okengine 0.2.5 → 0.2.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (584) hide show
  1. package/AGENTS.md +24 -23
  2. package/README.md +52 -346
  3. package/docs/spec/console.md +165 -142
  4. package/docs/spec/example.md +490 -312
  5. package/docs/spec/four-applications.md +495 -314
  6. package/docs/spec/unified-theory.md +184 -175
  7. package/package.json +46 -38
  8. package/spec/manifest.v1.schema.json +40 -9
  9. package/src/auth/api-keys.ts +2 -5
  10. package/src/auth/attenuation.ts +2 -6
  11. package/src/auth/auth.test.ts +53 -31
  12. package/src/auth/invoke-as.ts +1 -3
  13. package/src/auth/operator.ts +8 -26
  14. package/src/auth/planes.ts +2 -7
  15. package/src/auth/plugin.ts +4 -7
  16. package/src/auth/roles.ts +1 -5
  17. package/src/auth/sessions.ts +10 -39
  18. package/src/cli/args.ts +1 -5
  19. package/src/cli/ask-dev-mode.ts +40 -0
  20. package/src/cli/build.ts +1 -2
  21. package/src/cli/client-add.test.ts +8 -15
  22. package/src/cli/client-add.ts +5 -14
  23. package/src/cli/completion.test.ts +1 -5
  24. package/src/cli/completion.ts +4 -17
  25. package/src/cli/db-auto-push.test.ts +64 -0
  26. package/src/cli/db-auto-push.ts +72 -0
  27. package/src/cli/db.test.ts +189 -0
  28. package/src/cli/db.ts +386 -0
  29. package/src/cli/dev-app-runner.ts +2 -8
  30. package/src/cli/dev-db-push.test.ts +163 -0
  31. package/src/cli/dev-mode.test.ts +45 -0
  32. package/src/cli/dev-mode.ts +78 -0
  33. package/src/cli/dev.test.ts +148 -21
  34. package/src/cli/dev.ts +208 -134
  35. package/src/cli/doc-drift.test.ts +3 -2
  36. package/src/cli/doc-drift.ts +21 -50
  37. package/src/cli/doc-staleness.test.ts +69 -0
  38. package/src/cli/docker-cli.test.ts +7 -8
  39. package/src/cli/docker.ts +1 -3
  40. package/src/cli/doctor-diff-examples.ts +1 -3
  41. package/src/cli/doctor-diff.test.ts +1 -5
  42. package/src/cli/doctor-diff.ts +17 -46
  43. package/src/cli/doctor-pii.ts +2 -7
  44. package/src/cli/doctor.test.ts +26 -4
  45. package/src/cli/doctor.ts +35 -11
  46. package/src/cli/eval.ts +4 -14
  47. package/src/cli/gates-list.ts +1 -4
  48. package/src/cli/hero-meta.test.ts +17 -19
  49. package/src/cli/hero-meta.ts +20 -30
  50. package/src/cli/images.ts +3 -8
  51. package/src/cli/index.ts +11 -2
  52. package/src/cli/load-config.images.test.ts +14 -14
  53. package/src/cli/load-config.ts +41 -47
  54. package/src/cli/mcp-from-console.ts +1 -4
  55. package/src/cli/mode.ts +45 -0
  56. package/src/cli/ports.test.ts +4 -13
  57. package/src/cli/ports.ts +1 -3
  58. package/src/cli/privacy-erase.ts +1 -3
  59. package/src/cli/registry.ts +75 -25
  60. package/src/cli/schema.ts +3 -10
  61. package/src/cli/stack.ts +2 -7
  62. package/src/cli/start.ts +4 -15
  63. package/src/cli/upgrade.ts +1 -4
  64. package/src/client/budget-entry.ts +1 -6
  65. package/src/client/create.test.ts +6 -12
  66. package/src/client/create.ts +2 -8
  67. package/src/client/errors.ts +1 -4
  68. package/src/client/index.ts +1 -6
  69. package/src/client/notes-contract.test.ts +4 -13
  70. package/src/client/transport.ts +9 -30
  71. package/src/client/types.ts +8 -29
  72. package/src/compiler/aot.test.ts +2 -9
  73. package/src/compiler/aot.ts +1 -4
  74. package/src/compiler/differential.test.ts +3 -11
  75. package/src/compiler/dynamic.ts +1 -4
  76. package/src/compiler/effects-infer.ts +8 -34
  77. package/src/compiler/emit.ts +1 -3
  78. package/src/compiler/extract.test.ts +96 -30
  79. package/src/compiler/extract.ts +362 -156
  80. package/src/compiler/fixtures/skyport/oke.config.ts +1 -1
  81. package/src/compiler/fixtures/skyport/src/flows/bookings/index.ts +7 -3
  82. package/src/compiler/fixtures/skyport/src/flows/payments/index.ts +1 -3
  83. package/src/compiler/fixtures/skyport/src/flows/support/index.ts +4 -1
  84. package/src/compiler/fixtures/skyport.expected.json +24 -83
  85. package/src/compiler/fixtures/triggers/five-triggers.ts +1 -2
  86. package/src/compiler/http-parse.ts +2 -9
  87. package/src/compiler/index.ts +1 -5
  88. package/src/compiler/response.ts +4 -7
  89. package/src/compiler/sucrose.ts +11 -31
  90. package/src/config/define-config.test.ts +57 -34
  91. package/src/config/index.ts +181 -37
  92. package/src/config/resolve-driver.test.ts +28 -17
  93. package/src/console/budget.test.ts +1 -4
  94. package/src/console/index.ts +1 -4
  95. package/src/console/server/access.test.ts +15 -43
  96. package/src/console/server/access.ts +19 -49
  97. package/src/console/server/ai.test.ts +3 -11
  98. package/src/console/server/ai.ts +23 -46
  99. package/src/console/server/app.ts +14 -45
  100. package/src/console/server/auth-rate.test.ts +4 -12
  101. package/src/console/server/bind.ts +1 -5
  102. package/src/console/server/channels.test.ts +2 -6
  103. package/src/console/server/channels.ts +10 -35
  104. package/src/console/server/claim.ts +2 -8
  105. package/src/console/server/clock.test.ts +2 -6
  106. package/src/console/server/clock.ts +8 -26
  107. package/src/console/server/console.test.ts +1 -3
  108. package/src/console/server/diff.test.ts +5 -17
  109. package/src/console/server/diff.ts +10 -31
  110. package/src/console/server/dry-run.audit.test.ts +2 -8
  111. package/src/console/server/flows.ts +64 -233
  112. package/src/console/server/gates.test.ts +14 -50
  113. package/src/console/server/gates.ts +13 -48
  114. package/src/console/server/index.ts +2 -9
  115. package/src/console/server/live.ts +3 -12
  116. package/src/console/server/operator-db.test.ts +4 -15
  117. package/src/console/server/operator-db.ts +13 -32
  118. package/src/console/server/plugin.ts +50 -53
  119. package/src/console/server/plugins.test.ts +2 -6
  120. package/src/console/server/plugins.ts +17 -56
  121. package/src/console/server/runs-pii.ts +2 -7
  122. package/src/console/server/security.gate.test.ts +18 -40
  123. package/src/console/server/serve.ts +10 -25
  124. package/src/console/server/signals.test.ts +1 -3
  125. package/src/console/server/signals.ts +17 -40
  126. package/src/console/server/state.ts +21 -59
  127. package/src/console/server/store.test.ts +20 -22
  128. package/src/console/server/store.ts +31 -76
  129. package/src/console/server/vault.test.ts +12 -29
  130. package/src/console/server/vault.ts +23 -60
  131. package/src/console/ui/access/AccessA11yView.tsx +6 -21
  132. package/src/console/ui/access/a11y.test.tsx +3 -12
  133. package/src/console/ui/access/acknowledgement.test.ts +1 -4
  134. package/src/console/ui/access/acknowledgement.ts +1 -3
  135. package/src/console/ui/access/blast-radius.ts +1 -3
  136. package/src/console/ui/access/confirmation.test.ts +1 -5
  137. package/src/console/ui/access/confirmation.ts +1 -4
  138. package/src/console/ui/access/fixture.ts +1 -5
  139. package/src/console/ui/access/grantable.test.ts +1 -3
  140. package/src/console/ui/access/grantable.ts +2 -7
  141. package/src/console/ui/access/index.ts +2 -9
  142. package/src/console/ui/access/provenance.test.ts +1 -3
  143. package/src/console/ui/access/provenance.ts +2 -6
  144. package/src/console/ui/access/search.test.ts +1 -5
  145. package/src/console/ui/access/search.ts +2 -6
  146. package/src/console/ui/ai/AiA11yView.tsx +6 -17
  147. package/src/console/ui/ai/a11y.test.tsx +2 -5
  148. package/src/console/ui/ai/fixture.ts +2 -7
  149. package/src/console/ui/ai/format.ts +1 -3
  150. package/src/console/ui/ai/group.test.ts +1 -3
  151. package/src/console/ui/ai/group.ts +4 -12
  152. package/src/console/ui/ai/index.ts +2 -9
  153. package/src/console/ui/ai/promotion.test.ts +2 -7
  154. package/src/console/ui/ai/promotion.ts +4 -13
  155. package/src/console/ui/ai/search.test.ts +2 -11
  156. package/src/console/ui/ai/search.ts +3 -13
  157. package/src/console/ui/ai/types.ts +1 -8
  158. package/src/console/ui/architecture/ArchitectureA11yView.tsx +8 -29
  159. package/src/console/ui/architecture/a11y.test.tsx +1 -2
  160. package/src/console/ui/architecture/declared.ts +1 -5
  161. package/src/console/ui/architecture/index.ts +7 -35
  162. package/src/console/ui/architecture/layout.ts +1 -3
  163. package/src/console/ui/architecture/pathologies.ts +10 -19
  164. package/src/console/ui/architecture/search.ts +6 -15
  165. package/src/console/ui/architecture/traffic.ts +4 -14
  166. package/src/console/ui/architecture/types.ts +2 -10
  167. package/src/console/ui/architecture/view.test.ts +7 -19
  168. package/src/console/ui/architecture/view.ts +9 -36
  169. package/src/console/ui/channels/ChannelsA11yView.tsx +4 -13
  170. package/src/console/ui/channels/a11y.test.tsx +1 -2
  171. package/src/console/ui/channels/confirmation.test.ts +1 -4
  172. package/src/console/ui/channels/confirmation.ts +1 -4
  173. package/src/console/ui/channels/findings.ts +1 -5
  174. package/src/console/ui/channels/index.ts +2 -8
  175. package/src/console/ui/channels/locale.test.ts +1 -3
  176. package/src/console/ui/channels/locale.ts +2 -8
  177. package/src/console/ui/channels/search.ts +4 -13
  178. package/src/console/ui/channels/taxonomy.ts +1 -3
  179. package/src/console/ui/clock/ClockA11yView.tsx +9 -26
  180. package/src/console/ui/clock/a11y.test.tsx +2 -5
  181. package/src/console/ui/clock/confirmation.test.ts +1 -3
  182. package/src/console/ui/clock/confirmation.ts +1 -4
  183. package/src/console/ui/clock/findings.ts +1 -4
  184. package/src/console/ui/clock/health.ts +2 -7
  185. package/src/console/ui/clock/index.ts +2 -10
  186. package/src/console/ui/clock/search.test.ts +1 -3
  187. package/src/console/ui/clock/search.ts +2 -6
  188. package/src/console/ui/clock/timeline.test.ts +1 -3
  189. package/src/console/ui/clock/waiting-on.test.ts +1 -5
  190. package/src/console/ui/clock/waiting-on.ts +2 -7
  191. package/src/console/ui/diff/DiffA11yView.tsx +8 -17
  192. package/src/console/ui/diff/a11y.test.tsx +2 -5
  193. package/src/console/ui/diff/group.test.ts +3 -13
  194. package/src/console/ui/diff/group.ts +2 -8
