okengine 0.17.2 → 0.18.4

package/src/kernel/fx.test.ts

@@ -574,6 +574,7 @@ describe("fx — wholesale swap", () => {
       get signal() {
         return new AbortController().signal;
       },
+      rlsIdentity: undefined,
       all(thunks) {
         return Promise.all(thunks.map((t) => t())) as never;
       },

package/src/kernel/fx.ts

@@ -72,6 +72,7 @@ import type { RunsRuntime } from "../runs/runtime.ts";
 import type { RunsRow, WideEvent } from "../runs/types.ts";
 import type { RunWindowStats, SloBreach } from "../runs/window.ts";
 import type { MessageCatalogs } from "../i18n/messages.ts";
+import { okid } from "../okid.ts";
 import { lazyRequire } from "./lazy-require.ts";
 import type { AppMessageKey, MessageValues } from "../i18n/types.ts";
 
@@ -853,6 +854,14 @@ export interface Fx {
    * Outside `all` / `race`, a never-aborted signal.
    */
   readonly signal: AbortSignal;
+  /**
+   * Resolved RLS identity for this invocation (`undefined` when bypassed,
+   * operator-plane, or unauthenticated on an un-gated trigger). The live
+   * query stack subscribes SSE streams under this exact stamp so per-event
+   * visibility re-checks are Postgres-authoritative — identical to what a
+   * read through {@link Fx.store} would see.
+   */
+  readonly rlsIdentity: import("../drivers/pg-rls.ts").RlsIdentity | undefined;
   /**
    * Run thunks in parallel. On first rejection, abort sibling branches and
    * rethrow. Pass thunks (not started Promises) so abort scopes exist first.
@@ -1197,7 +1206,7 @@ export function createFxContext(options: CreateFxOptions): FxContext {
       },
       insert(row: Record<string, unknown>): Promise<{ id: string }> {
         return gated("write", ref, () => {
-          const id = typeof row.id === "string" ? row.id : crypto.randomUUID();
+          const id = typeof row.id === "string" ? row.id : okid();
           table().set(id, { ...row, id });
           return { id };
         });
@@ -2088,7 +2097,7 @@ export function createFxContext(options: CreateFxOptions): FxContext {
     },
     locale,
     id() {
-      return crypto.randomUUID();
+      return okid();
     },
     auth,
     operator,
@@ -2130,6 +2139,9 @@ export function createFxContext(options: CreateFxOptions): FxContext {
     get signal(): AbortSignal {
       return currentAbortSignal();
     },
+    get rlsIdentity() {
+      return rlsInvokeContext().rls;
+    },
     all(thunks) {
       return fxAll(thunks);
     },

package/src/kernel/horizontal-child.ts

@@ -38,6 +38,7 @@ import { http } from "./triggers.ts";
 import { GATE_KV_NAMESPACE } from "./boot-bind/gate.ts";
 import { createBunRuntime } from "../runtime/bun.ts";
 import { installGracefulShutdown } from "./graceful-shutdown.ts";
+import { okid } from "../okid.ts";
 
 const mode = process.argv[2];
 if (mode !== "serve") {
@@ -139,7 +140,7 @@ const rate = flow("horizontal.rate", {
 });
 const write = flow("horizontal.write", {
   do: async (_input, fx) => {
-    const id = crypto.randomUUID();
+    const id = okid();
     await fx
       .store(db)
       .insert(writesTable)

package/src/kernel/http-resource.ts

@@ -13,7 +13,9 @@ import {
   type HttpTrigger,
   type ResourceFlowBag,
   type ResourceMount,
+  type SignalSource,
 } from "./triggers.ts";
+import { registerPendingResourceLiveMount } from "./resource-live.ts";
 
