okengine 0.2.6 → 0.2.8

package/src/console/server/gates.test.ts

@@ -3,18 +3,9 @@
  */
 
 import { describe, expect, test } from "bun:test";
-import {
-  createApiKeyStore,
-  createRoleStore,
-  setRoleGrants,
-  upsertRole,
-} from "../../auth/index.ts";
+import { createApiKeyStore, createRoleStore, setRoleGrants, upsertRole } from "../../auth/index.ts";
 import { memoryKvDriver } from "../../drivers/memory.ts";
-import {
-  createGateRuntime,
-  gate,
-  type GateRuntime,
-} from "../../elements/gate.ts";
+import { createGateRuntime, gate, type GateRuntime } from "../../elements/gate.ts";
 import type { Manifest } from "../../manifest/types.ts";
 import {
   createDefaultGateAuthStores,
@@ -65,9 +56,7 @@ async function liveRuntime(): Promise<{
 }> {
   const kv = await memoryKvDriver.open({ name: "gates-test-live" });
   const member = gate.policy("member", ({ auth }) => Boolean(auth.verified));
-  const canBook = gate.policy("booking:create", ({ auth }) =>
-    auth.scopes.has("booking:create"),
-  );
+  const canBook = gate.policy("booking:create", ({ auth }) => auth.scopes.has("booking:create"));
   const staff = gate.policy("staff", ({ auth }) => auth.scopes.has("staff"));
   const fair = gate.rate({
     strategy: "sliding-window-counter",
@@ -100,10 +89,7 @@ describe("projectGatesPanel", () => {
   test("two inquiry surfaces + continuous audit + plane violations", () => {
     const auth = createDefaultGateAuthStores();
     // Poison an operator role with an application scope.
-    setRoleGrants(auth.roles, "role_ops", [
-      "console:store.sql:read",
-      "booking:create",
-    ]);
+    setRoleGrants(auth.roles, "role_ops", ["console:store.sql:read", "booking:create"]);
 
     const projection = projectGatesPanel({
       manifest: MANIFEST,
@@ -119,9 +105,7 @@ describe("projectGatesPanel", () => {
         },
       ],
       operatorRoles: new Map([["op_1", ["role_ops"]]]),
-      operators: new Map([
-        ["op_1", { name: "Ops", email: "ops@example.com" }],
-      ]),
+      operators: new Map([["op_1", { name: "Ops", email: "ops@example.com" }]]),
       roleMembers: auth.roleMembers,
     });
 
@@ -136,16 +120,10 @@ describe("projectGatesPanel", () => {
     expect(projection.audit.emptyRoles).toContain("role_staff");
 
     // Operator with application scope is a violation, never a principal row.
-    expect(
-      projection.violations.some((v) =>
-        v.applicationScopes.includes("booking:create"),
-      ),
-    ).toBe(true);
-    expect(
-      projection.principals.some(
-        (p) => p.kind === "role" && p.id === "role_ops",
-      ),
-    ).toBe(false);
+    expect(projection.violations.some((v) => v.applicationScopes.includes("booking:create"))).toBe(
+      true,
+    );
+    expect(projection.principals.some((p) => p.kind === "role" && p.id === "role_ops")).toBe(false);
 
     // Clean user principals remain rows.
     expect(projection.principals.some((p) => p.kind === "user")).toBe(true);
@@ -201,10 +179,7 @@ describe("simulateGates — evaluate only", () => {
       expect(denied.allowed).toBe(false);
       // member passes (verified); first denial is booking:create — chain stops.
       expect(denied.deniedAt).toBe("booking:create");
-      expect(denied.evaluations.map((e) => e.name)).toEqual([
-        "member",
-        "booking:create",
-      ]);
+      expect(denied.evaluations.map((e) => e.name)).toEqual(["member", "booking:create"]);
       expect(denied.denial?.code).toBe("Forbidden");
       expect(denied.denial?.status).toBe(403);
       expect(denied.denial?.data).toMatchObject({ gate: "booking:create" });
@@ -235,18 +210,9 @@ describe("simulateGates — evaluate only", () => {
       meta: { userId: "user_demo" },
     };
     try {
-      await runtime.check(
-        ["member", "booking:create", "rate:sliding-window-counter:2/1m"],
-        ctx,
-      );
-      await runtime.check(
-        ["member", "booking:create", "rate:sliding-window-counter:2/1m"],
-        ctx,
-      );
-      const liveDenied = await runtime.check(
-        ["rate:sliding-window-counter:2/1m"],
-        ctx,
-      );
+      await runtime.check(["member", "booking:create", "rate:sliding-window-counter:2/1m"], ctx);
+      await runtime.check(["member", "booking:create", "rate:sliding-window-counter:2/1m"], ctx);
+      const liveDenied = await runtime.check(["rate:sliding-window-counter:2/1m"], ctx);
       expect(liveDenied[0]?.allowed).toBe(false);
 