  195. package/src/console/ui/diff/index.ts +2 -8
  196. package/src/console/ui/diff/search.test.ts +1 -5
  197. package/src/console/ui/diff/search.ts +4 -16
  198. package/src/console/ui/diff/summary.ts +1 -2
  199. package/src/console/ui/dist/assets/{index-Dy4jht9P.js → index-BWo8R7NR.js} +2 -2
  200. package/src/console/ui/dist/assets/{panel-access-Dd37LU2c.js → panel-access-C0J2D-a2.js} +1 -1
  201. package/src/console/ui/dist/assets/{panel-ai-CC7LR6-J.js → panel-ai-D_m6WQI8.js} +1 -1
  202. package/src/console/ui/dist/assets/{panel-architecture-B5b3iKCz.js → panel-architecture-CKnXFyUx.js} +1 -1
  203. package/src/console/ui/dist/assets/{panel-channels-CeNjTKXp.js → panel-channels-BOmQ-onL.js} +1 -1
  204. package/src/console/ui/dist/assets/{panel-clock-DgFTLoHV.js → panel-clock-giAq0Ccv.js} +1 -1
  205. package/src/console/ui/dist/assets/{panel-diff-DxehccqB.js → panel-diff-cdonmH8c.js} +1 -1
  206. package/src/console/ui/dist/assets/{panel-flows-BtrVn-Eg.js → panel-flows-DlCU5zjA.js} +2 -2
  207. package/src/console/ui/dist/assets/{panel-gates-Z9MKRGdH.js → panel-gates-XclZxWD5.js} +1 -1
  208. package/src/console/ui/dist/assets/{panel-overview-Dt_AeXgd.js → panel-overview-BznEOTnb.js} +1 -1
  209. package/src/console/ui/dist/assets/{panel-plugins-DWd0TowH.js → panel-plugins-CcGM1g64.js} +1 -1
  210. package/src/console/ui/dist/assets/{panel-runs-DGstFHeq.js → panel-runs-CGWNHLR4.js} +1 -1
  211. package/src/console/ui/dist/assets/{panel-signals-DzEa2Fnt.js → panel-signals-CNywkdak.js} +1 -1
  212. package/src/console/ui/dist/assets/{panel-store-BJkbNgxx.js → panel-store-KmTbFHMH.js} +1 -1
  213. package/src/console/ui/dist/assets/{panel-traces-BaRVO3gM.js → panel-traces-DBLx2ilD.js} +1 -1
  214. package/src/console/ui/dist/assets/panel-vault-CEnFc0dk.js +1 -0
  215. package/src/console/ui/dist/index.html +1 -1
  216. package/src/console/ui/flows/FlowsA11yView.tsx +7 -22
  217. package/src/console/ui/flows/a11y.test.tsx +2 -8
  218. package/src/console/ui/flows/buffer.test.ts +3 -11
  219. package/src/console/ui/flows/buffer.ts +4 -11
  220. package/src/console/ui/flows/confirmation.ts +1 -3
  221. package/src/console/ui/flows/contract.test.ts +3 -7
  222. package/src/console/ui/flows/contract.ts +12 -36
  223. package/src/console/ui/flows/graph.test.ts +3 -11
  224. package/src/console/ui/flows/graph.ts +5 -15
  225. package/src/console/ui/flows/index.ts +1 -6
  226. package/src/console/ui/flows/save-as-test.ts +1 -3
  227. package/src/console/ui/flows/search.ts +8 -25
  228. package/src/console/ui/flows/tiers.ts +2 -9
  229. package/src/console/ui/gates/GatesA11yView.tsx +4 -13
  230. package/src/console/ui/gates/a11y.test.tsx +2 -5
  231. package/src/console/ui/gates/audit.ts +1 -3
  232. package/src/console/ui/gates/denial.test.ts +1 -3
  233. package/src/console/ui/gates/denial.ts +4 -12
  234. package/src/console/ui/gates/findings.ts +1 -3
  235. package/src/console/ui/gates/group.test.ts +3 -3
  236. package/src/console/ui/gates/group.ts +3 -11
  237. package/src/console/ui/gates/index.ts +2 -10
  238. package/src/console/ui/gates/search.ts +3 -10
  239. package/src/console/ui/overview/OverviewA11yView.tsx +9 -27
  240. package/src/console/ui/overview/a11y.test.tsx +1 -2
  241. package/src/console/ui/overview/busiest.ts +1 -3
  242. package/src/console/ui/overview/compose.ts +1 -13
  243. package/src/console/ui/overview/cost.ts +34 -38
  244. package/src/console/ui/overview/fixture.ts +21 -26
  245. package/src/console/ui/overview/golden.ts +4 -14
  246. package/src/console/ui/overview/index.ts +2 -9
  247. package/src/console/ui/overview/rank.test.ts +3 -10
  248. package/src/console/ui/overview/rank.ts +2 -7
  249. package/src/console/ui/overview/slo.test.ts +5 -9
  250. package/src/console/ui/overview/slo.ts +6 -23
  251. package/src/console/ui/overview/verdict.ts +3 -10
  252. package/src/console/ui/plugins/PluginsA11yView.tsx +8 -18
  253. package/src/console/ui/plugins/a11y.test.tsx +1 -2
  254. package/src/console/ui/plugins/fixture.ts +2 -4
  255. package/src/console/ui/plugins/group.test.ts +1 -3
  256. package/src/console/ui/plugins/group.ts +1 -6
  257. package/src/console/ui/plugins/index.ts +3 -13
  258. package/src/console/ui/plugins/search.ts +7 -19
  259. package/src/console/ui/runs/RunsA11yView.tsx +5 -20
  260. package/src/console/ui/runs/a11y.test.tsx +2 -5
  261. package/src/console/ui/runs/explain.ts +2 -6
  262. package/src/console/ui/runs/group.ts +3 -12
  263. package/src/console/ui/runs/histogram.test.ts +2 -11
  264. package/src/console/ui/runs/histogram.ts +1 -4
  265. package/src/console/ui/runs/index.ts +4 -18
  266. package/src/console/ui/runs/project.ts +2 -6
  267. package/src/console/ui/runs/query.test.ts +1 -3
  268. package/src/console/ui/runs/query.ts +12 -35
  269. package/src/console/ui/runs/search.ts +5 -19
  270. package/src/console/ui/runs/trace-link.test.ts +2 -6
  271. package/src/console/ui/runs/trace-link.ts +4 -16
  272. package/src/console/ui/runs/types.ts +1 -3
  273. package/src/console/ui/shell/App.tsx +2 -10
  274. package/src/console/ui/shell/client.ts +22 -115
  275. package/src/console/ui/shell/components/ui.tsx +1 -4
  276. package/src/console/ui/shell/layout/Shell.tsx +2 -4
  277. package/src/console/ui/shell/main.tsx +31 -96
  278. package/src/console/ui/shell/panels/access/AccessPanel.tsx +34 -98
  279. package/src/console/ui/shell/panels/ai/AiPanel.tsx +35 -106
  280. package/src/console/ui/shell/panels/architecture/ArchitecturePanel.tsx +18 -66
  281. package/src/console/ui/shell/panels/channels/ChannelsPanel.tsx +20 -57
  282. package/src/console/ui/shell/panels/clock/ClockPanel.tsx +22 -54
  283. package/src/console/ui/shell/panels/diff/DiffPanel.tsx +20 -61
  284. package/src/console/ui/shell/panels/flows/ContractEditor.tsx +6 -23
  285. package/src/console/ui/shell/panels/flows/FlowDrawer.tsx +13 -28
  286. package/src/console/ui/shell/panels/flows/FlowsPanel.tsx +9 -29
  287. package/src/console/ui/shell/panels/gates/GatesPanel.tsx +24 -80
  288. package/src/console/ui/shell/panels/overview/OverviewPanel.tsx +20 -58
  289. package/src/console/ui/shell/panels/plugins/PluginsPanel.tsx +16 -41
  290. package/src/console/ui/shell/panels/runs/RunsPanel.tsx +31 -99
  291. package/src/console/ui/shell/panels/signals/SignalsPanel.tsx +38 -101
  292. package/src/console/ui/shell/panels/store/StorePanel.tsx +27 -66
  293. package/src/console/ui/shell/panels/traces/TracesPanel.tsx +28 -89
  294. package/src/console/ui/shell/panels/vault/VaultPanel.tsx +22 -53
  295. package/src/console/ui/shell/setup/Wizard.tsx +3 -5
  296. package/src/console/ui/shell/styles.css +1 -2
  297. package/src/console/ui/signals/SignalsA11yView.tsx +9 -33
  298. package/src/console/ui/signals/a11y.test.tsx +2 -5
  299. package/src/console/ui/signals/confirmation.test.ts +1 -5
  300. package/src/console/ui/signals/confirmation.ts +2 -6
  301. package/src/console/ui/signals/dry-run.ts +1 -3
  302. package/src/console/ui/signals/durable.ts +1 -3
  303. package/src/console/ui/signals/findings.ts +1 -3
  304. package/src/console/ui/signals/group.test.ts +2 -8
  305. package/src/console/ui/signals/group.ts +2 -10
  306. package/src/console/ui/signals/index.ts +1 -4
  307. package/src/console/ui/signals/monitor.ts +2 -7
  308. package/src/console/ui/signals/schema-form.test.ts +3 -14
  309. package/src/console/ui/signals/schema-form.ts +1 -4
  310. package/src/console/ui/signals/search.ts +4 -13
  311. package/src/console/ui/store/StoreA11yView.tsx +3 -9
  312. package/src/console/ui/store/a11y.test.tsx +2 -5
  313. package/src/console/ui/store/confirmation.test.ts +1 -3
  314. package/src/console/ui/store/confirmation.ts +1 -4
  315. package/src/console/ui/store/dry-run.ts +2 -5
  316. package/src/console/ui/store/fixture.ts +1 -2
  317. package/src/console/ui/store/group.test.ts +1 -6
  318. package/src/console/ui/store/group.ts +1 -4
  319. package/src/console/ui/store/index.ts +1 -5
  320. package/src/console/ui/store/search.ts +2 -6
  321. package/src/console/ui/store/will-not-fire.ts +1 -2
  322. package/src/console/ui/traces/TracesA11yView.tsx +10 -29
  323. package/src/console/ui/traces/a11y.test.tsx +1 -2
  324. package/src/console/ui/traces/chain.test.ts +5 -19
  325. package/src/console/ui/traces/chain.ts +1 -3
  326. package/src/console/ui/traces/critical-path.test.ts +1 -3
  327. package/src/console/ui/traces/critical-path.ts +2 -6
  328. package/src/console/ui/traces/filter.test.ts +2 -6
  329. package/src/console/ui/traces/filter.ts +5 -13
  330. package/src/console/ui/traces/fold.test.ts +4 -12
  331. package/src/console/ui/traces/fold.ts +1 -3
  332. package/src/console/ui/traces/mini.ts +1 -3
  333. package/src/console/ui/traces/replay.test.ts +1 -3
  334. package/src/console/ui/traces/replay.ts +1 -3
  335. package/src/console/ui/traces/sampling.ts +1 -4
  336. package/src/console/ui/traces/search.ts +4 -17
  337. package/src/console/ui/traces/tier.ts +1 -3
  338. package/src/console/ui/vault/VaultA11yView.tsx +5 -17
  339. package/src/console/ui/vault/a11y.test.tsx +1 -2
  340. package/src/console/ui/vault/blast-radius.ts +1 -3
  341. package/src/console/ui/vault/confirmation.test.ts +1 -5
  342. package/src/console/ui/vault/confirmation.ts +1 -4
  343. package/src/console/ui/vault/dormant.test.ts +1 -4
  344. package/src/console/ui/vault/export-safe.test.ts +1 -5
  345. package/src/console/ui/vault/export-safe.ts +1 -4
  346. package/src/console/ui/vault/fixture.ts +3 -3
  347. package/src/console/ui/vault/group.ts +1 -2
  348. package/src/console/ui/vault/index.ts +2 -10
  349. package/src/console/ui/vault/search.ts +2 -6
  350. package/src/console/ui/vault/types.ts +1 -1
  351. package/src/console/xss.gate.test.ts +1 -3
  352. package/src/docker/compose.ts +112 -20
  353. package/src/docker/derive.ts +5 -19
  354. package/src/docker/docker.test.ts +15 -15
  355. package/src/docker/dockerfile.integration.test.ts +12 -21
