okengine 0.13.0 → 0.15.2

package/src/kernel/adopt-routes.ts

@@ -39,10 +39,20 @@ export type AppFlowRoute<
       readonly path?: undefined;
     };
 
-/** Unit → flow → contract. */
+/**
+ * Unit → flow → contract. Leaf is the HTTP / call-only union — do not
+ * index with `AppFlowRoute<any, any, any, any, any>` (`any extends string`
+ * makes `method`/`path` required and rejects cron / signal flows).
+ */
 export type AppRouteMap = {
   readonly [unit: string]: {
-    readonly [flow: string]: AppFlowRoute<any, any, any, any, any>;
+    readonly [flow: string]: {
+      readonly in?: unknown;
+      readonly out?: unknown;
+      readonly errors?: unknown;
+      readonly method?: string;
+      readonly path?: string;
+    };
   };
 };
 
@@ -170,6 +180,7 @@ export function accumulateAdoptArgs(args: readonly unknown[], into: RuntimeRoute
       const unitBag = into[unit] ?? (into[unit] = {});
       for (const [flowName, flowDef] of Object.entries(value as Record<string, unknown>)) {
         if (!isFlow(flowDef)) continue;
+        stampAdoptedFlow(flowDef, unit, flowName);
         found.push(flowDef);
         unitBag[flowName] = runtimeRouteFromFlow(flowDef);
       }
@@ -178,3 +189,20 @@ export function accumulateAdoptArgs(args: readonly unknown[], into: RuntimeRoute
 
   return found;
 }
+
+/**
+ * Stamp `unit.export` on nameless flows — same rule as {@link unit}.
+ *
+ * @param flowDef - Flow to stamp
+ * @param unit - Client unit (folder / adopt key)
+ * @param exportName - Namespace export
+ */
+function stampAdoptedFlow(flowDef: AnyFlowDef, unit: string, exportName: string): void {
+  const f = flowDef as { name: string; unit: string | undefined };
+  if (!f.name || f.name.startsWith("flow_")) {
+    f.name = `${unit}.${exportName}`;
+  }
+  if (!f.unit) {
+    f.unit = unit;
+  }
+}

package/src/kernel/app.ts

@@ -14,6 +14,7 @@ import {
   accumulateAdoptArgs,
   type AppRouteMap,
   type RoutesFromAdoptArgs,
+  type RoutesFromNamespace,
   type RuntimeRouteMap,
 } from "./adopt-routes.ts";
 // `./boot.ts` pulls in every element + driver module (vault, store, signal,
@@ -37,10 +38,12 @@ import { runWithLocale } from "../i18n/locale-context.ts";
 import { runDurable } from "../elements/clock/durable.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
 import { failureFromUnknown, runCompensationPhase } from "./compensate.ts";
+import { withAbortSignal } from "./abort-scope.ts";
 import { fxRetry } from "./concurrency.ts";
 import {
   createFxContext,
   freezePrincipal,
+  isJsonStreamResult,
   resolveName,
   type CreateFxOptions,
   type Fx,
@@ -57,7 +60,8 @@ import {
 } from "../runtime/dev-request-log.ts";
 import { asBrowserJsonCodeBlock, httpNavGroups } from "../runtime/json-code-block.ts";
 import { resolveDurationMs } from "./elapsed.ts";
-import { fail } from "./errors.ts";
+import { fail, throwOke } from "./errors.ts";
+import { consumeRegisteredFlowUnits, type FlowUnitBag } from "./flow-units.ts";
 import {
   isFlowFailure,
   mergeHooks,
@@ -85,9 +89,12 @@ import { listBindings, resetBindings, type Binding } from "./on.ts";
 import {
   aiAgentRegistry,
   aiEmbedRegistry,
+  aiMcpServerRegistry,
   aiModelRegistry,
   aiPromptRegistry,
   channelTemplateRegistry,
+  clockRegistry,
+  gateRegistry,
   requiredEnvRegistry,
   secretRegistry,
   signalRegistry,
@@ -96,6 +103,7 @@ import {
 import {
   applyPrincipal,
   createElementPipelineHooks,
+  gateNamesOf,
   type PrincipalBag,
   type ResolvedPrincipal,
 } from "./pipeline.ts";
@@ -115,6 +123,7 @@ import {
   type RouterPreset,
   type SmartRouter,
 } from "./router.ts";
+import { isPendingHttpPath } from "./http-path-pending.ts";
 import type {
   CdcTrigger,
   EveryTrigger,
@@ -296,6 +305,21 @@ export interface UnitHooks<D extends Record<string, unknown> = {}> {
   plug<P extends PluginDef>(pluginDef: P): UnitHooks<AccumulateDecorations<D, P>>;
 }
 