       // Simulate clones decls onto ephemeral KV — does not consume live budget.
@@ -319,9 +285,7 @@ describe("simulateGates — evaluate only", () => {
       operator: ctx.operator,
     });
     expect(mapped.error.code).toBe("RateLimited");
-    expect(
-      (mapped.error.data as { retryAfterMs: number }).retryAfterMs,
-    ).toBeGreaterThan(0);
+    expect((mapped.error.data as { retryAfterMs: number }).retryAfterMs).toBeGreaterThan(0);
     await kv.close();
   });
 

package/src/console/server/gates.ts

@@ -31,11 +31,7 @@ import {
 import { statusForFailure } from "../../compiler/response.ts";
 import { gateDenialFailure } from "../../kernel/index.ts";
 import { diffManifest } from "../../manifest/diff.ts";
-import type {
-  Gate as ManifestGate,
-  Manifest,
-  ManifestChange,
-} from "../../manifest/types.ts";
+import type { Gate as ManifestGate, Manifest, ManifestChange } from "../../manifest/types.ts";
 
 /** Identity slice needed for Gates (avoids circular import with state). */
 export interface GatesIdentity {
@@ -154,10 +150,7 @@ export interface ProjectGatesOptions {
   /** operatorId → role ids. */
   readonly operatorRoles: ReadonlyMap<string, readonly string[]>;
   /** operatorId → { name, email }. */
-  readonly operators: ReadonlyMap<
-    string,
-    { readonly name: string; readonly email: string }
-  >;
+  readonly operators: ReadonlyMap<string, { readonly name: string; readonly email: string }>;
   /** roleId → member principal ids (users + operators). */
   readonly roleMembers: ReadonlyMap<string, readonly string[]>;
   /** Previous Manifest for deploy-diff widenings (optional). */
@@ -190,9 +183,7 @@ export function isApplicationScope(action: string): boolean {
  *
  * @param options - Manifest, roles, keys, identities, operators
  */
-export function projectGatesPanel(
-  options: ProjectGatesOptions,
-): GatesPanelProjection {
+export function projectGatesPanel(options: ProjectGatesOptions): GatesPanelProjection {
   const manifest = options.manifest;
   const moduleActions = manifest ? deriveModuleActions(manifest) : [];
   const flows = projectFlows(manifest);
@@ -205,10 +196,7 @@ export function projectGatesPanel(
     roles: options.roles,
     roleMembers: options.roleMembers,
   });
-  const widenings = projectWidenings(
-    options.previousManifest ?? null,
-    manifest,
-  );
+  const widenings = projectWidenings(options.previousManifest ?? null, manifest);
 
   return {
     moduleActions,
@@ -228,9 +216,7 @@ export function projectGatesPanel(
  *
  * @param options - Flow, principal, runtime
  */
-export async function simulateGates(
-  options: SimulateGatesOptions,
-): Promise<SimulateGatesResult> {
+export async function simulateGates(options: SimulateGatesOptions): Promise<SimulateGatesResult> {
   const flow = options.manifest?.flows?.[options.flowId];
   if (!flow) {
     return {
@@ -337,9 +323,7 @@ export async function powersForPrincipal(options: {
   const flows = projectFlows(options.manifest);
   let scopes: string[] = [];
   if (options.kind === "user") {
-    scopes = [
-      ...(options.identities.find((u) => u.id === options.id)?.scopes ?? []),
-    ];
+    scopes = [...(options.identities.find((u) => u.id === options.id)?.scopes ?? [])];
   } else if (options.kind === "role") {
     scopes = [...(options.roles.grants.get(options.id) ?? [])];
   } else {
@@ -352,10 +336,7 @@ export async function powersForPrincipal(options: {
 
