okengine 0.13.0 → 0.15.2

package/src/elements/store/sql-condition.test.ts

@@ -86,6 +86,18 @@ describe("compileWhere", () => {
     expect(c.params).toEqual(["n1", "t"]);
   });
 
+  test("legacy array-valued StringChunk fragments still compile", () => {
+    const c = compileWhere({
+      queryChunks: [
+        notes.id,
+        { constructor: { name: "StringChunk" }, value: [" = "] },
+        { value: "n1" },
+      ],
+    });
+    expect(c.clause).toBe(`"id" = ?`);
+    expect(c.params).toEqual(["n1"]);
+  });
+
   test("inArray expands one placeholder per value", () => {
     const c = compileWhere(inArray(notes.id, ["a", "b", "c"]));
     expect(c.clause).toBe(`"id" in (?, ?, ?)`);

package/src/elements/store/sql-condition.ts

@@ -333,10 +333,33 @@ function chunksOf(node: unknown): readonly unknown[] {
   return (node as { queryChunks: unknown[] }).queryChunks;
 }
 
-/** Joined text of a Drizzle `StringChunk` (`{ value: string[] }`). */
+/**
+ * True when `chunk` is a Drizzle `StringChunk` (or the synthetic array-valued
+ * shape `resource.ts` still emits). `Param` also has a `value` field — never
+ * treat those as SQL text.
+ */
+function isStringChunk(chunk: object): boolean {
+  const ctor = (chunk as { constructor?: { name?: unknown } }).constructor?.name;
+  if (ctor === "StringChunk") return true;
+  const value = (chunk as { value?: unknown }).value;
+  return (
+    Array.isArray(value) &&
+    value.every((part) => typeof part === "string") &&
+    !("encoder" in chunk) &&
+    !("name" in chunk)
+  );
+}
+
+/**
+ * Joined text of a Drizzle `StringChunk`.
+ *
+ * drizzle-orm `1.0.0-rc.5-169397b` stores `value` as a `string`. Earlier
+ * snapshots (and the synthetic chunks in `resource.ts`) store `string[]`.
+ */
 function chunkText(chunk: unknown): string | undefined {
-  if (!chunk || typeof chunk !== "object") return undefined;
+  if (!chunk || typeof chunk !== "object" || !isStringChunk(chunk)) return undefined;
   const value = (chunk as { value?: unknown }).value;
+  if (typeof value === "string") return value;
   return Array.isArray(value) ? value.join("") : undefined;
 }
 
@@ -394,6 +417,7 @@ function asParamValue(chunk: unknown): { readonly found: boolean; readonly value
   if (chunk === undefined) return { found: false };
   if (chunk === null || typeof chunk !== "object") return { found: true, value: chunk };
   if (Array.isArray(chunk)) return { found: false };
+  if (isStringChunk(chunk)) return { found: false };
   if (!("value" in (chunk as object))) return { found: false };
   if (Array.isArray((chunk as { value: unknown }).value)) return { found: false };
   if ((chunk as { name?: unknown }).name) return { found: false };

