okengine 0.10.0 → 0.10.2

package/src/docker/stack-id.ts

@@ -128,6 +128,7 @@ export const STACK_CONTROL_KEYS = [
   "MP_SMTP_AUTH_ACCEPT_ANY",
   "MP_SMTP_AUTH_ALLOW_INSECURE",
   "OKE_AI_MODEL",
+  "OKE_AI_CTX_SIZE",
   "OKE_PROXY_HOST",
   "OKE_PROXY_ACME_EMAIL",
   // OpenBao app token — minted by bootstrap, must survive `writeDerivedFiles`.

package/src/elements/channel/declare.ts

@@ -5,6 +5,7 @@
  */
 
 import type { ChannelMedium } from "../../manifest/types.ts";
+import { channelTemplateRegistry } from "../../kernel/element-registries.ts";
 
 /** Options for a medium binder (`channel.email`, …). */
 export interface ChannelMediumOptions {
@@ -49,6 +50,29 @@ export interface ChannelMediumBinder {
   ): ChannelTemplateDecl;
 }
 
+/**
+ * Medium binders' `.template()` (email / sms / whatsapp / push) push into
+ * the shared {@link channelTemplateRegistry} (`src/kernel/element-registries.ts`)
+ * so {@link oke} can auto-populate `channel.templates` with zero explicit
+ * array — mirrors the {@link on} trigger-drain registry
+ * (`src/kernel/on.ts`). The medium-agnostic `channel.template()` is
+ * intentionally not auto-registered (out of scope).
+ *
+ * Snapshot of every medium-binder template declared since the last reset.
+ */
+export function listChannelTemplates(): readonly ChannelTemplateDecl[] {
+  return channelTemplateRegistry.slice();
+}
+
+/**
+ * Clear the channel-template registry (tests / fresh app adopt).
+ *
+ * @internal
+ */
+export function resetChannelTemplates(): void {
+  channelTemplateRegistry.length = 0;
+}
+
 /**
  * Create a medium binder.
  *
@@ -64,7 +88,7 @@ function mediumBinder(
     medium,
     ...(from !== undefined ? { from } : {}),
     template(name, opts = {}) {
-      return {
+      const decl: ChannelTemplateDecl = {
         kind: "template",
         name,
         medium,
@@ -73,6 +97,8 @@ function mediumBinder(
         ...(opts.schema !== undefined ? { schema: opts.schema } : {}),
         ...(from !== undefined ? { from } : {}),
       };
+      channelTemplateRegistry.push(decl);
+      return decl;
     },
   };
 }

package/src/elements/clock/chaos-child.ts

@@ -169,8 +169,7 @@ if (mode === "tick-loop") {
   }
 
   const journalStore = createFileJournalStore(join(journalPath));
-  const charge = flow({
-    name: "chaos.charge",
+  const charge = flow("chaos.charge", {
     durable: true,
     do: async (_input, fx) => {
       const intent = await fx.step("create-intent", async () => {
@@ -329,8 +328,7 @@ async function logHasStep(path: string, step: string, instanceId: string): Promi
 
 /** Durable charge flow: step 1 → block → step 2 (both logged). */
 function chargeFlow(instanceId: string, stepLogPath: string, blockMs: number): AnyFlowDef {
-  return flow({
-    name: "chaos.journal.charge",
+  return flow("chaos.journal.charge", {
     durable: true,
     do: async (_input, fx) => {
       const intent = await fx.step("create-intent", async () => {
@@ -349,8 +347,7 @@ function chargeFlow(instanceId: string, stepLogPath: string, blockMs: number): A
 
 /** Durable sleeper flow: step 1 → sleep → confirm (steps logged). */
 function sleeperFlow(instanceId: string, stepLogPath: string, wakeMs: number): AnyFlowDef {
-  return flow({
-    name: "chaos.journal.sleeper",
+  return flow("chaos.journal.sleeper", {
     durable: true,
     do: async (_input, fx) => {
       await fx.step("create-intent", async () => {

package/src/elements/clock/chaos.test.ts

@@ -173,8 +173,7 @@ describe("chaos — SIGKILL durable mid-step", () => {
 
       const calls: string[] = [];
       const journalStore = createFileJournalStore(journalPath);
-      const charge = flow({
-        name: "chaos.charge",
+      const charge = flow("chaos.charge", {
         durable: true,
         do: async (_input, fx) => {
           const intent = await fx.step("create-intent", () => {

package/src/elements/clock.test.ts

@@ -67,8 +67,7 @@ describe("durable journal", () => {
     const tt = createTimeTravel(0);
     let crashAfterFirstStep = true;
 