   for (const flow of flows) {
     // User/key inquiry is application power; skip operator-plane flows.
-    if (
-      flow.plane === "operator" &&
-      (options.kind === "user" || options.kind === "key")
-    ) {
+    if (flow.plane === "operator" && (options.kind === "user" || options.kind === "key")) {
       continue;
     }
     const result = await simulateGates({
@@ -426,12 +407,7 @@ export function createDefaultGateAuthStores(): {
     description: "Console operators",
   });
   setRoleGrants(roles, "role_member", ["member", "booking:create"]);
-  setRoleGrants(roles, "role_staff", [
-    "member",
-    "booking:create",
-    "staff",
-    "reports:export",
-  ]);
+  setRoleGrants(roles, "role_staff", ["member", "booking:create", "staff", "reports:export"]);
   setRoleGrants(roles, "role_ops", [
     "console:store.sql:read",
     "console:store.sql:write",
@@ -508,9 +484,7 @@ function projectGateDefs(
       max: def.max,
       per: def.per,
       keyBy: def.keyBy,
-      overridable: Boolean(
-        (def as ManifestGate & { overridable?: boolean }).overridable,
-      ),
+      overridable: Boolean((def as ManifestGate & { overridable?: boolean }).overridable),
       attachedTo: attached.get(name) ?? [],
     });
   }
@@ -603,9 +577,7 @@ function projectPrincipals(options: ProjectGatesOptions): {
   // Operators: only those with clean console scopes appear… but Access owns
   // operator listing. Gates only surfaces the violation when they hold app scopes.
   for (const [operatorId, roleIds] of options.operatorRoles) {
-    const scopes = [
-      ...scopesForRoles(options.roles, roleIds, "operator"),
-    ].sort();
+    const scopes = [...scopesForRoles(options.roles, roleIds, "operator")].sort();
     const appScopes = scopes.filter(isApplicationScope);
     if (appScopes.length === 0) continue;
     const op = options.operators.get(operatorId);
@@ -653,9 +625,7 @@ function buildAudit(options: {
     .map((g) => g.name)
     .sort((a, b) => a.localeCompare(b));
 
-  const unguardedFlows = options.flows
-    .filter((f) => f.unguarded)
-    .map((f) => f.flowId);
+  const unguardedFlows = options.flows.filter((f) => f.unguarded).map((f) => f.flowId);
 
   return {
     unguardedFlows,
@@ -665,10 +635,7 @@ function buildAudit(options: {
   };
 }
 
-function projectWidenings(
-  before: Manifest | null,
-  after: Manifest | null,
-): ManifestChange[] {
+function projectWidenings(before: Manifest | null, after: Manifest | null): ManifestChange[] {
   if (!before || !after) return [];
   const diff = diffManifest(before, after);
   return diff.changes.filter((c) => c.category === "permission-widening");
@@ -831,9 +798,7 @@ function declFromManifestGate(name: string, def: ManifestGate): GateDecl {
       max: def.max ?? parsed.max,
       per: def.per ?? parsed.per,
       keyBy: def.keyBy,
-      overridable: Boolean(
-        (def as ManifestGate & { overridable?: boolean }).overridable,
-      ),
+      overridable: Boolean((def as ManifestGate & { overridable?: boolean }).overridable),
     };
   }
 

package/src/console/server/index.ts

@@ -76,16 +76,9 @@ export {
   resolveConsoleSecret,
   type ConsolePersistence,
 } from "./operator-db.ts";
-export {
-  createConsoleBindings,
-} from "./flows.ts";
+export { createConsoleBindings } from "./flows.ts";
 export { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
-export {
-  createLiveWebsocket,
-  feedManifest,
-  subscribeLive,
-  type ConsoleLiveData,
-} from "./live.ts";
+export { createLiveWebsocket, feedManifest, subscribeLive, type ConsoleLiveData } from "./live.ts";
 export { consolePlugin } from "./plugin.ts";
 export {
   CONSOLE_COOKIES,

package/src/console/server/live.ts

@@ -22,10 +22,7 @@ export interface ConsoleLiveData {
  */
 export interface ConsoleServerWebSocket<T = undefined> {
   readonly data: T;
-  send(
-    data: string | ArrayBuffer | Uint8Array,
-    compress?: boolean,
-  ): number;
+  send(data: string | ArrayBuffer | Uint8Array, compress?: boolean): number;
 }
 