package/src/elements/store/sql-rls-isolation.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Real PGlite RLS isolation through {@link createSqlStoreHandle}.
+ *
+ * Covers the gap unit tests missed: a live policy, two concurrent identity
+ * bags on one shared connection, and row-level isolation. PGlite `query`
+ * rejects multi-command batches — the stamp is split statements pinned
+ * through `SqlConnection.transaction`.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { connectPglite } from "../../drivers/pglite.ts";
+import { connectPostgres } from "../../drivers/postgres.ts";
+import { installOkeRlsHelpers } from "../../drivers/pg-rls.ts";
+import type { SqlConnection } from "../../drivers/types.ts";
+import { createSqlStoreHandle, type SqlStoreHandle } from "./sql-session.ts";
+
+const NOTES_DDL = `CREATE TABLE notes (
+  id text PRIMARY KEY,
+  owner text NOT NULL,
+  body text NOT NULL
+)`;
+
+const OWNER_POLICY = `CREATE POLICY owner_select ON notes
+  AS PERMISSIVE FOR SELECT TO public
+  USING (owner = oke.user())`;
+
+/** File-scoped warmed PGlite. */
+let conn: SqlConnection;
+/** Stamped as alice. */
+let asAlice: SqlStoreHandle;
+/** Stamped as bob. */
+let asBob: SqlStoreHandle;
+/** No stamp — table-owner / superuser bypass. */
+let asOwner: SqlStoreHandle;
+
+beforeAll(async () => {
+  conn = await connectPglite({ url: "memory://sql-rls-isolation", role: "primary" });
+  await conn.exec(NOTES_DDL);
+  await conn.exec(`INSERT INTO notes VALUES ('a', 'alice', 'hi'), ('b', 'bob', 'yo')`);
+  await conn.exec(`ALTER TABLE notes ENABLE ROW LEVEL SECURITY`);
+  await installOkeRlsHelpers((sql) => conn.exec(sql));
+  await conn.exec(OWNER_POLICY);
+  asAlice = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+    rls: { gate: "member", userId: "alice", scopes: ["member"] },
+  });
+  asBob = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+    rls: { gate: "member", userId: "bob", scopes: ["member"] },
+  });
+  asOwner = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+  });
+}, 15_000);
+
+afterAll(async () => {
+  await conn.close();
+});
+
+describe("sql-session RLS isolation (pglite)", () => {
+  test("pglite query rejects a multi-command batch (the old prelude)", async () => {
+    await expect(
+      conn.query("BEGIN; SET LOCAL row_security = on; SELECT set_config('oke.user', $1, true)", [
+        "alice",
+      ]),
+    ).rejects.toThrow(/multiple commands/i);
+  });
+
+  test("sequential identities see only their rows", async () => {
+    const alice = await asAlice.raw(`SELECT id, owner FROM notes ORDER BY id`);
+    const bob = await asBob.raw(`SELECT id, owner FROM notes ORDER BY id`);
+    expect(alice).toEqual([{ id: "a", owner: "alice" }]);
+    expect(bob).toEqual([{ id: "b", owner: "bob" }]);
+  });
+
+  test("concurrent identities do not leak across the shared connection", async () => {
+    const [alice, bob, aliceAgain] = await Promise.all([
+      asAlice.raw(`SELECT id, owner FROM notes ORDER BY id`),
+      asBob.raw(`SELECT id, owner FROM notes ORDER BY id`),
+      asAlice.raw(`SELECT id, owner FROM notes ORDER BY id`),
+    ]);
+    expect(alice).toEqual([{ id: "a", owner: "alice" }]);
+    expect(bob).toEqual([{ id: "b", owner: "bob" }]);
+    expect(aliceAgain).toEqual([{ id: "a", owner: "alice" }]);
+  });
+
+  test("unstamped owner/superuser still sees every row", async () => {
+    const rows = await asOwner.raw(`SELECT id, owner FROM notes ORDER BY id`);
+    expect(rows).toEqual([
+      { id: "a", owner: "alice" },
+      { id: "b", owner: "bob" },
+    ]);
+  });
+});
+
+const LIVE_PG =
+  process.env.OKE_TEST_DOCKER === "1" &&
+  (process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL)?.startsWith("postgres");
+if (!LIVE_PG) {
+  console.log("skip: live Postgres RLS isolation needs OKE_TEST_DOCKER=1 and DATABASE_URL");
+}
+
+describe("sql-session RLS isolation (live postgres)", () => {
+  const live = LIVE_PG ? test : test.skip;
+  const table = "oke_rls_isolation_notes";
+
+  live(
+    "split stamp isolates concurrent identities",
+    async () => {
+      const pg = await connectPostgres({
+        url: process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL,
+        role: "primary",
+      });
+      try {
+        await pg.exec(`DROP TABLE IF EXISTS ${table}`);
+        await pg.exec(
+          `CREATE TABLE ${table} (id text PRIMARY KEY, owner text NOT NULL, body text NOT NULL)`,
+        );
+        await pg.exec(`INSERT INTO ${table} VALUES ('a', 'alice', 'hi'), ('b', 'bob', 'yo')`);
+        await pg.exec(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY`);
+        await installOkeRlsHelpers((sql) => pg.exec(sql));
+        await pg.exec(
+          `CREATE POLICY owner_select ON ${table} AS PERMISSIVE FOR SELECT TO public USING (owner = oke.user())`,
+        );
+        const alice = createSqlStoreHandle("sql:app", {
+          connection: pg,
+          classifications: new Map(),
+          routedRole: "primary",
+          domainDdl: "off",
+          rls: { gate: "member", userId: "alice", scopes: ["member"] },
+        });
+        const bob = createSqlStoreHandle("sql:app", {
+          connection: pg,
+          classifications: new Map(),
+          routedRole: "primary",
+          domainDdl: "off",
+          rls: { gate: "member", userId: "bob", scopes: ["member"] },
+        });
+        const [a, b] = await Promise.all([
+          alice.raw(`SELECT id, owner FROM ${table} ORDER BY id`),
+          bob.raw(`SELECT id, owner FROM ${table} ORDER BY id`),
+        ]);
+        expect(a).toEqual([{ id: "a", owner: "alice" }]);
+        expect(b).toEqual([{ id: "b", owner: "bob" }]);
+      } finally {
+        try {
+          await pg.exec(`DROP TABLE IF EXISTS ${table}`);
+        } catch {
+          // Best-effort cleanup.
+        }
+        await pg.close();
+      }
+    },
+    20_000,
+  );
+});

