okengine 0.2.5 → 0.2.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +24 -23
- package/README.md +52 -346
- package/docs/spec/console.md +165 -142
- package/docs/spec/example.md +490 -312
- package/docs/spec/four-applications.md +495 -314
- package/docs/spec/unified-theory.md +184 -175
- package/package.json +46 -38
- package/spec/manifest.v1.schema.json +40 -9
- package/src/auth/api-keys.ts +2 -5
- package/src/auth/attenuation.ts +2 -6
- package/src/auth/auth.test.ts +53 -31
- package/src/auth/invoke-as.ts +1 -3
- package/src/auth/operator.ts +8 -26
- package/src/auth/planes.ts +2 -7
- package/src/auth/plugin.ts +4 -7
- package/src/auth/roles.ts +1 -5
- package/src/auth/sessions.ts +10 -39
- package/src/cli/args.ts +1 -5
- package/src/cli/ask-dev-mode.ts +40 -0
- package/src/cli/build.ts +1 -2
- package/src/cli/client-add.test.ts +8 -15
- package/src/cli/client-add.ts +5 -14
- package/src/cli/completion.test.ts +1 -5
- package/src/cli/completion.ts +4 -17
- package/src/cli/db-auto-push.test.ts +64 -0
- package/src/cli/db-auto-push.ts +72 -0
- package/src/cli/db.test.ts +189 -0
- package/src/cli/db.ts +386 -0
- package/src/cli/dev-app-runner.ts +2 -8
- package/src/cli/dev-db-push.test.ts +163 -0
- package/src/cli/dev-mode.test.ts +45 -0
- package/src/cli/dev-mode.ts +78 -0
- package/src/cli/dev.test.ts +148 -21
- package/src/cli/dev.ts +208 -134
- package/src/cli/doc-drift.test.ts +3 -2
- package/src/cli/doc-drift.ts +21 -50
- package/src/cli/doc-staleness.test.ts +69 -0
- package/src/cli/docker-cli.test.ts +7 -8
- package/src/cli/docker.ts +1 -3
- package/src/cli/doctor-diff-examples.ts +1 -3
- package/src/cli/doctor-diff.test.ts +1 -5
- package/src/cli/doctor-diff.ts +17 -46
- package/src/cli/doctor-pii.ts +2 -7
- package/src/cli/doctor.test.ts +26 -4
- package/src/cli/doctor.ts +35 -11
- package/src/cli/eval.ts +4 -14
- package/src/cli/gates-list.ts +1 -4
- package/src/cli/hero-meta.test.ts +17 -19
- package/src/cli/hero-meta.ts +20 -30
- package/src/cli/images.ts +3 -8
- package/src/cli/index.ts +11 -2
- package/src/cli/load-config.images.test.ts +14 -14
- package/src/cli/load-config.ts +41 -47
- package/src/cli/mcp-from-console.ts +1 -4
- package/src/cli/mode.ts +45 -0
- package/src/cli/ports.test.ts +4 -13
- package/src/cli/ports.ts +1 -3
- package/src/cli/privacy-erase.ts +1 -3
- package/src/cli/registry.ts +75 -25
- package/src/cli/schema.ts +3 -10
- package/src/cli/stack.ts +2 -7
- package/src/cli/start.ts +4 -15
- package/src/cli/upgrade.ts +1 -4
- package/src/client/budget-entry.ts +1 -6
- package/src/client/create.test.ts +6 -12
- package/src/client/create.ts +2 -8
- package/src/client/errors.ts +1 -4
- package/src/client/index.ts +1 -6
- package/src/client/notes-contract.test.ts +4 -13
- package/src/client/transport.ts +9 -30
- package/src/client/types.ts +8 -29
- package/src/compiler/aot.test.ts +2 -9
- package/src/compiler/aot.ts +1 -4
- package/src/compiler/differential.test.ts +3 -11
- package/src/compiler/dynamic.ts +1 -4
- package/src/compiler/effects-infer.ts +8 -34
- package/src/compiler/emit.ts +1 -3
- package/src/compiler/extract.test.ts +96 -30
- package/src/compiler/extract.ts +362 -156
- package/src/compiler/fixtures/skyport/oke.config.ts +1 -1
- package/src/compiler/fixtures/skyport/src/flows/bookings/index.ts +7 -3
- package/src/compiler/fixtures/skyport/src/flows/payments/index.ts +1 -3
- package/src/compiler/fixtures/skyport/src/flows/support/index.ts +4 -1
- package/src/compiler/fixtures/skyport.expected.json +24 -83
- package/src/compiler/fixtures/triggers/five-triggers.ts +1 -2
- package/src/compiler/http-parse.ts +2 -9
- package/src/compiler/index.ts +1 -5
- package/src/compiler/response.ts +4 -7
- package/src/compiler/sucrose.ts +11 -31
- package/src/config/define-config.test.ts +57 -34
- package/src/config/index.ts +181 -37
- package/src/config/resolve-driver.test.ts +28 -17
- package/src/console/budget.test.ts +1 -4
- package/src/console/index.ts +1 -4
- package/src/console/server/access.test.ts +15 -43
- package/src/console/server/access.ts +19 -49
- package/src/console/server/ai.test.ts +3 -11
- package/src/console/server/ai.ts +23 -46
- package/src/console/server/app.ts +14 -45
- package/src/console/server/auth-rate.test.ts +4 -12
- package/src/console/server/bind.ts +1 -5
- package/src/console/server/channels.test.ts +2 -6
- package/src/console/server/channels.ts +10 -35
- package/src/console/server/claim.ts +2 -8
- package/src/console/server/clock.test.ts +2 -6
- package/src/console/server/clock.ts +8 -26
- package/src/console/server/console.test.ts +1 -3
- package/src/console/server/diff.test.ts +5 -17
- package/src/console/server/diff.ts +10 -31
- package/src/console/server/dry-run.audit.test.ts +2 -8
- package/src/console/server/flows.ts +64 -233
- package/src/console/server/gates.test.ts +14 -50
- package/src/console/server/gates.ts +13 -48
- package/src/console/server/index.ts +2 -9
- package/src/console/server/live.ts +3 -12
- package/src/console/server/operator-db.test.ts +4 -15
- package/src/console/server/operator-db.ts +13 -32
- package/src/console/server/plugin.ts +50 -53
- package/src/console/server/plugins.test.ts +2 -6
- package/src/console/server/plugins.ts +17 -56
- package/src/console/server/runs-pii.ts +2 -7
- package/src/console/server/security.gate.test.ts +18 -40
- package/src/console/server/serve.ts +10 -25
- package/src/console/server/signals.test.ts +1 -3
- package/src/console/server/signals.ts +17 -40
- package/src/console/server/state.ts +21 -59
- package/src/console/server/store.test.ts +20 -22
- package/src/console/server/store.ts +31 -76
- package/src/console/server/vault.test.ts +12 -29
- package/src/console/server/vault.ts +23 -60
- package/src/console/ui/access/AccessA11yView.tsx +6 -21
- package/src/console/ui/access/a11y.test.tsx +3 -12
- package/src/console/ui/access/acknowledgement.test.ts +1 -4
- package/src/console/ui/access/acknowledgement.ts +1 -3
- package/src/console/ui/access/blast-radius.ts +1 -3
- package/src/console/ui/access/confirmation.test.ts +1 -5
- package/src/console/ui/access/confirmation.ts +1 -4
- package/src/console/ui/access/fixture.ts +1 -5
- package/src/console/ui/access/grantable.test.ts +1 -3
- package/src/console/ui/access/grantable.ts +2 -7
- package/src/console/ui/access/index.ts +2 -9
- package/src/console/ui/access/provenance.test.ts +1 -3
- package/src/console/ui/access/provenance.ts +2 -6
- package/src/console/ui/access/search.test.ts +1 -5
- package/src/console/ui/access/search.ts +2 -6
- package/src/console/ui/ai/AiA11yView.tsx +6 -17
- package/src/console/ui/ai/a11y.test.tsx +2 -5
- package/src/console/ui/ai/fixture.ts +2 -7
- package/src/console/ui/ai/format.ts +1 -3
- package/src/console/ui/ai/group.test.ts +1 -3
- package/src/console/ui/ai/group.ts +4 -12
- package/src/console/ui/ai/index.ts +2 -9
- package/src/console/ui/ai/promotion.test.ts +2 -7
- package/src/console/ui/ai/promotion.ts +4 -13
- package/src/console/ui/ai/search.test.ts +2 -11