  356. package/src/docker/helpers.ts +5 -4
  357. package/src/docker/index.ts +4 -11
  358. package/src/docker/pin.ts +1 -9
  359. package/src/docker/recipes/index.ts +5 -6
  360. package/src/docker/recipes/mailpit.ts +22 -0
  361. package/src/docker/recipes/postgres.ts +17 -6
  362. package/src/docker/recipes/redis.ts +6 -1
  363. package/src/docker/recipes/rustfs.ts +33 -0
  364. package/src/docker/stack-id.test.ts +33 -0
  365. package/src/docker/stack-id.ts +25 -13
  366. package/src/docker/stack.integration.test.ts +6 -21
  367. package/src/docker/types.ts +13 -4
  368. package/src/drivers/ai-anthropic.ts +5 -14
  369. package/src/drivers/ai-mock.ts +2 -5
  370. package/src/drivers/ai-openai-compatible.ts +4 -10
  371. package/src/drivers/ai-providers.test.ts +6 -13
  372. package/src/drivers/bun-native-completeness.test.ts +6 -15
  373. package/src/drivers/channel-console.ts +6 -7
  374. package/src/drivers/channel-fcm.ts +20 -30
  375. package/src/drivers/channel-resend.ts +1 -3
  376. package/src/drivers/channel-smtp.ts +2 -6
  377. package/src/drivers/channel-types.ts +2 -12
  378. package/src/drivers/channel-unifonic.ts +2 -6
  379. package/src/drivers/channel-wa-cloud.ts +2 -6
  380. package/src/drivers/channel-webpush.ts +21 -60
  381. package/src/drivers/conformance.test.ts +2 -10
  382. package/src/drivers/conformance.ts +8 -21
  383. package/src/drivers/fs.ts +2 -8
  384. package/src/drivers/index.ts +12 -56
  385. package/src/drivers/memory.ts +14 -41
  386. package/src/drivers/pgvector.ts +7 -11
  387. package/src/drivers/postgres.ts +7 -13
  388. package/src/drivers/redis.ts +13 -37
  389. package/src/drivers/s3.ts +5 -17
  390. package/src/drivers/signal-engine.ts +12 -49
  391. package/src/drivers/signal-memory.ts +2 -8
  392. package/src/drivers/signal-nats.ts +4 -9
  393. package/src/drivers/signal-postgres.ts +62 -129
  394. package/src/drivers/signal-redis.ts +7 -21
  395. package/src/drivers/signal-types.ts +1 -4
  396. package/src/drivers/sqlite.ts +3 -12
  397. package/src/drivers/types.ts +4 -23
  398. package/src/drivers/vault-env.ts +2 -6
  399. package/src/drivers/vault-infisical.ts +1 -5
  400. package/src/drivers/vault-managed.ts +1 -5
  401. package/src/drivers/vault-memory.ts +1 -5
  402. package/src/drivers/vault-openbao.ts +1 -5
  403. package/src/drivers/vault-sops.ts +10 -35
  404. package/src/drivers/vault-types.ts +1 -7
  405. package/src/elements/ai/declare.ts +4 -14
  406. package/src/elements/ai/eval.ts +2 -6
  407. package/src/elements/ai/pii.ts +1 -3
  408. package/src/elements/ai/runtime.ts +12 -50
  409. package/src/elements/ai/schema.ts +4 -15
  410. package/src/elements/ai.test.ts +13 -24
  411. package/src/elements/ai.ts +1 -5
  412. package/src/elements/channel/consent.ts +3 -12
  413. package/src/elements/channel/costs.ts +4 -15
  414. package/src/elements/channel/declare.ts +1 -4
  415. package/src/elements/channel/email-auth.ts +1 -4
  416. package/src/elements/channel/locale.ts +2 -10
  417. package/src/elements/channel/mask.ts +1 -3
  418. package/src/elements/channel/mime.ts +2 -12
  419. package/src/elements/channel/outcomes.test.ts +1 -5
  420. package/src/elements/channel/outcomes.ts +5 -15
  421. package/src/elements/channel/receipts.ts +2 -7
  422. package/src/elements/channel/runtime.ts +28 -74
  423. package/src/elements/channel/suppression.ts +8 -14
  424. package/src/elements/channel.test.ts +8 -31
  425. package/src/elements/channel.ts +3 -14
  426. package/src/elements/clock/actions.ts +6 -18
  427. package/src/elements/clock/declare.ts +1 -3
  428. package/src/elements/clock/dst.ts +1 -5
  429. package/src/elements/clock/durable.ts +4 -16
  430. package/src/elements/clock/health.ts +2 -7
  431. package/src/elements/clock/leader.ts +2 -9
  432. package/src/elements/clock/reconcile.ts +4 -15
  433. package/src/elements/clock/runtime.ts +2 -5
  434. package/src/elements/clock/schedule.ts +4 -20
  435. package/src/elements/clock.test.ts +2 -7
  436. package/src/elements/clock.ts +5 -23
  437. package/src/elements/gate/permissions.ts +1 -4
  438. package/src/elements/gate/runtime.ts +7 -28
  439. package/src/elements/gate.ts +1 -5
  440. package/src/elements/index.ts +9 -7
  441. package/src/elements/signal/declare.ts +2 -7
  442. package/src/elements/signal/reconcile.test.ts +1 -4
  443. package/src/elements/signal/runtime.ts +1 -3
  444. package/src/elements/signal.test.ts +3 -15
  445. package/src/elements/signal.ts +2 -8
  446. package/src/elements/store/cache.test.ts +46 -0
  447. package/src/elements/store/cache.ts +3 -11
  448. package/src/elements/store/classify.ts +5 -22
  449. package/src/elements/store/declare.ts +8 -17
  450. package/src/elements/store/domain-ddl.test.ts +86 -0
  451. package/src/elements/store/emit-drizzle.ts +363 -0
  452. package/src/elements/store/files-policy.test.ts +1 -5
  453. package/src/elements/store/files-policy.ts +4 -12
  454. package/src/elements/store/load-plugin-tables.ts +103 -0
  455. package/src/elements/store/missing-relation.test.ts +83 -0
  456. package/src/elements/store/missing-relation.ts +38 -0
  457. package/src/elements/store/replica.ts +1 -4
  458. package/src/elements/store/runtime.ts +25 -28
  459. package/src/elements/store/schema-decl.test.ts +227 -0
  460. package/src/elements/store/schema-decl.ts +516 -0
  461. package/src/elements/store/sql-condition.ts +11 -21
  462. package/src/elements/store/sql-session.test.ts +50 -0
  463. package/src/elements/store/sql-session.ts +60 -63
  464. package/src/elements/store/table.ts +35 -19
  465. package/src/elements/store.test.ts +17 -39
  466. package/src/elements/store.ts +37 -31
  467. package/src/elements/vault/chain.ts +34 -0
  468. package/src/elements/vault/declare.ts +22 -32
  469. package/src/elements/vault/fingerprint.ts +2 -7
  470. package/src/elements/vault/redact.ts +2 -6
  471. package/src/elements/vault/runtime.ts +18 -32
  472. package/src/elements/vault.test.ts +12 -28
  473. package/src/elements/vault.ts +8 -12
  474. package/src/index.ts +5 -2
  475. package/src/kernel/adopt-routes.ts +15 -29
  476. package/src/kernel/app.ts +34 -94
  477. package/src/kernel/auth-resolve.ts +2 -9
  478. package/src/kernel/boot-bind/ai.ts +1 -4
  479. package/src/kernel/boot-bind/channel.ts +2 -8
  480. package/src/kernel/boot-bind/clock.ts +2 -6
  481. package/src/kernel/boot-bind/gate.ts +2 -8
  482. package/src/kernel/boot-bind/runs.ts +1 -3
  483. package/src/kernel/boot-bind/signal.ts +3 -10
  484. package/src/kernel/boot-bind/store.test.ts +17 -17
  485. package/src/kernel/boot-bind/store.ts +44 -50
  486. package/src/kernel/boot-bind/vault.ts +2 -8
  487. package/src/kernel/boot.test.ts +4 -9
  488. package/src/kernel/boot.ts +29 -76
  489. package/src/kernel/budget.test.ts +1 -3
  490. package/src/kernel/capability.ts +3 -10
  491. package/src/kernel/dry-run.test.ts +1 -4
  492. package/src/kernel/dry-run.ts +3 -11
  493. package/src/kernel/effects.test.ts +1 -5
  494. package/src/kernel/effects.ts +4 -11
  495. package/src/kernel/errors.registry.test.ts +2 -8
  496. package/src/kernel/errors.ts +23 -32
  497. package/src/kernel/flow.test.ts +12 -25
  498. package/src/kernel/flow.ts +5 -25
  499. package/src/kernel/fx.test.ts +15 -44
  500. package/src/kernel/fx.ts +27 -79
  501. package/src/kernel/hook-timing.test.ts +3 -6
  502. package/src/kernel/hook-timing.ts +5 -14
  503. package/src/kernel/hooks.test.ts +10 -10
  504. package/src/kernel/hooks.ts +3 -12
  505. package/src/kernel/index.ts +4 -17
  506. package/src/kernel/journal.ts +7 -31
  507. package/src/kernel/on.ts +1 -6
  508. package/src/kernel/pipeline.test.ts +10 -19
  509. package/src/kernel/pipeline.ts +5 -17
  510. package/src/kernel/plug.ts +4 -11
  511. package/src/kernel/plugin/conflicts.test.ts +13 -25
  512. package/src/kernel/plugin/decorate.test.ts +8 -13
  513. package/src/kernel/plugin/scoping.test.ts +4 -11
  514. package/src/kernel/plugin.ts +48 -24
  515. package/src/kernel/registry.ts +80 -29
  516. package/src/kernel/router.test.ts +15 -13
  517. package/src/kernel/router.ts +9 -29
  518. package/src/kernel/routing-budget.test.ts +1 -3
  519. package/src/kernel/run-telemetry.ts +1 -3
  520. package/src/kernel/triggers.ts +4 -21
  521. package/src/manifest/diff.test.ts +26 -91
  522. package/src/manifest/diff.ts +95 -225
  523. package/src/manifest/index.ts +2 -9
  524. package/src/manifest/types.ts +29 -5
  525. package/src/manifest/undeclared.test.ts +4 -12
  526. package/src/manifest/undeclared.ts +1 -2
  527. package/src/manifest/validate.test.ts +2 -6
  528. package/src/manifest/validate.ts +4 -14
  529. package/src/mcp/authorization.ts +8 -27
  530. package/src/mcp/confirmation.ts +3 -10
  531. package/src/mcp/data.ts +2 -6
  532. package/src/mcp/docs-index.ts +4 -7
  533. package/src/mcp/docs-mcp.test.ts +3 -12
  534. package/src/mcp/docs-server.ts +7 -27
  535. package/src/mcp/docs-tools.ts +2 -6
  536. package/src/mcp/index.ts +1 -6
  537. package/src/mcp/injection.gate.test.ts +4 -18
  538. package/src/mcp/mcp.test.ts +18 -49
  539. package/src/mcp/protocol.ts +3 -10
  540. package/src/mcp/server.ts +11 -52
  541. package/src/mcp/session.ts +4 -14
  542. package/src/mcp/tools.ts +14 -50
  543. package/src/plugins/catalogue.test.ts +3 -7
  544. package/src/plugins/catalogue.ts +1 -3
  545. package/src/plugins/node-import-scan.ts +2 -5
  546. package/src/plugins/supply-chain.ts +5 -17
  547. package/src/release/exports.ts +3 -8
  548. package/src/release/measure.exports.test.ts +1 -3
  549. package/src/release/measure.ts +15 -43
  550. package/src/runs/bench.test.ts +1 -3
  551. package/src/runs/collect.ts +8 -25
  552. package/src/runs/drivers/clickhouse.ts +2 -9
  553. package/src/runs/drivers/files.ts +9 -31
  554. package/src/runs/drivers/memory.ts +5 -22
  555. package/src/runs/drivers/postgres.ts +8 -20
  556. package/src/runs/duckdb.ts +2 -8
  557. package/src/runs/index.ts +3 -14
  558. package/src/runs/outlier.ts +3 -10
