okengine 0.13.0 → 0.15.2

package/src/kernel/stamp-http.ts

@@ -0,0 +1,75 @@
+/**
+ * In-place HTTP path + Flow name stamps.
+ *
+ * `on()` already registered the trigger (possibly still on the pending-path
+ * sentinel). A wrapper that returned a new trigger would leave `listBindings()`
+ * on the sentinel — mutate the existing object.
+ */
+
+import { isFlow, type AnyFlowDef, type FlowDef } from "./flow.ts";
+import { isPendingHttpPath, type HttpPathPending } from "./http-path-pending.ts";
+import type { HttpTrigger, Trigger } from "./triggers.ts";
+
+/**
+ * Replace a pending HTTP path on {@link FlowDef} with the file-tree stamp.
+ *
+ * Explicit `http.get("/x")` wins — the pending sentinel is the only path
+ * this function overwrites. Returns the same object with a tighter trigger
+ * type when the original path was pending.
+ *
+ * @param flow - Bound flow (already passed through `on()`)
+ * @param path - Inferred URL (`/notes/:id`)
+ */
+export function stampHttpPath<F extends AnyFlowDef, P extends string>(
+  flow: F,
+  path: P,
+): StampHttpPath<F, P> {
+  if (!isFlow(flow)) return flow as StampHttpPath<F, P>;
+  const apply = (trigger: Trigger): void => {
+    if (trigger.kind !== "http") return;
+    if (!isPendingHttpPath(trigger.path)) return;
+    (trigger as { path: string }).path = path;
+  };
+  if (flow.$trigger) apply(flow.$trigger);
+  for (const trigger of flow.triggers) apply(trigger);
+  return flow as StampHttpPath<F, P>;
+}
+
+/**
+ * Stamp `unit.export` onto a nameless (or `flow_*`) Flow.
+ *
+ * Explicit `flow("notes.get")` wins. Fills `unit` when missing.
+ *
+ * @param flow - Flow definition
+ * @param name - `notes.get`
+ */
+export function stampFlowName<F extends AnyFlowDef>(flow: F, name: string): F {
+  if (!isFlow(flow)) return flow;
+  const f = flow as { name: string; unit: string | undefined };
+  if (!f.name || f.name.startsWith("flow_")) {
+    f.name = name;
+  }
+  if (!f.unit) {
+    const resolved = f.name || name;
+    const dot = resolved.indexOf(".");
+    f.unit = dot > 0 ? resolved.slice(0, dot) : resolved;
+  }
+  return flow;
+}
+
+/**
+ * Type-level path replacement — only when the bound trigger is still pending.
+ *
+ * @typeParam F - Flow definition
+ * @typeParam P - Stamped path
+ */
+export type StampHttpPath<F, P extends string> =
+  F extends FlowDef<infer I, infer O, infer E, infer D, infer T>
+    ? T extends HttpTrigger<infer M, infer Cur>
+      ? [Cur] extends [HttpPathPending]
+        ? FlowDef<I, O, E, D, HttpTrigger<M, P>>
+        : F
+      : F
+    : F;
+
+export { HTTP_PATH_PENDING, isPendingHttpPath } from "./http-path-pending.ts";

package/src/kernel/triggers.ts

@@ -7,8 +7,11 @@
 
 import { flattenGateArgs, GATE_PUBLIC_NAME, type GateAllDecl } from "../elements/gate/flatten.ts";
 import type { NamedRef } from "./fx.ts";
+import { HTTP_PATH_PENDING, type HttpPathPending } from "./http-path-pending.ts";
 import { lazyRequire } from "./lazy-require.ts";
 
+export { HTTP_PATH_PENDING, isPendingHttpPath, type HttpPathPending } from "./http-path-pending.ts";
+
 /** HTTP methods accepted by {@link http}. */
 export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "HEAD" | "QUERY";
 
