okengine 0.2.2 → 0.2.4

package/src/console/server/serve.ts

@@ -11,6 +11,7 @@ import {
   resolveAllowedHosts,
   secureFetch,
 } from "../../runtime/security.ts";
+import { runWithDevSurface } from "../../runtime/dev-request-log.ts";
 import { CONSOLE_PORT, type ServerHandle } from "../../runtime/types.ts";
 import {
   bindManifestSignalBus,
@@ -22,6 +23,7 @@ import {
   type CreateConsoleAppOptions,
 } from "./app.ts";
 import { createLiveWebsocket, type ConsoleLiveData } from "./live.ts";
+import { openConsolePersistence } from "./operator-db.ts";
 import {
   CONSOLE_COOKIES,
   consoleSessionCookie,
@@ -37,6 +39,11 @@ export interface ServeConsoleOptions extends CreateConsoleAppOptions {
   readonly staticDir?: string;
   /** Boot environment — use `"dev"` / `"prod"` so Bearer auth is production-like. */
   readonly env?: "dev" | "prod" | "test";
+  /**
+   * Persist operators + secret under `.oke/` (default true).
+   * Set false for ephemeral test servers.
+   */
+  readonly persist?: boolean;
 }
 
 /** Running Console server handle. */
@@ -54,9 +61,26 @@ export async function serveConsole(
 ): Promise<ConsoleServerHandle> {
   const hostname = options.hostname ?? "127.0.0.1";
   const port = options.port ?? CONSOLE_PORT;
+  const cwd = options.cwd ?? process.cwd();
+  const wantPersist = options.persist !== false && options.operators === undefined;
+  const persistence = wantPersist
+    ? await openConsolePersistence(cwd, {
+        envSecret: options.secret ?? process.env.OKE_CONSOLE_SECRET,
+      })
+    : null;
   const handle = createConsoleApp({
     ...options,
+    cwd,
     silentClaim: options.silentClaim ?? false,
+    ...(persistence
+      ? {
+          secret: options.secret ?? persistence.secret,
+          operators: persistence.operators,
+          sessions: persistence.sessions,
+          persistOperator: persistence.persistOperator,
+          persistSessions: persistence.persistSessions,
+        }
+      : {}),
   });
 
   const env = options.env ?? "dev";
@@ -88,7 +112,9 @@ export async function serveConsole(
     const authed = withCookieAuth(request);
 
     if (url.pathname.startsWith("/console/")) {
-      const response = await handle.app.fetch(authed);
+      const response = await runWithDevSurface("Console", () =>
+        handle.app.fetch(authed),
+      );
       const withCookies = await attachSessionCookies(authed, response);
       return withConsoleSecurityHeaders(withCookies);
     }
@@ -160,6 +186,7 @@ export async function serveConsole(
     stop(closeActive = false) {
       server.stop(closeActive);
       void handle.app.stop();
+      persistence?.close();
     },
   };
 }
@@ -172,11 +199,30 @@ export async function serveConsole(
 export async function startConsoleApp(
   options: CreateConsoleAppOptions & {
     readonly env?: "dev" | "prod" | "test";
+    /** Opt-in durable operators under `.oke/` (default false for unit tests). */
+    readonly persist?: boolean;
   } = {},
 ): Promise<ConsoleAppHandle> {
+  const cwd = options.cwd ?? process.cwd();
+  const persistence =
+    options.persist === true && options.operators === undefined
+      ? await openConsolePersistence(cwd, {
+          envSecret: options.secret ?? process.env.OKE_CONSOLE_SECRET,
+        })
+      : null;
   const handle = createConsoleApp({
     ...options,
+    cwd,
     silentClaim: options.silentClaim ?? true,
+    ...(persistence
+      ? {
+          secret: options.secret ?? persistence.secret,
+          operators: persistence.operators,
+          sessions: persistence.sessions,
+          persistOperator: persistence.persistOperator,
+          persistSessions: persistence.persistSessions,
+        }
+      : {}),
   });
   await bootConsoleApp(handle);
   return handle;

package/src/console/server/state.ts

@@ -345,6 +345,16 @@ export interface ConsoleState {
   }>;
   /** Whether first operator exists (wizard permanently closed). */
   get setupClosed(): boolean;
+  /**
+   * Persist an operator after claim/create (SQLite under `.oke/`).
+   * No-op when persistence is disabled (tests / memory-only).
+   */
+  persistOperator: (operatorId: string) => void;
+  /**
+   * Persist sessions after issue / revoke (SQLite under `.oke/`).
+   * No-op when persistence is disabled (tests / memory-only).
+   */
+  persistSessions: () => void;
   /**
    * Per-email login attempt timestamps for credential-check rate limiting
    * (console §10.4 — same 5/60s strategy as setup-claim).
@@ -398,6 +408,14 @@ export interface CreateConsoleStateOptions {
   readonly okeConfig?: OkeConfig | null;
   /** Host plugin registry for scopes / capabilities. */
   readonly pluginRegistry?: PluginRegistry | null;
+  /** Pre-hydrated operator store (from `.oke/console.sqlite`). */
+  readonly operators?: OperatorStore;
+  /** Pre-hydrated session store (from `.oke/console.sqlite`). */
+  readonly sessions?: SessionStore;
+  /** Persist hook after claim/create. */
+  readonly persistOperator?: (operatorId: string) => void;
+  /** Persist hook after session issue / revoke. */
+  readonly persistSessions?: () => void;
 }
 
 /**
@@ -413,10 +431,13 @@ export function createConsoleState(
     process.env.OKE_CONSOLE_SECRET ??
     `oke-console-dev-${crypto.randomUUID()}`;
   const now = options.now ?? (() => Date.now());
+  const operators = options.operators ?? createOperatorStore();
   const claim = mintClaimCode(now);
-  const operators = createOperatorStore();
-  const sessions = createSessionStore();
+  const sessions = options.sessions ?? createSessionStore();
   const liveSubscribers = new Set<(msg: ConsoleLiveMessage) => void>();
+  const persistOperator =
+    options.persistOperator ?? ((_operatorId: string) => {});
+  const persistSessions = options.persistSessions ?? (() => {});
 
   const signalConfig = createMemorySignalConfigStore();
   const gateAuth = createDefaultGateAuthStores();
@@ -843,6 +864,8 @@ export function createConsoleState(
     get setupClosed() {
       return operators.operators.size > 0;
     },
+    persistOperator,
+    persistSessions,
   };
 
   return state;