okengine 0.17.2 → 0.18.4

package/src/kernel/realtime-bind.ts

@@ -0,0 +1,326 @@
+/**
+ * Boot-time Realtime wire-up (Phase 2 of the realtime round).
+ *
+ * When the booted Store exposes a primary SQL connection on a
+ * `row_passes_policies`-capable driver (`postgres` / `pglite`):
+ *  1. Install the process-wide `sql-session` CDC sink → LiveQuery runtime
+ *     ingest, outbox append (multi-host durability), and user-declared CDC
+ *     flow dispatch.
+ *  2. Start a {@link CdcOutboxRunner} SKIP LOCKED poller draining durable
+ *     events back into the same runtime.
+ *  3. Register each subscribed table's live signal on the Signal bus so
+ *     existing `fx.live` SSE routes deliver classified events to clients.
+ *
+ * Torn down by {@link unbindRealtimeBridge} on app stop.
+ */
+
+import { CdcOutbox, CdcOutboxRunner, type OutboxRow } from "../drivers/cdc-outbox.ts";
+import { RLS_CONTEXT_DRIVERS, type RlsIdentity } from "../drivers/pg-rls.ts";
+import type { SqlConnection } from "../drivers/types.ts";
+import { liveQueryRuntimeFromConn } from "../elements/store/live-query-server.ts";
+import { setSqlCdcSink, type SqlCdcSink } from "../elements/store/sql-session.ts";
+import type { LiveQueryEvent, LiveSubscription } from "../elements/store/live-query-runtime.ts";
+import { currentAbortSignal, linkAbort } from "./abort-scope.ts";
+
+/**
+ * Column-kind hint for one SQL column — drives {@link restoreImage} type
+ * restoration for outbox-round-tripped CDC images.
+ */
+export type LiveColumnKind = "string" | "number" | "boolean";
+
+/** Internal Signal name prefix carrying classified live-query events. */
+const LIVE_SIGNAL_PREFIX = "oke/live/sql:";
+
+/**
+ * Reserved live-signal name for one table. Exported for compiler synthesis —
+ * manifest effects reference the exact same string.
+ *
+ * @param table - Physical table name
+ */
+export function liveSignalName(table: string): string {
+  return `${LIVE_SIGNAL_PREFIX}${table}`;
+}
+
+/** Mutation header echoed into `mutationId` on write-path events. */
+export const MUTATION_ID_HEADER = "x-oke-mutation-id";
+
+/** Per-stream event buffer cap (bounded memory per SSE session). */
+const LIVE_STREAM_BUFFER_MAX = 512;
+
+/** Active bridge state (singleton per process). */
+let active: {
+  /** Primary connection the runtime / outbox classify and poll against. */
+  readonly primary: SqlConnection;
+  readonly runtime: ReturnType<typeof liveQueryRuntimeFromConn>;
+  readonly outbox: CdcOutbox;
+  readonly runner?: CdcOutboxRunner;
+} | null = null;
+
+/** Delivery subscription for one SSE client (returned to `fx.live` glue). */
+export interface LiveSubscriptionHandle {
+  /** Push one classified event to this subscriber's stream. */
+  deliver(event: LiveQueryEvent): void;
+  /** Detach from fan-out (idempotent). */
+  unsubscribe(): void;
+}
+
+/**
+ * Wire the realtime stack for this process. Idempotent for the **same**
+ * primary connection (test graphs re-`oke()` freely). A different primary
+ * (e.g. a fresh PGLite instance on the next test) tears down the old bridge
+ * and rebinds — otherwise classification probes the previous DB and live
+ * SSE frames never fire.
+ *
+ * @param primary - Shared primary SQL connection (postgres/pglite only)
+ * @param dispatchCdc - App-level dispatcher for user-declared CDC flows
+ * @returns The process runtime, or `null` when the SQL driver cannot host it
+ */
+export function bindRealtimeBridge(
+  primary: SqlConnection,
+  dispatchCdc: (
+    tableName: string,
+    payload: { readonly before: unknown; readonly after: unknown },
+    column?: string,
+  ) => Promise<unknown[]> | unknown[],
+): ReturnType<typeof liveQueryRuntimeFromConn> | null {
+  if (!RLS_CONTEXT_DRIVERS.has(primary.driverId)) return null;
+  if (active) {
+    if (active.primary === primary) return active.runtime;
+    unbindRealtimeBridge();
+  }
+
+  const runtime = liveQueryRuntimeFromConn(primary);
+  const outbox = new CdcOutbox(primary);
+  // First tick creates the table + indexes without blocking boot.
+  void outbox.ensure().catch(() => undefined);