@@ -18,15 +21,8 @@ export type GateRef = NamedRef;
 /** One `.gate(...)` argument — a named ref, an `all` handle, or an array. */
 export type GateArg = GateRef | GateAllDecl | readonly GateArg[];
 
-/**
- * Attach function on an HTTP trigger / resource mount.
- * Call it with members, or use `.public` for the unauthenticated sentinel.
- */
-export interface GateAttach<T> {
-  (...gates: GateArg[]): T;
-  /** Attach {@link gate.public} — same as `.gate(gate.public)`. */
-  readonly public: T;
-}
+/** Attach gates on an HTTP trigger / resource mount. */
+export type GateAttach<T> = (...gates: GateArg[]) => T;
 
 /**
  * HTTP trigger value. Method and path are literal type parameters so
@@ -44,9 +40,12 @@ export interface HttpTrigger<M extends HttpMethod = HttpMethod, P extends string
   readonly isLive: boolean;
   /**
    * Attach gates (registration order). `gate.all` handles and arrays flatten.
-   * `.gate.public` is the unauthenticated sentinel.
    */
   readonly gate: GateAttach<HttpTrigger<M, P>>;
+  /**
+   * Attach the unauthenticated public sentinel.
+   */
+  public(): HttpTrigger<M, P>;
   /**
    * Mark the HTTP trigger as live (push result to subscribers).
    */
@@ -93,7 +92,7 @@ export type Trigger = HttpTrigger | EveryTrigger | SignalAsTrigger | CdcTrigger
 export type TriggerKind = Trigger["kind"];
 
 /**
- * Callable `.gate(...)` plus `.gate.public` on a trigger or resource mount.
+ * Callable `.gate(...)` on a trigger or resource mount.
  *
  * @param apply - Rebuild the host with the flattened gate list
  * @param current - Gates already attached
@@ -102,19 +101,11 @@ export function createGateAttach<T>(
   apply: (next: readonly GateRef[]) => T,
   current: readonly GateRef[],
 ): GateAttach<T> {
-  const attach = ((...next: GateArg[]) =>
-    apply([...current, ...flattenGateArgs(next)])) as GateAttach<T>;
-  Object.defineProperty(attach, "public", {
-    get() {
-      return apply([...current, GATE_PUBLIC_NAME]);
-    },
-    enumerable: true,
-  });
-  return attach;
+  return (...next: GateArg[]) => apply([...current, ...flattenGateArgs(next)]);
 }
 