- package/src/console/ui/ai/search.ts +3 -13
- package/src/console/ui/ai/types.ts +1 -8
- package/src/console/ui/architecture/ArchitectureA11yView.tsx +8 -29
- package/src/console/ui/architecture/a11y.test.tsx +1 -2
- package/src/console/ui/architecture/declared.ts +1 -5
- package/src/console/ui/architecture/index.ts +7 -35
- package/src/console/ui/architecture/layout.ts +1 -3
- package/src/console/ui/architecture/pathologies.ts +10 -19
- package/src/console/ui/architecture/search.ts +6 -15
- package/src/console/ui/architecture/traffic.ts +4 -14
- package/src/console/ui/architecture/types.ts +2 -10
- package/src/console/ui/architecture/view.test.ts +7 -19
- package/src/console/ui/architecture/view.ts +9 -36
- package/src/console/ui/channels/ChannelsA11yView.tsx +4 -13
- package/src/console/ui/channels/a11y.test.tsx +1 -2
- package/src/console/ui/channels/confirmation.test.ts +1 -4
- package/src/console/ui/channels/confirmation.ts +1 -4
- package/src/console/ui/channels/findings.ts +1 -5
- package/src/console/ui/channels/index.ts +2 -8
- package/src/console/ui/channels/locale.test.ts +1 -3
- package/src/console/ui/channels/locale.ts +2 -8
- package/src/console/ui/channels/search.ts +4 -13
- package/src/console/ui/channels/taxonomy.ts +1 -3
- package/src/console/ui/clock/ClockA11yView.tsx +9 -26
- package/src/console/ui/clock/a11y.test.tsx +2 -5
- package/src/console/ui/clock/confirmation.test.ts +1 -3
- package/src/console/ui/clock/confirmation.ts +1 -4
- package/src/console/ui/clock/findings.ts +1 -4
- package/src/console/ui/clock/health.ts +2 -7
- package/src/console/ui/clock/index.ts +2 -10
- package/src/console/ui/clock/search.test.ts +1 -3
- package/src/console/ui/clock/search.ts +2 -6
- package/src/console/ui/clock/timeline.test.ts +1 -3
- package/src/console/ui/clock/waiting-on.test.ts +1 -5
- package/src/console/ui/clock/waiting-on.ts +2 -7
- package/src/console/ui/diff/DiffA11yView.tsx +8 -17
- package/src/console/ui/diff/a11y.test.tsx +2 -5
- package/src/console/ui/diff/group.test.ts +3 -13
- package/src/console/ui/diff/group.ts +2 -8
- package/src/console/ui/diff/index.ts +2 -8
- package/src/console/ui/diff/search.test.ts +1 -5
- package/src/console/ui/diff/search.ts +4 -16
- package/src/console/ui/diff/summary.ts +1 -2
- package/src/console/ui/dist/assets/{index-Dy4jht9P.js → index-BWo8R7NR.js} +2 -2
- package/src/console/ui/dist/assets/{panel-access-Dd37LU2c.js → panel-access-C0J2D-a2.js} +1 -1
- package/src/console/ui/dist/assets/{panel-ai-CC7LR6-J.js → panel-ai-D_m6WQI8.js} +1 -1
- package/src/console/ui/dist/assets/{panel-architecture-B5b3iKCz.js → panel-architecture-CKnXFyUx.js} +1 -1
- package/src/console/ui/dist/assets/{panel-channels-CeNjTKXp.js → panel-channels-BOmQ-onL.js} +1 -1
- package/src/console/ui/dist/assets/{panel-clock-DgFTLoHV.js → panel-clock-giAq0Ccv.js} +1 -1
- package/src/console/ui/dist/assets/{panel-diff-DxehccqB.js → panel-diff-cdonmH8c.js} +1 -1
- package/src/console/ui/dist/assets/{panel-flows-BtrVn-Eg.js → panel-flows-DlCU5zjA.js} +2 -2
- package/src/console/ui/dist/assets/{panel-gates-Z9MKRGdH.js → panel-gates-XclZxWD5.js} +1 -1
- package/src/console/ui/dist/assets/{panel-overview-Dt_AeXgd.js → panel-overview-BznEOTnb.js} +1 -1
- package/src/console/ui/dist/assets/{panel-plugins-DWd0TowH.js → panel-plugins-CcGM1g64.js} +1 -1
- package/src/console/ui/dist/assets/{panel-runs-DGstFHeq.js → panel-runs-CGWNHLR4.js} +1 -1
- package/src/console/ui/dist/assets/{panel-signals-DzEa2Fnt.js → panel-signals-CNywkdak.js} +1 -1
- package/src/console/ui/dist/assets/{panel-store-BJkbNgxx.js → panel-store-KmTbFHMH.js} +1 -1
- package/src/console/ui/dist/assets/{panel-traces-BaRVO3gM.js → panel-traces-DBLx2ilD.js} +1 -1
- package/src/console/ui/dist/assets/panel-vault-CEnFc0dk.js +1 -0
- package/src/console/ui/dist/index.html +1 -1
- package/src/console/ui/flows/FlowsA11yView.tsx +7 -22
- package/src/console/ui/flows/a11y.test.tsx +2 -8
- package/src/console/ui/flows/buffer.test.ts +3 -11
- package/src/console/ui/flows/buffer.ts +4 -11
- package/src/console/ui/flows/confirmation.ts +1 -3
- package/src/console/ui/flows/contract.test.ts +3 -7
- package/src/console/ui/flows/contract.ts +12 -36
- package/src/console/ui/flows/graph.test.ts +3 -11
- package/src/console/ui/flows/graph.ts +5 -15
- package/src/console/ui/flows/index.ts +1 -6
- package/src/console/ui/flows/save-as-test.ts +1 -3
- package/src/console/ui/flows/search.ts +8 -25
- package/src/console/ui/flows/tiers.ts +2 -9
- package/src/console/ui/gates/GatesA11yView.tsx +4 -13
- package/src/console/ui/gates/a11y.test.tsx +2 -5
- package/src/console/ui/gates/audit.ts +1 -3
- package/src/console/ui/gates/denial.test.ts +1 -3
- package/src/console/ui/gates/denial.ts +4 -12
- package/src/console/ui/gates/findings.ts +1 -3
- package/src/console/ui/gates/group.test.ts +3 -3
- package/src/console/ui/gates/group.ts +3 -11
- package/src/console/ui/gates/index.ts +2 -10
- package/src/console/ui/gates/search.ts +3 -10
- package/src/console/ui/overview/OverviewA11yView.tsx +9 -27
- package/src/console/ui/overview/a11y.test.tsx +1 -2
- package/src/console/ui/overview/busiest.ts +1 -3
- package/src/console/ui/overview/compose.ts +1 -13
- package/src/console/ui/overview/cost.ts +34 -38
- package/src/console/ui/overview/fixture.ts +21 -26
- package/src/console/ui/overview/golden.ts +4 -14
- package/src/console/ui/overview/index.ts +2 -9
- package/src/console/ui/overview/rank.test.ts +3 -10
- package/src/console/ui/overview/rank.ts +2 -7
- package/src/console/ui/overview/slo.test.ts +5 -9
- package/src/console/ui/overview/slo.ts +6 -23
- package/src/console/ui/overview/verdict.ts +3 -10
- package/src/console/ui/plugins/PluginsA11yView.tsx +8 -18
- package/src/console/ui/plugins/a11y.test.tsx +1 -2
- package/src/console/ui/plugins/fixture.ts +2 -4
- package/src/console/ui/plugins/group.test.ts +1 -3
- package/src/console/ui/plugins/group.ts +1 -6
- package/src/console/ui/plugins/index.ts +3 -13
- package/src/console/ui/plugins/search.ts +7 -19
- package/src/console/ui/runs/RunsA11yView.tsx +5 -20
- package/src/console/ui/runs/a11y.test.tsx +2 -5
- package/src/console/ui/runs/explain.ts +2 -6
- package/src/console/ui/runs/group.ts +3 -12
- package/src/console/ui/runs/histogram.test.ts +2 -11
- package/src/console/ui/runs/histogram.ts +1 -4
- package/src/console/ui/runs/index.ts +4 -18
- package/src/console/ui/runs/project.ts +2 -6
- package/src/console/ui/runs/query.test.ts +1 -3
- package/src/console/ui/runs/query.ts +12 -35
- package/src/console/ui/runs/search.ts +5 -19
- package/src/console/ui/runs/trace-link.test.ts +2 -6
- package/src/console/ui/runs/trace-link.ts +4 -16
- package/src/console/ui/runs/types.ts +1 -3
- package/src/console/ui/shell/App.tsx +2 -10
- package/src/console/ui/shell/client.ts +22 -115
- package/src/console/ui/shell/components/ui.tsx +1 -4
- package/src/console/ui/shell/layout/Shell.tsx +2 -4
- package/src/console/ui/shell/main.tsx +31 -96
- package/src/console/ui/shell/panels/access/AccessPanel.tsx +34 -98