 /**
@@ -52,16 +49,10 @@ export function subscribeLive(
  */
 export function createLiveWebsocket(state: ConsoleState): {
   readonly open: (ws: ConsoleServerWebSocket<ConsoleLiveData>) => void;
-  readonly message: (
-    ws: ConsoleServerWebSocket<ConsoleLiveData>,
-    message: string | Buffer,
-  ) => void;
+  readonly message: (ws: ConsoleServerWebSocket<ConsoleLiveData>, message: string | Buffer) => void;
   readonly close: (ws: ConsoleServerWebSocket<ConsoleLiveData>) => void;
 } {
-  const unsubs = new WeakMap<
-    ConsoleServerWebSocket<ConsoleLiveData>,
-    () => void
-  >();
+  const unsubs = new WeakMap<ConsoleServerWebSocket<ConsoleLiveData>, () => void>();
 
   return {
     open(ws) {

package/src/console/server/operator-db.test.ts

@@ -9,18 +9,13 @@ import { join } from "node:path";
 import { createOperator } from "../../auth/operator.ts";
 import { issueSession, verifyAccess } from "../../auth/sessions.ts";
 import { bootConsoleApp, createConsoleApp } from "./app.ts";
-import {
-  openConsolePersistence,
-  resolveConsoleSecret,
-} from "./operator-db.ts";
+import { openConsolePersistence, resolveConsoleSecret } from "./operator-db.ts";
 
 describe("console operator persistence", () => {
   const dirs: string[] = [];
 
   afterEach(async () => {
-    await Promise.all(
-      dirs.splice(0).map((d) => rm(d, { recursive: true, force: true })),
-    );
+    await Promise.all(dirs.splice(0).map((d) => rm(d, { recursive: true, force: true })));
   });
 
   test("secret is stable across resolveConsoleSecret calls", async () => {
@@ -48,9 +43,7 @@ describe("console operator persistence", () => {
 
     const second = await openConsolePersistence(cwd);
     expect(second.operators.operators.size).toBe(1);
-    expect(second.operators.operators.get(op.id)?.email).toBe(
-      "ops@example.com",
-    );
+    expect(second.operators.operators.get(op.id)?.email).toBe("ops@example.com");
     expect(second.operators.credentials.has(op.id)).toBe(true);
 
     const printed: string[] = [];
@@ -97,11 +90,7 @@ describe("console operator persistence", () => {
 
     const second = await openConsolePersistence(cwd);
     expect(second.sessions.sessions.size).toBe(1);
-    const claims = await verifyAccess(
-      second.sessions,
-      second.secret,
-      issued.accessToken,
-    );
+    const claims = await verifyAccess(second.sessions, second.secret, issued.accessToken);
     expect(claims.sub).toBe(op.id);
     second.close();
   });

package/src/console/server/operator-db.ts

@@ -9,14 +9,8 @@
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { Database } from "bun:sqlite";
-import {
-  createOperatorStore,
-  type OperatorStore,
-} from "../../auth/operator.ts";
-import {
-  createSessionStore,
-  type SessionStore,
-} from "../../auth/sessions.ts";
+import { createOperatorStore, type OperatorStore } from "../../auth/operator.ts";
+import { createSessionStore, type SessionStore } from "../../auth/sessions.ts";
 import type {
   OperatorCredentialRow,
   OperatorRow,
@@ -72,10 +66,7 @@ export function consoleOkePaths(cwd: string): {
  * @param cwd - Project root
  * @param envSecret - Optional `OKE_CONSOLE_SECRET` override
  */
-export async function resolveConsoleSecret(
-  cwd: string,
-  envSecret?: string,
-): Promise<string> {
+export async function resolveConsoleSecret(cwd: string, envSecret?: string): Promise<string> {
   if (envSecret !== undefined && envSecret.length > 0) return envSecret;
   const paths = consoleOkePaths(cwd);
   const file = Bun.file(paths.secret);
@@ -85,9 +76,7 @@ export async function resolveConsoleSecret(
   }
   const bytes = new Uint8Array(32);
   crypto.getRandomValues(bytes);
-  const secret = [...bytes]
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
+  const secret = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
   await Bun.write(paths.secret, `${secret}\n`);
   return secret;
 }
@@ -350,9 +339,7 @@ export function loadOperatorStore(db: Database): OperatorStore {
   }
 