  559. package/src/runs/parquet.ts +8 -26
  560. package/src/runs/privacy.ts +2 -8
  561. package/src/runs/runs.test.ts +3 -9
  562. package/src/runs/runtime.ts +7 -32
  563. package/src/runs/shred.ts +10 -29
  564. package/src/runs/types.ts +1 -4
  565. package/src/runtime/bun.ts +4 -15
  566. package/src/runtime/cold-start.bench.ts +1 -3
  567. package/src/runtime/dev-request-log.test.ts +1 -4
  568. package/src/runtime/dev-request-log.ts +1 -4
  569. package/src/runtime/index.ts +1 -6
  570. package/src/runtime/primitives.ts +5 -4
  571. package/src/runtime/security.ts +3 -13
  572. package/src/runtime/serve.test.ts +4 -7
  573. package/src/runtime/types.ts +1 -4
  574. package/src/runtime/web-standard.ts +3 -15
  575. package/src/term.test.ts +4 -6
  576. package/src/term.ts +49 -98
  577. package/src/test/create-test-app.test.ts +4 -14
  578. package/src/test/create-test-app.ts +13 -31
  579. package/src/test/provisions.integration.test.ts +3 -11
  580. package/src/upgrade/codemods.test.ts +25 -6
  581. package/src/upgrade/codemods.ts +116 -3
  582. package/src/validation/standard-schema.test.ts +2 -5
  583. package/src/validation/standard-schema.ts +13 -33
  584. package/src/console/ui/dist/assets/panel-vault-BbfWdox0.js +0 -1
package/package.json CHANGED
@@ -1,39 +1,72 @@
1
1
  {
2
2
  "name": "okengine",
3
- "version": "0.2.5",
3
+ "version": "0.2.8",
4
4
  "description": "One law. Eight elements. Ten exports. One package. One manifest. Every backend need is derived, never added.",
5
5
  "license": "MIT",
6
- "type": "module",
7
- "sideEffects": false,
8
6
  "repository": {
9
7
  "type": "git",
10
8
  "url": "git+https://github.com/omqkhafi/okengine.git"
11
9
  },
10
+ "bin": {
11
+ "oke": "src/cli/index.ts"
12
+ },
12
13
  "workspaces": [
13
14
  "packages/*",
14
15
  "examples/*",
15
16
  "site"
16
17
  ],
18
+ "files": [
19
+ "src",
20
+ "spec",
21
+ "AGENTS.md",
22
+ "docs/spec"
23
+ ],
24
+ "type": "module",
25
+ "sideEffects": false,
26
+ "exports": {
27
+ ".": "./src/index.ts",
28
+ "./client": "./src/client/index.ts",
29
+ "./test": "./src/test/index.ts",
30
+ "./config": "./src/config/index.ts",
31
+ "./auth": "./src/auth/index.ts",
32
+ "./console": "./src/console/index.ts",
33
+ "./mcp": "./src/mcp/index.ts",
34
+ "./store": "./src/elements/store.ts",
35
+ "./signal": "./src/elements/signal.ts",
36
+ "./clock": "./src/elements/clock.ts",
37
+ "./gate": "./src/elements/gate.ts",
38
+ "./vault": "./src/elements/vault.ts",
39
+ "./channel": "./src/elements/channel.ts",
40
+ "./ai": "./src/elements/ai.ts",
41
+ "./runs": "./src/runs/index.ts",
42
+ "./drivers": "./src/drivers/index.ts",
43
+ "./drivers/*": "./src/drivers/*"
44
+ },
17
45
  "scripts": {
18
- "typecheck": "tsc --noEmit",
46
+ "typecheck": "tsc --noEmit && bun run --cwd packages/create-oke typecheck",
47
+ "lint": "oxlint --type-aware --quiet",
48
+ "lint:fix": "oxlint --type-aware --fix",
49
+ "fmt": "oxfmt",
50
+ "fmt:check": "oxfmt --check",
19
51
  "test": "bun test --pass-with-no-tests",
20
52
  "test:coverage": "bun test --coverage --pass-with-no-tests",
21
53
  "test:console:smoke": "bunx playwright test tests/console/smoke.spec.ts",
22
- "test:integration": "bun test examples/notes examples/linkly examples/provisions examples/skyport examples/skyport/tests/docker.test.ts && bun run --cwd packages/create-oke typecheck && bun test packages/create-oke/src && CREATE_OKE_INTEGRATION=1 bun test --timeout 180000 packages/create-oke/tests/scaffold.integration.test.ts packages/create-oke/tests/dev.integration.test.ts",
23
54
  "build": "bunx vite build --config src/console/ui/vite.config.ts",
24
55
  "prepack": "bun run build",
25
56
  "bench": "bun test ./src/runtime/cold-start.bench.ts src/client/budget.test.ts src/console/budget.test.ts src/kernel/budget.test.ts src/kernel/routing-budget.test.ts src/runs/bench.test.ts",
26
57
  "budgets": "bun src/release/publish.ts",
27
- "gate": "bun src/cli/doctor-diff-examples.ts && bun test src/kernel/errors.registry.test.ts src/upgrade/codemods.test.ts scripts/publish.gate.test.ts && bun src/cli/doc-drift.ts",
58
+ "gate": "bun src/cli/doctor-diff-examples.ts && bun src/cli/doc-drift.ts",
28
59
  "site:sync": "bun run --cwd site sync",
29
60
  "site:dev": "bun run --cwd site dev",
30
61
  "site:build": "bun run --cwd site build",
31
- "ci": "bun run bench && bun run typecheck && bun run test && bun run budgets && bun run gate && bun run site:build && bun run test:integration",
62
+ "ci": "bun run typecheck && bun run lint && bun run fmt:check && bun run test && bun run budgets -- --dry-run && bun run gate && bun run site:build",
63
+ "ci:integration": "CREATE_OKE_INTEGRATION=1 bun run ci",
32
64
  "bump": "bun run scripts/bump-version.ts",
33
- "publish": "bun run scripts/publish.ts",
65
+ "release": "bun run scripts/publish.ts",
34
66
  "g": "gflows"
35
67
  },
36
68
  "dependencies": {
69
+ "@clack/prompts": "^1.7.0",
37
70
  "@duckdb/node-api": "^1.5.5-r.1",
38
71
  "ajv": "^8.20.0",
39
72
  "ajv-formats": "^3.0.1",
@@ -41,7 +74,6 @@
41
74
  "sently": "^0.8.0"
42
75
  },
43
76
  "devDependencies": {
44
- "age-encryption": "^0.3.0",
45
77
  "@base-ui/react": "^1.6.0",
46
78
  "@codemirror/commands": "^6.10.4",
47
79
  "@codemirror/lang-json": "^6.0.2",
@@ -58,6 +90,7 @@
58
90
  "@types/react": "^19.2.17",
59
91
  "@types/react-dom": "^19.2.3",
60
92
  "@vitejs/plugin-react": "^6.0.4",
93
+ "age-encryption": "^0.3.0",
61
94
  "arktype": "^2.2.3",
62
95
  "axe-core": "^4.12.1",
63
96
  "clsx": "^2.1.1",
@@ -68,6 +101,9 @@
68
101
  "gflows": "^1.2.1",
69
102
  "happy-dom": "^20.11.1",
70
103
  "mermaid": "^11.16.0",
104
+ "oxfmt": "^0.61.0",
105
+ "oxlint": "^1.76.0",
106
+ "oxlint-tsgolint": "^7.0.2001",
71
107
  "playwright": "^1.62.0",
72
108
  "react": "^19.2.8",
73
109
  "react-dom": "^19.2.8",
@@ -103,33 +139,5 @@
103
139
  },
104
140
  "engines": {
105
141
  "bun": ">=1.3"
106
- },
107
- "bin": {
108
- "oke": "src/cli/index.ts"
109
- },
110
- "exports": {
111
- ".": "./src/index.ts",
112
- "./client": "./src/client/index.ts",
113
- "./test": "./src/test/index.ts",
114
- "./config": "./src/config/index.ts",
115
- "./auth": "./src/auth/index.ts",
116
- "./console": "./src/console/index.ts",
117
- "./mcp": "./src/mcp/index.ts",
118
- "./store": "./src/elements/store.ts",
119
- "./signal": "./src/elements/signal.ts",
120
- "./clock": "./src/elements/clock.ts",
121
- "./gate": "./src/elements/gate.ts",
122
- "./vault": "./src/elements/vault.ts",
123
- "./channel": "./src/elements/channel.ts",
124
- "./ai": "./src/elements/ai.ts",
125
- "./runs": "./src/runs/index.ts",
126
- "./drivers": "./src/drivers/index.ts",
127
- "./drivers/*": "./src/drivers/*"
128
- },
129
- "files": [
130
- "src",
131
- "spec",
132
- "AGENTS.md",
133
- "docs/spec"
134
- ]
142
+ }
135
143
  }
@@ -104,10 +104,7 @@
104
104
  "$defs": {
105
105
  "JsonSchema": {
106
106
  "description": "A JSON Schema document, or an opaque string ref produced by extraction.",
107
- "oneOf": [
108
- { "type": "string", "minLength": 1 },
109
- { "type": "object" }
110
- ]
107
+ "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "object" }]
111
108
  },
112
109
  "ResourceRef": {
113
110
  "description": "Store resource: facet:name (sql:table, kv:namespace, files:bucket, index:name).",
@@ -289,10 +286,7 @@
289
286
  "durable": { "type": "boolean" },
290
287
  "live": { "type": "boolean" },
291
288
  "cache": {
292
- "oneOf": [
293
- { "type": "boolean" },
294
- { "type": "string", "minLength": 1 }
295
- ]
289
+ "oneOf": [{ "type": "boolean" }, { "type": "string", "minLength": 1 }]
296
290
  },
297
291
  "cacheKeys": {
298
292
  "description": "Computed invalidation key expression (derived or declared).",
@@ -342,6 +336,38 @@
342
336
  "retain": { "type": "string", "minLength": 1 }
343
337
  }
344
338
  },
339
+ "DeclaredColumn": {
340
+ "description": "Abstract schema column (DDL shape + optional classification). Bare ColumnClassification remains valid.",
341
+ "type": "object",
342
+ "additionalProperties": false,
343
+ "properties": {
344
+ "type": { "type": "string", "enum": ["text", "integer"] },
345
+ "nullable": { "type": "boolean" },
346
+ "primaryKey": { "type": "boolean" },
347
+ "unique": { "type": "boolean" },
348
+ "default": {
349
+ "anyOf": [
350
+ { "type": "string" },
351
+ { "type": "number" },
352
+ { "type": "boolean" },
353
+ { "type": "null" }
354
+ ]
355
+ },
356
+ "sqlName": { "type": "string", "minLength": 1 },
357
+ "pii": { "type": "boolean" },
358
+ "sensitive": { "type": "boolean" },
359
+ "retain": { "type": "string", "minLength": 1 },
360
+ "references": {
361
+ "description": "Foreign key target from field.*.references().",
362
+ "type": "object",
363
+ "additionalProperties": false,
364
+ "properties": {
365
+ "table": { "type": "string", "minLength": 1 },
366
+ "column": { "type": "string", "minLength": 1 }
367
+ }
368
+ }
369
+ }
370
+ },
345
371
  "Table": {
346
372
  "type": "object",
347
373
  "additionalProperties": false,
@@ -349,7 +375,12 @@
349
375
  "columns": {
350
376
  "type": "object",
351
377
  "propertyNames": { "type": "string", "minLength": 1 },
352
- "additionalProperties": { "$ref": "#/$defs/ColumnClassification" }
378
+ "additionalProperties": {
379
+ "oneOf": [
380
+ { "$ref": "#/$defs/DeclaredColumn" },
381
+ { "$ref": "#/$defs/ColumnClassification" }
382
+ ]
383
+ }
353
384
  },
354
385
  "classifications": {
355
386
  "description": "Field → classification tags (pii, sensitive, retain duration).",
@@ -56,9 +56,7 @@ export function createApiKeyStore(): ApiKeyStore {
56
56
  export async function hashApiKeySecret(secret: string): Promise<string> {
57
57
  const bytes = new TextEncoder().encode(secret);
58
58
  const digest = await crypto.subtle.digest("SHA-256", bytes);
59
- return [...new Uint8Array(digest)]
60
- .map((b) => b.toString(16).padStart(2, "0"))
61
- .join("");
59
+ return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
62
60
  }
63
61
 
