okengine 0.21.0 → 0.22.0

package/src/okid-shared.ts

@@ -0,0 +1,103 @@
+/**
+ * OKID constants and the options-path encoder.
+ *
+ * The default `okid()` / `okid(length)` hot path does not import the
+ * alphabet resolver — only these constants and {@link assertLength}.
+ */
+
+/**
+ * Default `okid()` / `okid(length)` alphabet.
+ *
+ * Same 64-character set and order as
+ * `resolveAlphabet(true, true, true, true, true)` (numbers, lowercase,
+ * uppercase, symbols). Power-of-two size, so a bitmask is unbiased.
+ */
+export const OKID_DEFAULT_CHARS =
+  "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";
+
+/**
+ * Characters removed when `lookAlikes` is disabled (human transcription).
+ */
+export const OKID_LOOKALIKE_CHARS = "1lI0Oouv5Ss";
+
+/** Default URL-safe alphabet: Base64URL charset in its conventional order. */
+export const OKID_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+/**
+ * Codepoint-ordered variant of {@link OKID_ALPHABET}: identical characters,
+ * sorted by code unit so plain string comparison equals value comparison.
+ * The default Base64URL order is NOT lexicographic (`_` sorts between `Z`
+ * and `a`), which would silently break time ordering — so the sortable
+ * encoder always uses this order.
+ *
+ * Kept as a literal (not `[...OKID_ALPHABET].sort().join("")`) so the public
+ * JSR API stays fast-type / explicitly typed.
+ */
+export const OKID_SORTABLE_ALPHABET: string =
+  "-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz";
+
+/** Default id length — 21 chars × 6 bits = 126 bits of entropy. */
+export const OKID_DEFAULT_LENGTH = 21;
+
+/** Shortest permitted id length (8 chars ≈ 48 bits entropy floor). */
+export const OKID_MIN_LENGTH = 8;
+
+/** Longest permitted id length. */
+export const OKID_MAX_LENGTH = 128;
+
+/** Sortable ids need ≥ 16: 8 timestamp chars alone would leave no randomness. */
+export const OKID_SORTABLE_MIN_LENGTH = 16;
+
+/** Longest permitted semantic {@link OkidOptions.prefix}. */
+export const OKID_MAX_PREFIX_LENGTH = 32;
+
+/** Options for {@link okid}. All alphabet toggles default to included. */
+export interface OkidOptions {
+  /**
+   * Generated body length (default {@link OKID_DEFAULT_LENGTH}). Does not
+   * include {@link prefix} — the returned string is `prefix + body`.
+   */
+  readonly length?: number;
+  /**
+   * Fixed semantic label prepended to the body (e.g. `"usr_"`, `"evt_"`).
+   * Characters must belong to {@link OKID_ALPHABET}; max
+   * {@link OKID_MAX_PREFIX_LENGTH}. Empty / omitted means no label.
+   */
+  readonly prefix?: string;
+  /**
+   * Prefix the body with a 48-bit epoch-ms timestamp (exactly 8 chars) so
+   * lexicographic order tracks creation time across milliseconds. Alphabet
+   * toggles are ignored under this mode — see {@link OKID_SORTABLE_ALPHABET}.
+   * Combines with {@link prefix}: `prefix + timestamp + random`.
+   */
+  readonly sortable?: boolean;
+  /** Include `a-z` (default true). */
+  readonly lowercase?: boolean;
+  /** Include `A-Z` (default true). */
+  readonly uppercase?: boolean;
+  /** Include `0-9` (default true). */
+  readonly numbers?: boolean;
+  /** Include `-` and `_` (default true). */
+  readonly symbols?: boolean;
+  /**
+   * Include visually confusable characters (`1lI0Oouv5Ss`, default true).
+   * Set `false` to drop them for human transcription.
+   */
+  readonly lookAlikes?: boolean;
+}
+
+/**
+ * Assert `length` is a valid integer within bounds for the requested mode.
+ *
+ * @param length - Requested length
+ * @param min - Mode-specific minimum
+ * @param label - Option name used in the error message
+ */
+export function assertLength(length: number, min: number, label: string): void {
+  if (!Number.isInteger(length)) {
+    throw new RangeError(`okid: ${label} must be an integer, got ${length}`);
+  }
+  if (length < min || length > OKID_MAX_LENGTH) {
+    throw new RangeError(`okid: ${label} ${length} is out of range [${min}, ${OKID_MAX_LENGTH}]`);
+  }
+}