-    const charge = flow({
-      name: "payments.charge",
+    const charge = flow("payments.charge", {
       durable: true,
       do: async (_input, fx) => {
         const intent = await fx.step("create-intent", () => {
@@ -118,8 +117,7 @@ describe("durable journal", () => {
     const tt = createTimeTravel(0);
 
     try {
-      const sleepy = flow({
-        name: "trial.wait",
+      const sleepy = flow("trial.wait", {
         durable: true,
         do: async (_input, fx) => {
           await fx.step("start", () => "begun");

package/src/elements/signal/declare.ts

@@ -6,6 +6,7 @@
  */
 
 import type { SignalDelivery } from "../../manifest/types.ts";
+import { signalRegistry } from "../../kernel/element-registries.ts";
 
 /** Options for {@link signal}. */
 export interface SignalOptions {
@@ -54,6 +55,27 @@ export interface SignalDecl<T = unknown> {
   readonly _payload?: T;
 }
 
+/**
+ * `signal()` pushes into the shared {@link signalRegistry}
+ * (`src/kernel/element-registries.ts`) so {@link oke} can auto-populate
+ * `signals` with zero explicit array — mirrors the {@link on} trigger-drain
+ * registry (`src/kernel/on.ts`).
+ *
+ * Snapshot of every signal declared since the last reset.
+ */
+export function listSignals(): readonly SignalDecl[] {
+  return signalRegistry.slice();
+}
+
+/**
+ * Clear the signal registry (tests / fresh app adopt).
+ *
+ * @internal
+ */
+export function resetSignals(): void {
+  signalRegistry.length = 0;
+}
+
 /**
  * Declare a signal. `delivery` is mandatory — omitting it is a type error.
  *
@@ -68,7 +90,7 @@ export function signal<T = unknown>(name: string, options: SignalOptions): Signa
   ) {
     throw new TypeError(`signal("${name}"): delivery is mandatory (once | broadcast | live)`);
   }
-  return {
+  const decl: SignalDecl<T> = {
     name,
     delivery: options.delivery,
     ...(options.description !== undefined ? { description: options.description } : {}),
@@ -77,4 +99,6 @@ export function signal<T = unknown>(name: string, options: SignalOptions): Signa
     schema: options.schema,
     optional: options.optional ?? false,
   };
+  signalRegistry.push(decl as SignalDecl);
+  return decl;
 }

package/src/elements/store/cache.test.ts

@@ -43,4 +43,32 @@ describe("tier-1 cache — exact per-resource invalidation (path b)", () => {
     expect(cache.invalidateFromEffects({ writes: ["sql:links"] }).keys).toEqual(keys);
     expect(cache.get(keys[0]!)).toBeUndefined();
   });
+
+  test("write to table A does not invalidate a cached read of table B in the same sql store", () => {
+    // Two tables under one `store.sql("app", …)` — the exact shape Direction
+    // B's per-table kernel resolution (fx.ts `gatedTable`) now produces:
+    // `sql:notes` / `sql:orders`, not the old coarse `sql:app` for both.
+    // This precision was already correct in cache.ts before Direction B —
+    // it simply never received per-table refs to prove it with. Confirmed
+    // here with the exact naming the kernel now emits.
+    const cache = createStoreCache();
+    const notesRead: Effects = { reads: ["sql:notes"] };
+    const keys = tier1KeysForReads(notesRead);
+
+    cache.set({
+      tier: 1,
+      key: keys[0]!,
+      value: [{ id: "n1" }],
+      resources: ["sql:notes"],
+      expiresAt: null,
+    });
+
+    // A write to "orders" — a different table, same store — must not touch it.
+    expect(cache.invalidateFromEffects({ writes: ["sql:orders"] }).keys).toEqual([]);
+    expect(cache.get(keys[0]!)).toBeDefined();
+
+    // A write to "notes" itself still invalidates.
+    expect(cache.invalidateFromEffects({ writes: ["sql:notes"] }).keys).toEqual(keys);
+    expect(cache.get(keys[0]!)).toBeUndefined();
+  });
 });

package/src/elements/store/declare.ts

@@ -5,6 +5,7 @@
  */
 
 import type { ColumnClassification, ResourceRef, StoreFacet } from "../../manifest/types.ts";
+import { storeRegistry } from "../../kernel/element-registries.ts";
 import { resource } from "./resource.ts";
 import { schema } from "./schema-decl.ts";
 import { resolveTableName, type TableHandle } from "./table.ts";
@@ -114,6 +115,28 @@ export interface IndexStoreDecl extends StoreDeclBase {
 /** Any store declaration. */
 export type StoreDecl = SqlStoreDecl | KvStoreDecl | FilesStoreDecl | IndexStoreDecl;
 
