okengine 0.18.4 → 0.19.0

package/src/release/limits.ts

@@ -5,10 +5,10 @@
  */
 
 /** Kernel (edge profile) — gzipped minified bundle. */
-export const KERNEL_EDGE_BUDGET_BYTES = 16 * 1024;
+export const KERNEL_EDGE_BUDGET_BYTES = 17 * 1024;
 
 /** Client runtime — gzipped minified bundle. */
-export const CLIENT_BUDGET_BYTES = 4 * 1024;
+export const CLIENT_BUDGET_BYTES = 5 * 1024;
 
 /** Console initial load — gzipped html + entry js/css (ui-next SPA, no panel-* split). */
 export const CONSOLE_BUDGET_BYTES = 700 * 1024;

package/src/release/measure.ts

@@ -692,7 +692,7 @@ export function formatBudgetsMarkdown(snapshot: BudgetsSnapshot): string {
     "",
     `_okengine v${snapshot.version} · measured ${snapshot.measuredAt}_`,
     "",
-    "Core rows are absolute AGENTS caps (plus HTTP-ping regression samples). Exports, Plugins, and Drivers fail on regression vs the prior [`budgets.json`](budgets.json) (max +256 B or +2%). Export gzip excludes peers/optionals (`zod`, `sently`, `oxc-parser`, `ajv`, DuckDB, FormatJS). The `okengine` export row is the **thin root** (gzip); use `okengine/full` for the legacy mega-barrel and `okengine/http` for HTTP-only apps.",
+    "Core rows are absolute AGENTS caps (plus HTTP-ping regression samples). Exports, Plugins, and Drivers fail on regression vs the prior [`budgets.json`](budgets.json) (max +256 B or +2%). Export gzip excludes hard/optional externals (`zod`, `sently`, `oxc-parser`, `ajv`, DuckDB, FormatJS). The `okengine` export row is the **thin root** (gzip); use `okengine/full` for the legacy mega-barrel and `okengine/http` for HTTP-only apps.",
   ];
   const order: readonly BudgetGroup[] = ["core", "exports", "plugins", "drivers"];
   for (const group of order) {

package/src/runs/collect.test.ts

@@ -3,7 +3,6 @@
  */
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
 import { createEffectLedger } from "../kernel/effects.ts";
 import { flow } from "../kernel/flow.ts";
 import { createFx } from "../kernel/fx.ts";
@@ -13,7 +12,6 @@ import { fail } from "../kernel/errors.ts";
 import { collectWideEvent } from "./collect.ts";
 
 const demo = flow("demo.fast", {
-  in: z.object({}),
   do: () => ({ ok: true }),
 });
 

package/src/runtime/json-code-block.test.ts

@@ -12,10 +12,14 @@ import {
   asBrowserJsonCodeBlock,
   consoleUrlFromRequest,
   escapeHtml,
+  fillPathTemplate,
   formatJsonCodeLatency,
+  jsonCodeAuthFrom,
   jsonCodeLatencyTone,
   httpGetNavPaths,
   httpNavGroups,
+  matchPathTemplate,
+  pathParamNames,
   prefersHtml,
   prettyHrefFromRequest,
   prettyJson,
@@ -104,7 +108,6 @@ describe("renderJsonCodeBlockHtml", () => {
       method: "GET",
       path: "/",
       app: "keel",
-      consoleUrl: "http://127.0.0.1:6533",
       rawHref: "/?raw=1",
       prettyHref: "/",
     });
@@ -113,7 +116,12 @@ describe("renderJsonCodeBlockHtml", () => {
     expect(html).not.toContain("border-radius: 1rem");
     expect(html).toContain("GET /");
     expect(html).toContain("Ready");
-    expect(html).toContain("http://127.0.0.1:6533");
+    expect(html).not.toContain('data-slot="json-code-auth-switch"');
+    expect(html).toContain('data-slot="json-code-view-toggle"');
+    expect(html).toContain('href="/?raw=1"');
+    expect(html).toContain(">Pretty</a>");
+    expect(html).not.toContain(">Raw</a>");
+    expect(html).not.toContain(">Console</a>");
     expect(html).not.toContain("</script><script>alert(1)</script>");
     expect(html).toContain("&lt;/script&gt;");
   });
@@ -129,7 +137,6 @@ describe("renderJsonCodeBlockHtml", () => {
       method: "GET",
       path: "/",
       app: "keel",
-      consoleUrl: "http://127.0.0.1:6533",
       rawHref: "/?raw=1",
       prettyHref: "/",
       latencyMs: 12,
@@ -154,7 +161,6 @@ describe("renderJsonCodeBlockHtml", () => {
       method: "GET",
       path: "/",
       app: "keel",
-      consoleUrl: "http://127.0.0.1:6533",
       rawHref: "/?raw=1",
       prettyHref: "/",
       cache: "hit",
@@ -165,45 +171,226 @@ describe("renderJsonCodeBlockHtml", () => {
     expect(html).toContain("Hit");
   });
 