+  const sink: SqlCdcSink = (event) => {
+    // In-process leg first — classification needs no outbox round-trip.
+    runtime.onCdc(event);
+    // Durable multi-host leg: other hosts drain via the poller. Local events
+    // are also appended so a restarted process replays un-delivered rows;
+    // the poller redelivery is idempotent at the client by PK+seq.
+    void outbox.append(event).catch(() => undefined);
+    void dispatchCdc(event.tableName, { before: event.before, after: event.after });
+  };
+  setSqlCdcSink(sink);
+
+  const runner = new CdcOutboxRunner(
+    outbox,
+    async (rows: readonly OutboxRow[]) => {
+      for (const row of rows) {
+        runtime.onCdc({
+          tableName: row.tableName,
+          op: row.op,
+          before: row.before,
+          after: row.after,
+          ...(Number.isFinite(row.seq) ? { seq: row.seq } : {}),
+          ...(row.mutationId !== undefined ? { mutationId: row.mutationId } : {}),
+        });
+      }
+    },
+    {},
+  );
+  runner.start();
+
+  active = { primary, runtime, outbox, runner };
+  return runtime;
+}
+
+/**
+ * Push→pull bridge: convert runtime `deliver` callbacks into an SSE async
+ * iterable. Bounded per-stream buffer — a slow client sheds its own events
+ * (silently stale until resync; the v1 documented trade-off) instead of
+ * pinning the fan-out worker pool.
+ */
+export interface LiveEventStream {
+  /** Classified events as SSE frames (already JSON-shaped). */
+  readonly chunks: AsyncIterable<{ readonly data: LiveQueryEvent }>;
+  /** Stop fan-out and close the iterator (idempotent). */
+  close(): Promise<void>;
+}
+
+/** Options for {@link openLiveStream} — one SSE subscriber's window. */
+export interface OpenLiveStreamOptions {
+  /** Physical table name. */
+  readonly table: string;
+  /** Subscriber stamp (gate/user/scopes/tenant). */
+  readonly identity: RlsIdentity;
+  /** Primary key column. */
+  readonly pkColumn: string;
+  /** List query window compiled to SQL (`?` placeholders), when any. */
+  readonly whereSql?: string;
+  readonly whereParams?: readonly unknown[];
+  /**
+   * Column-kind hints for JSONB image restoration on outbox replay
+   * (`jsKey → primitive kind`). Optional.
+   */
+  readonly tableColumns?: Readonly<Record<string, LiveColumnKind>>;
+}
+/**
+ * Subscribe this SSE session to classified live events for one table.
+ *
+ * The returned handle implements the {@link Fx} live-stream physics without
+ * touching a signal tape: per-subscriber classification makes shared-tape
+ * delivery impossible to do safely — each identity's verdict differs.
+ *
+ * Links the ambient structured-concurrency abort signal: when the request
+ * branch aborts (client disconnect), the subscription detaches itself —
+ * the same ALS physics `fx.live` SSE streams use.
+ *
+ * @param id - Stable stream id (used for registry dedupe + metrics)
+ * @param options - Table, stamp, query window, column hints
+ */
+export function openLiveStream(
+  id: string,
+  options: OpenLiveStreamOptions,
+  runtimeOverride?: ReturnType<typeof liveQueryRuntimeFromConn>,
+): LiveEventStream {
+  const runtime = runtimeOverride ?? active?.runtime;
+  if (!runtime) throw new Error("live subscribe before realtime bridge bind");
+  const buffer: { readonly data: LiveQueryEvent }[] = [];
+  let woke = false;
+  let done = false;
+  let notify: (() => void) | undefined;
+  const wake = (): void => {
+    if (!woke || done) return;
+    woke = false;
+    const n = notify;
+    notify = undefined;
+    n?.();
+  };
+  const sub: LiveSubscription = {
+    ...options,
+    id,
+    ref: `sql:${options.table}`,
+    deliver(event) {
+      if (done) return;
+      // Per-stream cap: bounded memory per subscriber regardless of churn.
+      if (buffer.length >= LIVE_STREAM_BUFFER_MAX) {
+        // Shed from the front — the oldest missed event is re-fetchable via
+        // list refetch; newer state wins for eventual convergence.
+        buffer.shift();
+      }
+      buffer.push({ data: event });
+      wake();
+    },
+  };
+  const unsubscribe = runtime.subscribe(sub);