- package/src/console/ui/shell/panels/ai/AiPanel.tsx +35 -106
- package/src/console/ui/shell/panels/architecture/ArchitecturePanel.tsx +18 -66
- package/src/console/ui/shell/panels/channels/ChannelsPanel.tsx +20 -57
- package/src/console/ui/shell/panels/clock/ClockPanel.tsx +22 -54
- package/src/console/ui/shell/panels/diff/DiffPanel.tsx +20 -61
- package/src/console/ui/shell/panels/flows/ContractEditor.tsx +6 -23
- package/src/console/ui/shell/panels/flows/FlowDrawer.tsx +13 -28
- package/src/console/ui/shell/panels/flows/FlowsPanel.tsx +9 -29
- package/src/console/ui/shell/panels/gates/GatesPanel.tsx +24 -80
- package/src/console/ui/shell/panels/overview/OverviewPanel.tsx +20 -58
- package/src/console/ui/shell/panels/plugins/PluginsPanel.tsx +16 -41
- package/src/console/ui/shell/panels/runs/RunsPanel.tsx +31 -99
- package/src/console/ui/shell/panels/signals/SignalsPanel.tsx +38 -101
- package/src/console/ui/shell/panels/store/StorePanel.tsx +27 -66
- package/src/console/ui/shell/panels/traces/TracesPanel.tsx +28 -89
- package/src/console/ui/shell/panels/vault/VaultPanel.tsx +22 -53
- package/src/console/ui/shell/setup/Wizard.tsx +3 -5
- package/src/console/ui/shell/styles.css +1 -2
- package/src/console/ui/signals/SignalsA11yView.tsx +9 -33
- package/src/console/ui/signals/a11y.test.tsx +2 -5
- package/src/console/ui/signals/confirmation.test.ts +1 -5
- package/src/console/ui/signals/confirmation.ts +2 -6
- package/src/console/ui/signals/dry-run.ts +1 -3
- package/src/console/ui/signals/durable.ts +1 -3
- package/src/console/ui/signals/findings.ts +1 -3
- package/src/console/ui/signals/group.test.ts +2 -8
- package/src/console/ui/signals/group.ts +2 -10
- package/src/console/ui/signals/index.ts +1 -4
- package/src/console/ui/signals/monitor.ts +2 -7
- package/src/console/ui/signals/schema-form.test.ts +3 -14
- package/src/console/ui/signals/schema-form.ts +1 -4
- package/src/console/ui/signals/search.ts +4 -13
- package/src/console/ui/store/StoreA11yView.tsx +3 -9
- package/src/console/ui/store/a11y.test.tsx +2 -5
- package/src/console/ui/store/confirmation.test.ts +1 -3
- package/src/console/ui/store/confirmation.ts +1 -4
- package/src/console/ui/store/dry-run.ts +2 -5
- package/src/console/ui/store/fixture.ts +1 -2
- package/src/console/ui/store/group.test.ts +1 -6
- package/src/console/ui/store/group.ts +1 -4
- package/src/console/ui/store/index.ts +1 -5
- package/src/console/ui/store/search.ts +2 -6
- package/src/console/ui/store/will-not-fire.ts +1 -2
- package/src/console/ui/traces/TracesA11yView.tsx +10 -29
- package/src/console/ui/traces/a11y.test.tsx +1 -2
- package/src/console/ui/traces/chain.test.ts +5 -19
- package/src/console/ui/traces/chain.ts +1 -3
- package/src/console/ui/traces/critical-path.test.ts +1 -3
- package/src/console/ui/traces/critical-path.ts +2 -6
- package/src/console/ui/traces/filter.test.ts +2 -6
- package/src/console/ui/traces/filter.ts +5 -13
- package/src/console/ui/traces/fold.test.ts +4 -12
- package/src/console/ui/traces/fold.ts +1 -3
- package/src/console/ui/traces/mini.ts +1 -3
- package/src/console/ui/traces/replay.test.ts +1 -3
- package/src/console/ui/traces/replay.ts +1 -3
- package/src/console/ui/traces/sampling.ts +1 -4
- package/src/console/ui/traces/search.ts +4 -17
- package/src/console/ui/traces/tier.ts +1 -3
- package/src/console/ui/vault/VaultA11yView.tsx +5 -17
- package/src/console/ui/vault/a11y.test.tsx +1 -2
- package/src/console/ui/vault/blast-radius.ts +1 -3
- package/src/console/ui/vault/confirmation.test.ts +1 -5
- package/src/console/ui/vault/confirmation.ts +1 -4
- package/src/console/ui/vault/dormant.test.ts +1 -4
- package/src/console/ui/vault/export-safe.test.ts +1 -5
- package/src/console/ui/vault/export-safe.ts +1 -4
- package/src/console/ui/vault/fixture.ts +3 -3
- package/src/console/ui/vault/group.ts +1 -2
- package/src/console/ui/vault/index.ts +2 -10
- package/src/console/ui/vault/search.ts +2 -6
- package/src/console/ui/vault/types.ts +1 -1
- package/src/console/xss.gate.test.ts +1 -3
- package/src/docker/compose.ts +112 -20
- package/src/docker/derive.ts +5 -19
- package/src/docker/docker.test.ts +15 -15
- package/src/docker/dockerfile.integration.test.ts +12 -21
- package/src/docker/helpers.ts +5 -4
- package/src/docker/index.ts +4 -11
- package/src/docker/pin.ts +1 -9
- package/src/docker/recipes/index.ts +5 -6
- package/src/docker/recipes/mailpit.ts +22 -0
- package/src/docker/recipes/postgres.ts +17 -6
- package/src/docker/recipes/redis.ts +6 -1
- package/src/docker/recipes/rustfs.ts +33 -0
- package/src/docker/stack-id.test.ts +33 -0
- package/src/docker/stack-id.ts +25 -13
- package/src/docker/stack.integration.test.ts +6 -21
- package/src/docker/types.ts +13 -4
- package/src/drivers/ai-anthropic.ts +5 -14
- package/src/drivers/ai-mock.ts +2 -5
- package/src/drivers/ai-openai-compatible.ts +4 -10
- package/src/drivers/ai-providers.test.ts +6 -13
- package/src/drivers/bun-native-completeness.test.ts +6 -15
- package/src/drivers/channel-console.ts +6 -7
- package/src/drivers/channel-fcm.ts +20 -30
- package/src/drivers/channel-resend.ts +1 -3
- package/src/drivers/channel-smtp.ts +2 -6
- package/src/drivers/channel-types.ts +2 -12
- package/src/drivers/channel-unifonic.ts +2 -6
- package/src/drivers/channel-wa-cloud.ts +2 -6
- package/src/drivers/channel-webpush.ts +21 -60
- package/src/drivers/conformance.test.ts +2 -10
- package/src/drivers/conformance.ts +8 -21
- package/src/drivers/fs.ts +2 -8
- package/src/drivers/index.ts +12 -56
- package/src/drivers/memory.ts +14 -41
- package/src/drivers/pgvector.ts +7 -11
- package/src/drivers/postgres.ts +7 -13
- package/src/drivers/redis.ts +13 -37
- package/src/drivers/s3.ts +5 -17
- package/src/drivers/signal-engine.ts +12 -49
- package/src/drivers/signal-memory.ts +2 -8
- package/src/drivers/signal-nats.ts +4 -9
- package/src/drivers/signal-postgres.ts +62 -129
- package/src/drivers/signal-redis.ts +7 -21
- package/src/drivers/signal-types.ts +1 -4
- package/src/drivers/sqlite.ts +3 -12
- package/src/drivers/types.ts +4 -23
- package/src/drivers/vault-env.ts +2 -6
- package/src/drivers/vault-infisical.ts +1 -5
- package/src/drivers/vault-managed.ts +1 -5
- package/src/drivers/vault-memory.ts +1 -5
- package/src/drivers/vault-openbao.ts +1 -5
- package/src/drivers/vault-sops.ts +10 -35
- package/src/drivers/vault-types.ts +1 -7
- package/src/elements/ai/declare.ts +4 -14
- package/src/elements/ai/eval.ts +2 -6
- package/src/elements/ai/pii.ts +1 -3
- package/src/elements/ai/runtime.ts +12 -50
- package/src/elements/ai/schema.ts +4 -15
- package/src/elements/ai.test.ts +13 -24
- package/src/elements/ai.ts +1 -5
- package/src/elements/channel/consent.ts +3 -12
- package/src/elements/channel/costs.ts +4 -15
- package/src/elements/channel/declare.ts +1 -4
- package/src/elements/channel/email-auth.ts +1 -4
- package/src/elements/channel/locale.ts +2 -10
- package/src/elements/channel/mask.ts +1 -3
- package/src/elements/channel/mime.ts +2 -12