 /**
- * Build an HTTP trigger with `.gate` / `.live`.
+ * Build an HTTP trigger with `.gate` / `.public` / `.live`.
  *
  * @param method - HTTP verb
  * @param path - Route path
@@ -134,6 +125,9 @@ export function createHttpTrigger<M extends HttpMethod, P extends string>(
     gates,
     isLive,
     gate: createGateAttach((next) => createHttpTrigger(method, path, next, isLive), gates),
+    public() {
+      return createHttpTrigger(method, path, [...gates, GATE_PUBLIC_NAME], isLive);
+    },
     live() {
       return createHttpTrigger(method, path, gates, true);
     },
@@ -156,7 +150,7 @@ export interface ResourceFlowBag {
 /**
  * A mounted resource — the single argument to the `on(http.resource(…))`
  * overload. Branded so `on` can tell it apart from a plain trigger.
- * Same chain as {@link HttpTrigger}: `.gate(...)` / `.live()`.
+ * Same chain as {@link HttpTrigger}: `.gate(...)` / `.public()` / `.live()`.
  */
 export interface ResourceMount {
   readonly [resourceMountBrand]: true;
@@ -166,9 +160,12 @@ export interface ResourceMount {
   readonly isLive: boolean;
   /**
    * Attach gates to every verb (registration order). `gate.all` and arrays flatten.
-   * `.gate.public` is the unauthenticated sentinel.
    */
   readonly gate: GateAttach<ResourceMount>;
+  /**
+   * Attach the unauthenticated public sentinel to every verb.
+   */
+  public(): ResourceMount;
   /**
    * Mark list and get as live (GET mounts). Mutations stay request/response.
    */
@@ -200,34 +197,55 @@ function loadHttpResource(): typeof import("./http-resource.ts") {
  * types for param extraction.
  */
 export interface HttpTriggerNamespace {
+  /**
+   * Pathless — file-tree stamp fills the URL. Unresolved sentinel fails boot.
+   */
+  get(): HttpTrigger<"GET", HttpPathPending>;
   /**
    * @param path - Route path (`/:id` params supported)
    */
   get<P extends string>(path: P): HttpTrigger<"GET", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  post(): HttpTrigger<"POST", HttpPathPending>;
   /**
    * @param path - Route path
    */
   post<P extends string>(path: P): HttpTrigger<"POST", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  put(): HttpTrigger<"PUT", HttpPathPending>;
   /**
    * @param path - Route path
    */
   put<P extends string>(path: P): HttpTrigger<"PUT", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  patch(): HttpTrigger<"PATCH", HttpPathPending>;
   /**
    * @param path - Route path
    */
   patch<P extends string>(path: P): HttpTrigger<"PATCH", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  delete(): HttpTrigger<"DELETE", HttpPathPending>;
   /**
    * @param path - Route path
    */
   delete<P extends string>(path: P): HttpTrigger<"DELETE", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  options(): HttpTrigger<"OPTIONS", HttpPathPending>;
   /**
    * @param path - Route path
    */
   options<P extends string>(path: P): HttpTrigger<"OPTIONS", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  head(): HttpTrigger<"HEAD", HttpPathPending>;
   /**
    * @param path - Route path
    */
   head<P extends string>(path: P): HttpTrigger<"HEAD", P>;
+  /**
+   * Safe, idempotent read that carries a JSON body (RFC 10008).
+   * Pathless — file-tree stamp fills the URL.
+   */
+  query(): HttpTrigger<"QUERY", HttpPathPending>;
   /**
    * Safe, idempotent read that carries a JSON body (RFC 10008).
    *
@@ -236,8 +254,8 @@ export interface HttpTriggerNamespace {
   query<P extends string>(path: P): HttpTrigger<"QUERY", P>;
   /**
    * Mount a CRUD resource (list/create on `path`, get/update/remove on
-   * `path/:id`) for the `on(http.resource(…))` overload. Chain `.gate(...)`
-   * and `.live()` like {@link HttpTrigger}.
+   * `path/:id`) for the `on(http.resource(…))` overload. Chain `.gate(...)`,
+   * `.public()`, and `.live()` like {@link HttpTrigger}.
    */
   resource<P extends string>(path: P, ops: ResourceFlowBag): ResourceMount;
 }
@@ -245,8 +263,15 @@ export interface HttpTriggerNamespace {
 /** Bind an HTTP verb constructor (`http.get`, `http.query`, …). */
 function httpVerb<M extends HttpMethod>(
   method: M,
-): <P extends string>(path: P) => HttpTrigger<M, P> {
-  return (path) => createHttpTrigger(method, path);
+): {
+  (): HttpTrigger<M, HttpPathPending>;
+  <P extends string>(path: P): HttpTrigger<M, P>;
+} {
+  return ((path?: string) =>
+    createHttpTrigger(method, path === undefined ? HTTP_PATH_PENDING : path)) as {
+    (): HttpTrigger<M, HttpPathPending>;
+    <P extends string>(path: P): HttpTrigger<M, P>;
+  };
 }
 
