts

@@ -5,7 +5,7 @@
  */
 
 /** Docs / landing category for an official plugin. */
-export type PluginBudgetCategory = "auth" | "security" | "ops" | "perf";
+export type PluginBudgetCategory = "auth" | "oauth" | "security" | "ops" | "perf";
 
 /** One official plugin entry measured as `export:./plugins/<name>`. */
 export type OfficialPluginBudget = {
@@ -20,6 +20,7 @@ export type OfficialPluginBudget = {
 /** Category display order (docs index). */
 export const PLUGIN_BUDGET_CATEGORIES: readonly PluginBudgetCategory[] = [
   "auth",
+  "oauth",
   "security",
   "ops",
   "perf",
@@ -36,6 +37,8 @@ export const OFFICIAL_PLUGIN_BUDGETS: readonly OfficialPluginBudget[] = [
   { name: "otp", file: "otp.ts", category: "auth" },
   { name: "twoFactor", file: "two-factor.ts", category: "auth" },
   { name: "passkey", file: "passkey.ts", category: "auth" },
+  { name: "oauth", file: "oauth.ts", category: "oauth" },
+  { name: "mcpOauth", file: "mcp-oauth.ts", category: "oauth" },
   { name: "headers", file: "headers.ts", category: "security" },
   { name: "cors", file: "cors.ts", category: "security" },
   { name: "csrf", file: "csrf.ts", category: "security" },

package/src/runs/collect.ts

@@ -12,6 +12,7 @@ import type { Fx } from "../kernel/fx.ts";
 import type { Trigger } from "../kernel/triggers.ts";
 import type { FlowPlane } from "../manifest/types.ts";
 import { cacheDimensionOf, type RunTelemetry } from "../kernel/run-telemetry.ts";
+import { okid } from "../okid.ts";
 import type { RunError, WideEvent } from "./types.ts";
 
 /** Inputs for {@link collectWideEvent}. */
@@ -97,7 +98,7 @@ export function collectWideEvent(input: CollectWideEventInput): WideEvent {
   };
 
   return {
-    id: input.id ?? crypto.randomUUID(),
+    id: input.id ?? okid(),
     ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
     flow: input.flow.name,
     ...(input.flow.unit !== undefined ? { unit: input.flow.unit } : {}),

package/src/runs/drivers/files.ts

@@ -12,6 +12,7 @@ import { join, resolve } from "node:path";
 
 import { fsDriver } from "../../drivers/fs.ts";
 import type { FilesBucket } from "../../drivers/types.ts";
+import { okid } from "../../okid.ts";
 import {
   duckPath,
   duckQuery,
@@ -102,7 +103,7 @@ export const filesRunsDriver: RunsDriver = {
           locality === "remote" && remote
             ? { bucket: remote, keyPrefix: remotePrefix }
             : { bucket: local, keyPrefix: "" };
-        const fileId = crypto.randomUUID();
+        const fileId = okid();
         const objectKey = `${target.keyPrefix}${partitionObjectKey(day!, fileId)}`;
         const tmpDir = await mkdtemp(join(tmpdir(), "oke-pq-"));
         const tmp = join(tmpDir, `${fileId}.parquet`);

package/src/test/create-test-app.ts

@@ -44,6 +44,8 @@ export interface TestUser {
   readonly id: string;
   readonly scopes: ReadonlySet<string>;
   readonly verified: boolean;
+  /** Tenant id stamped onto `fx.tenant.id` for scoped calls. */
+  readonly tenantId?: string;
 }
 
 /** Options for {@link TestAuth.loginAs}. */
@@ -52,11 +54,15 @@ export interface LoginAsOptions {
   readonly scopes?: readonly string[];
   readonly verified?: boolean;
   readonly plane?: "user" | "operator";
+  /** Tenant the principal belongs to — stamped onto `fx.tenant.id`. */
+  readonly tenantId?: string;
 }
 
 /** Second argument to test API calls. */
 export interface TestCallOptions {
   readonly as?: TestUser | ResolvedPrincipal;
+  /** Override the tenant stamped for this call (overrides `as.tenantId`). */
+  readonly tenant?: string;
 }
 
 /** Auth surface on the harness. */
@@ -91,10 +97,44 @@ export interface TestCron {
   run(name: string): Promise<boolean>;
 }
 
+/** Live-subscription handlers for {@link TestSignals.subscribeLive}. */
+export interface TestLiveHandlers<T = unknown> {
+  /** Called with each live event payload. */
+  readonly onEvent: (event: T) => void;
+  /** Called when the live stream errors. */
+  readonly onError?: (error: unknown) => void;
+}
+
+/** Unsubscribe handle returned by {@link TestSignals.subscribeLive}. */
+export type TestLiveUnsubscribe = () => void;
+
 /** Signal surface. */
 export interface TestSignals {
   /** Drain the bus until idle (deterministic queued work). */
   drain(): Promise<void>;
+  /**
+   * Subscribe to a `delivery: "live"` signal's event stream.
+   *
+   * @param signal - Signal declaration or name
+   * @param handlers - Event / error handlers
+   * @returns Unsubscribe function
+   */
+  subscribeLive<T = unknown>(
+    signal: SignalDecl | string,
+    handlers: TestLiveHandlers<T>,
+  ): TestLiveUnsubscribe;
+  /**
+   * Resolve once a live event matching `predicate` arrives.
+   *
+   * @param signal - Signal declaration or name
+   * @param predicate - Event filter
+   * @param timeoutMs - Reject after this many ms (default 1000)
+   */
+  waitForLive<T = unknown>(
+    signal: SignalDecl | string,
+    predicate: (event: T) => boolean,
+    timeoutMs?: number,
+  ): Promise<T>;
 }
 