- package/src/elements/channel/outcomes.test.ts +1 -5
- package/src/elements/channel/outcomes.ts +5 -15
- package/src/elements/channel/receipts.ts +2 -7
- package/src/elements/channel/runtime.ts +28 -74
- package/src/elements/channel/suppression.ts +8 -14
- package/src/elements/channel.test.ts +8 -31
- package/src/elements/channel.ts +3 -14
- package/src/elements/clock/actions.ts +6 -18
- package/src/elements/clock/declare.ts +1 -3
- package/src/elements/clock/dst.ts +1 -5
- package/src/elements/clock/durable.ts +4 -16
- package/src/elements/clock/health.ts +2 -7
- package/src/elements/clock/leader.ts +2 -9
- package/src/elements/clock/reconcile.ts +4 -15
- package/src/elements/clock/runtime.ts +2 -5
- package/src/elements/clock/schedule.ts +4 -20
- package/src/elements/clock.test.ts +2 -7
- package/src/elements/clock.ts +5 -23
- package/src/elements/gate/permissions.ts +1 -4
- package/src/elements/gate/runtime.ts +7 -28
- package/src/elements/gate.ts +1 -5
- package/src/elements/index.ts +9 -7
- package/src/elements/signal/declare.ts +2 -7
- package/src/elements/signal/reconcile.test.ts +1 -4
- package/src/elements/signal/runtime.ts +1 -3
- package/src/elements/signal.test.ts +3 -15
- package/src/elements/signal.ts +2 -8
- package/src/elements/store/cache.test.ts +46 -0
- package/src/elements/store/cache.ts +3 -11
- package/src/elements/store/classify.ts +5 -22
- package/src/elements/store/declare.ts +8 -17
- package/src/elements/store/domain-ddl.test.ts +86 -0
- package/src/elements/store/emit-drizzle.ts +363 -0
- package/src/elements/store/files-policy.test.ts +1 -5
- package/src/elements/store/files-policy.ts +4 -12
- package/src/elements/store/load-plugin-tables.ts +103 -0
- package/src/elements/store/missing-relation.test.ts +83 -0
- package/src/elements/store/missing-relation.ts +38 -0
- package/src/elements/store/replica.ts +1 -4
- package/src/elements/store/runtime.ts +25 -28
- package/src/elements/store/schema-decl.test.ts +227 -0
- package/src/elements/store/schema-decl.ts +516 -0
- package/src/elements/store/sql-condition.ts +11 -21
- package/src/elements/store/sql-session.test.ts +50 -0
- package/src/elements/store/sql-session.ts +60 -63
- package/src/elements/store/table.ts +35 -19
- package/src/elements/store.test.ts +17 -39
- package/src/elements/store.ts +37 -31
- package/src/elements/vault/chain.ts +34 -0
- package/src/elements/vault/declare.ts +22 -32
- package/src/elements/vault/fingerprint.ts +2 -7
- package/src/elements/vault/redact.ts +2 -6
- package/src/elements/vault/runtime.ts +18 -32
- package/src/elements/vault.test.ts +12 -28
- package/src/elements/vault.ts +8 -12
- package/src/index.ts +5 -2
- package/src/kernel/adopt-routes.ts +15 -29
- package/src/kernel/app.ts +34 -94
- package/src/kernel/auth-resolve.ts +2 -9
- package/src/kernel/boot-bind/ai.ts +1 -4
- package/src/kernel/boot-bind/channel.ts +2 -8
- package/src/kernel/boot-bind/clock.ts +2 -6
- package/src/kernel/boot-bind/gate.ts +2 -8
- package/src/kernel/boot-bind/runs.ts +1 -3
- package/src/kernel/boot-bind/signal.ts +3 -10
- package/src/kernel/boot-bind/store.test.ts +17 -17
- package/src/kernel/boot-bind/store.ts +44 -50
- package/src/kernel/boot-bind/vault.ts +2 -8
- package/src/kernel/boot.test.ts +4 -9
- package/src/kernel/boot.ts +29 -76
- package/src/kernel/budget.test.ts +1 -3
- package/src/kernel/capability.ts +3 -10
- package/src/kernel/dry-run.test.ts +1 -4
- package/src/kernel/dry-run.ts +3 -11
- package/src/kernel/effects.test.ts +1 -5
- package/src/kernel/effects.ts +4 -11
- package/src/kernel/errors.registry.test.ts +2 -8
- package/src/kernel/errors.ts +23 -32
- package/src/kernel/flow.test.ts +12 -25
- package/src/kernel/flow.ts +5 -25
- package/src/kernel/fx.test.ts +15 -44
- package/src/kernel/fx.ts +27 -79
- package/src/kernel/hook-timing.test.ts +3 -6
- package/src/kernel/hook-timing.ts +5 -14
- package/src/kernel/hooks.test.ts +10 -10
- package/src/kernel/hooks.ts +3 -12
- package/src/kernel/index.ts +4 -17
- package/src/kernel/journal.ts +7 -31
- package/src/kernel/on.ts +1 -6
- package/src/kernel/pipeline.test.ts +10 -19
- package/src/kernel/pipeline.ts +5 -17
- package/src/kernel/plug.ts +4 -11
- package/src/kernel/plugin/conflicts.test.ts +13 -25
- package/src/kernel/plugin/decorate.test.ts +8 -13
- package/src/kernel/plugin/scoping.test.ts +4 -11
- package/src/kernel/plugin.ts +48 -24
- package/src/kernel/registry.ts +80 -29
- package/src/kernel/router.test.ts +15 -13
- package/src/kernel/router.ts +9 -29
- package/src/kernel/routing-budget.test.ts +1 -3
- package/src/kernel/run-telemetry.ts +1 -3
- package/src/kernel/triggers.ts +4 -21
- package/src/manifest/diff.test.ts +26 -91
- package/src/manifest/diff.ts +95 -225
- package/src/manifest/index.ts +2 -9
- package/src/manifest/types.ts +29 -5
- package/src/manifest/undeclared.test.ts +4 -12
- package/src/manifest/undeclared.ts +1 -2
- package/src/manifest/validate.test.ts +2 -6
- package/src/manifest/validate.ts +4 -14
- package/src/mcp/authorization.ts +8 -27
- package/src/mcp/confirmation.ts +3 -10
- package/src/mcp/data.ts +2 -6
- package/src/mcp/docs-index.ts +4 -7
- package/src/mcp/docs-mcp.test.ts +3 -12
- package/src/mcp/docs-server.ts +7 -27
- package/src/mcp/docs-tools.ts +2 -6
- package/src/mcp/index.ts +1 -6
- package/src/mcp/injection.gate.test.ts +4 -18
- package/src/mcp/mcp.test.ts +18 -49
- package/src/mcp/protocol.ts +3 -10
- package/src/mcp/server.ts +11 -52
- package/src/mcp/session.ts +4 -14
- package/src/mcp/tools.ts +14 -50
- package/src/plugins/catalogue.test.ts +3 -7
- package/src/plugins/catalogue.ts +1 -3
- package/src/plugins/node-import-scan.ts +2 -5
- package/src/plugins/supply-chain.ts +5 -17
- package/src/release/exports.ts +3 -8
- package/src/release/measure.exports.test.ts +1 -3
- package/src/release/measure.ts +15 -43
- package/src/runs/bench.test.ts +1 -3
- package/src/runs/collect.ts +8 -25
- package/src/runs/drivers/clickhouse.ts +2 -9
- package/src/runs/drivers/files.ts +9 -31
- package/src/runs/drivers/memory.ts +5 -22
- package/src/runs/drivers/postgres.ts +8 -20
- package/src/runs/duckdb.ts +2 -8
- package/src/runs/index.ts +3 -14
- package/src/runs/outlier.ts +3 -10
- package/src/runs/parquet.ts +8 -26
- package/src/runs/privacy.ts +2 -8
- package/src/runs/runs.test.ts +3 -9
- package/src/runs/runtime.ts +7 -32
- package/src/runs/shred.ts +10 -29
- package/src/runs/types.ts +1 -4
- package/src/runtime/bun.ts +4 -15
- package/src/runtime/cold-start.bench.ts +1 -3
- package/src/runtime/dev-request-log.test.ts +1 -4
- package/src/runtime/dev-request-log.ts +1 -4
- package/src/runtime/index.ts +1 -6
- package/src/runtime/primitives.ts +5 -4
- package/src/runtime/security.ts +3 -13
- package/src/runtime/serve.test.ts +4 -7
- package/src/runtime/types.ts +1 -4
- package/src/runtime/web-standard.ts +3 -15
- package/src/term.test.ts +4 -6
- package/src/term.ts +49 -98
- package/src/test/create-test-app.test.ts +4 -14
- package/src/test/create-test-app.ts +13 -31