 /**

package/src/manifest/mcp-ref.ts

@@ -0,0 +1,88 @@
+/**
+ * MCP tool resource refs — `mcp:<server>/<tool>` (capability / Manifest)
+ * and `<server>__<tool>` (provider-safe model tool name).
+ */
+
+/** Capability / Manifest ref for one declared MCP tool. */
+export type McpToolRef = `mcp:${string}/${string}`;
+
+/** Parsed `mcp:<server>/<tool>` ref. */
+export interface ParsedMcpToolRef {
+  readonly server: string;
+  readonly tool: string;
+}
+
+/**
+ * Build a capability ref.
+ *
+ * @param server - Declared MCP server name
+ * @param tool - Allowlisted tool name on that server
+ */
+export function mcpToolRef(server: string, tool: string): McpToolRef {
+  return `mcp:${server}/${tool}`;
+}
+
+/**
+ * Parse `mcp:<server>/<tool>`. Null when the prefix or parts are missing.
+ *
+ * @param ref - Effect / tool resource string
+ */
+export function parseMcpToolRef(ref: string): ParsedMcpToolRef | null {
+  if (!ref.startsWith("mcp:")) return null;
+  const rest = ref.slice(4);
+  const slash = rest.indexOf("/");
+  if (slash <= 0 || slash === rest.length - 1) return null;
+  return { server: rest.slice(0, slash), tool: rest.slice(slash + 1) };
+}
+
+/**
+ * True when `ref` is a well-formed MCP capability ref.
+ *
+ * @param ref - Candidate
+ */
+export function isMcpToolRef(ref: string): boolean {
+  return parseMcpToolRef(ref) !== null;
+}
+
+/**
+ * Graph node id for one MCP server (`mcp:github`).
+ *
+ * @param server - Declared server name
+ */
+export function mcpServerNodeId(server: string): string {
+  return `mcp:${server}`;
+}
+
+/**
+ * Provider-safe function name (`github__create_issue`).
+ *
+ * @param server - Declared server name
+ * @param tool - MCP tool name
+ */
+export function mcpModelToolName(server: string, tool: string): string {
+  return `${server}__${tool}`;
+}
+
+/**
+ * Inverse of {@link mcpModelToolName}.
+ *
+ * @param name - Model-facing tool name
+ */
+export function parseMcpModelToolName(name: string): ParsedMcpToolRef | null {
+  const sep = name.indexOf("__");
+  if (sep <= 0 || sep === name.length - 2) return null;
+  return { server: name.slice(0, sep), tool: name.slice(sep + 2) };
+}
+
+/**
+ * Capability ref from either `mcp:server/tool` or `server__tool`.
+ *
+ * @param name - Model-facing or capability name
+ */
+export function mcpCapabilityRefFromName(name: string): McpToolRef | null {
+  const fromRef = parseMcpToolRef(name);
+  if (fromRef) return mcpToolRef(fromRef.server, fromRef.tool);
+  const fromModel = parseMcpModelToolName(name);
+  if (fromModel) return mcpToolRef(fromModel.server, fromModel.tool);
+  return null;
+}

package/src/manifest/types.ts

@@ -46,6 +46,12 @@ export type ResourceRef = `${StoreFacet}:${string}`;
  */
 export type RunsResourceRef = "runs";
 
+/**
+ * Dead-letter read capability for `fx.deadLetters` — not a store facet.
+ * Declare on `effects.reads` (never `writes`).
+ */
+export type SignalResourceRef = `signal:${string}`;
+
 /** Signal name reference. */
 export type SignalRef = string;
 
@@ -74,8 +80,8 @@ export type JsonSchema = string | Record<string, unknown>;
  * `sends` / `asks` are irreversible (asks also nondeterministic + cost).
  */
 export interface Effects {
-  /** Store reads, plus optional `"runs"` for `fx.runs`. */
-  reads?: Array<ResourceRef | RunsResourceRef>;
+  /** Store reads, plus `"runs"` for `fx.runs` and `signal:name` for `fx.deadLetters`. */
+  reads?: Array<ResourceRef | RunsResourceRef | SignalResourceRef>;
   /** Store writes. */
   writes?: ResourceRef[];
   /** Emitted signals. */
@@ -218,10 +224,23 @@ export interface DeclaredColumn extends ColumnClassification {
 /** Field classification value forms. */
 export type ClassificationValue = string | string[] | ColumnClassification;
 