-  test("renders the Routes rail with the current GET on", () => {
+  test("renders auth for the handled request", () => {
+    expect(jsonCodeAuthFrom({ publicGate: true })).toEqual({ kind: "public" });
+    expect(jsonCodeAuthFrom({ userId: "usr_1" })).toEqual({ kind: "user", id: "usr_1" });
+    expect(jsonCodeAuthFrom({ apiKeyId: "key_1" })).toEqual({ kind: "key", id: "key_1" });
+    expect(jsonCodeAuthFrom({})).toEqual({ kind: "none" });
+
+    const publicHtml = renderJsonCodeBlockHtml({
+      json: '{"ok":true}',
+      status: 200,
+      method: "GET",
+      path: "/notes",
+      app: "notes",
+      rawHref: "/notes?raw=1",
+      prettyHref: "/notes",
+      auth: { kind: "public" },
+    });
+    expect(publicHtml).toContain('data-slot="json-code-auth"');
+    expect(publicHtml).toContain('data-auth="public"');
+    expect(publicHtml).toContain("intentionally unauthenticated");
+    expect(publicHtml).not.toContain('data-slot="json-code-auth-switch"');
+    expect(publicHtml).not.toContain("data-auth-default");
+    expect(publicHtml).not.toContain("data-route-public");
+    expect(publicHtml).not.toContain('data-slot="json-code-auth-global"');
+    expect(publicHtml).not.toContain('data-rail-section="auth"');
+    expect(publicHtml).not.toContain(">Inherit</button>");
+    expect(publicHtml).not.toContain(">Custom</button>");
+    expect(publicHtml).not.toContain("oke:json-code:bearer");
+    expect(publicHtml).not.toContain("Authentication");
+
+    const userHtml = renderJsonCodeBlockHtml({
+      json: '{"ok":true}',
+      status: 200,
+      method: "GET",
+      path: "/me",
+      app: "notes",
+      rawHref: "/me?raw=1",
+      prettyHref: "/me",
+      auth: { kind: "user", id: "usr_alice" },
+    });
+    expect(userHtml).toContain('data-auth="user"');
+    expect(userHtml).toContain("usr_alice");
+    expect(userHtml).toContain("Authenticated user · usr_alice");
+    expect(userHtml).not.toContain('data-slot="json-code-auth-switch"');
+    expect(userHtml).not.toContain('data-slot="json-code-api-key-global"');
+    expect(userHtml).not.toContain('data-slot="json-code-api-key-route"');
+    expect(userHtml).not.toContain('data-slot="json-code-auth-global"');
+    expect(userHtml).not.toContain('data-rail-section="auth"');
+    expect(userHtml).not.toContain("Authentication");
+    expect(userHtml).not.toContain(">Console</a>");
+  });
+
+  test("Authentication interactive UI is gone", () => {
+    const html = renderJsonCodeBlockHtml({
+      json: '{"ok":true}',
+      status: 200,
+      method: "GET",
+      path: "/",
+      app: "keel",
+      rawHref: "/?raw=1",
+      prettyHref: "/",
+      auth: { kind: "public" },
+    });
+    expect(html).not.toContain('data-slot="json-code-auth-switch"');
+    expect(html).not.toContain(">Authentication</button>");
+    expect(html).not.toContain("Global API Key");
+    expect(html).not.toContain("Route API Key");
+    expect(html).not.toContain('data-slot="json-code-api-key-apply-global"');
+    expect(html).not.toContain('data-slot="json-code-api-key-apply-route"');