+/**
+ * `store.sql` / `store.files` push into the shared {@link storeRegistry}
+ * (`src/kernel/element-registries.ts`) so {@link oke} can auto-populate
+ * `stores` with zero explicit array — mirrors the {@link on} trigger-drain
+ * registry (`src/kernel/on.ts`). `store.kv` / `store.index` are
+ * intentionally not auto-registered (out of scope).
+ *
+ * Snapshot of every `store.sql` / `store.files` declared since the last reset.
+ */
+export function listStores(): readonly StoreDecl[] {
+  return storeRegistry.slice();
+}
+
+/**
+ * Clear the store registry (tests / fresh app adopt).
+ *
+ * @internal
+ */
+export function resetStores(): void {
+  storeRegistry.length = 0;
+}
+
 /**
  * Declare a SQL store.
  *
@@ -140,6 +163,7 @@ export function sql(name: string, options: SqlStoreOptions = {}): SqlStoreDecl {
       };
     },
   };
+  storeRegistry.push(decl);
   return decl;
 }
 
@@ -165,12 +189,14 @@ export function kv(name: string, options: KvStoreOptions = {}): KvStoreDecl {
  * @param options - Options
  */
 export function files(name: string, options: FilesStoreOptions = {}): FilesStoreDecl {
-  return {
+  const decl: FilesStoreDecl = {
     facet: "files",
     name,
     ref: `files:${name}`,
     ...(options.description !== undefined ? { description: options.description } : {}),
   };
+  storeRegistry.push(decl);
+  return decl;
 }
 
 /**

package/src/elements/store/resource.ts

@@ -1,7 +1,7 @@
 /**
  * `store.resource(db, table, opts)` — a CRUD + list resource factory.
  *
- * Declarative sugar, never new physics: every op is an ordinary `flow({…})`
+ * Declarative sugar, never new physics: every op is an ordinary `flow(name, {…})`
  * whose body composes `fx.store(db)` (select/insert/update/findById/delete +
  * `page`/`count`) through the existing Drizzle-condition compiler. Wire
  * binding stays in `on(http.resource(path, resource.all()))` — the factory
@@ -649,8 +649,7 @@ export function resource(db: SqlStoreDecl, table: unknown, options: ResourceOpti
     return { data, meta };
   }
 
-  const listFlow = flow({
-    name: "list",
+  const listFlow = flow("list", {
     unit,
     ...(breaking ? { breaking: true as const } : {}),
     // Loose record so the HTTP AoT infers `query` and lets every list URL
@@ -664,8 +663,7 @@ export function resource(db: SqlStoreDecl, table: unknown, options: ResourceOpti
     },
   });
 
-  const createFlow = flow({
-    name: "create",
+  const createFlow = flow("create", {
     unit,
     ...(breaking ? { breaking: true as const } : {}),
     in: options.in as never,
@@ -682,8 +680,7 @@ export function resource(db: SqlStoreDecl, table: unknown, options: ResourceOpti
     },
   });
 
-  const getFlow = flow({
-    name: "get",
+  const getFlow = flow("get", {
     unit,
     ...(breaking ? { breaking: true as const } : {}),
     errors,
@@ -709,8 +706,7 @@ export function resource(db: SqlStoreDecl, table: unknown, options: ResourceOpti
       : patchSchema instanceof z.ZodObject
         ? patchSchema.extend({ [idKey]: z.string() })
         : patchSchema;
-  const updateFlow = flow({
-    name: "update",
+  const updateFlow = flow("update", {
     unit,
     ...(breaking ? { breaking: true as const } : {}),
     in: updateIn as never,
@@ -736,8 +732,7 @@ export function resource(db: SqlStoreDecl, table: unknown, options: ResourceOpti
     },
   });
 