- package/src/test/provisions.integration.test.ts +3 -11
- package/src/upgrade/codemods.test.ts +25 -6
- package/src/upgrade/codemods.ts +116 -3
- package/src/validation/standard-schema.test.ts +2 -5
- package/src/validation/standard-schema.ts +13 -33
- package/src/console/ui/dist/assets/panel-vault-BbfWdox0.js +0 -1
package/package.json
CHANGED
|
@@ -1,39 +1,72 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "okengine",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.8",
|
|
4
4
|
"description": "One law. Eight elements. Ten exports. One package. One manifest. Every backend need is derived, never added.",
|
|
5
5
|
"license": "MIT",
|
|
6
|
-
"type": "module",
|
|
7
|
-
"sideEffects": false,
|
|
8
6
|
"repository": {
|
|
9
7
|
"type": "git",
|
|
10
8
|
"url": "git+https://github.com/omqkhafi/okengine.git"
|
|
11
9
|
},
|
|
10
|
+
"bin": {
|
|
11
|
+
"oke": "src/cli/index.ts"
|
|
12
|
+
},
|
|
12
13
|
"workspaces": [
|
|
13
14
|
"packages/*",
|
|
14
15
|
"examples/*",
|
|
15
16
|
"site"
|
|
16
17
|
],
|
|
18
|
+
"files": [
|
|
19
|
+
"src",
|
|
20
|
+
"spec",
|
|
21
|
+
"AGENTS.md",
|
|
22
|
+
"docs/spec"
|
|
23
|
+
],
|
|
24
|
+
"type": "module",
|
|
25
|
+
"sideEffects": false,
|
|
26
|
+
"exports": {
|
|
27
|
+
".": "./src/index.ts",
|
|
28
|
+
"./client": "./src/client/index.ts",
|
|
29
|
+
"./test": "./src/test/index.ts",
|
|
30
|
+
"./config": "./src/config/index.ts",
|
|
31
|
+
"./auth": "./src/auth/index.ts",
|
|
32
|
+
"./console": "./src/console/index.ts",
|
|
33
|
+
"./mcp": "./src/mcp/index.ts",
|
|
34
|
+
"./store": "./src/elements/store.ts",
|
|
35
|
+
"./signal": "./src/elements/signal.ts",
|
|
36
|
+
"./clock": "./src/elements/clock.ts",
|
|
37
|
+
"./gate": "./src/elements/gate.ts",
|
|
38
|
+
"./vault": "./src/elements/vault.ts",
|
|
39
|
+
"./channel": "./src/elements/channel.ts",
|
|
40
|
+
"./ai": "./src/elements/ai.ts",
|
|
41
|
+
"./runs": "./src/runs/index.ts",
|
|
42
|
+
"./drivers": "./src/drivers/index.ts",
|
|
43
|
+
"./drivers/*": "./src/drivers/*"
|
|
44
|
+
},
|
|
17
45
|
"scripts": {
|
|
18
|
-
"typecheck": "tsc --noEmit",
|
|
46
|
+
"typecheck": "tsc --noEmit && bun run --cwd packages/create-oke typecheck",
|
|
47
|
+
"lint": "oxlint --type-aware --quiet",
|
|
48
|
+
"lint:fix": "oxlint --type-aware --fix",
|
|
49
|
+
"fmt": "oxfmt",
|
|
50
|
+
"fmt:check": "oxfmt --check",
|
|
19
51
|
"test": "bun test --pass-with-no-tests",
|
|
20
52
|
"test:coverage": "bun test --coverage --pass-with-no-tests",
|
|
21
53
|
"test:console:smoke": "bunx playwright test tests/console/smoke.spec.ts",
|
|
22
|
-
"test:integration": "bun test examples/notes examples/linkly examples/provisions examples/skyport examples/skyport/tests/docker.test.ts && bun run --cwd packages/create-oke typecheck && bun test packages/create-oke/src && CREATE_OKE_INTEGRATION=1 bun test --timeout 180000 packages/create-oke/tests/scaffold.integration.test.ts packages/create-oke/tests/dev.integration.test.ts",
|
|
23
54
|
"build": "bunx vite build --config src/console/ui/vite.config.ts",
|
|
24
55
|
"prepack": "bun run build",
|
|
25
56
|
"bench": "bun test ./src/runtime/cold-start.bench.ts src/client/budget.test.ts src/console/budget.test.ts src/kernel/budget.test.ts src/kernel/routing-budget.test.ts src/runs/bench.test.ts",
|
|
26
57
|
"budgets": "bun src/release/publish.ts",
|
|
27
|
-
"gate": "bun src/cli/doctor-diff-examples.ts && bun
|
|
58
|
+
"gate": "bun src/cli/doctor-diff-examples.ts && bun src/cli/doc-drift.ts",
|
|
28
59
|
"site:sync": "bun run --cwd site sync",
|
|
29
60
|
"site:dev": "bun run --cwd site dev",
|
|
30
61
|
"site:build": "bun run --cwd site build",
|
|
31
|
-
"ci": "bun run
|
|
62
|
+
"ci": "bun run typecheck && bun run lint && bun run fmt:check && bun run test && bun run budgets -- --dry-run && bun run gate && bun run site:build",
|
|
63
|
+
"ci:integration": "CREATE_OKE_INTEGRATION=1 bun run ci",
|
|
32
64
|
"bump": "bun run scripts/bump-version.ts",
|
|
33
|
-
"
|
|
65
|
+
"release": "bun run scripts/publish.ts",
|
|
34
66
|
"g": "gflows"
|
|
35
67
|
},
|
|
36
68
|
"dependencies": {
|
|
69
|
+
"@clack/prompts": "^1.7.0",
|
|
37
70
|
"@duckdb/node-api": "^1.5.5-r.1",
|
|
38
71
|
"ajv": "^8.20.0",
|
|
39
72
|
"ajv-formats": "^3.0.1",
|
|
@@ -41,7 +74,6 @@
|
|
|
41
74
|
"sently": "^0.8.0"
|
|
42
75
|
},
|
|
43
76
|
"devDependencies": {
|
|
44
|
-
"age-encryption": "^0.3.0",
|
|
45
77
|
"@base-ui/react": "^1.6.0",
|
|
46
78
|
"@codemirror/commands": "^6.10.4",
|
|
47
79
|
"@codemirror/lang-json": "^6.0.2",
|
|
@@ -58,6 +90,7 @@
|
|
|
58
90
|
"@types/react": "^19.2.17",
|
|
59
91
|
"@types/react-dom": "^19.2.3",
|
|
60
92
|
"@vitejs/plugin-react": "^6.0.4",
|
|
93
|
+
"age-encryption": "^0.3.0",
|
|
61
94
|
"arktype": "^2.2.3",
|
|
62
95
|
"axe-core": "^4.12.1",
|
|
63
96
|
"clsx": "^2.1.1",
|
|
@@ -68,6 +101,9 @@
|
|
|
68
101
|
"gflows": "^1.2.1",
|
|
69
102
|
"happy-dom": "^20.11.1",
|
|
70
103
|
"mermaid": "^11.16.0",
|
|
104
|
+
"oxfmt": "^0.61.0",
|
|
105
|
+
"oxlint": "^1.76.0",
|
|
106
|
+
"oxlint-tsgolint": "^7.0.2001",
|
|
71
107
|
"playwright": "^1.62.0",
|
|
72
108
|
"react": "^19.2.8",
|
|
73
109
|
"react-dom": "^19.2.8",
|
|
@@ -103,33 +139,5 @@
|
|
|
103
139
|
},
|
|
104
140
|
"engines": {
|
|
105
141
|
"bun": ">=1.3"
|
|
106
|
-
}
|
|
107
|
-
"bin": {
|
|
108
|
-
"oke": "src/cli/index.ts"
|
|
109
|
-
},
|
|
110
|
-
"exports": {
|
|
111
|
-
".": "./src/index.ts",
|
|
112
|
-
"./client": "./src/client/index.ts",
|
|
113
|
-
"./test": "./src/test/index.ts",
|
|
114
|
-
"./config": "./src/config/index.ts",
|
|
115
|
-
"./auth": "./src/auth/index.ts",
|
|
116
|
-
"./console": "./src/console/index.ts",
|
|
117
|
-
"./mcp": "./src/mcp/index.ts",
|
|
118
|
-
"./store": "./src/elements/store.ts",
|
|
119
|
-
"./signal": "./src/elements/signal.ts",
|
|
120
|
-
"./clock": "./src/elements/clock.ts",
|
|
121
|
-
"./gate": "./src/elements/gate.ts",
|
|
122
|
-
"./vault": "./src/elements/vault.ts",
|
|
123
|
-
"./channel": "./src/elements/channel.ts",
|
|
124
|
-
"./ai": "./src/elements/ai.ts",
|
|
125
|
-
"./runs": "./src/runs/index.ts",
|
|
126
|
-
"./drivers": "./src/drivers/index.ts",
|
|
127
|
-
"./drivers/*": "./src/drivers/*"
|
|
128
|
-
},
|
|
129
|
-
"files": [
|
|
130
|
-
"src",
|
|
131
|
-
"spec",
|
|
132
|
-
"AGENTS.md",
|
|
133
|
-
"docs/spec"
|
|
134
|
-
]
|
|
142
|
+
}
|
|
135
143
|
}
|
|
@@ -104,10 +104,7 @@
|
|
|
104
104
|
"$defs": {
|
|
105
105
|
"JsonSchema": {
|
|
106
106
|
"description": "A JSON Schema document, or an opaque string ref produced by extraction.",
|
|
107
|
-
"oneOf": [
|
|
108
|
-
{ "type": "string", "minLength": 1 },
|
|
109
|
-
{ "type": "object" }
|
|
110
|
-
]
|
|
107
|
+
"oneOf": [{ "type": "string", "minLength": 1 }, { "type": "object" }]
|
|
111
108
|
},
|
|
112
109
|
"ResourceRef": {
|
|
113
110
|
"description": "Store resource: facet:name (sql:table, kv:namespace, files:bucket, index:name).",
|
|
@@ -289,10 +286,7 @@
|
|
|
289
286
|
"durable": { "type": "boolean" },
|
|
290
287
|
"live": { "type": "boolean" },
|
|
291
288
|