64
62
  /**
@@ -156,8 +154,7 @@ export async function rotateApiKey(
156
154
  ): Promise<CreatedApiKey | null> {
157
155
  const row = store.keys.get(id);
158
156
  if (!row || row.revokedAt !== null) return null;
159
- const secret =
160
- options.secret ?? `oke_${id.replace(/-/g, "")}_${randomSecret()}`;
157
+ const secret = options.secret ?? `oke_${id.replace(/-/g, "")}_${randomSecret()}`;
161
158
  row.hash = await hashApiKeySecret(secret);
162
159
  return { row, secret };
163
160
  }
@@ -20,10 +20,7 @@ export interface AttenuationResult {
20
20
  * @param held - Raw scopes from the principal / session
21
21
  * @param catalog - Manifest-derived Module:Action pairs
22
22
  */
23
- export function expandHeldScopes(
24
- held: Iterable<string>,
25
- catalog: readonly string[],
26
- ): Set<string> {
23
+ export function expandHeldScopes(held: Iterable<string>, catalog: readonly string[]): Set<string> {
27
24
  const out = new Set<string>();
28
25
  let star = false;
29
26
  for (const s of held) {
@@ -48,8 +45,7 @@ export function attenuateScopes(
48
45
  creatorScopes: ReadonlySet<string> | Iterable<string>,
49
46
  requestedScopes: Iterable<string>,
50
47
  ): AttenuationResult {
51
- const creator =
52
- creatorScopes instanceof Set ? creatorScopes : new Set(creatorScopes);
48
+ const creator = creatorScopes instanceof Set ? creatorScopes : new Set(creatorScopes);
53
49
  const excess: string[] = [];
54
50
  for (const scope of requestedScopes) {
55
51
  if (!creator.has(scope)) excess.push(scope);
@@ -41,22 +41,46 @@ describe("auth plugin", () => {
41
41
  test("registers oke_ tables on both planes", () => {
42
42
  const tables: string[] = [];
43
43
  auth({ secret: "test" }).register({
44
- hook() { return this; },
45
- decorate() { return this; },
46
- element() { return this; },
47
- needs() { return this; },
48
- errors() { return this; },
49
- consolePanel() { return this; },
50
- cli() { return this; },
51
- driver() { return this; },
52
- image() { return this; },
44
+ hook() {
45
+ return this;
46
+ },
47
+ decorate() {
48
+ return this;
49
+ },
50
+ element() {
51
+ return this;
52
+ },
53
+ needs() {
54
+ return this;
55
+ },
56
+ errors() {
57
+ return this;
58
+ },
59
+ consolePanel() {
60
+ return this;
61
+ },
62
+ cli() {
63
+ return this;
64
+ },
65
+ driver() {
66
+ return this;
67
+ },
68
+ image() {
69
+ return this;
70
+ },
53
71
  table(name) {
54
72
  tables.push(name);
55
73
  return this;
56
74
  },
57
- flow() { return this; },
58
- client() { return this; },
59
- config() { return this; },
75
+ flow() {
76
+ return this;
77
+ },
78
+ client() {
79
+ return this;
80
+ },
81
+ config() {
82
+ return this;
83
+ },
60
84
  });
61
85
  expect(tables).toContain("oke_operators");
62
86
  expect(tables).toContain("oke_operator_credentials");
@@ -141,13 +165,15 @@ describe("cross-plane compile error", () => {
141
165
  expect(diags.some((d) => d.message.includes("fx.auth"))).toBe(true);
142
166
  expect(diags.some((d) => d.message.includes("cross-plane call"))).toBe(true);
143
167
 