package/src/elements/store/sql-rls-stamp.test.ts

@@ -0,0 +1,117 @@
+/**
+ * RLS stamps on pooled postgres must `reserve()` one slot, then BEGIN/SET
+ * on that slot. `begin()` + parent `unsafe()` checkouts a second slot and
+ * deadlocks a tiny pool (`checkout timeout` from PgDog).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { connectPostgres, type PostgresClientLike } from "../../drivers/postgres.ts";
+import { createSqlStoreHandle } from "./sql-session.ts";
+
+/**
+ * Two-slot pool. `reserve()` holds a slot until `release()`. Unreserved
+ * `BEGIN` occupies a slot until COMMIT on that same checkout.
+ */
+function createTinyPoolClient(size = 2): PostgresClientLike & {
+  readonly reserveCalls: { n: number };
+  readonly rootBegins: { n: number };
+} {
+  const slots = Array.from({ length: size }, () => ({ held: false }));
+  const reserveCalls = { n: 0 };
+  const rootBegins = { n: 0 };
+
+  function checkout(): { held: boolean } {
+    const idle = slots.find((slot) => !slot.held);
+    if (!idle) {
+      throw new Error("checkout timeout");
+    }
+    return idle;
+  }
+
+  function rowsFor(sql: string): Record<string, unknown>[] {
+    return /select/i.test(sql) && !/set_config/i.test(sql) ? [{ id: "a", owner: "alice" }] : [];
+  }
+
+  const client: PostgresClientLike & {
+    readonly reserveCalls: { n: number };
+    readonly rootBegins: { n: number };
+  } = {
+    reserveCalls,
+    rootBegins,
+    async reserve() {
+      reserveCalls.n += 1;
+      const slot = checkout();
+      slot.held = true;
+      return {
+        async unsafe(sql) {
+          return rowsFor(sql);
+        },
+        release() {
+          slot.held = false;
+        },
+      };
+    },
+    async unsafe(sql) {
+      const slot = checkout();
+      const head = sql.trim().split(/\s+/)[0]?.toUpperCase();
+      if (head === "BEGIN") {
+        rootBegins.n += 1;
+        slot.held = true;
+        return [];
+      }
+      if (head === "COMMIT" || head === "ROLLBACK") {
+        slot.held = false;
+        return [];
+      }
+      return rowsFor(sql);
+    },
+  };
+  return client;
+}
+
+describe("sql-session RLS stamp on pooled postgres", () => {
+  test("pins the stamp through reserve — no leaked root BEGIN", async () => {
+    const pool = createTinyPoolClient(2);
+    const connection = await connectPostgres({ client: pool, role: "primary" });
+    const handle = createSqlStoreHandle("sql:app", {
+      connection,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+      rls: { gate: "member", userId: "alice", scopes: ["member"] },
+    });
+
+    const [a, b] = await Promise.all([
+      handle.raw(`SELECT id, owner FROM notes`),
+      handle.raw(`SELECT id, owner FROM notes`),
+    ]);
+
+    expect(a).toEqual([{ id: "a", owner: "alice" }]);
+    expect(b).toEqual([{ id: "a", owner: "alice" }]);
+    expect(pool.reserveCalls.n).toBe(2);
+    expect(pool.rootBegins.n).toBe(0);
+  });
+
+  test("table browse SELECT pins through reserve like any other stamped query", async () => {
+    const pool = createTinyPoolClient(2);
+    const connection = await connectPostgres({ client: pool, role: "primary" });
+    const handle = createSqlStoreHandle("sql:app", {
+      connection,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+      rls: { gate: "member", userId: "alice", scopes: ["member"] },
+    });
+    const rows = await handle.raw(`SELECT * FROM "notes" LIMIT 50`);
+    expect(rows).toEqual([{ id: "a", owner: "alice" }]);
+    expect(pool.reserveCalls.n).toBe(1);
+    expect(pool.rootBegins.n).toBe(0);
+  });
+
+  test("standalone BEGIN on a 2-slot pool reproduces checkout timeout", async () => {
+    const pool = createTinyPoolClient(2);
+    await expect(pool.unsafe("BEGIN")).resolves.toEqual([]);
+    await expect(pool.unsafe("BEGIN")).resolves.toEqual([]);
+    await expect(pool.unsafe("SET LOCAL ROLE oke_app")).rejects.toThrow("checkout timeout");
+  });
+});