package/src/okid.ts

@@ -52,193 +52,33 @@
  * @module
  */
 
-/** Character groups addressable through {@link OkidOptions} toggles. */
-const GROUPS = {
-  numbers: "0123456789",
-  lowercase: "abcdefghijklmnopqrstuvwxyz",
-  uppercase: "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
-  symbols: "-_",
-} as const;
+import { lazyRequire } from "./kernel/lazy-require.ts";
+import {
+  assertLength,
+  OKID_DEFAULT_CHARS,
+  OKID_DEFAULT_LENGTH,
+  OKID_MIN_LENGTH,
+  type OkidOptions,
+} from "./okid-shared.ts";
+
+export type { OkidOptions } from "./okid-shared.ts";
+export {
+  OKID_ALPHABET,
+  OKID_DEFAULT_LENGTH,
+  OKID_LOOKALIKE_CHARS,
+  OKID_MAX_LENGTH,
+  OKID_MAX_PREFIX_LENGTH,
+  OKID_MIN_LENGTH,
+  OKID_SORTABLE_ALPHABET,
+  OKID_SORTABLE_MIN_LENGTH,
+} from "./okid-shared.ts";
 
 /**
- * Characters removed when `lookAlikes` is disabled (human transcription).
+ * Load sortable / prefix / alphabet-toggle encoding.
+ * Computed stem so the edge profile does not inline it.
  */
-export const OKID_LOOKALIKE_CHARS = "1lI0Oouv5Ss";
-
-/** Default URL-safe alphabet: Base64URL charset in its conventional order. */
-export const OKID_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-
-/**
- * Codepoint-ordered variant of {@link OKID_ALPHABET}: identical characters,
- * sorted by code unit so plain string comparison equals value comparison.
- * The default Base64URL order is NOT lexicographic (`_` sorts between `Z`
- * and `a`), which would silently break time ordering — so the sortable
- * encoder always uses this order.
- *
- * Kept as a literal (not `[...OKID_ALPHABET].sort().join("")`) so the public
- * JSR API stays fast-type / explicitly typed.
- */
-export const OKID_SORTABLE_ALPHABET: string =
-  "-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz";
-
-/** Default id length — 21 chars × 6 bits = 126 bits of entropy. */
-export const OKID_DEFAULT_LENGTH = 21;
-
-/** Shortest permitted id length (8 chars ≈ 48 bits entropy floor). */
-export const OKID_MIN_LENGTH = 8;
-
-/** Longest permitted id length. */
-export const OKID_MAX_LENGTH = 128;
-
-/** Sortable ids need ≥ 16: 8 timestamp chars alone would leave no randomness. */
-export const OKID_SORTABLE_MIN_LENGTH = 16;
-
-/** Longest permitted semantic {@link OkidOptions.prefix}. */
-export const OKID_MAX_PREFIX_LENGTH = 32;
-
-/** Options for {@link okid}. All alphabet toggles default to included. */
-export interface OkidOptions {
-  /**
-   * Generated body length (default {@link OKID_DEFAULT_LENGTH}). Does not
-   * include {@link prefix} — the returned string is `prefix + body`.
-   */
-  readonly length?: number;
-  /**
-   * Fixed semantic label prepended to the body (e.g. `"usr_"`, `"evt_"`).
-   * Characters must belong to {@link OKID_ALPHABET}; max
-   * {@link OKID_MAX_PREFIX_LENGTH}. Empty / omitted means no label.
-   */
-  readonly prefix?: string;
-  /**
-   * Prefix the body with a 48-bit epoch-ms timestamp (exactly 8 chars) so
-   * lexicographic order tracks creation time across milliseconds. Alphabet
-   * toggles are ignored under this mode — see {@link OKID_SORTABLE_ALPHABET}.
-   * Combines with {@link prefix}: `prefix + timestamp + random`.
-   */
-  readonly sortable?: boolean;
-  /** Include `a-z` (default true). */
-  readonly lowercase?: boolean;
-  /** Include `A-Z` (default true). */
-  readonly uppercase?: boolean;
-  /** Include `0-9` (default true). */
-  readonly numbers?: boolean;
-  /** Include `-` and `_` (default true). */
-  readonly symbols?: boolean;
-  /**
-   * Include visually confusable characters (`1lI0Oouv5Ss`, default true).
-   * Set `false` to drop them for human transcription.
-   */
-  readonly lookAlikes?: boolean;
-}
-
-/** Resolved alphabet + encoding metadata for one options combination. */