144
- expect(() => assertCrossPlane(manifest, [
145
- {
146
- path: "x.ts",
147
- flow: "console.store.query",
148
- source: `plane: "operator"; fx.auth.userId`,
149
- },
150
- ])).toThrow(CrossPlaneError);
168
+ expect(() =>
169
+ assertCrossPlane(manifest, [
170
+ {
171
+ path: "x.ts",
172
+ flow: "console.store.query",
173
+ source: `plane: "operator"; fx.auth.userId`,
174
+ },
175
+ ]),
176
+ ).toThrow(CrossPlaneError);
151
177
 
152
178
  const user = userPrincipal({ userId: "u1", scopes: ["bookings:create"] });
153
179
  expect(() => assertPlaneAccess(user, "operator")).toThrow(CrossPlaneError);
@@ -172,14 +198,14 @@ describe("hybrid sessions", () => {
172
198
  expect(rotated.accessToken).not.toBe(issued.accessToken);
173
199
 
174
200
  // Reuse of the old refresh token revokes the family.
175
- await expect(
176
- rotateRefresh(store, crypto, issued.refreshToken),
177
- ).rejects.toMatchObject({ name: "SessionError" });
201
+ await expect(rotateRefresh(store, crypto, issued.refreshToken)).rejects.toMatchObject({
202
+ name: "SessionError",
203
+ });
178
204
 