package/src/elements/store/sql-session.ts

@@ -7,6 +7,12 @@
 
 import type { DomainDdlMode } from "../../config/index.ts";
 import type { ClassificationMap, SqlConnection, SqlRow } from "../../drivers/types.ts";
+import {
+  buildRlsIdentityPreludeSql,
+  installOkeRlsHelpers,
+  RLS_CONTEXT_DRIVERS,
+  type RlsIdentity,
+} from "../../drivers/pg-rls.ts";
 import { throwOke } from "../../kernel/errors.ts";
 import { maskRows, tableFromSql } from "./classify.ts";
 import { isMissingDomainRelationError } from "./missing-relation.ts";
@@ -28,6 +34,45 @@ import {
 
 export type { WhereMap } from "./sql-condition.ts";
 
+/** Serialize stamp frames on a shared connection so concurrent identities cannot interleave. */
+const rlsStampTails = new WeakMap<SqlConnection, Promise<unknown>>();
+
+/**
+ * True when SQL must not enter an RLS identity frame (txn control or DDL).
+ *
+ * @param sql - Statement
+ */
+export function isRlsStampExemptSql(sql: string): boolean {
+  return /^\s*(begin|commit|rollback|create|alter|drop|truncate|grant|revoke|comment)\b/i.test(sql);
+}
+
+/**
+ * Run `fn` after any in-flight stamp on `connection` finishes.
+ *
+ * @param connection - Shared SQL connection
+ * @param fn - Stamp frame
+ */
+async function withRlsStampLock<T>(connection: SqlConnection, fn: () => Promise<T>): Promise<T> {
+  const prev = rlsStampTails.get(connection) ?? Promise.resolve();
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  rlsStampTails.set(
+    connection,
+    prev.then(
+      () => gate,
+      () => gate,
+    ),
+  );
+  await prev.catch(() => undefined);
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+
 /** Options for a SQL session. */
 export interface SqlSessionOptions {
   /** Open connection (already role-routed). */
@@ -44,6 +89,8 @@ export interface SqlSessionOptions {
    * and local+autoPush). Default `ensure` for backward-compatible tests.
    */
   readonly domainDdl?: DomainDdlMode;
+  /** Gate identity — stamps `oke.*` on postgres / pglite. */
+  readonly rls?: RlsIdentity;
 }
 
 /**
@@ -339,8 +386,9 @@ export function createSqlStoreHandle(
   ref: `sql:${string}`,
   options: SqlSessionOptions,
 ): SqlStoreHandle {
-  const { connection, classifications, revealPii } = options;
+  const { connection, classifications, revealPii, rls } = options;
   const domainDdl: DomainDdlMode = options.domainDdl ?? "ensure";
+  let helpersReady = false;
 
   function mask(rows: SqlRow[], table?: string): SqlRow[] {
     return maskRows(rows, { classifications, table, revealPii });
@@ -362,11 +410,41 @@ export function createSqlStoreHandle(
   }
 
   function query(sql: string, params: readonly unknown[] = []): Promise<SqlRow[]> {
-    return withSchemaGuard(() => connection.query(sql, params));
+    return withSchemaGuard(() => withRlsStamp((conn) => conn.query(sql, params), sql));
   }
 