-  const removeFlow = flow({
-    name: "remove",
+  const removeFlow = flow("remove", {
     unit,
     ...(breaking ? { breaking: true as const } : {}),
     errors,

package/src/elements/store/upsert-app.test.ts

@@ -46,8 +46,7 @@ describe("fx.store(db).upsert via app.fetch (real boot)", () => {
 
     const seed = on(
       http.post("/seed").gate(gate.public),
-      flow({
-        name: "notes.seed",
+      flow("notes.seed", {
         in: UpsertIn,
         out: UpsertOut,
         effects: { writes: ["sql:app"], reads: ["sql:app"] },

package/src/elements/vault/declare.ts

@@ -4,6 +4,8 @@
  * Physics: secrets · config · environment.
  */
 
+import { secretRegistry } from "../../kernel/element-registries.ts";
+
 /** Options for {@link vault} / {@link vault.secret} / {@link vault.config}. */
 export interface VaultSecretOptions {
   /** Human description shown in boot-gap listings. */
@@ -35,6 +37,30 @@ export interface VaultSecretDecl {
   readonly sensitive: boolean;
 }
 
+/**
+ * `vault.secret` (only) pushes into the shared {@link secretRegistry}
+ * (`src/kernel/element-registries.ts`) so {@link oke} can auto-populate
+ * `secrets` with zero explicit array — mirrors the {@link on} trigger-drain
+ * registry (`src/kernel/on.ts`). `vault.config` is intentionally not
+ * auto-registered (out of scope).
+ */
+
+/**
+ * Snapshot of every `vault.secret` declared since the last reset.
+ */
+export function listSecrets(): readonly VaultSecretDecl[] {
+  return secretRegistry.slice();
+}
+
+/**
+ * Clear the vault-secret registry (tests / fresh app adopt).
+ *
+ * @internal
+ */
+export function resetSecrets(): void {
+  secretRegistry.length = 0;
+}
+
 /**
  * Declare a vault secret contract (fingerprinted — never revealed).
  *
@@ -45,7 +71,7 @@ function declareSecret(name: string, options: VaultSecretOptions = {}): VaultSec
   if (!name) {
     throw new TypeError("vault.secret: name is required");
   }
-  return {
+  const decl: VaultSecretDecl = {
     kind: "secret",
     name,
     sensitive: options.sensitive ?? true,
@@ -54,6 +80,8 @@ function declareSecret(name: string, options: VaultSecretOptions = {}): VaultSec
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
   };
+  secretRegistry.push(decl);
+  return decl;
 }
 
 /**

package/src/kernel/adopt-barrel-fresh.test.ts

@@ -0,0 +1,103 @@
+/**
+ * Boot-level proof: a `src/flows/<unit>` folder on disk with no adopted
+ * flow under that unit — the stale/missing `.adopt()` barrel case.
+ *
+ * Mirrors `effects-stamping.test.ts`'s OKE1008 shape exactly: opt-in only
+ * via `rootDir`, `local`/`test` warn once (dev-loop stays unbroken),
+ * `docker`/`prod` hard-fail (`OKE1009`) — never a silently-incomplete route
+ * table in a deploy-shaped environment.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gate } from "../elements/gate.ts";
+import { assertAdoptBarrelFresh, resetStaleAdoptBarrelWarnForTests } from "./boot.ts";
+import { flow, resetFlowSeq } from "./flow.ts";
+import { on, resetBindings } from "./on.ts";
+import { http } from "./triggers.ts";
+import { oke } from "./app.ts";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+  resetStaleAdoptBarrelWarnForTests();
+});
+
+async function makeUnitDir(root: string, unit: string): Promise<void> {
+  const dir = join(root, "src/flows", unit);
+  await mkdir(dir, { recursive: true });
+  await writeFile(join(dir, "index.ts"), "export const nothing = 1;\n");
+}
+
+describe("assertAdoptBarrelFresh — direct", () => {
+  test("no rootDir: no-op, never reads the filesystem", async () => {
+    await expect(assertAdoptBarrelFresh([], "prod", undefined)).resolves.toBeUndefined();
+  });
+
+  test("fresh: every disk unit has an adopted flow — no warn, no throw, any env", async () => {
+    const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
+    try {
+      await makeUnitDir(root, "notes");
+      const notesFlow = flow("notes.create", { do: () => ({ ok: true as const }) });
+      await expect(assertAdoptBarrelFresh([notesFlow], "docker", root)).resolves.toBeUndefined();
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  test("stale: unit on disk, zero adopted flows for it — docker hard-fails OKE1009", async () => {
+    const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
+    try {
+      await makeUnitDir(root, "notes");
+      await expect(assertAdoptBarrelFresh([], "docker", root)).rejects.toThrow(/OKE1009/);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  test("stale: prod — same posture as docker", async () => {
+    const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
+    try {
+      await makeUnitDir(root, "notes");
+      await expect(assertAdoptBarrelFresh([], "prod", root)).rejects.toThrow(/OKE1009/);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  test("stale: local — warns, never throws (dev-loop stays unbroken)", async () => {
+    const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
+    try {
+      await makeUnitDir(root, "notes");
+      await expect(assertAdoptBarrelFresh([], "local", root)).resolves.toBeUndefined();
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("boot-level: stale barrel through a real oke() boot", () => {
+  test("docker: real app.boot() hard-fails OKE1009 when a unit folder was never adopted", async () => {
+    const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
+    try {
+      // "notes" exists on disk but this app only ever adopted "main" —
+      // exactly what a stale `src/flows/generated.ts` after adding a unit
+      // (and forgetting to rerun `oke dev` / `oke build`) looks like.
+      await makeUnitDir(root, "notes");
+      const mainFlow = flow("main.health", {
+        effects: {},
+        do: () => ({ ok: true as const }),
+      });
+      on(http.get("/health").gate(gate.public), mainFlow);
+      const app = oke({ name: "stale-barrel", gate: { unguardedHttp: "allow" } });
+
+      await expect(
+        app.boot({ env: "docker", rootDir: root, unguardedHttp: "allow", startScheduler: false }),
+      ).rejects.toThrow(/OKE1009/);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});