+/**
+ * Module-augmentation slot filled by `src/flows/generated.ts`.
+ * Kernel tests do not import an app generated file, so this stays `{}`.
+ */
+export interface RegisteredFlowUnits {}
+
+/**
+ * `$routes` derived from {@link RegisteredFlowUnits} after `import generated`.
+ *
+ * @typeParam U - Augmented unit map
+ */
+export type RoutesFromRegisteredUnits<U = RegisteredFlowUnits> = {
+  [K in keyof U]: U[K] extends Record<string, unknown> ? RoutesFromNamespace<U[K]> : never;
+};
+
 /**
  * Application instance — adopts flows, routes HTTP, runs the pipeline.
  *
@@ -432,6 +456,8 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
        * Takes effect only with {@link trustedInvoke}.
        */
       readonly revealPii?: boolean;
+      /** Forced RLS bag (Console / Call API). Operator omit = no stamp. */
+      readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
       /** Parent WideEvent id when this execution was caused by another. */
       readonly parentId?: string;
       /** Explicit run / WideEvent id (defaults to a new UUID). */
@@ -531,18 +557,21 @@ function mergeAiOptions(
     readonly prompts: NonNullable<BootOptions["ai"]>["prompts"];
     readonly embeds: NonNullable<BootOptions["ai"]>["embeds"];
     readonly agents: NonNullable<BootOptions["ai"]>["agents"];
+    readonly mcpServers: NonNullable<BootOptions["ai"]>["mcpServers"];
   },
 ): BootOptions["ai"] | undefined {
   const models = mergeUnique(explicit?.models, fromRegistry.models ?? []);
   const prompts = mergeUnique(explicit?.prompts, fromRegistry.prompts ?? []);
   const embeds = mergeUnique(explicit?.embeds, fromRegistry.embeds ?? []);
   const agents = mergeUnique(explicit?.agents, fromRegistry.agents ?? []);
+  const mcpServers = mergeUnique(explicit?.mcpServers, fromRegistry.mcpServers ?? []);
   if (
     explicit === undefined &&
     models.length === 0 &&
     prompts.length === 0 &&
     embeds.length === 0 &&
-    agents.length === 0
+    agents.length === 0 &&
+    mcpServers.length === 0
   ) {
     return undefined;
   }
@@ -552,14 +581,61 @@ function mergeAiOptions(
     ...(prompts.length > 0 ? { prompts } : {}),
     ...(embeds.length > 0 ? { embeds } : {}),
     ...(agents.length > 0 ? { agents } : {}),
+    ...(mcpServers.length > 0 ? { mcpServers } : {}),
   };
 }
 
+/**
+ * Refuse an unresolved path sentinel or a nameless HTTP flow.
+ *
+ * @param binding - HTTP binding
+ */
+function assertHttpBindingReady(binding: Binding): void {
+  const trigger = binding.trigger;
+  if (trigger.kind !== "http") return;
+  if (isPendingHttpPath(trigger.path)) {
+    throwOke("HTTP_PATH_UNRESOLVED", {
+      flow: binding.flow.name || "(unnamed)",
+      method: trigger.method,
+    });
+  }
+  if (!binding.flow.name || binding.flow.name.startsWith("flow_")) {
+    throwOke("HTTP_FLOW_UNNAMED", {
+      method: trigger.method,
+      path: trigger.path,
+    });
+  }
+}
+
+/**
+ * Fold `generated.ts` units into `$routes` and `flowsByName`.
+ *
+ * @param units - Drained {@link registerFlowUnits} bag
+ * @param routes - Runtime `$routes`
+ * @param registerFlow - App flow index
+ */
+function drainGeneratedUnits(
+  units: Record<string, FlowUnitBag>,
+  routes: RuntimeRouteMap,
+  registerFlow: (flowDef: AnyFlowDef) => void,
+): void {
+  if (Object.keys(units).length === 0) return;
+  const flows = accumulateAdoptArgs([units], routes);
+  for (const flowDef of flows) {
+    registerFlow(flowDef);
+  }
+}
+
 /**
  * Create an application. Adopts bindings registered via {@link on}.
+ * Drains {@link registerFlowUnits} into `$routes` unless `registry: "ignore"`.
  *
  * @param options - App name and router preset
  */
+export function oke(
+  options: OkeOptions & { readonly registry: "ignore" },
+): OkeApp<Record<string, never>, Record<string, never>>;
+export function oke(options: OkeOptions): OkeApp<{}, RoutesFromRegisteredUnits>;
 export function oke(options: OkeOptions): OkeApp {
   const aot = options.aot !== false;
   const registry = options.registry ?? "consume";
@@ -569,11 +645,12 @@ export function oke(options: OkeOptions): OkeApp {
       : [...listBindings(), ...(options.bindings ?? [])];
   if (registry === "consume") resetBindings();
 