+  const chunks: AsyncIterable<{ readonly data: LiveQueryEvent }> = {
+    [Symbol.asyncIterator]() {
+      return {
+        async next(): Promise<IteratorResult<{ readonly data: LiveQueryEvent }>> {
+          for (;;) {
+            const frame = buffer.shift();
+            if (frame !== undefined) return { done: false as const, value: frame };
+            if (done) return { done: true as const, value: undefined };
+            await new Promise<void>((resolve) => {
+              notify = resolve;
+              woke = true;
+            });
+          }
+        },
+        async return(): Promise<IteratorResult<{ readonly data: LiveQueryEvent }>> {
+          await close();
+          return { done: true as const, value: undefined };
+        },
+      };
+    },
+  };
+  // Ambient-branch abort (client disconnect) detaches the subscription —
+  // same ALS physics `createLiveStream` uses for `fx.live` SSE.
+  const local = new AbortController();
+  const unlink = linkAbort(currentAbortSignal(), local);
+  const onAbort = (): void => {
+    void close();
+  };
+  local.signal.addEventListener("abort", onAbort, { once: true });
+
+  async function close(): Promise<void> {
+    if (done) return;
+    done = true;
+    unsubscribe();
+    local.signal.removeEventListener("abort", onAbort);
+    unlink();
+    wake();
+  }
+
+  return { chunks, close };
+}
+
+/**
+ * Register an SSE-side subscription without opening a stream. Kept for
+ * transport tests that drive `deliver` manually.
+ *
+ * @param table - Physical table name
+ * @param id - Stable stream/session id
+ * @param identity - Subscriber stamp
+ * @param sub - Query window + delivery sink
+ */
+export function subscribeLive(
+  table: string,
+  id: string,
+  identity: RlsIdentity,
+  sub: {
+    readonly pkColumn: string;
+    readonly whereSql?: string;
+    readonly whereParams?: readonly unknown[];
+    deliver(event: LiveQueryEvent): void;
+  },
+): LiveSubscriptionHandle {
+  if (!active) throw new Error("live subscribe before realtime bridge bind");
+  const unsub = active.runtime.subscribe({ ...sub, id, ref: `sql:${table}`, table, identity });
+  return { deliver: sub.deliver, unsubscribe: unsub };
+}
+
+/** Tear down polling and the process-wide sink (app stop). */
+export function unbindRealtimeBridge(): void {
+  if (!active) return;
+  active.runner?.stop();
+  setSqlCdcSink(null);
+  active = null;
+}
+
+/** Test/doctor visibility into the bound bridge. */
+export function realtimeBridgeRuntime(): ReturnType<typeof liveQueryRuntimeFromConn> | undefined {
+  return active?.runtime;
+}
+
+/**
+ * Realtime observability snapshot (metrics / doctor / Console):
+ *
+ * - `subscribers` — active live subscriptions right now
+ * - `queueDepth` — pending fan-out jobs (architecture contract gauge)
+ * - `fanout` — LiveQuery runtime counters (events in/shed, checks run/failed)
+ * - `outbox` — pending rows + delivered-over-cap gauge, plus runner counters
+ *   (`eventsDrained`, `pruneFailures`, …) when the poller leg is bound
+ *
+ * Returns `null` when no realtime bridge is bound (no Postgres-capable
+ * primary SQL driver, or app already stopped).
+ */
+export async function realtimeMetrics(): Promise<{
+  subscribers: number;
+  queueDepth: number;
+  fanout: { eventsIn: number; eventsShed: number; checksRun: number; checkFailures: number };
+  outbox:
+    | {
+        pending: number;
+        dispatchedOverCap: number;
+        runner?: { polls: number; batches: number; eventsDrained: number; pruneFailures: number };
+      }
+    | { unavailable: "no_bridge" };
+} | null> {
+  if (!active) return null;
+  const outboxStats = await active.outbox.stats().catch(() => null);
+  return {
+    subscribers: active.runtime.size,
+    queueDepth: active.runtime.queueDepth,
+    fanout: { ...active.runtime.metrics },
+    outbox:
+      outboxStats === null
+        ? { unavailable: "no_bridge" as const }
+        : {
+            ...outboxStats,
+            ...(active.runner !== undefined ? { runner: { ...active.runner.metrics } } : {}),
+          },
+  };
+}