   function exec(sql: string, params: readonly unknown[] = []): Promise<{ changes: number }> {
-    return withSchemaGuard(() => connection.exec(sql, params));
+    return withSchemaGuard(() => withRlsStamp((conn) => conn.exec(sql, params), sql));
+  }
+
+  async function withRlsStamp<T>(fn: (conn: SqlConnection) => Promise<T>, sql: string): Promise<T> {
+    if (!rls || !RLS_CONTEXT_DRIVERS.has(connection.driverId)) return fn(connection);
+    if (isRlsStampExemptSql(sql)) return fn(connection);
+    const run = (): Promise<T> => applyRlsStamp(fn);
+    // PGlite is one backend session — concurrent identities must not interleave.
+    // Pooled postgres pins each stamp via `transaction()` instead.
+    if (connection.driverId === "pglite") {
+      return withRlsStampLock(connection, run);
+    }
+    return run();
+  }
+
+  async function applyRlsStamp<T>(fn: (conn: SqlConnection) => Promise<T>): Promise<T> {
+    if (!rls) return fn(connection);
+    if (!helpersReady) {
+      await installOkeRlsHelpers((sql) => connection.exec(sql));
+      helpersReady = true;
+    }
+    const frame = async (tx: SqlConnection): Promise<T> => {
+      for (const stmt of buildRlsIdentityPreludeSql(rls)) {
+        await tx.exec(stmt.sql, stmt.params ?? []);
+      }
+      return fn(tx);
+    };
+    if (!connection.transaction) {
+      throw new Error("RLS stamp needs SqlConnection.transaction to pin SET LOCAL");
+    }
+    return connection.transaction(frame);
   }
 
   async function ensureFromMeta(table: TableHandle | unknown): Promise<void> {

package/src/elements/store/upsert-app.test.ts

@@ -45,7 +45,7 @@ describe("fx.store(db).upsert via app.fetch (real boot)", () => {
     const db = store.sql("app", { schema: { notes } });
 
     const seed = on(
-      http.post("/seed").gate.public,
+      http.post("/seed").public(),
       flow("notes.seed", {
         in: UpsertIn,
         out: UpsertOut,

package/src/elements/store.ts

@@ -26,6 +26,11 @@ export {
   schema,
   schemaTable,
   schemaRelations,
+  schemaRls,
+  schemaPolicy,
+  schemaPolicyGate,
+  schemaPolicyOwner,
+  schemaPolicyScope,
   isSchemaTableDecl,
   isSchemaColumnDecl,
   isSchemaRelationsDecl,
@@ -43,6 +48,8 @@ export type {
   SchemaTableDecl,
   SchemaTableWithColumns,
   SchemaRelationsDecl,
+  SchemaPolicyDecl,
+  SchemaTableExtra,
   SchemaRelationEntry,
   SchemaRelationOne,
   SchemaRelationMany,
@@ -123,6 +130,13 @@ export type {
   WhereMap,
 } from "./store/sql-session.ts";
 
+export {
+  resolveRlsIdentity,
+  rlsIdentityFromAuth,
+  firstPolicyOrPublic,
+  policyGateForScopes,
+} from "./store/rls-identity.ts";
+export type { RlsIdentityRow, ResolveRlsIdentityInput } from "./store/rls-identity.ts";
 export { createStoreRuntime, putTier2 } from "./store/runtime.ts";
 export type {
   StoreRuntime,

package/src/elements/vault/builtin-adapter.ts

@@ -450,6 +450,23 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
    * @param keyRow - That version's live wrapped DEK
    */
   async function decryptRow(row: SecretRow, keyRow: KeyRow): Promise<string> {
+    try {
+      return await decryptRowOnce(row, keyRow);
+    } catch (err) {
+      // Stale key snapshot: rotation committed and dropped `pending` after
+      // this read. Reload the wrap and retry once — never return torn bytes.
+      if (!(err instanceof VaultError) || err.code !== "INVALID_KEY") throw err;
+      return await decryptRowOnce(row, await readKeyRow(row.id));
+    }
+  }
+
+  /**
+   * Unwrap the DEK and decrypt the value ciphertext.
+   *
+   * @param row - Stored secret version
+   * @param keyRow - That version's wrapped DEK
+   */
+  async function decryptRowOnce(row: SecretRow, keyRow: KeyRow): Promise<string> {
     const path = row.path;
     const version = toInt(row.version);
     const algorithm = row.algorithm as VaultAlgorithm;