"cache": {
|
|
292
|
-
"oneOf": [
|
|
293
|
-
{ "type": "boolean" },
|
|
294
|
-
{ "type": "string", "minLength": 1 }
|
|
295
|
-
]
|
|
289
|
+
"oneOf": [{ "type": "boolean" }, { "type": "string", "minLength": 1 }]
|
|
296
290
|
},
|
|
297
291
|
"cacheKeys": {
|
|
298
292
|
"description": "Computed invalidation key expression (derived or declared).",
|
|
@@ -342,6 +336,38 @@
|
|
|
342
336
|
"retain": { "type": "string", "minLength": 1 }
|
|
343
337
|
}
|
|
344
338
|
},
|
|
339
|
+
"DeclaredColumn": {
|
|
340
|
+
"description": "Abstract schema column (DDL shape + optional classification). Bare ColumnClassification remains valid.",
|
|
341
|
+
"type": "object",
|
|
342
|
+
"additionalProperties": false,
|
|
343
|
+
"properties": {
|
|
344
|
+
"type": { "type": "string", "enum": ["text", "integer"] },
|
|
345
|
+
"nullable": { "type": "boolean" },
|
|
346
|
+
"primaryKey": { "type": "boolean" },
|
|
347
|
+
"unique": { "type": "boolean" },
|
|
348
|
+
"default": {
|
|
349
|
+
"anyOf": [
|
|
350
|
+
{ "type": "string" },
|
|
351
|
+
{ "type": "number" },
|
|
352
|
+
{ "type": "boolean" },
|
|
353
|
+
{ "type": "null" }
|
|
354
|
+
]
|
|
355
|
+
},
|
|
356
|
+
"sqlName": { "type": "string", "minLength": 1 },
|
|
357
|
+
"pii": { "type": "boolean" },
|
|
358
|
+
"sensitive": { "type": "boolean" },
|
|
359
|
+
"retain": { "type": "string", "minLength": 1 },
|
|
360
|
+
"references": {
|
|
361
|
+
"description": "Foreign key target from field.*.references().",
|
|
362
|
+
"type": "object",
|
|
363
|
+
"additionalProperties": false,
|
|
364
|
+
"properties": {
|
|
365
|
+
"table": { "type": "string", "minLength": 1 },
|
|
366
|
+
"column": { "type": "string", "minLength": 1 }
|
|
367
|
+
}
|
|
368
|
+
}
|
|
369
|
+
}
|
|
370
|
+
},
|
|
345
371
|
"Table": {
|
|
346
372
|
"type": "object",
|
|
347
373
|
"additionalProperties": false,
|
|
@@ -349,7 +375,12 @@
|
|
|
349
375
|
"columns": {
|
|
350
376
|
"type": "object",
|
|
351
377
|
"propertyNames": { "type": "string", "minLength": 1 },
|
|
352
|
-
"additionalProperties": {
|
|
378
|
+
"additionalProperties": {
|
|
379
|
+
"oneOf": [
|
|
380
|
+
{ "$ref": "#/$defs/DeclaredColumn" },
|
|
381
|
+
{ "$ref": "#/$defs/ColumnClassification" }
|
|
382
|
+
]
|
|
383
|
+
}
|
|
353
384
|
},
|
|
354
385
|
"classifications": {
|
|
355
386
|
"description": "Field → classification tags (pii, sensitive, retain duration).",
|
package/src/auth/api-keys.ts
CHANGED
|
@@ -56,9 +56,7 @@ export function createApiKeyStore(): ApiKeyStore {
|
|
|
56
56
|
export async function hashApiKeySecret(secret: string): Promise<string> {
|
|
57
57
|
const bytes = new TextEncoder().encode(secret);
|
|
58
58
|
const digest = await crypto.subtle.digest("SHA-256", bytes);
|
|
59
|
-
return [...new Uint8Array(digest)]
|
|
60
|
-
.map((b) => b.toString(16).padStart(2, "0"))
|
|
61
|
-
.join("");
|
|
59
|
+
return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
|
|
62
60
|
}
|
|
63
61
|
|
|
64
62
|
/**
|
|
@@ -156,8 +154,7 @@ export async function rotateApiKey(
|
|
|
156
154
|
): Promise<CreatedApiKey | null> {
|
|
157
155
|
const row = store.keys.get(id);
|
|
158
156
|
if (!row || row.revokedAt !== null) return null;
|
|
159
|
-
const secret =
|
|
160
|
-
options.secret ?? `oke_${id.replace(/-/g, "")}_${randomSecret()}`;
|
|
157
|
+
const secret = options.secret ?? `oke_${id.replace(/-/g, "")}_${randomSecret()}`;
|
|
161
158
|
row.hash = await hashApiKeySecret(secret);
|
|
162
159
|
return { row, secret };
|
|
163
160
|
}
|
package/src/auth/attenuation.ts
CHANGED
|
@@ -20,10 +20,7 @@ export interface AttenuationResult {
|
|
|
20
20
|
* @param held - Raw scopes from the principal / session
|
|
21
21
|
* @param catalog - Manifest-derived Module:Action pairs
|
|
22
22
|
*/
|
|
23
|
-
export function expandHeldScopes(
|
|
24
|
-
held: Iterable<string>,
|
|
25
|
-
catalog: readonly string[],
|
|
26
|
-
): Set<string> {
|
|
23
|
+
export function expandHeldScopes(held: Iterable<string>, catalog: readonly string[]): Set<string> {
|
|
27
24
|
const out = new Set<string>();
|
|
28
25
|
let star = false;
|
|
29
26
|
for (const s of held) {
|
|
@@ -48,8 +45,7 @@ export function attenuateScopes(
|
|
|
48
45
|
creatorScopes: ReadonlySet<string> | Iterable<string>,
|
|
49
46
|
requestedScopes: Iterable<string>,
|
|
50
47
|
): AttenuationResult {
|
|
51
|
-
const creator =
|
|
52
|
-
creatorScopes instanceof Set ? creatorScopes : new Set(creatorScopes);
|
|
48
|
+
const creator = creatorScopes instanceof Set ? creatorScopes : new Set(creatorScopes);
|
|
53
49
|
const excess: string[] = [];
|
|
54
50
|
for (const scope of requestedScopes) {
|
|
55
51
|
if (!creator.has(scope)) excess.push(scope);
|
package/src/auth/auth.test.ts
CHANGED
|
@@ -41,22 +41,46 @@ describe("auth plugin", () => {
|
|
|
41
41
|
test("registers oke_ tables on both planes", () => {
|
|
42
42
|
const tables: string[] = [];
|
|
43
43
|
auth({ secret: "test" }).register({
|
|
44
|
-
hook() {
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
44
|
+
hook() {
|
|
45
|
+
return this;
|
|
46
|
+
},
|
|
47
|
+
decorate() {
|
|
48
|
+
return this;
|
|
49
|
+
},
|
|
50
|
+
element() {
|
|
51
|
+
return this;
|
|
52
|
+
},
|
|
53
|
+
needs() {
|
|
54
|
+
return this;
|
|
55
|
+
},
|
|
56
|
+
errors() {
|
|
57
|
+
return this;
|
|
58
|
+
},
|
|
59
|
+
consolePanel() {
|
|
60
|
+
return this;
|
|
61
|
+
},
|
|
62
|
+
cli() {
|
|
63
|
+
return this;
|
|
64
|
+
},
|
|
65
|
+
driver() {
|
|
66
|
+
return this;
|
|
67
|
+
},
|
|
68
|
+
image() {
|
|
69
|
+
return this;
|
|
70
|
+
},
|
|
53
71
|
table(name) {
|
|
54
72
|
tables.push(name);
|
|
55
73
|
return this;
|
|
56
74
|
},
|
|
57
|
-
flow() {
|
|
58
|
-
|
|
59
|
-
|
|
75
|
+
flow() {
|
|
76
|
+
return this;
|
|
77
|
+
},
|
|
78
|
+
client() {
|
|
79
|
+
return this;
|
|
80
|
+
},
|
|
81
|
+
config() {
|
|
82
|
+
return this;
|
|
83
|
+
},
|
|
60
84
|
});
|
|
61
85
|
expect(tables).toContain("oke_operators");
|
|
62
86
|
expect(tables).toContain("oke_operator_credentials");
|
|
@@ -141,13 +165,15 @@ describe("cross-plane compile error", () => {
|
|
|
141
165
|
expect(diags.some((d) => d.message.includes("fx.auth"))).toBe(true);
|
|
142
166
|
expect(diags.some((d) => d.message.includes("cross-plane call"))).toBe(true);
|
|
143
167
|
|
|
144
|
-
expect(() =>
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
168
|
+
expect(() =>
|
|
169
|
+
assertCrossPlane(manifest, [
|
|
170
|
+
{
|
|
171
|
+
path: "x.ts",
|
|
172
|
+
flow: "console.store.query",
|
|
173
|
+
source: `plane: "operator"; fx.auth.userId`,
|
|
174
|
+
},
|
|
175
|
+
]),
|
|
176
|
+
).toThrow(CrossPlaneError);
|
|
151
177
|
|
|
152
178
|
const user = userPrincipal({ userId: "u1", scopes: ["bookings:create"] });
|
|
153
179
|
expect(() => assertPlaneAccess(user, "operator")).toThrow(CrossPlaneError);
|
|
@@ -172,14 +198,14 @@ describe("hybrid sessions", () => {
|
|
|
172
198
|
expect(rotated.accessToken).not.toBe(issued.accessToken);
|
|
173
199
|
|
|
174
200
|
// Reuse of the old refresh token revokes the family.