package/src/kernel/app.ts

@@ -83,6 +83,12 @@ import {
 import { releaseInstanceLeases } from "./graceful-shutdown.ts";
 import type { JournalRuntime } from "./boot-bind/journal.ts";
 import { listBindings, resetBindings, type Binding } from "./on.ts";
+import {
+  channelTemplateRegistry,
+  secretRegistry,
+  signalRegistry,
+  storeRegistry,
+} from "./element-registries.ts";
 import {
   applyPrincipal,
   createElementPipelineHooks,
@@ -162,6 +168,18 @@ export interface OkeOptions {
   readonly docker?: BootOptions["docker"];
   /** Optional `oke.config.ts` document consumed at boot. */
   readonly config?: BootOptions["config"];
+  /**
+   * Compiled Manifest for flows with no hand-declared `effects` — highest
+   * priority source for the boot-time capability stamp (see
+   * {@link BootOptions.manifest}).
+   */
+  readonly manifest?: BootOptions["manifest"];
+  /**
+   * Project root for a lazy, best-effort effects extraction when a flow has
+   * no hand-declared `effects` and no {@link manifest} was given (see
+   * {@link BootOptions.rootDir}).
+   */
+  readonly rootDir?: BootOptions["rootDir"];
   /** Pre-built element runtimes (skip construction at boot when present). */
   readonly elements?: BootOptions["elements"];
   /** Vault create options (chain / allowDevFallbacks / secrets). */
@@ -430,6 +448,21 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
   readonly $options: OkeOptions;
 }
 
+/**
+ * Concat two decl lists, skipping registry entries already present by
+ * reference (the same call-site object explicitly re-passed).
+ *
+ * @param explicit - Hand-passed decls (kept in order, always wins position)
+ * @param fromRegistry - Auto-drained decls to append
+ */
+function mergeUnique<T>(explicit: readonly T[] | undefined, fromRegistry: readonly T[]): T[] {
+  const out: T[] = [...(explicit ?? [])];
+  for (const item of fromRegistry) {
+    if (!out.includes(item)) out.push(item);
+  }
+  return out;
+}
+
 /**
  * Create an application. Adopts bindings registered via {@link on}.
  *
@@ -444,6 +477,42 @@ export function oke(options: OkeOptions): OkeApp {
       : [...listBindings(), ...(options.bindings ?? [])];
   if (registry === "consume") resetBindings();
 