179
205
  // Family revoked — the rotated refresh is also dead.
180
- await expect(
181
- rotateRefresh(store, crypto, rotated.refreshToken),
182
- ).rejects.toBeInstanceOf(SessionError);
206
+ await expect(rotateRefresh(store, crypto, rotated.refreshToken)).rejects.toBeInstanceOf(
207
+ SessionError,
208
+ );
183
209
  });
184
210
  });
185
211
 
@@ -193,9 +219,7 @@ describe("operator plane", () => {
193
219
  });
194
220
 
195
221
  expect(store.credentials.has(op.id)).toBe(true);
196
- expect(() => removeOperatorCredential(store, op.id)).toThrow(
197
- /cannot be removed/,
198
- );
222
+ expect(() => removeOperatorCredential(store, op.id)).toThrow(/cannot be removed/);
199
223
  expect(store.credentials.has(op.id)).toBe(true);
200
224
 
201
225
  linkOperatorSso(store, op.id, "oidc", "sub-123");
@@ -266,8 +290,6 @@ describe("roles are data", () => {
266
290
  });
267
291
 
268
292
  test("assertAttenuated helper", () => {
269
- expect(() =>
270
- assertAttenuated(new Set(["a"]), ["a", "b"], "api key"),
271
- ).toThrow(/missing: b/);
293
+ expect(() => assertAttenuated(new Set(["a"]), ["a", "b"], "api key")).toThrow(/missing: b/);
272
294
  });
273
295
  });
@@ -36,9 +36,7 @@ export function invokeAs(options: InvokeAsOptions): UserPrincipal {
36
36
  assertAttenuated(options.operatorScopes, options.scopes, "invoke-as");
37
37
 
38
38
  if (options.impersonateRealUser && !options.development) {
39
- throw new Error(
40
- "invoke-as: impersonating a real user is development-only",
41
- );
39
+ throw new Error("invoke-as: impersonating a real user is development-only");
42
40
  }
43
41
 
44
42
  return userPrincipal({
@@ -8,11 +8,7 @@
8
8
  */
9
9
 
10
10
  import { createBunCrypto } from "../runtime/primitives.ts";
11
- import type {
12
- OperatorCredentialRow,
13
- OperatorRow,
14
- OperatorSsoLinkRow,
15
- } from "./tables.ts";
11
+ import type { OperatorCredentialRow, OperatorRow, OperatorSsoLinkRow } from "./tables.ts";
16
12
 
17
13
  /** Operator-plane store. */
18
14
  export interface OperatorStore {
@@ -82,15 +78,10 @@ export async function createOperator(
82
78
  * @param store - Operator store
83
79
  * @param operatorId - Operator id
84
80
  */
85
- export function removeOperatorCredential(
86
- store: OperatorStore,
87
- operatorId: string,
88
- ): never {
81
+ export function removeOperatorCredential(store: OperatorStore, operatorId: string): never {
89
82
  void store;
90
83
  void operatorId;
91
- throw new OperatorError(
92
- "operator local credential cannot be removed; SSO is additive only",
93
- );
84
+ throw new OperatorError("operator local credential cannot be removed; SSO is additive only");
94
85
  }
95
86
 
96
87
  /**
@@ -111,9 +102,7 @@ export function linkOperatorSso(
111
102
  throw new OperatorError(`unknown operator: ${operatorId}`);
112
103
  }
113
104
  if (!store.credentials.has(operatorId)) {
114
- throw new OperatorError(
115
- "operator is missing local credential — invariant violated",
116
- );
105
+ throw new OperatorError("operator is missing local credential — invariant violated");
117
106
  }
118
107
  const link: OperatorSsoLinkRow = { operatorId, provider, subject };
119
108
  const list = store.ssoLinks.get(operatorId) ?? [];
@@ -128,14 +117,9 @@ export function linkOperatorSso(
128
117
  */
129
118
  let dummyPasswordHash: string | null = null;
130
119
 