-interface ResolvedAlphabet {
-  readonly chars: string;
-  readonly size: number;
-  /** Bitmask covering `size` values (`size` is always a power of two here). */
-  readonly mask: number;
-}
-
-/** Memoized resolutions keyed by the toggle bitmask (32 combinations max). */
-const ALPHABET_CACHE = new Map<number, ResolvedAlphabet>();
-
-function resolveAlphabet(
-  numbers: boolean,
-  lowercase: boolean,
-  uppercase: boolean,
-  symbols: boolean,
-  lookAlikes: boolean,
-): ResolvedAlphabet {
-  const key =
-    (numbers ? 1 : 0) |
-    (lowercase ? 2 : 0) |
-    (uppercase ? 4 : 0) |
-    (symbols ? 8 : 0) |
-    (lookAlikes ? 0 : 16);
-  const cached = ALPHABET_CACHE.get(key);
-  if (cached) return cached;
-
-  let chars = "";
-  if (numbers) chars += GROUPS.numbers;
-  if (lowercase) chars += GROUPS.lowercase;
-  if (uppercase) chars += GROUPS.uppercase;
-  if (symbols) chars += GROUPS.symbols;
-  if (!chars) {
-    throw new RangeError("okid: alphabet is empty — enable at least one character group");
-  }
-  if (!lookAlikes) {
-    chars = [...chars].filter((c) => !OKID_LOOKALIKE_CHARS.includes(c)).join("");
-  }
-
-  // Round up to a power of two for mask-based rejection sampling: bytes below
-  // `size` map uniformly, bytes above are discarded and re-drawn — unbiased at
-  // every alphabet size, unlike naive modulo.
-  const rawSize = chars.length;
-  const size = 1 << Math.ceil(Math.log2(rawSize));
-  const resolved: ResolvedAlphabet = { chars, size: rawSize, mask: size - 1 };
-  ALPHABET_CACHE.set(key, resolved);
-  return resolved;
-}
-
-/** Encode one random byte stream into `length` characters of `alphabet`. */
-function encode(alphabet: ResolvedAlphabet, length: number): string {
-  const { chars, size, mask } = alphabet;
-  const bytes = new Uint8Array(length + Math.ceil(length >> 2));
-  crypto.getRandomValues(bytes.subarray(0, length));
-  let out = "";
-  let i = 0;
-  while (out.length < length && i < bytes.length) {
-    const byte = bytes[i++]!;
-    if ((byte & mask) < size) out += chars[byte & mask];
-  }
-  return out;
-}
-
-/** Pack epoch-ms into exactly 8 codepoint-ordered characters (48 bits). */
-function encodeTimestamp(nowMs: number): string {
-  let t = nowMs % 2 ** 48;
-  let out = "";
-  for (let i = 0; i < 8; i++) {
-    out = OKID_SORTABLE_ALPHABET[t & 63]! + out;
-    t = Math.floor(t / 64);
-  }
-  return out;
-}
-
-/**
- * Assert `length` is a valid integer within bounds for the requested mode.
- *
- * @param length - Requested length
- * @param min - Mode-specific minimum
- * @param label - Option name used in the error message
- */
-function assertLength(length: number, min: number, label: string): void {
-  if (!Number.isInteger(length)) {
-    throw new RangeError(`okid: ${label} must be an integer, got ${length}`);
-  }
-  if (length < min || length > OKID_MAX_LENGTH) {
-    throw new RangeError(`okid: ${label} ${length} is out of range [${min}, ${OKID_MAX_LENGTH}]`);
-  }
-}
-
-/**
- * Assert a semantic prefix is within bounds and stays on the URL-safe alphabet.
- *
- * @param prefix - Caller-supplied label
- */
-function assertPrefix(prefix: string): void {
-  if (prefix.length > OKID_MAX_PREFIX_LENGTH) {
-    throw new RangeError(
-      `okid: prefix length ${prefix.length} exceeds max ${OKID_MAX_PREFIX_LENGTH}`,
-    );
-  }
-  for (const char of prefix) {
-    if (!OKID_ALPHABET.includes(char)) {
-      throw new RangeError(
-        `okid: prefix contains invalid character ${JSON.stringify(char)} — use characters from OKID_ALPHABET`,
-      );
-    }
-  }
+function loadOkidExtended(): typeof import("./okid-extended.ts") {
+  return lazyRequire(import.meta.dir, ["okid", "extended"].join("-"));
 }
 
