okengine 0.3.6 → 0.5.0

package/src/console/server/flows.ts

@@ -751,6 +751,7 @@ const GatesListOut = z.object({
       plane: z.enum(["user", "operator"]),
       gates: z.array(z.string()),
       unguarded: z.boolean(),
+      explicitPublic: z.boolean(),
     }),
   ),
   gates: z.array(
@@ -2817,6 +2818,7 @@ function createGatesList(state: ConsoleState) {
           plane: f.plane,
           gates: [...f.gates],
           unguarded: f.unguarded,
+          explicitPublic: f.explicitPublic,
         })),
         gates: projection.gates.map((g) => ({
           name: g.name,

package/src/console/server/gates.ts

@@ -66,8 +66,13 @@ export interface ConsoleFlowGatesRow {
   readonly flowId: string;
   readonly plane: "user" | "operator";
   readonly gates: readonly string[];
-  /** User-plane with empty chain — public. */
+  /**
+   * User-plane with empty chain — missing auth posture (boot error when
+   * `unguardedHttp: "deny"`). Distinct from {@link explicitPublic}.
+   */
   readonly unguarded: boolean;
+  /** Chain includes the reserved `public` sentinel (`gate.public`). */
+  readonly explicitPublic: boolean;
 }
 
 /**
@@ -449,11 +454,13 @@ function projectFlows(manifest: Manifest | null): ConsoleFlowGatesRow[] {
   for (const [flowId, flow] of Object.entries(manifest.flows)) {
     const plane = flow.plane === "operator" ? "operator" : "user";
     const gates = [...(flow.gates ?? [])];
+    const explicitPublic = gates.includes("public");
     rows.push({
       flowId,
       plane,
       gates,
       unguarded: plane === "user" && gates.length === 0,
+      explicitPublic,
     });
   }
   return rows.sort((a, b) => a.flowId.localeCompare(b.flowId));

package/src/console/server/operator-db.test.ts

@@ -36,7 +36,7 @@ describe("console operator persistence", () => {
     const op = await createOperator(first.operators, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
     first.persistOperator(op.id);
     first.close();
@@ -77,7 +77,7 @@ describe("console operator persistence", () => {
     const op = await createOperator(first.operators, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
     first.persistOperator(op.id);
     const issued = await issueSession(
@@ -120,7 +120,7 @@ describe("console operator persistence", () => {
             claimCode: first.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -169,7 +169,7 @@ describe("console operator persistence", () => {
     const op = await createOperator(persistence.operators, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
     persistence.persistOperator(op.id);
 

package/src/console/server/operator-db.ts

@@ -157,7 +157,8 @@ export function migrateOperatorSchema(db: Database): void {
       family_id TEXT NOT NULL,
       revoked_at INTEGER,
       created_at INTEGER NOT NULL,
-      expires_at INTEGER NOT NULL
+      expires_at INTEGER NOT NULL,
+      last_active_at INTEGER
     );
     CREATE TABLE IF NOT EXISTS ${AUTH_TABLES.refreshTokens} (
       id TEXT PRIMARY KEY NOT NULL,
@@ -169,6 +170,20 @@ export function migrateOperatorSchema(db: Database): void {
       revoked_at INTEGER
     );
   `);
+  ensureSessionLastActiveColumn(db);
+}
+
+/**
+ * Add `last_active_at` when opening an older console.sqlite that predates idle TTL.
+ *
+ * @param db - Open database
+ */
+function ensureSessionLastActiveColumn(db: Database): void {
+  const cols = db.query(`PRAGMA table_info(${AUTH_TABLES.sessions})`).all() as Array<{
+    name: string;
+  }>;
+  if (cols.some((c) => c.name === "last_active_at")) return;
+  db.exec(`ALTER TABLE ${AUTH_TABLES.sessions} ADD COLUMN last_active_at INTEGER`);
 }
 