 /** Channel surface. */
@@ -269,6 +309,7 @@ export async function createTestApp<App extends OkeApp>(
         id: opts.id ?? `user_${crypto.randomUUID().slice(0, 8)}`,
         scopes: new Set(opts.scopes ?? []),
         verified: opts.verified ?? true,
+        ...(opts.tenantId !== undefined ? { tenantId: opts.tenantId } : {}),
       };
     },
   };
@@ -306,6 +347,63 @@ export async function createTestApp<App extends OkeApp>(
         const bus = app.bootResult?.signal?.bus;
         if (bus) await bus.drain();
       },
+      subscribeLive(signal, handlers) {
+        const name = typeof signal === "string" ? signal : signal.name;
+        let active = true;
+        const rt = app.bootResult?.signal;
+        void (async () => {
+          const iter = rt?.live(name)[Symbol.asyncIterator]();
+          if (!iter) return;
+          for (;;) {
+            if (!active) {
+              await iter.return?.();
+              return;
+            }
+            const { done, value } = await iter.next();
+            if (done || !active) {
+              await iter.return?.();
+              return;
+            }
+            if (!active) break;
+            try {
+              handlers.onEvent(value.payload as never);
+            } catch (err) {
+              handlers.onError?.(err);
+            }
+          }
+        })();
+        return () => {
+          active = false;
+        };
+      },
+      waitForLive(signal, predicate, timeoutMs) {
+        const name = typeof signal === "string" ? signal : signal.name;
+        return new Promise((resolve, reject) => {
+          let unsubscribe: TestLiveUnsubscribe | undefined;
+          const timer = setTimeout(() => {
+            unsubscribe?.();
+            reject(
+              new Error(
+                `waitForLive: no matching event for "${name}" within ${timeoutMs ?? 1000}ms`,
+              ),
+            );
+          }, timeoutMs ?? 1000);
+          unsubscribe = this.subscribeLive(signal as never, {
+            onEvent: (event: unknown) => {
+              if (predicate(event as never)) {
+                clearTimeout(timer);
+                unsubscribe?.();
+                resolve(event as never);
+              }
+            },
+            onError: (err) => {
+              clearTimeout(timer);
+              unsubscribe?.();
+              reject(err);
+            },
+          });
+        });
+      },
     },
     channels: {
       sent() {
@@ -340,7 +438,10 @@ export async function createTestApp<App extends OkeApp>(
       return events;
     },
     async close() {
-      await app.bootResult?.close();
+      // Prefer `app.stop()` so the process-wide realtime bridge unbinds with
+      // the SQL connections — bare `bootResult.close()` left CDC classifying
+      // against a dead PGLite instance for later tests in the same process.
+      await app.stop();
     },
   };
 
@@ -381,7 +482,7 @@ function createTestApi(app: OkeApp, now: () => number): TestApi {
       };
     }
 
-    const principal = toPrincipal(opts?.as);
+    const principal = toPrincipal(opts?.as, opts?.tenant);
     const httpTrigger = flowDef.triggers.find((t) => t.kind === "http");
     const trigger: Trigger =
       httpTrigger ?? flowDef.triggers[0] ?? ({ kind: "internal" } satisfies InternalTrigger);
@@ -389,6 +490,7 @@ function createTestApi(app: OkeApp, now: () => number): TestApi {
     const result = await app.execute(flowDef, input, trigger, {
       principal,
       auth: principal,
+      ...(principal?.tenantId !== undefined ? { tenant: { id: principal.tenantId } } : {}),
     });
 
     // Keep effects cache warm for t.effects.of after the caller awaits runs().
@@ -533,8 +635,13 @@ function matchRestHeuristic(
   return undefined;
 }
 
-function toPrincipal(as: TestUser | ResolvedPrincipal | undefined): ResolvedPrincipal | undefined {
-  if (!as) return undefined;
+function toPrincipal(
+  as: TestUser | ResolvedPrincipal | undefined,
+  tenantOverride?: string,
+): ResolvedPrincipal | undefined {
+  if (!as) {
+    return tenantOverride ? { tenantId: tenantOverride } : undefined;
+  }
   if ("scopes" in as && as.scopes instanceof Set && "id" in as) {
     const u = as as TestUser;
     return {
@@ -542,9 +649,11 @@ function toPrincipal(as: TestUser | ResolvedPrincipal | undefined): ResolvedPrin
       userId: u.id,
       scopes: u.scopes,
       verified: u.verified,
+      tenantId: tenantOverride ?? u.tenantId,
     };
   }
-  return as as ResolvedPrincipal;
+  const p = as as ResolvedPrincipal;
+  return tenantOverride ? { ...p, tenantId: tenantOverride } : p;
 }
 