package/src/kernel/resource-live.ts

@@ -0,0 +1,117 @@
+/**
+ * Project-wide `store.live` default — deferred live-query mounts.
+ *
+ * `oke({ store: { live: true } })` flips the default posture for NEW
+ * `store.schema.table()` declarations to live-by-default. `store.resource`
+ * and `http.resource` both run at module evaluation, before `oke()` is
+ * constructed, so the flag is not yet known when they execute. This module
+ * records their pending live surfaces and mount slots; the `oke()`
+ * constructor drains them and adopts the synthesized `GET <path>/live`
+ * bindings only when the flag is on. When the flag is off, the pending
+ * entries are discarded — 100% of today's explicit-only behavior.
+ *
+ * Declaration ergonomics only: draining mounts the same
+ * `store.resource({ live: true })` live surface. It never changes the
+ * underlying CDC / RLS-per-event cost model.
+ */
+
+import { createHttpTrigger, type GateRef } from "./triggers.ts";
+import type { AnyFlowDef } from "./flow.ts";
+import type { Binding } from "./on.ts";
+
+/** Marker placed on resource ops bags whose live surface is flag-dependent. */
+export const PENDING_RESOURCE_LIVE: unique symbol = Symbol.for("oke.resource.pending-live");
+
+/** A lazily-built live surface for a resource whose `live` was omitted. */
+export interface PendingResourceLive {
+  /** Signal name — `oke/live/sql:<table>`. */
+  readonly signalName: string;
+  /** Resource definition to stamp `live` onto when the flag resolves on. */
+  readonly def: object;
+  /** Ops bag (`resource.all()`) to stamp `live` onto when resolved on. */
+  readonly bag: object;
+  /** Build the surface on demand (never called when the flag stays off). */
+  readonly build: () => { readonly signal: string; readonly flow: AnyFlowDef };
+}
+
+/** Mount slot left by `http.resource` for a resource with a pending surface. */
+export interface PendingResourceLiveMount {
+  readonly path: string;
+  readonly gates: readonly GateRef[];
+  readonly signalName: string;
+}
+
+const pendingSurfaces = new Map<string, PendingResourceLive>();
+const pendingMounts = new Map<string, PendingResourceLiveMount>();
+
+/**
+ * Record a resource whose `live` was omitted (flag-dependent).
+ *
+ * @param surface - Pending live surface
+ */
+export function registerPendingResourceLive(surface: PendingResourceLive): void {
+  pendingSurfaces.set(surface.signalName, surface);
+}
+
+/**
+ * Record a `http.resource(path, ops)` mount slot whose ops bag carries a
+ * pending live surface. Keyed by path so gate-chaining rebuilds overwrite
+ * earlier partial-gate registrations.
+ *
+ * @param mount - Path, gates, and the pending surface's signal name
+ */
+export function registerPendingResourceLiveMount(mount: PendingResourceLiveMount): void {
+  pendingMounts.set(mount.path, mount);
+}
+
+/**
+ * Resolve every pending mount. Always clears the pending state; bindings
+ * are only emitted (and surfaces built) when `enabled` is true.
+ *
+ * @param enabled - Whether the project-wide `store.live` default is on
+ * @param adopt - Adopt one binding (`oke`'s `adoptBinding`)
+ * @returns The adopted bindings (empty when the flag is off)
+ */
+export function drainPendingResourceLiveMounts(
+  enabled: boolean,
+  adopt: (binding: Binding) => void,
+): Binding[] {
+  const mounts = [...pendingMounts.values()];
+  pendingMounts.clear();
+  const adopted: Binding[] = [];
+  if (!enabled) {
+    pendingSurfaces.clear();
+    return adopted;
+  }
+  for (const mount of mounts) {
+    const surface = pendingSurfaces.get(mount.signalName);
+    if (!surface) continue;
+    const built = surface.build();
+    const liveFlow = built.flow as AnyFlowDef & { live?: string };
+    // Match what `on(http.get(...).live(signal), flow)` stamps on the flow —
+    // `flow.live` is the signal name the Manifest / client tooling reads.
+    liveFlow.live = mount.signalName;
+    // Stamp the resolved surface onto the resource + bag so post-construction
+    // `resource.live` reads are precise per object (never a global flag).
+    Object.defineProperty(surface.def, "live", { value: built, configurable: true });
+    Object.defineProperty(surface.bag, "live", { value: built, configurable: true });
+    const binding: Binding = {
+      trigger: createHttpTrigger("GET", `${mount.path}/live`, mount.gates, {
+        name: mount.signalName,
+      }),
+      flow: built.flow,
+    };
+    adopt(binding);
+    adopted.push(binding);
+  }
+  pendingSurfaces.clear();
+  return adopted;
+}
+
+/**
+ * Clear pending live state without draining (test reset).
+ */
+export function resetPendingResourceLive(): void {
+  pendingMounts.clear();
+  pendingSurfaces.clear();
+}