+/** Declared Postgres RLS policy on a {@link Table}. */
+export interface TablePolicy {
+  as?: "permissive" | "restrictive";
+  to?: string | string[];
+  for?: "all" | "select" | "insert" | "update" | "delete";
+  using?: string;
+  withCheck?: string;
+}
+
 /** SQL table metadata. */
 export interface Table {
   columns?: Record<string, DeclaredColumn | ColumnClassification>;
   classifications?: Record<string, ClassificationValue>;
+  /** RLS enabled (`pgTable.withRLS` or any policy). */
+  rls?: boolean;
+  /** Policy name → Drizzle-shaped spec. */
+  policies?: Record<string, TablePolicy>;
 }
 
 /** One Store declaration. */
@@ -297,6 +316,8 @@ export interface AiModel {
   provider?: string;
   tier?: string;
   model?: string;
+  /** Protocol driver override for this logical binding. */
+  driverId?: string;
 }
 
 /** Prompt / agent budget. */
@@ -327,11 +348,29 @@ export interface AiAgent {
   budget?: AiBudget;
 }
 
+/**
+ * External MCP server the app consumes — tools join the existing `fx.call`
+ * / `toolLoop` path as `mcp:<server>/<tool>` capability refs.
+ */
+export interface AiMcpServer {
+  /** Streamable HTTP endpoint. */
+  url?: string;
+  /** stdio executable (no shell string). */
+  command?: string;
+  /** Arguments for {@link command}. */
+  args?: string[];
+  /** Bearer secret contract name (never the value). */
+  auth?: SecretRef;
+  /** Required allowlist — never trust whatever `tools/list` exposes. */
+  tools: string[];
+}
+
 /** AI element catalogue. */
 export interface Ai {
   models?: Record<string, AiModel>;
   prompts?: Record<string, AiPrompt>;
   agents?: Record<string, AiAgent>;
+  mcpServers?: Record<string, AiMcpServer>;
 }
 
 /** Per-table metadata on a Manifest {@link Plugin}. */

package/src/manifest/validate.test.ts

@@ -75,6 +75,26 @@ describe("validateManifest", () => {
     expect(result.ok).toBe(false);
   });
 
+  test("accepts signal resource refs on reads only", async () => {
+    const reads = await validateManifest({
+      oke: "1.0",
+      app: "x",
+      flows: {
+        f: { effects: { reads: ["signal:notify"] } },
+      },
+    });
+    expect(reads.ok).toBe(true);
+
+    const writes = await validateManifest({
+      oke: "1.0",
+      app: "x",
+      flows: {
+        f: { effects: { writes: ["signal:notify"] } },
+      },
+    });
+    expect(writes.ok).toBe(false);
+  });
+
   test("parseManifest throws ManifestValidationError on invalid JSON", async () => {
     expect(parseManifest("{")).rejects.toBeInstanceOf(ManifestValidationError);
   });

package/src/mcp/docs-server.ts

@@ -197,7 +197,7 @@ export async function serveDocsMcp(
     hostname: boundHost,
     fetch: mcp.fetch,
     stop(closeActive = false) {
-      server.stop(closeActive);
+      return server.stop(closeActive);
     },
   };
 }

package/src/mcp/server.ts

@@ -268,7 +268,7 @@ export async function serveMcp(options: ServeMcpOptions): Promise<McpServerHandl
     hostname: boundHost,
     fetch: mcp.fetch,
     stop(closeActive = false) {
-      server.stop(closeActive);
+      return server.stop(closeActive);
     },
   };
 }