package/src/full.ts

@@ -88,6 +88,8 @@ export {
   type SignalDecl,
   type SignalOptions,
   type SignalRuntime,
+  type DeadLetter,
+  type SignalFailureReason,
 } from "./elements/signal.ts";
 
 export {

package/src/http.ts

@@ -8,7 +8,7 @@
  * ```ts
  * import { on, flow, http, gate, oke, createBunRuntime } from "okengine/http";
  *
- * on(http.get("/").gate.public, flow("ping", { do: () => "Hi" }));
+ * on(http.get("/").public(), flow("ping", { do: () => "Hi" }));
  * const app = oke({ name: "ping" });
  * createBunRuntime().serve(app);
  * ```
@@ -24,15 +24,32 @@ export { fail, type FlowFailure } from "./kernel/errors.ts";
 export { isFlowFailure } from "./kernel/hooks.ts";
 export { plugin, isPlugin, type PluginDef } from "./kernel/plugin.ts";
 export { createBunRuntime, APP_PORT, type Runtime, type ServeOptions } from "./runtime/index.ts";
-export type { OkeApp, OkeOptions, ReadyState } from "./kernel/app.ts";
+export type {
+  OkeApp,
+  OkeOptions,
+  ReadyState,
+  RegisteredFlowUnits,
+  RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
+export { registerFlowUnits } from "./kernel/flow-units.ts";
+export { stampFlowName, stampHttpPath } from "./kernel/stamp-http.ts";
 
-import { oke as okeCore, type OkeApp, type OkeOptions } from "./kernel/app.ts";
+import {
+  oke as okeCore,
+  type OkeApp,
+  type OkeOptions,
+  type RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
 
 /**
  * Create an HTTP-oriented app — defaults `router` to `"edge"` when omitted.
  *
  * @param options - Application options
  */
+export function oke(
+  options: OkeOptions & { readonly registry: "ignore" },
+): OkeApp<Record<string, never>, Record<string, never>>;
+export function oke(options: OkeOptions): OkeApp<{}, RoutesFromRegisteredUnits>;
 export function oke(options: OkeOptions): OkeApp {
   return okeCore({
     ...options,

package/src/index.ts

@@ -14,10 +14,19 @@
  * @module
  */
 
-export { oke, type OkeApp, type OkeOptions, type ReadyState } from "./kernel/app.ts";
+export {
+  oke,
+  type OkeApp,
+  type OkeOptions,
+  type ReadyState,
+  type RegisteredFlowUnits,
+  type RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
 export { on, type Binding } from "./kernel/on.ts";
 export { flow, isFlow, type FlowDef } from "./kernel/flow.ts";
 export { http, every, internal, table } from "./kernel/triggers.ts";
+export { registerFlowUnits } from "./kernel/flow-units.ts";
+export { stampFlowName, stampHttpPath } from "./kernel/stamp-http.ts";
 export { fail, type FlowFailure, type FlowErrorValue } from "./kernel/errors.ts";
 export { isFlowFailure } from "./kernel/hooks.ts";
 export { plugin, isPlugin, type PluginDef, type PluginCapabilities } from "./kernel/plugin.ts";
@@ -71,6 +80,8 @@ export {
   type SignalDecl,
   type SignalOptions,
   type SignalRuntime,
+  type DeadLetter,
+  type SignalFailureReason,
 } from "./elements/signal.ts";
 
 export {
@@ -143,6 +154,8 @@ export {
   type AiModelDecl,
   type AiPromptDecl,
   type AiAgentDecl,
+  type AiMcpServerDecl,
+  type AiMcpServerOptions,
   type AiRuntime,
 } from "./elements/ai.ts";
 

package/src/kernel/adopt-barrel-fresh.test.ts

@@ -89,7 +89,7 @@ describe("boot-level: stale barrel through a real oke() boot", () => {
         effects: {},
         do: () => ({ ok: true as const }),
       });
-      on(http.get("/health").gate.public, mainFlow);
+      on(http.get("/health").public(), mainFlow);
       const app = oke({ name: "stale-barrel", gate: { unguardedHttp: "allow" } });
 
       await expect(