 /** @internal re-export fail for harness tests that assert typed denials */

package/src/test/export-bundle.test.ts

@@ -0,0 +1,33 @@
+/**
+ * `okengine/testing` subpath export & core/client bundle isolation.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { measureClientGzipBytes, measureKernelEdgeGzipBytes } from "../release/measure.ts";
+import { CLIENT_BUDGET_BYTES, KERNEL_EDGE_BUDGET_BYTES } from "../release/limits.ts";
+
+describe("testing entrypoint export & bundle isolation", () => {
+  test("package.json exports ./testing and ./test point to the harness entry", () => {
+    const pkg = JSON.parse(
+      readFileSync(resolve(import.meta.dir, "../../package.json"), "utf8"),
+    ) as {
+      exports: Record<string, unknown>;
+    };
+    const testing = pkg.exports["./testing"] as Record<string, string>;
+    expect(testing).toBeDefined();
+    expect(testing.bun).toBe("./src/testing.ts");
+    expect(testing.types).toBe("./src/testing.ts");
+    expect(testing.import).toBe("./dist/testing.js");
+    expect(testing.default).toBe("./dist/testing.js");
+    expect(pkg.exports["./test"]).toBeDefined();
+  });
+
+  test("importing okengine or okengine/http does not pull the test harness into core/client bundles", async () => {
+    const edgeSize = await measureKernelEdgeGzipBytes();
+    const clientSize = await measureClientGzipBytes();
+    expect(edgeSize).toBeLessThan(KERNEL_EDGE_BUDGET_BYTES);
+    expect(clientSize).toBeLessThan(CLIENT_BUDGET_BYTES);
+  });
+});

package/src/test/live-signals.test.ts

@@ -0,0 +1,83 @@
+/**
+ * `createTestApp` deterministic live-signal subscriptions
+ * (`signals.subscribeLive` / `signals.waitForLive`).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { oke } from "../kernel/app.ts";
+import { flow, resetFlowSeq } from "../kernel/flow.ts";
+import { on, resetBindings } from "../kernel/on.ts";
+import { http } from "../kernel/triggers.ts";
+import { signal } from "../elements/signal.ts";
+import { createTestApp } from "./create-test-app.ts";
+
+describe("createTestApp live-signal subscriptions", () => {
+  test("subscribeLive observes deterministic live emits; waitForLive resolves matching payloads", async () => {
+    resetBindings();
+    resetFlowSeq();
+
+    const orderStatus = signal("order-status", {
+      delivery: "live",
+      retention: { maxCount: 10 },
+    });
+
+    on(
+      http.post("/orders/status").public(),
+      flow("orders.updateStatus", {
+        in: z.object({ orderId: z.string(), status: z.string() }),
+        effects: { emits: ["order-status"] },
+        do: async (input, fx) => {
+          await fx.emit(orderStatus, input);
+          return { ok: true };
+        },
+      }),
+    );
+
+    const app = oke({
+      name: "live-signals-app",
+      signals: [orderStatus],
+      env: "test",
+    });
+
+    const t = await createTestApp(app, {
+      signals: [orderStatus],
+    });
+
+    const seen: Array<{ orderId: string; status: string }> = [];
+    const unsubscribe = t.signals.subscribeLive(orderStatus, {
+      onEvent: (event) => {
+        seen.push(event as { orderId: string; status: string });
+      },
+    });
+
+    // Emit 1 — deterministic after drain.
+    const res1 = await t.api.orders!.updateStatus!({ orderId: "o1", status: "placed" });
+    expect(res1.error).toBeNull();
+    await t.signals.drain();
+    expect(seen.map((e) => e.status)).toEqual(["placed"]);
+
+    // Emit 2 — observer updates.
+    await t.api.orders!.updateStatus!({ orderId: "o1", status: "shipped" });
+    await t.signals.drain();
+    expect(seen.map((e) => e.status)).toEqual(["placed", "shipped"]);
+
+    // waitForLive resolves the first payload matching the predicate.
+    const deliveredPromise = t.signals.waitForLive(
+      orderStatus,
+      (event) => (event as { status: string }).status === "delivered",
+    );
+    await t.api.orders!.updateStatus!({ orderId: "o1", status: "delivered" });
+    await t.signals.drain();
+    const delivered = await deliveredPromise;
+    expect((delivered as { status: string }).status).toBe("delivered");
+
+    // Unsubscribe then emit — the subscription must not observe it.
+    unsubscribe();
+    await t.api.orders!.updateStatus!({ orderId: "o2", status: "placed" });
+    await t.signals.drain();
+    expect(seen).toHaveLength(3);
+
+    await t.close();
+  });
+});