package/src/kernel/triggers.ts

@@ -54,6 +54,15 @@ export interface HttpTrigger<M extends HttpMethod = HttpMethod, P extends string
    * @param signal - Live signal handle
    */
   live(signal: SignalSource): LiveHttpTrigger<M, P>;
+  /**
+   * Declare a live query surface over a table on this GET: same CDC +
+   * per-subscriber RLS classification physics as
+   * `store.resource(…, { live: true })`, for a hand-written flow. The
+   * flow body opens the stream via `liveQuery(fx, table, input)`.
+   *
+   * @param table - `store.schema.table` (or drizzle/table handle) binding
+   */
+  live(table: object): LiveHttpTrigger<M, P>;
 }
 
 /**
@@ -107,8 +116,30 @@ export interface InternalTrigger {
   readonly kind: "internal";
 }
 
+/**
+ * MCP tool exposure — the per-flow opt-in surface for OAuth-protected
+ * user-plane tools (`on(mcp.tool("bookings.create").gate(...), flow)`).
+ *
+ * Deny-by-default: a flow without this trigger is never listed over MCP.
+ * Gates are required (typically `gate.auth` + `gate.scope(...)`) exactly
+ * like sensitive HTTP routes.
+ */
+export interface McpToolTrigger {
+  readonly kind: "mcp";
+  /** Tool name exposed in MCP `tools/list`. */
+  readonly name: string;
+  readonly gates: readonly GateRef[];
+  readonly gate: GateAttach<McpToolTrigger>;
+}
+
 /** Discriminated union of all trigger kinds. */
-export type Trigger = HttpTrigger | EveryTrigger | SignalAsTrigger | CdcTrigger | InternalTrigger;
+export type Trigger =
+  | HttpTrigger
+  | EveryTrigger
+  | SignalAsTrigger
+  | CdcTrigger
+  | InternalTrigger
+  | McpToolTrigger;
 
 /** Trigger kind string. */
 export type TriggerKind = Trigger["kind"];
@@ -162,8 +193,19 @@ export function createHttpTrigger<M extends HttpMethod, P extends string>(
     public() {
       return createHttpTrigger(method, path, [...gates, GATE_PUBLIC_NAME], liveSignal);
     },
-    live(signal: SignalSource) {
-      return createHttpTrigger(method, path, gates, signal);
+    live(source: SignalSource | object) {
+      if (typeof source === "object" && !("name" in source)) {
+        // Table binding — declare a live query surface over this table.
+        // Same signal name the `store.resource` live surface synthesizes;
+        // resolved lazily so triggers.ts stays free of store imports.
+        const storeTable = lazyRequire<typeof import("../elements/store/table.ts")>(
+          "../elements/store",
+          "table",
+        );
+        const signal = { name: `oke/live/sql:${storeTable.resolveTableName(source)}` };
+        return createHttpTrigger(method, path, gates, signal);
+      }
+      return createHttpTrigger(method, path, gates, source as SignalSource);
     },
   };
   return trigger;
@@ -179,6 +221,8 @@ export interface ResourceFlowBag {
   readonly get: unknown;
   readonly update: unknown;
   readonly remove: unknown;
+  /** Live surface when present — `store.resource(…, { live: true }).all()`. */
+  readonly live?: { readonly signal: string; readonly flow: unknown };
 }
 