 /**
@@ -256,34 +96,11 @@ function assertPrefix(prefix: string): void {
 export function okid(options: number | OkidOptions = OKID_DEFAULT_LENGTH): string {
   if (typeof options === "number") {
     assertLength(options, OKID_MIN_LENGTH, "length");
-    return encode(resolveAlphabet(true, true, true, true, true), options);
+    const bytes = new Uint8Array(options);
+    crypto.getRandomValues(bytes);
+    let out = "";
+    for (let i = 0; i < options; i++) out += OKID_DEFAULT_CHARS[bytes[i]! & 63]!;
+    return out;
   }
-
-  const {
-    length = OKID_DEFAULT_LENGTH,
-    prefix = "",
-    sortable = false,
-    lowercase = true,
-    uppercase = true,
-    numbers = true,
-    symbols = true,
-    lookAlikes = true,
-  } = options;
-
-  if (prefix) assertPrefix(prefix);
-
-  let body: string;
-  if (sortable) {
-    assertLength(length, OKID_SORTABLE_MIN_LENGTH, "length");
-    // Time ordering requires lexicographic encoding, which requires the full
-    // codepoint-ordered alphabet — partial subsets cannot preserve both the
-    // caller's charset choice AND cross-ms ordering, so toggles are ignored.
-    const alphabet = resolveAlphabet(true, true, true, true, true);
-    body = encodeTimestamp(Date.now()) + encode(alphabet, length - 8);
-  } else {
-    assertLength(length, OKID_MIN_LENGTH, "length");
-    body = encode(resolveAlphabet(numbers, lowercase, uppercase, symbols, lookAlikes), length);
-  }
-
-  return prefix ? prefix + body : body;
+  return loadOkidExtended().okidWithOptions(options);
 }

package/src/plugins/auth-delivery.mailpit.integration.test.ts

@@ -18,7 +18,7 @@ import { otp } from "./otp.ts";
 import { magicLink } from "./magic-link.ts";
 
 const SECRET = "test-secret-at-least-16";
-const MAILPIT_IMAGE = "axllent/mailpit:v1.31.1";
+const MAILPIT_IMAGE = "axllent/mailpit:v1.31.2";
 
 afterEach(() => {
   resetBindings();

package/src/plugins/otp.test.ts

@@ -117,7 +117,71 @@ describe("otp() provider mode boot", () => {
     const body = (await res.json()) as { data: { ok: true; devOtp?: string } };
     expect(body.data.ok).toBe(true);
     expect(body.data.devOtp).toBeUndefined();
-    expect(app.router.match("POST", "/auth/otp/resend")).toBeFalsy();
+    expect(app.router.match("POST", "/auth/otp/resend")).toBeTruthy();
+    await app.stop();
+  });
+
+  test("SMS resend issues a new request id, honors cooldown, and rejects another channel", async () => {
+    let now = 1_000_000;
+    const requestIds: string[] = [];
+    const verifications = createVerificationStore();
+    const driver = mockOtpSmsDriver();
+    const transport = driver.smsTransport as unknown as SmsOtpTransport;
+    const original = transport.sendOtp.bind(transport);
+    transport.sendOtp = async (opts) => {
+      requestIds.push(opts.requestId);
+      return original(opts);
+    };
+
+    const app = oke({
+      name: `otp-provider-resend-${crypto.randomUUID()}`,
+      env: "test",
+      registry: "ignore",
+      gate: { auth: { secret: SECRET } },
+      channel: { drivers: [driver] },
+      fx: { now: () => now },
+    }).plug(
+      otp({
+        mode: "provider",
+        resendCooldownMs: 60_000,
+        verifications,
+        now: () => now,
+      }),
+    );
+    await app.boot({ env: "test" });
+
+    const phone = "+15551234567";
+    expect((await app.fetch(jsonPost("/auth/otp/request", { phone }))).status).toBe(200);
+    const first = findActiveVerification(verifications, `otp:${phone}`, now);
+    expect(first?.value.startsWith("provider:")).toBe(true);
+    expect(first?.sealedOtp).toBeNull();
+    const firstId = first?.value.slice("provider:".length);
+
+    const cooled = await app.fetch(jsonPost("/auth/otp/resend", { phone }));
+    const cooledBody = (await cooled.json()) as { error?: { data?: { reason?: string } } };
+    expect(cooledBody.error?.data?.reason).toBe("resend_cooldown");
+
+    const other = await app.fetch(jsonPost("/auth/otp/resend", { phone, channel: "email" }));
+    const otherBody = (await other.json()) as { error?: { data?: { reason?: string } } };
+    expect(otherBody.error?.data?.reason).toBe("invalid_channel");
+
+    now += 60_001;
+    const resent = await app.fetch(jsonPost("/auth/otp/resend", { phone, channel: "sms" }));
+    expect(resent.status).toBe(200);
+    const resentBody = (await resent.json()) as { data: { channel: string; devOtp?: string } };
+    expect(resentBody.data.channel).toBe("sms");
+    expect(resentBody.data.devOtp).toBeUndefined();
+
+    const second = findActiveVerification(verifications, `otp:${phone}`, now);
+    const secondId = second?.value.slice("provider:".length);
+    expect(secondId).toBeDefined();
+    expect(secondId).not.toBe(firstId);
+    if (firstId === undefined || secondId === undefined) {
+      throw new Error("expected provider request ids");
+    }
+    expect(requestIds).toEqual([firstId, secondId]);
+    expect(findActiveVerification(verifications, `otp:${phone}`, now)?.sealedOtp).toBeNull();
+
     await app.stop();
   });
 });