131
- async function dummyHash(
132
- crypto: ReturnType<typeof createBunCrypto>,
133
- ): Promise<string> {
120
+ async function dummyHash(crypto: ReturnType<typeof createBunCrypto>): Promise<string> {
134
121
  if (dummyPasswordHash === null) {
135
- dummyPasswordHash = await crypto.hashPassword(
136
- "oke-operator-timing-dummy",
137
- "argon2id",
138
- );
122
+ dummyPasswordHash = await crypto.hashPassword("oke-operator-timing-dummy", "argon2id");
139
123
  }
140
124
  return dummyPasswordHash;
141
125
  }
@@ -157,10 +141,8 @@ export async function authenticateOperator(
157
141
  ): Promise<OperatorRow | null> {
158
142
  const crypto = createBunCrypto();
159
143
  const op = [...store.operators.values()].find((o) => o.email === email);
160
- const cred =
161
- op && op.status === "active" ? store.credentials.get(op.id) : undefined;
162
- const hash =
163
- cred && cred.loginEnabled ? cred.passwordHash : await dummyHash(crypto);
144
+ const cred = op && op.status === "active" ? store.credentials.get(op.id) : undefined;
145
+ const hash = cred && cred.loginEnabled ? cred.passwordHash : await dummyHash(crypto);
164
146
  const ok = await crypto.verifyPassword(password, hash);
165
147
  if (!ok || !op || !cred || !cred.loginEnabled || op.status !== "active") {
166
148
  return null;
@@ -81,14 +81,9 @@ export function operatorPrincipal(fields: {
81
81
  * @param principal - Acting principal
82
82
  * @param flowPlane - Target flow plane
83
83
  */
84
- export function assertPlaneAccess(
85
- principal: Principal,
86
- flowPlane: AuthPlane,
87
- ): void {
84
+ export function assertPlaneAccess(principal: Principal, flowPlane: AuthPlane): void {
88
85
  if (principal.plane === "user" && flowPlane === "operator") {
89
- throw new CrossPlaneError(
90
- "application principal cannot reach a console (operator) flow",
91
- );
86
+ throw new CrossPlaneError("application principal cannot reach a console (operator) flow");
92
87
  }
93
88
  }
94
89
 
@@ -23,15 +23,12 @@ export interface AuthPluginOptions {
23
23
  * @param options - Session crypto options
24
24
  */
25
25
  export function auth(options: AuthPluginOptions = {}): PluginDef {
26
- let builder = plugin("auth", { version: "0.0.1", config: options }).hook(
27
- "onAuth",
28
- (_ctx) => {
29
- /* principals resolved by session / API key middleware at runtime */
30
- },
31
- );
26
+ let builder = plugin("auth", { version: "0.0.1", config: options }).hook("onAuth", (_ctx) => {
27
+ /* principals resolved by session / API key middleware at runtime */
28
+ });
32
29
 
33
30
  for (const name of Object.values(AUTH_TABLES)) {
34
- builder = builder.table(name, {
31
+ builder = builder.table(name, undefined, {
35
32
  plane: name.includes("operator")
36
33
  ? "operator"
37
34
  : name.includes("identit") || name === AUTH_TABLES.credentials
package/src/auth/roles.ts CHANGED
@@ -38,11 +38,7 @@ export function upsertRole(store: RoleStore, role: RoleRow): void {
38
38
  * @param roleId - Role id
39
39
  * @param actions - Module:Action pairs
40
40
  */
41
- export function setRoleGrants(
42
- store: RoleStore,
43
- roleId: string,
44
- actions: readonly string[],
45
- ): void {
41
+ export function setRoleGrants(store: RoleStore, roleId: string, actions: readonly string[]): void {
46
42
  if (!store.roles.has(roleId)) {
47
43
  throw new Error(`unknown role: ${roleId}`);
48
44
  }
@@ -229,10 +229,7 @@ const sessionAudiences = new Map<string, string>();
229
229
  * @param sessionId - Session id
230
230
  * @param scopes - Scopes
231
231
  */
232
- export function bindSessionScopes(
233
- sessionId: string,
234
- scopes: Iterable<string>,
235
- ): void {
232
+ export function bindSessionScopes(sessionId: string, scopes: Iterable<string>): void {
236
233
  sessionScopes.set(sessionId, [...scopes]);
237
234
  }
238
235
 
@@ -242,10 +239,7 @@ export function bindSessionScopes(
242
239
  * @param sessionId - Session id
243
240
  * @param audience - Audience claim
244
241
  */
245
- export function bindSessionAudience(
246
- sessionId: string,
247
- audience: string,
248
- ): void {
242
+ export function bindSessionAudience(sessionId: string, audience: string): void {
249
243
  sessionAudiences.set(sessionId, audience);
250
244
  }
251
245
 
@@ -292,9 +286,7 @@ export async function verifyAccess(
292
286
  nowOrOptions: (() => number) | VerifyAccessOptions = () => Date.now(),
293
287
  ): Promise<AccessClaims> {
294
288
  const options: VerifyAccessOptions =
295
- typeof nowOrOptions === "function"
296
- ? { now: nowOrOptions }
297
- : nowOrOptions;
289
+ typeof nowOrOptions === "function" ? { now: nowOrOptions } : nowOrOptions;
298
290
  const now = options.now ?? (() => Date.now());
299
291
  const claims = await verifyAccessSignature(secret, token);
300
292
  if (claims.exp <= now()) {
@@ -302,9 +294,7 @@ export async function verifyAccess(
302
294
  }
303
295
  if (options.audience !== undefined) {
304
296
  if (claims.aud !== options.audience) {
305
- throw new SessionError(
306
- `access token audience mismatch: expected ${options.audience}`,
307
- );
297
+ throw new SessionError(`access token audience mismatch: expected ${options.audience}`);
308
298
  }
309
299
  }
310
300
  const session = store.sessions.get(claims.sid);
@@ -325,11 +315,7 @@ export async function verifyAccess(
325
315
  * @param familyId - Family id
326
316
  * @param at - Timestamp
327
317
  */
328
- export function revokeFamily(
329
- store: SessionStore,
330
- familyId: string,
331
- at: number = Date.now(),
332
- ): void {
318
+ export function revokeFamily(store: SessionStore, familyId: string, at: number = Date.now()): void {
333
319
  for (const session of store.sessions.values()) {
334
320
  if (session.familyId === familyId) session.revokedAt = at;
335
321
  }
@@ -348,23 +334,15 @@ export class SessionError extends Error {
348
334
  }
349
335
 
350
336
  async function hashToken(raw: string): Promise<string> {
351
- const digest = await crypto.subtle.digest(
352
- "SHA-256",
353
- new TextEncoder().encode(raw),
354
- );
355
- return [...new Uint8Array(digest)]
356
- .map((b) => b.toString(16).padStart(2, "0"))
357
- .join("");
337
+ const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
338
+ return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
358
339
  }
359
340
 
360
341
  function cryptoRandomId(): string {
361
342
  return crypto.randomUUID().replace(/-/g, "");
362
343
  }
363
344
 
364
- async function signAccess(
365
- secret: string,
366
- claims: AccessClaims,
367
- ): Promise<string> {
345
+ async function signAccess(secret: string, claims: AccessClaims): Promise<string> {
368
346
  const header = b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
369
347
  const payload = b64url(JSON.stringify(claims));
370
348
  const data = `${header}.${payload}`;
@@ -372,10 +350,7 @@ async function signAccess(
372
350
  return `${data}.${sig}`;
373
351
  }
374
352
 
375
- async function verifyAccessSignature(
376
- secret: string,
377
- token: string,
378
- ): Promise<AccessClaims> {
353
+ async function verifyAccessSignature(secret: string, token: string): Promise<AccessClaims> {
379
354
  const parts = token.split(".");
380
355
  if (parts.length !== 3) throw new SessionError("malformed access token");
381
356
  const [header, payload, sig] = parts as [string, string, string];
@@ -393,11 +368,7 @@ async function hmac(secret: string, data: string): Promise<string> {
393
368
  false,
394
369
  ["sign"],
395
370
  );
396
- const sig = await crypto.subtle.sign(
397
- "HMAC",
398
- key,
399
- new TextEncoder().encode(data),
400
- );
371
+ const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
401
372
  return b64urlBytes(new Uint8Array(sig));
402
373
  }
403
374
 
package/src/cli/args.ts CHANGED
@@ -41,10 +41,6 @@ export function flagValue(
41
41
  * @param long - Long flag
42
42
  * @param short - Optional short flag
43
43
  */
44
- export function hasFlag(
45
- args: readonly string[],
46
- long: string,
47
- short?: string,
48
- ): boolean {
44
+ export function hasFlag(args: readonly string[], long: string, short?: string): boolean {
49
45
  return args.includes(long) || (short !== undefined && args.includes(short));
50
46
  }