 /**
@@ -190,6 +234,12 @@ export interface ResourceMount {
   readonly [resourceMountBrand]: true;
   readonly mounts: ReadonlyArray<{ readonly trigger: HttpTrigger; readonly flow: unknown }>;
   readonly gates: readonly GateRef[];
+  /**
+   * Optional live surface — set by `httpResource` when the ops bag carries
+   * `live` (from `store.resource(…, { live: true }).all()`). `on()` then
+   * synthesizes the SSE exposure on `<path>/live`.
+   */
+  readonly live?: { readonly signal: string; readonly flow: unknown };
   /**
    * Attach gates to every verb (registration order). `gate.all` and arrays flatten.
    */
@@ -411,6 +461,37 @@ export function table(name: string, store?: string): TableHandle {
  */
 export const internal: InternalTrigger = { kind: "internal" };
 
+/**
+ * MCP tool namespace — `mcp.tool("bookings.create")` marks a flow as an
+ * explicitly exposed MCP tool for OAuth user-plane clients. Chain `.gate(...)`
+ * like HTTP triggers; no gates ⇒ not exposed (deny-by-default).
+ *
+ * @param name - Tool name (namespaced, e.g. `bookings.create`)
+ */
+export const mcp: {
+  /**
+   * @param name - Tool name
+   */
+  tool(name: string): McpToolTrigger;
+} = {
+  tool(name: string): McpToolTrigger {
+    if (typeof name !== "string" || name.trim().length === 0) {
+      throw new TypeError("mcp.tool(name): name is required");
+    }
+    return withMcpGates(name, []);
+  },
+};
+
+/** @internal Attach a resolved gate list onto a fresh {@link McpToolTrigger}. */
+function withMcpGates(name: string, gates: readonly GateRef[]): McpToolTrigger {
+  return {
+    kind: "mcp",
+    name,
+    gates,
+    gate: createGateAttach((next) => withMcpGates(name, next), gates),
+  };
+}
+
 /**
  * Normalize anything accepted by {@link on} into a {@link Trigger}.
  *
@@ -427,7 +508,8 @@ export function normalizeTrigger(value: Trigger | SignalSource): Trigger {
       kind === "every" ||
       kind === "signal" ||
       kind === "cdc" ||
-      kind === "internal"
+      kind === "internal" ||
+      kind === "mcp"
     ) {
       return value as Trigger;
     }

package/src/manifest/diff.ts

@@ -29,6 +29,7 @@ import type {
   Signal,
   Slo,
   Store,
+  StoreLive,
   Table,
   Tenancy,
   Trigger,
@@ -102,6 +103,7 @@ export function diffManifest(before: Manifest, after: Manifest): ManifestDiffRes
   diffAi(before.ai, after.ai, changes);
   diffDrivers(before.drivers, after.drivers, changes);
   diffTenancy(before.tenancy, after.tenancy, changes);
+  diffStoreLive(before.store, after.store, changes);
   diffI18n(before.i18n, after.i18n, changes);
   diffTopology(before.topology, after.topology, changes);
   diffImages(before.images, after.images, changes);
@@ -849,6 +851,18 @@ function diffTable(before: Table, after: Table, path: string, out: ManifestChang
       ),
     );
   }
+  if (before.live !== after.live && (before.live !== undefined || after.live !== undefined)) {
+    out.push(
+      change(
+        `${path}/live`,
+        "effect-widening",
+        kindOf(before.live, after.live),
+        before.live,
+        after.live,
+        `live ${String(before.live)} → ${String(after.live)}`,
+      ),
+    );
+  }
 }
 
 function diffClock(before: Clock, after: Clock, path: string, out: ManifestChange[]): void {
@@ -1289,6 +1303,29 @@ function diffTenancy(
   }
 }
 
+function diffStoreLive(
+  before: StoreLive | undefined,
+  after: StoreLive | undefined,
+  out: ManifestChange[],
+): void {
+  if (deepEqual(before, after)) return;
+  const beforeEnabled = before?.live === true;
+  const afterEnabled = after?.live === true;
+  if (!beforeEnabled && afterEnabled) {
+    // New default live surfaces under the flag are synthesized /live routes
+    // over SQL tables — effect-widening (behavioral, but not a contract break).
+    out.push(
+      change("/store/live", "effect-widening", "changed", undefined, true, "store.live enabled"),
+    );
+    return;
+  }
+  if (beforeEnabled && !afterEnabled) {
+    out.push(
+      change("/store/live", "effect-widening", "changed", true, undefined, "store.live disabled"),
+    );
+  }
+}
+
 function diffI18n(before: I18n | undefined, after: I18n | undefined, out: ManifestChange[]): void {
   if (deepEqual(before, after)) return;
   if (before === undefined && after !== undefined) {