+  // Same registry mode drains store.sql/store.files, vault.secret, signal(),
+  // and channel.<medium>().template() — module-evaluation registries that
+  // mirror `on`'s trigger drain (`listBindings`/`resetBindings` above).
+  // Explicit `options.stores` / `secrets` / `signals` / `channel.templates`
+  // are additive, never silently ignored — deduped by reference so an
+  // explicitly-passed decl that is also in the registry is not doubled.
+  const registrySnapshot =
+    registry === "ignore"
+      ? { stores: [], secrets: [], signals: [], channelTemplates: [] }
+      : {
+          stores: storeRegistry.slice(),
+          secrets: secretRegistry.slice(),
+          signals: signalRegistry.slice(),
+          channelTemplates: channelTemplateRegistry.slice(),
+        };
+  if (registry === "consume") {
+    storeRegistry.length = 0;
+    secretRegistry.length = 0;
+    signalRegistry.length = 0;
+    channelTemplateRegistry.length = 0;
+  }
+  const effectiveStores = mergeUnique(options.stores, registrySnapshot.stores);
+  const effectiveSecrets = mergeUnique(options.secrets, registrySnapshot.secrets);
+  const effectiveSignals = mergeUnique(options.signals, registrySnapshot.signals);
+  // Stay `undefined` (never a defined-but-empty object) when neither an
+  // explicit `options.channel` nor a registered template exists — a defined
+  // object here would flip `resolveElementNeeds`'s `channel` need to `true`
+  // for every app, whether or not it uses channel at all.
+  const effectiveChannel: BootOptions["channel"] =
+    options.channel === undefined && registrySnapshot.channelTemplates.length === 0
+      ? undefined
+      : {
+          ...(options.channel ?? {}),
+          templates: mergeUnique(options.channel?.templates, registrySnapshot.channelTemplates),
+        };
+
   // Resolve Gate bag early so auth HTTP Bindings join `adopted` + the router
   // before posture audit (same ensureBoot → doBoot path — never a side channel).
   const gateConfig: ResolvedGateConfig = resolveGateConfig({
@@ -760,13 +829,13 @@ export function oke(options: OkeOptions): OkeApp {
       docker: overrides?.docker ?? options.docker,
       config: overrides?.config ?? options.config,
       elements: overrides?.elements ?? options.elements,
-      secrets: overrides?.secrets ?? options.secrets,
+      secrets: overrides?.secrets ?? effectiveSecrets,
       vault: overrides?.vault ?? options.vault,
       gates: [...baseGates, ...authGates],
-      signals: overrides?.signals ?? options.signals,
+      signals: overrides?.signals ?? effectiveSignals,
       clocks: overrides?.clocks ?? options.clocks,
-      stores: overrides?.stores ?? options.stores,
-      channel: overrides?.channel ?? options.channel,
+      stores: overrides?.stores ?? effectiveStores,
+      channel: overrides?.channel ?? effectiveChannel,
       ai: overrides?.ai ?? options.ai,
       runs: overrides?.runs ?? options.runs,
       bindings: adopted,
@@ -778,7 +847,7 @@ export function oke(options: OkeOptions): OkeApp {
         if (d.startsWith("driver:")) driverIds.push(d.slice("driver:".length));
       }
     }
-    const stores = overrides?.stores ?? options.stores ?? [];
+    const stores = overrides?.stores ?? effectiveStores;
     const available = buildAvailableNeedTokens({
       elements: {
         storeSql:
@@ -817,16 +886,18 @@ export function oke(options: OkeOptions): OkeApp {
     if (gateConfig.auth) available.add("auth");
     assertPluginNeeds(caps, { pluginNames, available });
 
-    const baseSecrets = overrides?.secrets ?? options.secrets ?? [];
-    const baseSignals = overrides?.signals ?? options.signals ?? [];
+    const baseSecrets = overrides?.secrets ?? effectiveSecrets;
+    const baseSignals = overrides?.signals ?? effectiveSignals;
     const baseClocks = overrides?.clocks ?? options.clocks ?? [];
-    const baseChannel = overrides?.channel ?? options.channel;
+    const baseChannel = overrides?.channel ?? effectiveChannel;
     const mergedCatalog = mergeTemplateCatalogs(baseChannel?.catalog, ...pluginChannelCatalogs);
 
     const merged: BootOptions = {
       env: bootEnv,
       docker: overrides?.docker ?? options.docker,
       config: overrides?.config ?? options.config,
+      manifest: overrides?.manifest ?? options.manifest,
+      rootDir: overrides?.rootDir ?? options.rootDir,
       elements: overrides?.elements ?? options.elements,
       secrets: [...baseSecrets, ...pluginSecrets],
       vault: overrides?.vault ?? options.vault,
@@ -834,7 +905,7 @@ export function oke(options: OkeOptions): OkeApp {
       unguardedHttp,
       signals: [...baseSignals, ...pluginSignals],
       clocks: [...baseClocks, ...pluginClocks],
-      stores: overrides?.stores ?? options.stores,
+      stores: overrides?.stores ?? effectiveStores,
       channel: {
         ...(baseChannel ?? {}),
         templates: [...(baseChannel?.templates ?? []), ...pluginChannelTemplates],