 /**
  * Mount a CRUD resource at `path`: `list`/`create` on the base, `get` /
@@ -31,16 +33,40 @@ export function httpResource<P extends string>(
   const id = `${path}/:id` as `${P}/:id`;
   const verb = <M extends HttpMethod>(method: M, p: P | `${P}/:id`): HttpTrigger<M> =>
     createHttpTrigger(method, p, gates);
+  // Live exposure — synthesized from the resource's live surface so SSE
+  // rides the same gates as the CRUD verbs.
+  const liveFlow = (ops as { readonly live?: { readonly signal: string; readonly flow: unknown } })
+    .live;
+  // `store.resource(…, { live: omitted })` puts a pending surface on the ops
+  // bag. `http.resource` records the mount slot; `oke()` drains it only when
+  // the project-wide `store.live` flag is on.
+  const pendingSignal = (ops as { readonly pendingLive?: { readonly signalName: string } })
+    .pendingLive?.signalName;
+  if (pendingSignal !== undefined && liveFlow === undefined) {
+    registerPendingResourceLiveMount({ path, gates, signalName: pendingSignal });
+  }
+  const mounts = [
+    { trigger: verb("GET", path), flow: ops.list },
+    { trigger: verb("POST", path), flow: ops.create },
+    { trigger: verb("GET", id), flow: ops.get },
+    { trigger: verb("PATCH", id), flow: ops.update },
+    { trigger: verb("DELETE", id), flow: ops.remove },
+    ...(liveFlow !== undefined
+      ? [
+          {
+            trigger: createHttpTrigger("GET" as const, `${path}/live`, gates, {
+              name: liveFlow.signal,
+            } as SignalSource),
+            flow: liveFlow.flow,
+          },
+        ]
+      : []),
+  ];
   const mount: ResourceMount = {
     [resourceMountBrand]: true,
     gates,
-    mounts: [
-      { trigger: verb("GET", path), flow: ops.list },
-      { trigger: verb("POST", path), flow: ops.create },
-      { trigger: verb("GET", id), flow: ops.get },
-      { trigger: verb("PATCH", id), flow: ops.update },
-      { trigger: verb("DELETE", id), flow: ops.remove },
-    ],
+    ...(liveFlow !== undefined ? { live: { signal: liveFlow.signal, flow: liveFlow.flow } } : {}),
+    mounts,
     gate: createGateAttach((next) => httpResource(path, ops, next), gates),
     public() {
       return httpResource(path, ops, [...gates, GATE_PUBLIC_NAME]);

package/src/kernel/identity-host-persist.test.ts

@@ -0,0 +1,119 @@
+/**
+ * Host identity durability — standalone `oke()` (no Console).
+ *
+ * Creates a user via the real `/auth/sign-up/email` path, stops, boots a fresh
+ * app against the same SQL URL, and resolves the same user on `/auth/sign-in/email`.
+ * Production uses postgres + `DATABASE_URL`; this suite uses file-backed
+ * PGlite at that same URL so the restart is hermetic.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { AUTH_TABLES } from "../auth/tables.ts";
+import { gate } from "../elements/gate.ts";
+import { resetStores, store } from "../elements/store/declare.ts";
+import { oke } from "./app.ts";
+import { resetFlowSeq } from "./flow.ts";
+import { resetBindings } from "./on.ts";
+
+const PEPPER = "oke-host-identity-persist-pepper";
+const member = gate.policy("member", ({ auth }) => !!auth.verified);
+
+function resetIsolated(): void {
+  resetBindings();
+  resetFlowSeq();
+  resetStores();
+}
+
+afterEach(() => {
+  resetIsolated();
+});
+
+describe("host identity persist via store.sql()", () => {
+  test("standalone oke() persists users+credentials across restart; sign-in resolves on a fresh store", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "oke-host-identity-"));
+    const sqlUrl = join(dir, "pgdata");
+    const prevDb = process.env.DATABASE_URL;
+    const prevPglite = process.env.OKE_PGLITE_URL;
+    process.env.DATABASE_URL = sqlUrl;
+    process.env.OKE_PGLITE_URL = sqlUrl;
+
+    try {
+      resetIsolated();
+      const db1 = store.sql("app", { schema: {} });
+      const first = oke({
+        name: "host-identity-first",
+        stores: [db1],
+        gate: {
+          auth: { secret: PEPPER, emailAndPassword: { enabled: true } },
+          policies: [member],
+        },
+        env: "test",
+        startScheduler: false,
+      });
+      await first.boot({ env: "test", startScheduler: false });
+
+      const signUp = await first.fetch(
+        new Request("http://localhost/auth/sign-up/email", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ email: "persist@example.com", password: "CorrectHorse1!" }),
+        }),
+      );
+      expect(signUp.status).toBe(200);
+      const signedUp = (await signUp.json()) as {
+        data: { accessToken: string; userId: string };
+      };
+      expect(signedUp.data.userId).toBeTruthy();
+
+      const firstStore = first.bootResult?.store;
+      await first.stop();
+      await firstStore?.close();
+
+      resetIsolated();
+      const db2 = store.sql("app", { schema: {} });
+      const second = oke({
+        name: "host-identity-second",
+        stores: [db2],
+        gate: {
+          auth: { secret: PEPPER, emailAndPassword: { enabled: true } },
+          policies: [member],
+        },
+        env: "test",
+        startScheduler: false,
+      });
+      await second.boot({ env: "test", startScheduler: false });
+
+      const signIn = await second.fetch(
+        new Request("http://localhost/auth/sign-in/email", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ email: "persist@example.com", password: "CorrectHorse1!" }),
+        }),
+      );
+      expect(signIn.status).toBe(200);
+      const session = (await signIn.json()) as { data: { userId: string } };
+      expect(session.data.userId).toBe(signedUp.data.userId);
+
+      const conn = await second.bootResult?.store?.primarySql();
+      const identities = await conn?.query(`SELECT id, email FROM ${AUTH_TABLES.identities}`);
+      expect(identities?.some((r) => r.email === "persist@example.com")).toBe(true);
+      const credentials = await conn?.query(
+        `SELECT user_id, provider, provider_account_id FROM ${AUTH_TABLES.credentials}`,
+      );
+      expect(credentials?.some((r) => r.provider === "credential")).toBe(true);
+
+      const secondStore = second.bootResult?.store;
+      await second.stop();
+      await secondStore?.close();
+    } finally {
+      if (prevDb === undefined) delete process.env.DATABASE_URL;
+      else process.env.DATABASE_URL = prevDb;
+      if (prevPglite === undefined) delete process.env.OKE_PGLITE_URL;
+      else process.env.OKE_PGLITE_URL = prevPglite;
+      await rm(dir, { recursive: true, force: true });
+    }
+  }, 20_000);
+});