+    expect(html).not.toContain('data-slot="json-code-auth-route-mode"');
+    expect(html).not.toContain('data-slot="json-code-auth-inherit"');
+    expect(html).not.toContain('data-rail-section="auth"');
+    expect(html).not.toContain(">Inherit</button>");
+    expect(html).not.toContain(">Custom</button>");
+    expect(html).not.toContain("oke:json-code:bearer");
+    expect(html).not.toContain("oke:json-code:bearer-route");
+    expect(html).not.toContain("oke:json-code:auth-route-mode");
+    expect(html).not.toContain("oke:json-code:auth-tone");
+    expect(html).not.toContain("function resolveBearer");
+    expect(html).not.toContain("function routeIsPublic");
+    expect(html).not.toContain("function applyGlobalKey");
+    expect(html).not.toContain("refreshAuthTone");
+    expect(html).toContain('data-slot="json-code-send"');
+    expect(html).toContain('data-kv="headers"');
+    expect(html).toContain('aria-label="Request"');
+    expect(html).not.toContain(":6533");
+    expect(html).not.toContain(">Console</a>");
+  });
+
+  test("renders the Request rail with tabs and current GET on", () => {
     const html = renderJsonCodeBlockHtml({
       json: '{"ok":true}',
       status: 200,
       method: "GET",
       path: "/tasks",
       app: "keel",
-      consoleUrl: "http://127.0.0.1:6533",
       rawHref: "/tasks?raw=1",
       prettyHref: "/tasks",
       nav: [
         {
           name: "/",
-          routes: [{ method: "GET", path: "/", href: "/", current: false }],
+          routes: [
+            {
+              method: "GET",
+              path: "/",
+              href: "/",
+              current: false,
+              paramNames: [],
+            },
+          ],
         },
         {
           name: "tasks",
           routes: [
-            { method: "GET", path: "/tasks", href: "/tasks", current: true },
-            { method: "POST", path: "/tasks", href: null, current: false },
-            { method: "GET", path: "/tasks/:id", href: null, current: false },
+            {
+              method: "GET",
+              path: "/tasks",
+              href: "/tasks",
+              current: true,
+              paramNames: [],
+            },
+            {
+              method: "POST",
+              path: "/tasks",
+              href: null,
+              current: false,
+              paramNames: [],
+            },
+            {
+              method: "GET",
+              path: "/tasks/:id",
+              href: null,
+              current: false,
+              paramNames: ["id"],
+            },
           ],
         },
       ],
     });
     expect(html).toContain('data-slot="json-code-nav-panel"');
-    expect(html).toContain('aria-label="Expand routes"');
+    expect(html).not.toContain("data-route-public");
+    expect(html).toContain('aria-label="Expand request"');
     expect(html).not.toContain('id="json-code-rail" checked');
-    expect(html).toContain('aria-label="Routes"');
+    expect(html).toContain('aria-label="Request"');