-  // Same registry mode drains store.sql/store.files, vault.secret, signal(),
-  // channel.<medium>().template(), and ai.model/prompt/embed/agent —
-  // module-evaluation registries that mirror `on`'s trigger drain
-  // (`listBindings`/`resetBindings` above). Explicit `options.stores` /
-  // `secrets` / `signals` / `channel.templates` / `ai` are additive, never
+  // Same registry mode drains store.*, vault.secret, signal(), clock(),
+  // gate.policy/scope/rate, channel.<medium>().template(), and
+  // ai.model/prompt/embed/agent/mcpServer — module-evaluation registries
+  // that mirror `on`'s trigger drain (`listBindings`/`resetBindings` above).
+  // Explicit `options.stores` / `secrets` / `signals` / `clocks` /
+  // `gate.policies` / `channel.templates` / `ai` are additive, never
   // silently ignored — deduped by reference so an explicitly-passed decl
   // that is also in the registry is not doubled.
   const registrySnapshot =
@@ -583,37 +660,48 @@ export function oke(options: OkeOptions): OkeApp {
           secrets: [],
           requiredEnv: [],
           signals: [],
+          clocks: [],
+          gates: [],
           channelTemplates: [],
           aiModels: [],
           aiPrompts: [],
           aiEmbeds: [],
           aiAgents: [],
+          aiMcpServers: [],
         }
       : {
           stores: storeRegistry.slice(),
           secrets: secretRegistry.slice(),
           requiredEnv: requiredEnvRegistry.slice(),
           signals: signalRegistry.slice(),
+          clocks: clockRegistry.slice(),
+          gates: gateRegistry.slice(),
           channelTemplates: channelTemplateRegistry.slice(),
           aiModels: aiModelRegistry.slice(),
           aiPrompts: aiPromptRegistry.slice(),
           aiEmbeds: aiEmbedRegistry.slice(),
           aiAgents: aiAgentRegistry.slice(),
+          aiMcpServers: aiMcpServerRegistry.slice(),
         };
   if (registry === "consume") {
     storeRegistry.length = 0;
     secretRegistry.length = 0;
     requiredEnvRegistry.length = 0;
     signalRegistry.length = 0;
+    clockRegistry.length = 0;
+    gateRegistry.length = 0;
     channelTemplateRegistry.length = 0;
     aiModelRegistry.length = 0;
     aiPromptRegistry.length = 0;
     aiEmbedRegistry.length = 0;
     aiAgentRegistry.length = 0;
+    aiMcpServerRegistry.length = 0;
   }
   const effectiveStores = mergeUnique(options.stores, registrySnapshot.stores);
   const effectiveSecrets = mergeUnique(options.secrets, registrySnapshot.secrets);
   const effectiveSignals = mergeUnique(options.signals, registrySnapshot.signals);
+  const effectiveClocks = mergeUnique(options.clocks, registrySnapshot.clocks);
+  const effectivePolicies = mergeUnique(options.gate?.policies, registrySnapshot.gates);
   /**
    * Fold registered `vault.env.required` names into the vault boot options so
    * boot reports missing env vars in the same gap list as missing secrets.
@@ -643,20 +731,28 @@ export function oke(options: OkeOptions): OkeApp {
     prompts: registrySnapshot.aiPrompts,
     embeds: registrySnapshot.aiEmbeds,
     agents: registrySnapshot.aiAgents,
+    mcpServers: registrySnapshot.aiMcpServers,
   });
 
   // Resolve Gate bag early so auth HTTP Bindings join `adopted` + the router
   // before posture audit (same ensureBoot → doBoot path — never a side channel).
+  const mergedGate: GateOptions | undefined =
+    effectivePolicies.length > 0 ? { ...options.gate, policies: effectivePolicies } : options.gate;
   const gateConfig: ResolvedGateConfig = resolveGateConfig({
-    gate: options.gate,
+    gate: mergedGate,
     env: options.env,
   });
 