package/src/plugins/otp.ts

@@ -77,7 +77,8 @@ export interface OtpProviderModeOptions extends OtpBaseOptions {
   readonly channels?: never;
   /** Forbidden in provider mode — code never exists server-side. */
   readonly exposeDevOtp?: never;
-  readonly resendCooldownMs?: never;
+  /** Spacing between provider SMS resends. Default 60s. */
+  readonly resendCooldownMs?: number;
   readonly from?: never;
 }
 
@@ -216,10 +217,7 @@ export function otp(opts: OtpOptions): PluginDef {
   const identities = resolveSharedIdentities(opts);
   const verifications = opts.verifications ?? createVerificationStore();
   const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
-  const resendCooldownMs =
-    opts.mode === "app"
-      ? (opts.resendCooldownMs ?? DEFAULT_RESEND_COOLDOWN_MS)
-      : DEFAULT_RESEND_COOLDOWN_MS;
+  const resendCooldownMs = opts.resendCooldownMs ?? DEFAULT_RESEND_COOLDOWN_MS;
   const channels = opts.mode === "app" ? opts.channels : ([] as const);
   const exposeDevOtp = opts.mode === "app" && opts.exposeDevOtp === true;
   const from = opts.mode === "app" ? opts.from : undefined;
@@ -288,8 +286,61 @@ export function otp(opts: OtpOptions): PluginDef {
           attempts: 0,
           phone,
           sealedOtp: null,
+          lastDeliveredAt: now,
+          lastChannel: "sms",
+        });
+        return { ok: true as const, channel: "sms" as const };
+      },
+    });
+
+    const resendContract = {
+      in: z.object({
+        phone: z.string().min(8),
+        lang: z.enum(["en", "ar"]).optional(),
+        channel: z.enum(["sms", "whatsapp", "email"]).optional(),
+      }),
+      out: requestOut,
+      errors: { AuthFailed, AuthRateLimited },
+    };
+
+    const resend = flow("auth.resendOtp", {
+      plane: "user",
+      effects: { sends: ["sms-otp"] },
+      do: async (input, fx) => {
+        if (input.channel !== undefined && input.channel !== "sms") {
+          return fail("AuthFailed", { reason: "invalid_channel" });
+        }
+        const phone = input.phone.trim();
+        if (!E164.test(phone)) return fail("AuthFailed", { reason: "invalid_phone" });
+        const now = runtime.now();
+        const row = findActiveVerification(verifications, `otp:${phone}`, now);
+        if (!row || row.sealedOtp) {
+          return fail("AuthFailed", { reason: "invalid_credentials" });
+        }
+        if (row.lastDeliveredAt !== undefined && now - row.lastDeliveredAt < resendCooldownMs) {
+          return fail("AuthFailed", { reason: "resend_cooldown" });
+        }
+
+        const requestId = okid();
+        await fx.sendOtp({
+          to: phone,
+          requestId,
+          ...(input.lang ? { lang: input.lang } : {}),
+        });
+        invalidateVerifications(verifications, `otp:${phone}`, now);
+        putVerification(verifications, {
+          id: okid(),
+          identifier: `otp:${phone}`,
+          value: `provider:${requestId}`,
+          expiresAt: now + ttlMs,
+          createdAt: now,
+          consumedAt: null,
+          attempts: 0,
+          phone,
+          sealedOtp: null,
+          lastDeliveredAt: now,
+          lastChannel: "sms",
         });
-        // Provider mode: resend-via-different-channel is impossible — provider owns the code.
         return { ok: true as const, channel: "sms" as const };
       },
     });
@@ -373,7 +424,8 @@ export function otp(opts: OtpOptions): PluginDef {
     return plugin("otp", { version: "0.0.1", config: configSnapshot })
       .needs("auth")
       .binding(bindPublicAuth("/otp/request", request, "otp", requestContract))
-      .binding(bindPublicAuth("/otp/verify", verify, "otp", verifyContract));
+      .binding(bindPublicAuth("/otp/verify", verify, "otp", verifyContract))
+      .binding(bindPublicAuth("/otp/resend", resend, "otp", resendContract));
   }
 