+    expect(html).toContain('data-rail-section="routes"');
+    expect(html).toContain('class="rail-nav"');
+    expect(html).toContain('data-slot="json-code-request-dock"');
+    expect(html).toContain('data-slot="json-code-send"');
+    expect(html).toContain('data-slot="json-code-reset"');
+    expect(html).not.toContain('data-slot="json-code-dock-auth"');
+    expect(html).toContain('data-rail-section="query"');
+    expect(html).toContain(">Params</span>");
+    expect(html).toContain('data-rail-section="body"');
+    expect(html).toContain(">Body</span>");
+    expect(html).toContain('data-slot="json-code-body-mode"');
+    expect(html).toContain('data-mode="form"');
+    expect(html).toContain('data-mode="json"');
+    expect(html).toContain('data-slot="json-code-body-raw"');
+    expect(html).toContain('data-slot="json-code-body-hi"');
+    expect(html).toContain('data-kv="body"');
+    expect(html).not.toContain('data-rail-section="auth"');
+    expect(html).not.toContain('data-slot="json-code-auth-route-mode"');
+    expect(html).not.toContain(">Inherit</button>");
+    expect(html).not.toContain(">Custom</button>");
+    expect(html).not.toContain('data-slot="json-code-auth-global"');
+    expect(html).toContain('data-rail-section="cookies"');
+    expect(html).toContain('data-rail-section="headers"');
+    expect(html).toContain('data-rail-section="path"');
+    expect(html.indexOf('data-rail-section="query"')).toBeLessThan(
+      html.indexOf('data-rail-section="body"'),
+    );
+    expect(html.indexOf('data-rail-section="body"')).toBeLessThan(
+      html.indexOf('data-rail-section="cookies"'),
+    );
+    expect(html).toContain('data-method="GET"');
+    expect(html).toContain('data-method="POST"');
+    expect(html).toContain('class="rail-acc"');
+    expect(html).toContain('class="rail-dock"');
+    expect(html).toContain(">Routes</p>");
+    expect(html).toContain('data-kv="cookies"');
+    expect(html).toContain('data-kv="headers"');
+    expect(html).toContain('data-kv="query"');
+    expect(html).toContain('data-kv="path"');
+    expect(html).not.toContain("data-kv-apply=");
+    expect(html).toContain('data-path="/tasks"');
     expect(html).toContain('href="/tasks"');
     expect(html).toContain('class="leaf is-on"');
     expect(html).toContain("POST");
     expect(html).toContain("/tasks/:id");
+    expect(html).toContain('data-param-template="/tasks/:id"');
     expect(html).not.toContain('href="/tasks/:id"');
-    expect(html.match(/<details open>/g)?.length).toBe(1);
+    expect(html).toContain("data-route-leaf");
+    expect(html).toContain('data-route-options="1"');
+    expect(html).toContain("function selectRouteLeaf");
+    expect(html).toContain("a.leaf[data-route-leaf][href]");
+    expect(html).toContain("oke:json-code:rail-section");
+    expect(html).not.toContain("data-rail-tab=");
+    expect(html).not.toContain('data-slot="json-code-auth-panel"');
+    expect(html).not.toContain('data-rail-section="routes" open');
     expect(html).toContain("<details>");
   });
 });
 