package/src/kernel/instance-id.ts

@@ -3,14 +3,16 @@
  * and the fleet registry.
  */
 
+import { okid } from "../okid.ts";
+
 /** Prefix for process instance ids minted at boot. */
 export const INSTANCE_ID_PREFIX = "inst-";
 
 /**
- * Mint a process instance id (`inst-<uuid>`).
+ * Mint a process instance id (`inst-<okid>`).
  */
 export function mintInstanceId(): string {
-  return `${INSTANCE_ID_PREFIX}${crypto.randomUUID()}`;
+  return `${INSTANCE_ID_PREFIX}${okid()}`;
 }
 
 /**

package/src/kernel/journal.ts

@@ -9,6 +9,7 @@
 
 import { mkdir } from "node:fs/promises";
 import { dirname } from "node:path";
+import { okid } from "../okid.ts";
 import { JournalSuspend } from "./journal-suspend.ts";
 
 export { JournalSuspend, isJournalSuspend } from "./journal-suspend.ts";
@@ -452,7 +453,7 @@ export interface Journal {
  */
 export function createJournal(options: CreateJournalOptions): Journal {
   const now = options.now ?? (() => Date.now());
-  const newId = options.id ?? (() => crypto.randomUUID());
+  const newId = options.id ?? (() => okid());
   const lease = options.lease;
   const coordinated = lease !== undefined && hasJournalLease(options.store);
 