|
|
175
|
-
await expect(
|
|
176
|
-
|
|
177
|
-
|
|
201
|
+
await expect(rotateRefresh(store, crypto, issued.refreshToken)).rejects.toMatchObject({
|
|
202
|
+
name: "SessionError",
|
|
203
|
+
});
|
|
178
204
|
|
|
179
205
|
// Family revoked — the rotated refresh is also dead.
|
|
180
|
-
await expect(
|
|
181
|
-
|
|
182
|
-
)
|
|
206
|
+
await expect(rotateRefresh(store, crypto, rotated.refreshToken)).rejects.toBeInstanceOf(
|
|
207
|
+
SessionError,
|
|
208
|
+
);
|
|
183
209
|
});
|
|
184
210
|
});
|
|
185
211
|
|
|
@@ -193,9 +219,7 @@ describe("operator plane", () => {
|
|
|
193
219
|
});
|
|
194
220
|
|
|
195
221
|
expect(store.credentials.has(op.id)).toBe(true);
|
|
196
|
-
expect(() => removeOperatorCredential(store, op.id)).toThrow(
|
|
197
|
-
/cannot be removed/,
|
|
198
|
-
);
|
|
222
|
+
expect(() => removeOperatorCredential(store, op.id)).toThrow(/cannot be removed/);
|
|
199
223
|
expect(store.credentials.has(op.id)).toBe(true);
|
|
200
224
|
|
|
201
225
|
linkOperatorSso(store, op.id, "oidc", "sub-123");
|
|
@@ -266,8 +290,6 @@ describe("roles are data", () => {
|
|
|
266
290
|
});
|
|
267
291
|
|
|
268
292
|
test("assertAttenuated helper", () => {
|
|
269
|
-
expect(() =>
|
|
270
|
-
assertAttenuated(new Set(["a"]), ["a", "b"], "api key"),
|
|
271
|
-
).toThrow(/missing: b/);
|
|
293
|
+
expect(() => assertAttenuated(new Set(["a"]), ["a", "b"], "api key")).toThrow(/missing: b/);
|
|
272
294
|
});
|
|
273
295
|
});
|
package/src/auth/invoke-as.ts
CHANGED
|
@@ -36,9 +36,7 @@ export function invokeAs(options: InvokeAsOptions): UserPrincipal {
|
|
|
36
36
|
assertAttenuated(options.operatorScopes, options.scopes, "invoke-as");
|
|
37
37
|
|
|
38
38
|
if (options.impersonateRealUser && !options.development) {
|
|
39
|
-
throw new Error(
|
|
40
|
-
"invoke-as: impersonating a real user is development-only",
|
|
41
|
-
);
|
|
39
|
+
throw new Error("invoke-as: impersonating a real user is development-only");
|
|
42
40
|
}
|
|
43
41
|
|
|
44
42
|
return userPrincipal({
|
package/src/auth/operator.ts
CHANGED
|
@@ -8,11 +8,7 @@
|
|
|
8
8
|
*/
|
|
9
9
|
|
|
10
10
|
import { createBunCrypto } from "../runtime/primitives.ts";
|
|
11
|
-
import type {
|
|
12
|
-
OperatorCredentialRow,
|
|
13
|
-
OperatorRow,
|
|
14
|
-
OperatorSsoLinkRow,
|
|
15
|
-
} from "./tables.ts";
|
|
11
|
+
import type { OperatorCredentialRow, OperatorRow, OperatorSsoLinkRow } from "./tables.ts";
|
|
16
12
|
|
|
17
13
|
/** Operator-plane store. */
|
|
18
14
|
export interface OperatorStore {
|
|
@@ -82,15 +78,10 @@ export async function createOperator(
|
|
|
82
78
|
* @param store - Operator store
|
|
83
79
|
* @param operatorId - Operator id
|
|
84
80
|
*/
|
|
85
|
-
export function removeOperatorCredential(
|
|
86
|
-
store: OperatorStore,
|
|
87
|
-
operatorId: string,
|
|
88
|
-
): never {
|
|
81
|
+
export function removeOperatorCredential(store: OperatorStore, operatorId: string): never {
|
|
89
82
|
void store;
|
|
90
83
|
void operatorId;
|
|
91
|
-
throw new OperatorError(
|
|
92
|
-
"operator local credential cannot be removed; SSO is additive only",
|
|
93
|
-
);
|
|
84
|
+
throw new OperatorError("operator local credential cannot be removed; SSO is additive only");
|
|
94
85
|
}
|
|
95
86
|
|
|
96
87
|
/**
|
|
@@ -111,9 +102,7 @@ export function linkOperatorSso(
|
|
|
111
102
|
throw new OperatorError(`unknown operator: ${operatorId}`);
|
|
112
103
|
}
|
|
113
104
|
if (!store.credentials.has(operatorId)) {
|
|
114
|
-
throw new OperatorError(
|
|
115
|
-
"operator is missing local credential — invariant violated",
|
|
116
|
-
);
|
|
105
|
+
throw new OperatorError("operator is missing local credential — invariant violated");
|
|
117
106
|
}
|
|
118
107
|
const link: OperatorSsoLinkRow = { operatorId, provider, subject };
|
|
119
108
|
const list = store.ssoLinks.get(operatorId) ?? [];
|
|
@@ -128,14 +117,9 @@ export function linkOperatorSso(
|
|
|
128
117
|
*/
|
|
129
118
|
let dummyPasswordHash: string | null = null;
|
|
130
119
|
|
|
131
|
-
async function dummyHash(
|
|
132
|
-
crypto: ReturnType<typeof createBunCrypto>,
|
|
133
|
-
): Promise<string> {
|
|
120
|
+
async function dummyHash(crypto: ReturnType<typeof createBunCrypto>): Promise<string> {
|
|
134
121
|
if (dummyPasswordHash === null) {
|
|
135
|
-
dummyPasswordHash = await crypto.hashPassword(
|
|
136
|
-
"oke-operator-timing-dummy",
|
|
137
|
-
"argon2id",
|
|
138
|
-
);
|
|
122
|
+
dummyPasswordHash = await crypto.hashPassword("oke-operator-timing-dummy", "argon2id");
|
|
139
123
|
}
|
|
140
124
|
return dummyPasswordHash;
|
|
141
125
|
}
|
|
@@ -157,10 +141,8 @@ export async function authenticateOperator(
|
|
|
157
141
|
): Promise<OperatorRow | null> {
|
|
158
142
|
const crypto = createBunCrypto();
|
|
159
143
|
const op = [...store.operators.values()].find((o) => o.email === email);
|
|
160
|
-
const cred =
|
|
161
|
-
|
|
162
|
-
const hash =
|
|
163
|
-
cred && cred.loginEnabled ? cred.passwordHash : await dummyHash(crypto);
|
|
144
|
+
const cred = op && op.status === "active" ? store.credentials.get(op.id) : undefined;
|
|
145
|
+
const hash = cred && cred.loginEnabled ? cred.passwordHash : await dummyHash(crypto);
|
|
164
146
|
const ok = await crypto.verifyPassword(password, hash);
|
|
165
147
|
if (!ok || !op || !cred || !cred.loginEnabled || op.status !== "active") {
|
|
166
148
|
return null;
|
package/src/auth/planes.ts
CHANGED
|
@@ -81,14 +81,9 @@ export function operatorPrincipal(fields: {
|
|
|
81
81
|
* @param principal - Acting principal
|
|
82
82
|
* @param flowPlane - Target flow plane
|
|
83
83
|
*/
|
|
84
|
-
export function assertPlaneAccess(
|
|
85
|
-
principal: Principal,
|
|
86
|
-
flowPlane: AuthPlane,
|
|
87
|
-
): void {
|
|
84
|
+
export function assertPlaneAccess(principal: Principal, flowPlane: AuthPlane): void {
|
|
88
85
|
if (principal.plane === "user" && flowPlane === "operator") {
|
|
89
|
-
throw new CrossPlaneError(
|
|
90
|
-
"application principal cannot reach a console (operator) flow",
|
|
91
|
-
);
|
|
86
|
+
throw new CrossPlaneError("application principal cannot reach a console (operator) flow");
|
|
92
87
|
}
|
|
93
88
|
}
|
|
94
89
|
|
package/src/auth/plugin.ts
CHANGED
|
@@ -23,15 +23,12 @@ export interface AuthPluginOptions {
|
|
|
23
23
|
* @param options - Session crypto options
|
|
24
24
|
*/
|
|
25
25
|
export function auth(options: AuthPluginOptions = {}): PluginDef {
|
|
26
|
-
let builder = plugin("auth", { version: "0.0.1", config: options }).hook(
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
/* principals resolved by session / API key middleware at runtime */
|
|
30
|
-