+describe("path templates", () => {
+  test("pathParamNames extracts :segments", () => {
+    expect(pathParamNames("/notes/:id/archive")).toEqual(["id"]);
+    expect(pathParamNames("/a/:x/b/:y")).toEqual(["x", "y"]);
+    expect(pathParamNames("/tasks")).toEqual([]);
+  });
+
+  test("matchPathTemplate and fillPathTemplate round-trip", () => {
+    expect(matchPathTemplate("/notes/:id", "/notes/abc")).toEqual({ id: "abc" });
+    expect(matchPathTemplate("/notes/:id", "/notes/abc/extra")).toBeNull();
+    expect(fillPathTemplate("/notes/:id", { id: "abc" })).toBe("/notes/abc");
+    expect(fillPathTemplate("/notes/:id", { id: "" })).toBeNull();
+    expect(fillPathTemplate("/notes/:id/x/:slug", { id: "1", slug: "hi there" })).toBe(
+      "/notes/1/x/hi%20there",
+    );
+  });
+});
+
 describe("httpGetNavPaths", () => {
   test("keeps static GET paths and drops params and internals", () => {
     expect(
@@ -234,18 +421,52 @@ describe("httpGetNavPaths", () => {
     expect(groups).toEqual([
       {
         name: "/",
-        routes: [{ method: "GET", path: "/", href: "/?raw=1", current: false }],
+        routes: [
+          {
+            method: "GET",
+            path: "/",
+            href: "/?raw=1",
+            current: false,
+            paramNames: [],
+          },
+        ],
       },
       {
         name: "me",
-        routes: [{ method: "GET", path: "/me/tasks", href: "/me/tasks?raw=1", current: false }],
+        routes: [
+          {
+            method: "GET",
+            path: "/me/tasks",
+            href: "/me/tasks?raw=1",
+            current: false,
+            paramNames: [],
+          },
+        ],
       },
       {
         name: "tasks",
         routes: [
-          { method: "GET", path: "/tasks", href: "/tasks?raw=1", current: true },
-          { method: "POST", path: "/tasks", href: null, current: false },
-          { method: "GET", path: "/tasks/:id", href: null, current: false },
+          {
+            method: "GET",
+            path: "/tasks",
+            href: "/tasks?raw=1",
+            current: true,
+            paramNames: [],
+          },
+          {
+            method: "POST",
+            path: "/tasks",
+            href: null,
+            current: false,
+            paramNames: [],
+          },
+          {
+            method: "GET",
+            path: "/tasks/:id",
+            href: null,
+            current: false,
+            paramNames: ["id"],
+          },
         ],
       },
     ]);
@@ -273,11 +494,16 @@ describe("asBrowserJsonCodeBlock — HTTP", () => {
     expect(html).toContain("keel");
     expect(html).toContain("&quot;ok&quot;");
     expect(html).toContain('data-slot="json-code-nav-panel"');
-    expect(html).toContain('aria-label="Routes"');
+    expect(html).toContain('aria-label="Request"');
     expect(html).toContain('href="/"');
     expect(html).toContain('data-slot="json-code-latency"');
     expect(html).toContain('data-slot="json-code-cache"');
     expect(html).toContain('data-cache="none"');
+    expect(html).toContain('data-slot="json-code-auth"');
+    expect(html).toContain('data-auth="public"');
+    expect(html).not.toContain('data-slot="json-code-auth-switch"');
+    expect(html).not.toContain("data-auth-default");
+    expect(html).not.toContain(">Console</a>");
     expect(html).toMatch(/\d+(?:\.\d+)?(?:μs|ms|s)/);
 
     const curl = await app.fetch(new Request("http://127.0.0.1:6530/"));
@@ -295,6 +521,10 @@ describe("asBrowserJsonCodeBlock — HTTP", () => {
     expect(raw.headers.get("content-type")).toContain("text/html");
     const html = await raw.text();
     expect(html).toContain('data-view="raw"');
+    expect(html).toContain('data-slot="json-code-view-toggle"');
+    expect(html).toContain('href="/health"');
+    expect(html).toContain(">Raw</a>");
+    expect(html).toContain('aria-pressed="true"');
     expect(html).toContain("&quot;ok&quot;:true");
 
     const forced = await app.fetch(
@@ -319,7 +549,7 @@ describe("asBrowserJsonCodeBlock — HTTP", () => {
     expect(await res.json()).toEqual({ ready: false, reason: "booting" });
   });
 
-  test("console and raw href follow the request host", () => {
+  test("console helper and raw href follow the request host", () => {
     const request = new Request("http://127.0.0.1:6530/tasks?x=1");
     expect(consoleUrlFromRequest(request)).toBe("http://127.0.0.1:6533");
     expect(rawHrefFromRequest(request)).toBe("/tasks?x=1&raw=1");