package/src/kernel/mcp-tool.test.ts

@@ -0,0 +1,95 @@
+/**
+ * MCP tool trigger — name validation, gated registration lookup,
+ * duplicate-name boot failure (OKE1018), gate posture, and Manifest stamping.
+ */
+
+import { describe, expect, test, beforeEach } from "bun:test";
+import { GateBootError } from "../elements/gate/boot.ts";
+import { extractFromSources } from "../compiler/extract.ts";
+import { gate } from "../elements/gate.ts";
+import { oke } from "./app.ts";
+import { flow, resetFlowSeq } from "./flow.ts";
+import { on, resetBindings } from "./on.ts";
+import { mcp } from "./triggers.ts";
+
+const member = gate.policy("member", ({ auth }) => !!auth.verified);
+
+beforeEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+describe("mcp.tool(name)", () => {
+  test("empty or missing name throws TypeError", () => {
+    expect(() => mcp.tool("")).toThrow(/name is required/);
+    expect(() => mcp.tool("   ")).toThrow(/name is required/);
+    expect(() => (mcp.tool as (name?: string) => ReturnType<typeof mcp.tool>)()).toThrow(
+      /name is required/,
+    );
+  });
+
+  test("gated registration is indexed by exact tool name", () => {
+    const toolFlow = on(
+      mcp.tool("unit.action").gate(member),
+      flow("unit.action", {
+        plane: "user",
+        do: () => ({ ok: true }),
+      }),
+    );
+
+    expect(toolFlow.$trigger?.kind).toBe("mcp");
+    expect(toolFlow.$trigger && toolFlow.$trigger.kind === "mcp" && toolFlow.$trigger.name).toBe(
+      "unit.action",
+    );
+
+    const app = oke({ name: "t", autoBoot: false });
+    expect(app.resolveMcpTool("unit.action")).toBe(toolFlow);
+    expect(app.resolveMcpTool("other.action")).toBeUndefined();
+  });
+
+  test("duplicate tool name fails OKE1018 at construction", () => {
+    on(
+      mcp.tool("bookings.create").gate(member),
+      flow("bookings.create", { plane: "user", do: () => ({ ok: true }) }),
+    );
+    on(
+      mcp.tool("bookings.create").gate(member),
+      flow("bookings.also", { plane: "user", do: () => ({ ok: true }) }),
+    );
+    expect(() => oke({ name: "t", autoBoot: false })).toThrow(/OKE1018/);
+  });
+
+  test("ungated mcp.tool passes on() but fails gate posture at boot", async () => {
+    on(
+      mcp.tool("bookings.create"),
+      flow("bookings.create", { plane: "user", do: () => ({ ok: true }) }),
+    );
+
+    const app = oke({ name: "t", autoBoot: false });
+    expect(app.resolveMcpTool("bookings.create")).toBeUndefined();
+    await expect(app.boot()).rejects.toThrow(GateBootError);
+  });
+});
+
+describe("mcp.tool — Manifest", () => {
+  test("trigger.mcp.name and gates are stamped on the flow", async () => {
+    const source = `
+import { on, flow, gate, mcp } from "okengine";
+
+export const member = gate.policy("member", ({ auth }) => !!auth.verified);
+
+export const createBooking = on(
+  mcp.tool("bookings.create").gate(member),
+  flow("bookings.create", {
+    plane: "user",
+    do: () => ({ ok: true }),
+  }),
+);
+`;
+    const manifest = await extractFromSources({ "src/flows/bookings/index.ts": source });
+    const flowDef = manifest.flows?.["bookings.create"];
+    expect(flowDef?.trigger).toEqual({ mcp: { name: "bookings.create" } });
+    expect(flowDef?.gates).toEqual(["member"]);
+    expect(flowDef?.plane).toBe("user");
+  });
+});

package/src/kernel/on.ts

@@ -91,6 +91,9 @@ export function on(
     };
     const ops: Record<string, unknown> = {};
     for (const { trigger, flow } of triggerOrMount.mounts) {
+      // Live SSE exposure binds through the normal `on()` path below (its
+      // trigger carries a liveSignal) — it is not one of the five CRUD ops.
+      if (trigger.liveSignal !== undefined) continue;
       const key = trigger.path.endsWith("/:id")
         ? byIdVerb[trigger.method]
         : baseVerb[trigger.method];
@@ -100,6 +103,12 @@ export function on(
       on(trigger, flow as FlowDef<any, any, any, any, Trigger | undefined>);
       ops[key] = flow;
     }
+    // Live surface — the `<path>/live` mount carries a liveSignal; bind it
+    // through `on()` so SSE synthesis + exposure-uniqueness checks run once.
+    const liveMount = triggerOrMount.mounts.find((m) => m.trigger.liveSignal !== undefined);
+    if (liveMount !== undefined && isFlow(liveMount.flow)) {
+      on(liveMount.trigger, liveMount.flow as FlowDef<any, any, any, any, Trigger | undefined>);
+    }
     return ops as unknown as ResourceFlowBag;
   }
   const asHttp =