},
|
|
31
|
-
);
|
|
26
|
+
let builder = plugin("auth", { version: "0.0.1", config: options }).hook("onAuth", (_ctx) => {
|
|
27
|
+
/* principals resolved by session / API key middleware at runtime */
|
|
28
|
+
});
|
|
32
29
|
|
|
33
30
|
for (const name of Object.values(AUTH_TABLES)) {
|
|
34
|
-
builder = builder.table(name, {
|
|
31
|
+
builder = builder.table(name, undefined, {
|
|
35
32
|
plane: name.includes("operator")
|
|
36
33
|
? "operator"
|
|
37
34
|
: name.includes("identit") || name === AUTH_TABLES.credentials
|
package/src/auth/roles.ts
CHANGED
|
@@ -38,11 +38,7 @@ export function upsertRole(store: RoleStore, role: RoleRow): void {
|
|
|
38
38
|
* @param roleId - Role id
|
|
39
39
|
* @param actions - Module:Action pairs
|
|
40
40
|
*/
|
|
41
|
-
export function setRoleGrants(
|
|
42
|
-
store: RoleStore,
|
|
43
|
-
roleId: string,
|
|
44
|
-
actions: readonly string[],
|
|
45
|
-
): void {
|
|
41
|
+
export function setRoleGrants(store: RoleStore, roleId: string, actions: readonly string[]): void {
|
|
46
42
|
if (!store.roles.has(roleId)) {
|
|
47
43
|
throw new Error(`unknown role: ${roleId}`);
|
|
48
44
|
}
|
package/src/auth/sessions.ts
CHANGED
|
@@ -229,10 +229,7 @@ const sessionAudiences = new Map<string, string>();
|
|
|
229
229
|
* @param sessionId - Session id
|
|
230
230
|
* @param scopes - Scopes
|
|
231
231
|
*/
|
|
232
|
-
export function bindSessionScopes(
|
|
233
|
-
sessionId: string,
|
|
234
|
-
scopes: Iterable<string>,
|
|
235
|
-
): void {
|
|
232
|
+
export function bindSessionScopes(sessionId: string, scopes: Iterable<string>): void {
|
|
236
233
|
sessionScopes.set(sessionId, [...scopes]);
|
|
237
234
|
}
|
|
238
235
|
|
|
@@ -242,10 +239,7 @@ export function bindSessionScopes(
|
|
|
242
239
|
* @param sessionId - Session id
|
|
243
240
|
* @param audience - Audience claim
|
|
244
241
|
*/
|
|
245
|
-
export function bindSessionAudience(
|
|
246
|
-
sessionId: string,
|
|
247
|
-
audience: string,
|
|
248
|
-
): void {
|
|
242
|
+
export function bindSessionAudience(sessionId: string, audience: string): void {
|
|
249
243
|
sessionAudiences.set(sessionId, audience);
|
|
250
244
|
}
|
|
251
245
|
|
|
@@ -292,9 +286,7 @@ export async function verifyAccess(
|
|
|
292
286
|
nowOrOptions: (() => number) | VerifyAccessOptions = () => Date.now(),
|
|
293
287
|
): Promise<AccessClaims> {
|
|
294
288
|
const options: VerifyAccessOptions =
|
|
295
|
-
typeof nowOrOptions === "function"
|
|
296
|
-
? { now: nowOrOptions }
|
|
297
|
-
: nowOrOptions;
|
|
289
|
+
typeof nowOrOptions === "function" ? { now: nowOrOptions } : nowOrOptions;
|
|
298
290
|
const now = options.now ?? (() => Date.now());
|
|
299
291
|
const claims = await verifyAccessSignature(secret, token);
|
|
300
292
|
if (claims.exp <= now()) {
|
|
@@ -302,9 +294,7 @@ export async function verifyAccess(
|
|
|
302
294
|
}
|
|
303
295
|
if (options.audience !== undefined) {
|
|
304
296
|
if (claims.aud !== options.audience) {
|
|
305
|
-
throw new SessionError(
|
|
306
|
-
`access token audience mismatch: expected ${options.audience}`,
|
|
307
|
-
);
|
|
297
|
+
throw new SessionError(`access token audience mismatch: expected ${options.audience}`);
|
|
308
298
|
}
|
|
309
299
|
}
|
|
310
300
|
const session = store.sessions.get(claims.sid);
|
|
@@ -325,11 +315,7 @@ export async function verifyAccess(
|
|
|
325
315
|
* @param familyId - Family id
|
|
326
316
|
* @param at - Timestamp
|
|
327
317
|
*/
|
|
328
|
-
export function revokeFamily(
|
|
329
|
-
store: SessionStore,
|
|
330
|
-
familyId: string,
|
|
331
|
-
at: number = Date.now(),
|
|
332
|
-
): void {
|
|
318
|
+
export function revokeFamily(store: SessionStore, familyId: string, at: number = Date.now()): void {
|
|
333
319
|
for (const session of store.sessions.values()) {
|
|
334
320
|
if (session.familyId === familyId) session.revokedAt = at;
|
|
335
321
|
}
|
|
@@ -348,23 +334,15 @@ export class SessionError extends Error {
|
|
|
348
334
|
}
|
|
349
335
|
|
|
350
336
|
async function hashToken(raw: string): Promise<string> {
|
|
351
|
-
const digest = await crypto.subtle.digest(
|
|
352
|
-
|
|
353
|
-
new TextEncoder().encode(raw),
|
|
354
|
-
);
|
|
355
|
-
return [...new Uint8Array(digest)]
|
|
356
|
-
.map((b) => b.toString(16).padStart(2, "0"))
|
|
357
|
-
.join("");
|
|
337
|
+
const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
|
|
338
|
+
return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
|
|
358
339
|
}
|
|
359
340
|
|
|
360
341
|
function cryptoRandomId(): string {
|
|
361
342
|
return crypto.randomUUID().replace(/-/g, "");
|
|
362
343
|
}
|
|
363
344
|
|
|
364
|
-
async function signAccess(
|
|
365
|
-
secret: string,
|
|
366
|
-
claims: AccessClaims,
|
|
367
|
-
): Promise<string> {
|
|
345
|
+
async function signAccess(secret: string, claims: AccessClaims): Promise<string> {
|
|
368
346
|
const header = b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
|
|
369
347
|
const payload = b64url(JSON.stringify(claims));
|
|
370
348
|
const data = `${header}.${payload}`;
|
|
@@ -372,10 +350,7 @@ async function signAccess(
|
|
|
372
350
|
return `${data}.${sig}`;
|
|
373
351
|
}
|
|
374
352
|
|
|
375
|
-
async function verifyAccessSignature(
|
|
376
|
-
secret: string,
|
|
377
|
-
token: string,
|
|
378
|
-
): Promise<AccessClaims> {
|
|
353
|
+
async function verifyAccessSignature(secret: string, token: string): Promise<AccessClaims> {
|
|
379
354
|
const parts = token.split(".");
|
|
380
355
|
if (parts.length !== 3) throw new SessionError("malformed access token");
|
|
381
356
|
const [header, payload, sig] = parts as [string, string, string];
|
|
@@ -393,11 +368,7 @@ async function hmac(secret: string, data: string): Promise<string> {
|
|
|
393
368
|
false,
|
|
394
369
|
["sign"],
|
|
395
370
|
);
|
|
396
|
-
const sig = await crypto.subtle.sign(
|
|
397
|
-
"HMAC",
|
|
398
|
-
key,
|
|
399
|
-
new TextEncoder().encode(data),
|
|
400
|
-
);
|
|
371
|
+
const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
|
|
401
372
|
return b64urlBytes(new Uint8Array(sig));
|
|
402
373
|
}
|
|
403
374
|
|
package/src/cli/args.ts
CHANGED
|
@@ -41,10 +41,6 @@ export function flagValue(
|
|
|
41
41
|
* @param long - Long flag
|
|
42
42
|
* @param short - Optional short flag
|
|
43
43
|
*/
|
|
44
|
-
export function hasFlag(
|
|
45
|
-
args: readonly string[],
|
|
46
|
-
long: string,
|
|
47
|
-
short?: string,
|
|
48
|
-
): boolean {
|
|
44
|
+
export function hasFlag(args: readonly string[], long: string, short?: string): boolean {
|
|
49
45
|
return args.includes(long) || (short !== undefined && args.includes(short));
|
|
50
46
|
}
|