-  /** Retained for test harness / boot merges (includes auto-drained AI decls). */
-  const $options: OkeOptions =
-    effectiveAi === undefined || options.ai === effectiveAi
-      ? options
-      : { ...options, ai: effectiveAi };
+  /** Retained for test harness / boot merges (includes auto-drained decls). */
+  const $options: OkeOptions = {
+    ...options,
+    ...(effectiveAi !== undefined ? { ai: effectiveAi } : {}),
+    ...(effectiveStores.length > 0 ? { stores: effectiveStores } : {}),
+    ...(effectiveSecrets.length > 0 ? { secrets: effectiveSecrets } : {}),
+    ...(effectiveSignals.length > 0 ? { signals: effectiveSignals } : {}),
+    ...(effectiveClocks.length > 0 ? { clocks: effectiveClocks } : {}),
+    ...(mergedGate !== undefined ? { gate: mergedGate } : {}),
+  };
 
   const appHooks: HookMap = {};
   const unitHooks = new Map<string, HookMap>();
@@ -690,8 +786,19 @@ export function oke(options: OkeOptions): OkeApp {
   }
 
   const smart = createRouter<Binding>(options.router ?? "default");
+  const seenHttpRoutes = new Set<string>();
   for (const b of adopted) {
     if (b.trigger.kind === "http") {
+      assertHttpBindingReady(b);
+      const key = `${b.trigger.method} ${b.trigger.path}`;
+      if (seenHttpRoutes.has(key)) {
+        throwOke("HTTP_ROUTE_DUPLICATE", {
+          method: b.trigger.method,
+          path: b.trigger.path,
+          flow: b.flow.name || "(unnamed)",
+        });
+      }
+      seenHttpRoutes.add(key);
       smart.add(b.trigger.method, b.trigger.path, b);
       compiled.set(b, compileHttpBinding(b, aot));
     }
@@ -704,6 +811,16 @@ export function oke(options: OkeOptions): OkeApp {
     adopted.push(b);
     registerFlow(b.flow);
     if (b.trigger.kind === "http") {
+      assertHttpBindingReady(b);
+      const key = `${b.trigger.method} ${b.trigger.path}`;
+      if (seenHttpRoutes.has(key)) {
+        throwOke("HTTP_ROUTE_DUPLICATE", {
+          method: b.trigger.method,
+          path: b.trigger.path,
+          flow: b.flow.name || "(unnamed)",
+        });
+      }
+      seenHttpRoutes.add(key);
       smart.add(b.trigger.method, b.trigger.path, b);
       compiled.set(b, compileHttpBinding(b, aot));
     }
@@ -777,6 +894,11 @@ export function oke(options: OkeOptions): OkeApp {
     registerFlow(b.flow);
   }
 
+  if (registry !== "ignore") {
+    const generatedUnits = consumeRegisteredFlowUnits();
+    drainGeneratedUnits(generatedUnits, routes, registerFlow);
+  }
+
   // --- boot (vault → store → signal → clock → channel → AI → runs → caps) ---
   let bootResult: BootResult | undefined;
   let bootPromise: Promise<BootResult> | undefined;
@@ -952,7 +1074,7 @@ export function oke(options: OkeOptions): OkeApp {
       vault: withRequiredEnv(overrides?.vault ?? options.vault),
       gates: [...baseGates, ...authGates],
       signals: overrides?.signals ?? effectiveSignals,
-      clocks: overrides?.clocks ?? options.clocks,
+      clocks: overrides?.clocks ?? effectiveClocks,
       stores: overrides?.stores ?? effectiveStores,
       channel: overrides?.channel ?? effectiveChannel,
       ai: overrides?.ai ?? effectiveAi,
@@ -1008,7 +1130,7 @@ export function oke(options: OkeOptions): OkeApp {
 
     const baseSecrets = overrides?.secrets ?? effectiveSecrets;
     const baseSignals = overrides?.signals ?? effectiveSignals;
-    const baseClocks = overrides?.clocks ?? options.clocks ?? [];
+    const baseClocks = overrides?.clocks ?? effectiveClocks;
     const baseChannel = overrides?.channel ?? effectiveChannel;
     const mergedCatalog = mergeTemplateCatalogs(baseChannel?.catalog, ...pluginChannelCatalogs);
 