   // ── App mode ───────────────────────────────────────────────────────────

package/src/release/absolute-regression.test.ts

@@ -0,0 +1,63 @@
+/**
+ * Absolute budgets with room under the cap also fail at 2× the last value.
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+  absoluteBudgetOk,
+  absoluteRegressionCeiling,
+  formatBudgetsReport,
+  type BudgetsSnapshot,
+} from "./measure.ts";
+import {
+  ABSOLUTE_REGRESSION_RATIO,
+  CLIENT_BUDGET_BYTES,
+  COLD_START_BUDGET_MS,
+  CONSOLE_BUDGET_BYTES,
+  KERNEL_EDGE_BUDGET_BYTES,
+} from "./limits.ts";
+
+describe("absolute regression ceilings", () => {
+  test("ratio is 2× so a confirmed doubling fails and a single noisy run can be re-measured", () => {
+    expect(ABSOLUTE_REGRESSION_RATIO).toBe(2);
+  });
+
+  test("cold start and console initial load grow a ceiling; kernel, client, and a zero baseline do not", () => {
+    expect(absoluteRegressionCeiling(undefined, COLD_START_BUDGET_MS, "ms")).toBeUndefined();
+    expect(absoluteRegressionCeiling(0, 1, "ms")).toBeUndefined();
+    expect(absoluteRegressionCeiling(8.915, COLD_START_BUDGET_MS, "ms")).toBe(17.83);
+    expect(absoluteRegressionCeiling(353_621, CONSOLE_BUDGET_BYTES, "bytes")).toBe(707_242);
+    expect(absoluteRegressionCeiling(12_556, KERNEL_EDGE_BUDGET_BYTES, "bytes")).toBeUndefined();
+    expect(absoluteRegressionCeiling(4598, CLIENT_BUDGET_BYTES, "bytes")).toBeUndefined();
+  });
+
+  test("ok requires both the cap and the ceiling", () => {
+    expect(absoluteBudgetOk(8.915, COLD_START_BUDGET_MS, 17.83)).toBe(true);
+    expect(absoluteBudgetOk(17.83, COLD_START_BUDGET_MS, 17.83)).toBe(false);
+    expect(absoluteBudgetOk(20, COLD_START_BUDGET_MS, 17.83)).toBe(false);
+    expect(absoluteBudgetOk(80, COLD_START_BUDGET_MS, undefined)).toBe(false);
+    expect(absoluteBudgetOk(12_556, KERNEL_EDGE_BUDGET_BYTES, undefined)).toBe(true);
+  });
+
+  test("the CI log prints the 2× ceiling and the absolute cap", () => {
+    const snapshot: BudgetsSnapshot = {
+      measuredAt: "2026-09-23T00:00:00.000Z",
+      version: "0.0.0",
+      budgets: [
+        {
+          id: "coldStartMedianMs",
+          label: "Cold start on Bun",
+          value: 20,
+          limit: COLD_START_BUDGET_MS,
+          regressionLimit: 17.83,
+          unit: "ms",
+          gate: "absolute",
+          group: "core",
+          ok: false,
+        },
+      ],
+    };
+    const report = formatBudgetsReport(snapshot);
+    expect(report).toContain("[FAIL] Cold start on Bun: 20.000 ms < 17.830 ms (cap 75.000 ms)");
+  });
+});