 /**
@@ -181,7 +196,7 @@ export function loadSessionStore(db: Database): SessionStore {
 
   const sessionRows = db
     .query(
-      `SELECT id, plane, principal_id, family_id, revoked_at, created_at, expires_at
+      `SELECT id, plane, principal_id, family_id, revoked_at, created_at, expires_at, last_active_at
        FROM ${AUTH_TABLES.sessions}`,
     )
     .all() as Array<{
@@ -192,6 +207,7 @@ export function loadSessionStore(db: Database): SessionStore {
     revoked_at: number | null;
     created_at: number;
     expires_at: number;
+    last_active_at: number | null;
   }>;
 
   for (const row of sessionRows) {
@@ -203,6 +219,7 @@ export function loadSessionStore(db: Database): SessionStore {
       revokedAt: row.revoked_at,
       createdAt: row.created_at,
       expiresAt: row.expires_at,
+      lastActiveAt: row.last_active_at ?? row.created_at,
     };
     store.sessions.set(session.id, session);
   }
@@ -250,8 +267,8 @@ export function persistSessions(db: Database, store: SessionStore): void {
 
   const insertSession = db.query(
     `INSERT INTO ${AUTH_TABLES.sessions}
-      (id, plane, principal_id, family_id, revoked_at, created_at, expires_at)
-     VALUES ($id, $plane, $principal, $family, $revoked, $created, $expires)`,
+      (id, plane, principal_id, family_id, revoked_at, created_at, expires_at, last_active_at)
+     VALUES ($id, $plane, $principal, $family, $revoked, $created, $expires, $lastActive)`,
   );
   for (const session of store.sessions.values()) {
     insertSession.run({
@@ -262,6 +279,7 @@ export function persistSessions(db: Database, store: SessionStore): void {
       $revoked: session.revokedAt,
       $created: session.createdAt,
       $expires: session.expiresAt,
+      $lastActive: session.lastActiveAt,
     });
   }
 

package/src/console/server/security.gate.test.ts

@@ -69,7 +69,7 @@ describe("console security gates (whole surface)", () => {
           claimCode: handle.state.claim.code,
           email: "ops@example.com",
           name: "Ops",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );
@@ -234,7 +234,7 @@ describe("console security gates (whole surface)", () => {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           email: "ops@example.com",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );
@@ -252,7 +252,7 @@ describe("console security gates (whole surface)", () => {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           email: "other@example.com",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );

package/src/console/server/store.test.ts

@@ -137,7 +137,7 @@ describe("index driver resolution", () => {
     expect(decl).toBeDefined();
     const handle = (await runtime.open(decl!, {
       effects: { reads: ["index:docs"], writes: ["index:docs"] },
-    })) as import("../../elements/store.ts").IndexStoreFxHandle;
+    })) as import("../../elements/store.ts").VectorIndexStoreFxHandle;
     expect(handle.driverId).toBe("memory");
     await handle.upsert("d1", [1, 0, 0], { t: 1 });
     const hits = await handle.search([1, 0, 0], 1);

package/src/console/server/store.ts

@@ -329,6 +329,7 @@ export interface StoreQueryInput {
   readonly prefix?: string;
   readonly limit?: number;
   readonly vector?: readonly number[];
+  readonly q?: string;
   readonly topK?: number;
   readonly revealPii?: boolean;
 }
@@ -350,6 +351,7 @@ export interface StoreQueryResult {
     readonly score: number;
     readonly meta?: Record<string, unknown>;
   }>;
+  readonly facetDistribution?: Record<string, Record<string, number>>;
   readonly masked: boolean;
   readonly routedRole?: "primary" | "replica";
 }
@@ -438,12 +440,20 @@ export async function queryStore(
 
   // index
   const idx = handle as IndexStoreFxHandle;
+  void manifest;
+  if (idx.driverId === "meilisearch") {
+    const q = input.q ?? "";
+    if (q.trim().length === 0) {
+      return { facet, hits: [], masked: false };
+    }
+    const result = await idx.search(q, { topK: input.topK ?? 5 });
+    return { facet, hits: result.hits, facetDistribution: result.facetDistribution, masked: false };
+  }
   const vector = input.vector ?? [];
   if (vector.length === 0) {
     return { facet, hits: [], masked: false };
   }
   const hits = await idx.search(vector, input.topK ?? 5);
-  void manifest;
   return { facet, hits, masked: false };
 }