@@ -1127,6 +1249,8 @@ export function oke(options: OkeOptions): OkeApp {
       readonly bypassGates?: boolean;
       /** Console Call API — cleartext store PII. Requires {@link trustedInvoke}. */
       readonly revealPii?: boolean;
+      /** Forced RLS bag (Console / Call API). Operator omit = no stamp. */
+      readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
       /** Frozen origin identity for {@link Fx.principal} across `fx.call`. */
       readonly originPrincipal?: FxPrincipal;
       /** Explicit locale override for {@link Fx.t} / channel sends. */
@@ -1149,16 +1273,19 @@ export function oke(options: OkeOptions): OkeApp {
       defaultLocale,
     );
 
-    return runWithLocale({ locale: resolvedLocale, defaultLocale }, () =>
-      executeInLocale({
-        flowDef,
-        input,
-        trigger,
-        extras,
-        resolvedLocale,
-        defaultLocale,
-      }),
-    );
+    return runWithLocale({ locale: resolvedLocale, defaultLocale }, () => {
+      const run = () =>
+        executeInLocale({
+          flowDef,
+          input,
+          trigger,
+          extras,
+          resolvedLocale,
+          defaultLocale,
+        });
+      const signal = extras?.request?.signal;
+      return signal ? withAbortSignal(signal, run) : run();
+    });
   }
 
   async function executeInLocale(args: {
@@ -1175,6 +1302,7 @@ export function oke(options: OkeOptions): OkeApp {
       readonly trustedInvoke?: boolean;
       readonly bypassGates?: boolean;
       readonly revealPii?: boolean;
+      readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
       readonly originPrincipal?: FxPrincipal;
       readonly locale?: string;
       readonly parentId?: string;
@@ -1325,6 +1453,9 @@ export function oke(options: OkeOptions): OkeApp {
       ...(principals ? { auth: principals.auth as FxAuth, operator: principals.operator } : {}),
       ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(extras?.trustedInvoke === true && extras.revealPii === true ? { revealPii: true } : {}),
+      rlsGateNames: gateNamesOf(trigger),
+      rlsBypass: extras?.bypassGates === true || flowDef.plane === "operator",
+      ...(extras?.rls ? { rls: extras.rls } : {}),
       ...(capability ? { capability } : {}),
       ...(booted
         ? {
@@ -1451,7 +1582,7 @@ export function oke(options: OkeOptions): OkeApp {
                   durable: flowDef.durable,
                   effects: putEffects,
                 });
-              if (storeAfter && output !== undefined) {
+              if (storeAfter && output !== undefined && !isJsonStreamResult(output)) {
                 const ttlMs =
                   typeof flowDef.cache === "string" ? cache.parseTtlMs(flowDef.cache) : undefined;
                 storeRt.putTier1(
@@ -1499,60 +1630,79 @@ export function oke(options: OkeOptions): OkeApp {
 
     const endedAt = now();
     const durationMs = resolveDurationMs(endedAt - startedAt, performance.now() - startedHr);
+    const streamOut = isJsonStreamResult(result.output) ? result.output : undefined;
+
+    const finalizeRun = async (): Promise<void> => {
+      // Stream rows land in Traces only after close. Measure wall time then
+      // so duration / waterfall cover the open stream, not just TTFB.
+      const recordEndedAt = streamOut ? now() : endedAt;
+      const recordDurationMs = streamOut
+        ? resolveDurationMs(recordEndedAt - startedAt, performance.now() - startedHr)
+        : durationMs;
+      if (journalSession) {
+        inflightRuns.delete(journalSession.runId);
+        const sleeping = ctx.state.sleeping as
+          | { readonly wakeAt: number; readonly label: string; readonly runId: string }
+          | undefined;
+        // Lease-capable stores make the shared row the wake schedule; the
+        // in-process map is only for custom stores without the lease surface.
+        if (sleeping && !hasJournalLease(activeJournal().store)) {
+          sleepingRuns.set(sleeping.runId, {
+            flow: flowDef,
+            input: ctx.input,
+            wakeAt: sleeping.wakeAt,
+          });
+        } else if (!sleeping && isTerminalFailure(result)) {
+          const terminalErr = result.failure ?? result.ctx.error;
+          await runCompensationPhase({
+            flow: flowDef,
+            input: ctx.input,
+            session: journalSession,
+            fx,
+            error: terminalErr,
+          });
+        } else if (!sleeping) {
+          await journalSession.commit("completed", {
+            output: streamOut ? { streamed: true } : result.output,
+          });
+        }
+      }
 