   const ssoRows = db
-    .query(
-      `SELECT operator_id, provider, subject FROM ${AUTH_TABLES.operatorSsoLinks}`,
-    )
+    .query(`SELECT operator_id, provider, subject FROM ${AUTH_TABLES.operatorSsoLinks}`)
     .all() as Array<{
     operator_id: string;
     provider: string;
@@ -371,9 +358,7 @@ export function loadOperatorStore(db: Database): OperatorStore {
   }
 
   const roleRows = db
-    .query(
-      `SELECT operator_id, role FROM ${AUTH_TABLES.operatorRoles}`,
-    )
+    .query(`SELECT operator_id, role FROM ${AUTH_TABLES.operatorRoles}`)
     .all() as Array<{ operator_id: string; role: string }>;
 
   for (const row of roleRows) {
@@ -392,11 +377,7 @@ export function loadOperatorStore(db: Database): OperatorStore {
  * @param store - In-memory store
  * @param operatorId - Operator id
  */
-export function persistOperator(
-  db: Database,
-  store: OperatorStore,
-  operatorId: string,
-): void {
+export function persistOperator(db: Database, store: OperatorStore, operatorId: string): void {
   const op = store.operators.get(operatorId);
   if (!op) {
     throw new Error(`oke console: unknown operator ${operatorId}`);
@@ -442,9 +423,9 @@ export function persistOperator(
     $enabled: cred.loginEnabled ? 1 : 0,
   });
 
-  db.query(
-    `DELETE FROM ${AUTH_TABLES.operatorSsoLinks} WHERE operator_id = $id`,
-  ).run({ $id: operatorId });
+  db.query(`DELETE FROM ${AUTH_TABLES.operatorSsoLinks} WHERE operator_id = $id`).run({
+    $id: operatorId,
+  });
   const insertSso = db.query(
     `INSERT INTO ${AUTH_TABLES.operatorSsoLinks} (operator_id, provider, subject)
      VALUES ($id, $provider, $subject)`,
@@ -457,9 +438,9 @@ export function persistOperator(
     });
   }
 
-  db.query(
-    `DELETE FROM ${AUTH_TABLES.operatorRoles} WHERE operator_id = $id`,
-  ).run({ $id: operatorId });
+  db.query(`DELETE FROM ${AUTH_TABLES.operatorRoles} WHERE operator_id = $id`).run({
+    $id: operatorId,
+  });
   const insertRole = db.query(
     `INSERT INTO ${AUTH_TABLES.operatorRoles} (operator_id, role)
      VALUES ($id, $role)`,