package/src/release/build-lib.ts

@@ -26,6 +26,7 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   // Lazy sync chunks — loaded via requirePackageModule / computed require
   // when the feature actually runs (auth, list page, auto-cache).
   { src: "src/kernel/fx-runtime.ts", out: "dist/fx-runtime.js" },
+  { src: "src/kernel/client-descriptor.ts", out: "dist/client-descriptor.js" },
   { src: "src/auth/config.ts", out: "dist/auth-config.js" },
   { src: "src/kernel/fx-auth-keys.ts", out: "dist/fx-auth-keys.js" },
   { src: "src/kernel/fx-auth-tenants.ts", out: "dist/fx-auth-tenants.js" },
@@ -37,6 +38,12 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   { src: "src/kernel/errors-live-resume.ts", out: "dist/errors-live-resume.js" },
   { src: "src/kernel/errors-channel.ts", out: "dist/errors-channel.js" },
   { src: "src/kernel/errors-tenant.ts", out: "dist/errors-tenant.js" },
+  { src: "src/kernel/errors-text.ts", out: "dist/errors-text.js" },
+  { src: "src/kernel/fx-sql-handle.ts", out: "dist/fx-sql-handle.js" },
+  { src: "src/kernel/concurrency.ts", out: "dist/concurrency.js" },
+  { src: "src/compiler/aot.ts", out: "dist/aot.js" },
+  { src: "src/runs/window.ts", out: "dist/window.js" },
+  { src: "src/okid-extended.ts", out: "dist/okid-extended.js" },
   { src: "src/kernel/clock-durable.ts", out: "dist/clock-durable.js" },
   { src: "src/kernel/clock-reconcile.ts", out: "dist/clock-reconcile.js" },
   { src: "src/kernel/clock-per-tenant-name.ts", out: "dist/clock-per-tenant-name.js" },
@@ -44,6 +51,8 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   { src: "src/kernel/list-page.ts", out: "dist/list-page.js" },
   { src: "src/kernel/http-resource.ts", out: "dist/http-resource.js" },
   { src: "src/elements/store/cache.ts", out: "dist/store-cache.js" },
+  { src: "src/elements/store/search-runtime.ts", out: "dist/search-runtime.js" },
+  { src: "src/elements/store/schema-decl.ts", out: "dist/schema-decl.js" },
   { src: "src/i18n/messages.ts", out: "dist/messages.js" },
   { src: "src/i18n/failure-message.ts", out: "dist/failure-message.js" },
   { src: "src/okid.ts", out: "dist/okid.js" },

package/src/release/http-graph.test.ts

@@ -0,0 +1,25 @@
+/**
+ * `okengine/http` must not statically import heavy modules.
+ * Forbidden ids live in {@link HTTP_STATIC_GRAPH_FORBIDDEN}.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { forbiddenHttpGraphHits, readStaticGraphSpecifiers } from "./http-graph.ts";
+
+describe("okengine/http static import graph", () => {
+  test("zod and the hybrid-search runtime are not in the graph", async () => {
+    const specifiers = await readStaticGraphSpecifiers();
+    expect(specifiers.length).toBeGreaterThan(10);
+    expect(forbiddenHttpGraphHits(specifiers)).toEqual([]);
+  });
+
+  test("the forbidden list matches zod and search-runtime, and nothing nearby", () => {
+    expect(forbiddenHttpGraphHits(["node_modules/zod/index.js"])).toEqual(["zod"]);
+    expect(forbiddenHttpGraphHits(["zod"])).toEqual(["zod"]);
+    expect(forbiddenHttpGraphHits(["src/elements/store/search-runtime.ts"])).toEqual([
+      "hybrid-search runtime",
+    ]);
+    expect(forbiddenHttpGraphHits(["src/elements/store/search-lsh.ts"])).toEqual([]);
+    expect(forbiddenHttpGraphHits(["src/kernel/app.ts"])).toEqual([]);
+  });
+});