-    if (journalSession) {
-      inflightRuns.delete(journalSession.runId);
-      const sleeping = ctx.state.sleeping as
-        | { readonly wakeAt: number; readonly label: string; readonly runId: string }
-        | undefined;
-      // Lease-capable stores make the shared row the wake schedule; the
-      // in-process map is only for custom stores without the lease surface.
-      if (sleeping && !hasJournalLease(activeJournal().store)) {
-        sleepingRuns.set(sleeping.runId, {
-          flow: flowDef,
-          input: ctx.input,
-          wakeAt: sleeping.wakeAt,
-        });
-      } else if (!sleeping && isTerminalFailure(result)) {
-        const terminalErr = result.failure ?? result.ctx.error;
-        await runCompensationPhase({
-          flow: flowDef,
-          input: ctx.input,
-          session: journalSession,
-          fx,
-          error: terminalErr,
-        });
-      } else if (!sleeping) {
-        await journalSession.commit("completed", { output: result.output });
+      const runsRuntime =
+        booted?.runs ?? (isRunsRuntimeLike(options.runs) ? options.runs : undefined);
+      if (runsRuntime) {
+        const archiveCleartext = archiveFromInput(ctx.input, options.archiveInputFields);
+        const replayInput = redactArchivedFields(ctx.input, options.archiveInputFields);
+        const recordFailure =
+          result.failure ??
+          (isTerminalFailure(result) ? failureFromUnknown(result.ctx.error) : undefined);
+        await runsRuntime.record(
+          {
+            flow: flowDef,
+            trigger,
+            fx,
+            ledger,
+            telemetry,
+            startedAt,
+            endedAt: recordEndedAt,
+            durationMs: recordDurationMs,
+            failure: recordFailure,
+            id: runId,
+            input: replayInput,
+            ...(result.output !== undefined && !recordFailure
+              ? { output: streamOut ? { streamed: true } : result.output }
+              : {}),
+            ...(parentId !== undefined ? { parentId } : {}),
+          },
+          archiveCleartext,
+        );
       }
-    }
+    };
 
-    const runsRuntime =
-      booted?.runs ?? (isRunsRuntimeLike(options.runs) ? options.runs : undefined);
-    if (runsRuntime) {
-      const archiveCleartext = archiveFromInput(ctx.input, options.archiveInputFields);
-      const replayInput = redactArchivedFields(ctx.input, options.archiveInputFields);
-      const recordFailure =
-        result.failure ??
-        (isTerminalFailure(result) ? failureFromUnknown(result.ctx.error) : undefined);
-      await runsRuntime.record(
-        {
-          flow: flowDef,
-          trigger,
-          fx,
-          ledger,
-          telemetry,
-          startedAt,
-          endedAt,
-          durationMs,
-          failure: recordFailure,
-          id: runId,
-          input: replayInput,
-          ...(result.output !== undefined && !recordFailure ? { output: result.output } : {}),
-          ...(parentId !== undefined ? { parentId } : {}),
-        },
-        archiveCleartext,
-      );
+    if (streamOut && !isTerminalFailure(result)) {
+      streamOut.finalize = finalizeRun;
+    } else {
+      await finalizeRun();
     }
 
     return {

package/src/kernel/auto-cache.test.ts

@@ -44,7 +44,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         effects: { reads: ["sql:notes"] },
@@ -80,7 +80,7 @@ describe("automatic tier-1 cache from effects", () => {
     resetFlowSeq();
     const db = store.sql("app", { schema: { notes } });
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         effects: { reads: ["sql:notes"] },
@@ -115,7 +115,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         cache: false,
         effects: { reads: ["sql:notes"] },
@@ -146,7 +146,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         do: async (_input, fx) => {
@@ -191,7 +191,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         effects: { reads: ["sql:notes"] },
         do: () => {
@@ -201,7 +201,7 @@ describe("automatic tier-1 cache from effects", () => {
       }),
     );
     const create = on(
-      http.post("/notes").gate.public,
+      http.post("/notes").public(),
       flow("notes.create", {
         in: z.object({ title: z.string() }),
         effects: { writes: ["sql:notes"] },
@@ -231,7 +231,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         do: async (_input, fx) => {
@@ -242,7 +242,7 @@ describe("automatic tier-1 cache from effects", () => {
       }),
     );
     const create = on(
-      http.post("/notes").gate.public,
+      http.post("/notes").public(),
       flow("notes.create", {
         in: z.object({ title: z.string() }),
         do: async (input, fx) => {