package/src/console/server/plugin.ts

@@ -4,12 +4,7 @@
  * Uses only the public plugin API (unified-theory §14).
  */
 
-import {
-  fail,
-  plugin,
-  type Fx,
-  type PluginDef,
-} from "../../kernel/index.ts";
+import { fail, plugin, type Fx, type PluginDef } from "../../kernel/index.ts";
 import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 
 /**
@@ -18,53 +13,55 @@ import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
  * @returns Plugin definition
  */
 export function consolePlugin(): PluginDef {
-  return plugin("console", { version: "0.0.1" })
-    .consolePanel({
-      id: "overview",
-      title: "Overview",
-      entry: "./panels/overview.js",
-    })
-    .consolePanel({
-      id: "traces",
-      title: "Traces",
-      entry: "./panels/traces.js",
-    })
-    .table("oke_console_prefs", { plane: "operator" })
-    // Public flows must not 401 when a stale Bearer/cookie is present —
-    // kernel onAuth verifies before beforeHandle's public-flow exemption.
-    // Rebuild from URL: `new Request(req, { headers })` re-copies Authorization.
-    .hook("onRequest", (ctx) => {
-      if (!PUBLIC_CONSOLE_FLOWS.has(ctx.flow.name) || !ctx.request) return;
-      const auth = ctx.request.headers.get("authorization");
-      if (!auth?.startsWith("Bearer ")) return;
-      const headers = new Headers();
-      for (const [key, value] of ctx.request.headers) {
-        if (key.toLowerCase() === "authorization") continue;
-        headers.set(key, value);
-      }
-      const method = ctx.request.method;
-      const init: RequestInit = { method, headers };
-      if (method !== "GET" && method !== "HEAD") {
-        init.body = ctx.request.body;
-        (init as RequestInit & { duplex: "half" }).duplex = "half";
-      }
-      ctx.request = new Request(ctx.request.url, init);
-    })
-    .hook("beforeHandle", (ctx, fxOrErr) => {
-      const fx = fxOrErr as Fx;
-      const name = ctx.flow.name;
-      const plane = ctx.flow.plane ?? "user";
+  return (
+    plugin("console", { version: "0.0.1" })
+      .consolePanel({
+        id: "overview",
+        title: "Overview",
+        entry: "./panels/overview.js",
+      })
+      .consolePanel({
+        id: "traces",
+        title: "Traces",
+        entry: "./panels/traces.js",
+      })
+      .table("oke_console_prefs", undefined, { plane: "operator" })
+      // Public flows must not 401 when a stale Bearer/cookie is present —
+      // kernel onAuth verifies before beforeHandle's public-flow exemption.
+      // Rebuild from URL: `new Request(req, { headers })` re-copies Authorization.
+      .hook("onRequest", (ctx) => {
+        if (!PUBLIC_CONSOLE_FLOWS.has(ctx.flow.name) || !ctx.request) return;
+        const auth = ctx.request.headers.get("authorization");
+        if (!auth?.startsWith("Bearer ")) return;
+        const headers = new Headers();
+        for (const [key, value] of ctx.request.headers) {
+          if (key.toLowerCase() === "authorization") continue;
+          headers.set(key, value);
+        }
+        const method = ctx.request.method;
+        const init: RequestInit = { method, headers };
+        if (method !== "GET" && method !== "HEAD") {
+          init.body = ctx.request.body;
+          (init as RequestInit & { duplex: "half" }).duplex = "half";
+        }
+        ctx.request = new Request(ctx.request.url, init);
+      })
+      .hook("beforeHandle", (ctx, fxOrErr) => {
+        const fx = fxOrErr as Fx;
+        const name = ctx.flow.name;
+        const plane = ctx.flow.plane ?? "user";
 
-      // Application principals never reach operator-plane flows.
-      if (plane === "operator" && fx.auth.userId && !fx.operator.id) {
-        return fail("Forbidden", {
-          reason: "application principal cannot reach a console flow",
-        });
-      }
+        // Application principals never reach operator-plane flows.
+        if (plane === "operator" && fx.auth.userId && !fx.operator.id) {
+          return fail("Forbidden", {
+            reason: "application principal cannot reach a console flow",
+          });
+        }
 
-      if (PUBLIC_CONSOLE_FLOWS.has(name)) return;
-      if (plane === "operator" && !fx.operator.id) {
-        return fail("Unauthorized", {});
-      }
-    });
+        if (PUBLIC_CONSOLE_FLOWS.has(name)) return;
+        if (plane === "operator" && !fx.operator.id) {
+          return fail("Unauthorized", {});
+        }
+      })
+  );
 }

package/src/console/server/plugins.test.ts

@@ -88,9 +88,7 @@ describe("projectPluginsList", () => {
 
     expect(byId.audit?.capabilityDiff[0]?.summary).toContain("widened");
     expect(byId.auth?.supplyChain.lifecycleScripts.state).toBe("not-applicable");
-    expect(byId["oke-slack"]?.supplyChain.releaseCooldown.state).not.toBe(
-      "not-applicable",
-    );
+    expect(byId["oke-slack"]?.supplyChain.releaseCooldown.state).not.toBe("not-applicable");
   });
 
   test("privacy on from runs.redact", async () => {
@@ -124,8 +122,6 @@ describe("capability diff filter", () => {
       },
     ]);
     expect(grouped.audit).toHaveLength(1);
-    expect(
-      filterCapabilityDiffForPlugin(grouped.audit!, "audit"),
-    ).toHaveLength(1);
+    expect(filterCapabilityDiffForPlugin(grouped.audit!, "audit")).toHaveLength(1);
   });
 });