package/src/plugins/compression.test.ts

@@ -122,4 +122,25 @@ describe("compression plugin", () => {
     );
     expect(nt.headers.get("content-encoding")).toBeNull();
   });
+
+  test("skips text/event-stream even when Accept-Encoding is gzip", async () => {
+    on(
+      http.get("/sse"),
+      flow("sse.get", {
+        do: (_input, fx) =>
+          fx.json.stream(
+            (async function* () {
+              yield "hello";
+            })(),
+          ),
+      }),
+    );
+    const app = oke({ autoBoot: false, name: "zip-sse" }).plug(compression({ minSize: 0 }));
+    const res = await app.fetch(
+      new Request("http://localhost/sse", { headers: { "accept-encoding": "gzip" } }),
+    );
+    expect(res.headers.get("content-type")).toMatch(/text\/event-stream/);
+    expect(res.headers.get("content-encoding")).toBeNull();
+    expect(await res.text()).toContain('data: "hello"');
+  });
 });

package/src/plugins/compression.ts

@@ -73,6 +73,7 @@ export function compression(
     if (cacheControl !== null && /\bno-transform\b/i.test(cacheControl)) return;
 
     const contentType = headers.get("content-type") ?? "";
+    if (/^text\/event-stream\b/i.test(contentType.split(";")[0]?.trim() ?? "")) return;
     if (!match.test(contentType)) return;
 
     const body = await ctx.response.arrayBuffer();

package/src/release/measure.ts

@@ -201,7 +201,7 @@ export async function measureHttpPingAppBytes(): Promise<HttpPingBudgetSample> {
   await Bun.write(
     anchor,
     `import { on, flow, http, gate, oke, createBunRuntime } from ${JSON.stringify(httpEntry)};\n` +
-      `on(http.get("/").gate.public, flow("ping", { do: () => "Hi" }));\n` +
+      `on(http.get("/").public(), flow("ping", { do: () => "Hi" }));\n` +
       `export const app = oke({ name: "ping" });\n` +
       `export const rt = createBunRuntime;\n`,
   );
@@ -362,7 +362,7 @@ const t0 = performance.now();
 const { createBunRuntime, oke, on, flow, http, gate } = await import(${JSON.stringify(httpEntry)});
 const { resetBindings } = await import(${JSON.stringify(`${import.meta.dir}/../kernel/on.ts`)});
 resetBindings();
-on(http.get("/ping").gate.public, flow("ping", { do: () => ({ ok: true }) }));
+on(http.get("/ping").public(), flow("ping", { do: () => ({ ok: true }) }));
 const app = oke({ name: "cold-start" });
 const rt = createBunRuntime();
 const server = rt.serve(app, { port: 0, hostname: "127.0.0.1" });

package/src/runtime/bun.ts

@@ -81,7 +81,29 @@ export function isBunNativeMethod(method: string): boolean {
   );
 }
 
-type MethodHandlers = Partial<Record<string, (req: Request) => Response | Promise<Response>>>;
+/** Bun.serve `fetch` / route handler — second arg is the live server. */
+type ServeFetch = (
+  req: Request,
+  server: { timeout(request: Request, seconds: number): void },
+) => Response | Promise<Response>;
+
+type MethodHandlers = Partial<Record<string, ServeFetch>>;
+
+/**
+ * Disable the 10s idle timeout for SSE so a quiet token stream is not reset.
+ *
+ * @param inner - App fetch
+ */
+function holdSseIdle(inner: (request: Request) => Promise<Response>): ServeFetch {
+  return async (req, server) => {
+    const res = await inner(req);
+    const ct = (res.headers.get("content-type") ?? "").split(";")[0]?.trim() ?? "";
+    if (/^text\/event-stream$/i.test(ct)) {
+      server.timeout(req, 0);
+    }
+    return res;
+  };
+}
 
 /**
  * Build Bun.serve `routes` from app HTTP bindings.
@@ -103,7 +125,7 @@ export function buildBunRoutes(
     if (typeof path !== "string" || typeof method !== "string") continue;
     if (!isBunNativePath(path) || !isBunNativeMethod(method)) continue;
     const methods = routes[path] ?? (routes[path] = {});
-    methods[method] = (req) => fetchHandler(req);
+    methods[method] = holdSseIdle(fetchHandler);
   }
   return routes;
 }
@@ -128,10 +150,15 @@ export function serveBunHttp(options: {
   readonly routes?: Record<string, MethodHandlers>;
   readonly id?: string;
 }): ReturnType<typeof Bun.serve> {
+  const fetch = holdSseIdle(
+    typeof options.fetch === "function"
+      ? (req: Request) => Promise.resolve(options.fetch(req))
+      : options.fetch,
+  );
   const base = {
     port: options.port,
     hostname: options.hostname,
-    fetch: options.fetch,
+    fetch,
     ...(options.id !== undefined ? { id: options.id } : {}),
   };
   const table = options.routes;
@@ -160,6 +187,15 @@ function listenBun(app: FetchApp, options?: ServeOptions): ServerHandle {
     ...(options?.id !== undefined ? { id: options.id } : {}),
   });
 
+  const closeIdle = (
+    server as typeof server & { closeIdleConnections(): void }
+  ).closeIdleConnections.bind(server);
+  const onPressure = (): void => {
+    closeIdle();
+  };
+  const proc = process as NodeJS.EventEmitter;
+  proc.on("memoryPressure", onPressure);
+
   const boundPort = server.port ?? port;
   const boundHost = server.hostname ?? hostname;
   const url = new URL(`http://${formatHostForUrl(boundHost)}:${boundPort}/`);
@@ -170,7 +206,8 @@ function listenBun(app: FetchApp, options?: ServeOptions): ServerHandle {
     hostname: boundHost,
     fetch: fetchHandler,
     stop(closeActiveConnections = false) {
-      server.stop(closeActiveConnections);
+      proc.off("memoryPressure", onPressure);
+      return server.stop(closeActiveConnections);
     },
   };
 }

package/src/runtime/json-code-block.test.ts

@@ -255,7 +255,7 @@ describe("httpGetNavPaths", () => {
 describe("asBrowserJsonCodeBlock — HTTP", () => {
   test("Chrome GET / becomes the code block; curl stays JSON", async () => {
     on(
-      http.get("/").gate.public,
+      http.get("/").public(),
       flow("main.root", {
         do: () => ({ ok: true as const, app: "keel" }),
       }),
@@ -286,7 +286,7 @@ describe("asBrowserJsonCodeBlock — HTTP", () => {
   });
 
   test("?raw=1 stays on the traces page; format=json and Accept stay the envelope", async () => {
-    on(http.get("/health").gate.public, flow("main.health", { do: () => ({ ok: true as const }) }));
+    on(http.get("/health").public(), flow("main.health", { do: () => ({ ok: true as const }) }));
     const app = oke({ autoBoot: false, name: "keel" });
 
     const raw = await app.fetch(

package/src/runtime/serve.test.ts

@@ -55,13 +55,13 @@ function rawHttp(port: number, payload: string): Promise<string> {
 
 function buildApp() {
   on(
-    http.get("/ping").gate.public,
+    http.get("/ping").public(),
     flow("ping", {
       do: () => ({ ok: true as const, n: 1 }),
     }),
   );
   on(
-    http.get("/notes/:id").gate.public,
+    http.get("/notes/:id").public(),
     flow("notes.get", {
       do: ({ id }: { id: string }) => ({ id }),
     }),
@@ -157,13 +157,13 @@ describe("Bun.serve — real HTTP", () => {
 
   test("QUERY is omitted from native routes so Bun.serve still boots", async () => {
     on(
-      http.query("/search").gate.public,
+      http.query("/search").public(),
       flow("search.query", {
         do: () => ({ hits: 1 }),
       }),
     );
     on(
-      http.get("/search/suggest").gate.public,
+      http.get("/search/suggest").public(),
       flow("search.suggest", {
         do: () => ({ hits: 0 }),
       }),