okengine 0.13.0 → 0.15.2

package/src/cli/db-seed.ts

@@ -1,10 +1,10 @@
 /**
  * `oke db seed` — load `defineSeed`, boot the app store, run essential +
- * env-selected category (`dev` | `prod`).
+ * env-selected category (`dev` | `prod`). Tallies SQL upserts and `kv.set`.
  */
 
 import { resolve } from "node:path";
-import { isCancel, text } from "@clack/prompts";
+import { intro, isCancel, outro, text } from "@clack/prompts";
 import type { ConfigEnv, OkeConfig } from "../config/index.ts";
 import {
   normalizeSeedFns,
@@ -25,11 +25,13 @@ import { EXIT_OK, EXIT_RUNTIME, EXIT_USAGE } from "./exit.ts";
 import { loadOkeConfig } from "./load-config.ts";
 import { resolveDevSqlEnv } from "./resolve-dev-sql-env.ts";
 
-/** Per-function upsert outcome counts. */
+/** Per-function upsert / KV-set outcome counts. */
 export interface SeedTally {
   upserted: number;
   changed: number;
   alreadyExisted: number;
+  /** `fx.store(kv).set` calls (cache or durable). */
+  keys: number;
 }
 
 /** Options for {@link runSeed}. */
@@ -56,6 +58,11 @@ export interface SeedOptions {
    */
   readonly confirmEnv?: (env: ConfigEnv, target: string) => Promise<boolean>;
   readonly stdinIsTTY?: boolean;
+  /**
+   * Clack `intro` / `outro` for the standalone `oke db seed` path.
+   * Default: on when stdin is a TTY.
+   */
+  readonly intro?: boolean;
 }
 
 /**
@@ -127,12 +134,13 @@ export async function runSeedFns(
 ): Promise<void> {
   for (let i = 0; i < fns.length; i++) {
     const fn = fns[i]!;
-    const tally: SeedTally = { upserted: 0, changed: 0, alreadyExisted: 0 };
+    const tally: SeedTally = { upserted: 0, changed: 0, alreadyExisted: 0, keys: 0 };
     const instrumented = instrumentFxUpserts(fx, tally);
     await fn(instrumented);
     const label = fn.name.length > 0 ? fn.name : String(i);
+    const kv = tally.keys > 0 ? ` · keys ${tally.keys}` : "";
     write(
-      `oke db seed: ${category} ${label} — upserted ${tally.upserted} · changed ${tally.changed} · already-existed ${tally.alreadyExisted}\n`,
+      `oke db seed: ${category} ${label} — upserted ${tally.upserted} · changed ${tally.changed} · already-existed ${tally.alreadyExisted}${kv}\n`,
     );
   }
 }
@@ -233,7 +241,13 @@ export async function bootSeedFx(
   if (!app) {
     throw new Error(`oke db seed: no oke() app export in ${entryAbs}`);
   }
-  await app.boot({ env, startScheduler: false, config: config ?? undefined, rootDir: cwd });
+  await app.boot({
+    env,
+    startScheduler: false,
+    config: config ?? undefined,
+    rootDir: cwd,
+    docker: process.env.OKE_DOCKER === "1",
+  });
   const storeRuntime = app.elements?.store ?? app.bootResult?.store;
   if (!storeRuntime) {
     throw new Error(
@@ -243,6 +257,7 @@ export async function bootSeedFx(
   const fx = createFx({
     flow: "oke.db.seed",
     storeRuntime,
+    rlsBypass: true,
   });
   return {
     fx,
@@ -262,6 +277,14 @@ export async function runSeed(options: SeedOptions = {}): Promise<number> {
   const cwd = options.cwd ?? process.cwd();
   const loaded = await loadOkeConfig(cwd).catch(() => null);
   const env = options.env ?? (await resolveDevSqlEnv(cwd));
+  const tty = options.stdinIsTTY ?? Boolean(process.stdin.isTTY);
+  const useIntro = options.intro !== false && tty;
+  if (useIntro) intro("oke db seed");
+
+  const finish = (code: number, message: string): number => {
+    if (useIntro) outro(message);
+    return code;
+  };
 
   let targetLabel = String(env);
   try {
@@ -274,7 +297,6 @@ export async function runSeed(options: SeedOptions = {}): Promise<number> {
 
   if (env === "dev" || env === "prod") {
     if (options.force !== true) {
-      const tty = options.stdinIsTTY ?? Boolean(process.stdin.isTTY);
       const confirm =
         options.confirmEnv ??
         (tty
@@ -288,7 +310,7 @@ export async function runSeed(options: SeedOptions = {}): Promise<number> {
       const ok = await confirm(env, targetLabel);
       if (!ok) {
         write("oke db seed: cancelled\n");
-        return EXIT_USAGE;
+        return finish(EXIT_USAGE, "Cancelled.");
       }
     }
   }
@@ -308,10 +330,10 @@ export async function runSeed(options: SeedOptions = {}): Promise<number> {
     stop = session.stop;
     await executeSeedDef(def, env, session.fx, write);
     write("oke db seed: ok\n");
-    return EXIT_OK;
+    return finish(EXIT_OK, "oke db seed: ok");
   } catch (err) {
     write(`oke db seed: ${err instanceof Error ? err.message : String(err)}\n`);
-    return EXIT_RUNTIME;
+    return finish(EXIT_RUNTIME, "oke db seed: failed");
   } finally {
     if (stop) await stop().catch(() => {});
   }
@@ -374,14 +396,18 @@ function instrumentFxUpserts(fx: Fx, tally: SeedTally): Fx {
 
 function instrumentUpsertHandle<T>(handle: T, tally: SeedTally): T {
   if (!handle || typeof handle !== "object") return handle;
-  const h = handle as { upsert?: (...args: unknown[]) => Promise<{ status: UpsertStatus }> };
-  if (typeof h.upsert !== "function") return handle;
-  const orig = h.upsert.bind(h);
+  const h = handle as {
+    upsert?: (...args: unknown[]) => Promise<{ status: UpsertStatus }>;
+    set?: (...args: unknown[]) => Promise<unknown>;
+  };
+  const origUpsert = typeof h.upsert === "function" ? h.upsert.bind(h) : undefined;
+  const origSet = typeof h.set === "function" ? h.set.bind(h) : undefined;
+  if (!origUpsert && !origSet) return handle;
   return new Proxy(handle as object, {
     get(target, prop, receiver) {
-      if (prop === "upsert") {
+      if (prop === "upsert" && origUpsert) {
         return async (...args: unknown[]) => {
-          const result = await orig(...args);
+          const result = await origUpsert(...args);
           const status =
             result && typeof result === "object" && "status" in result
               ? (result as { status: UpsertStatus }).status
@@ -392,6 +418,13 @@ function instrumentUpsertHandle<T>(handle: T, tally: SeedTally): T {
           return result;
         };
       }
+      if (prop === "set" && origSet) {
+        return async (...args: unknown[]) => {
+          const result = await origSet(...args);
+          tally.keys += 1;
+          return result;
+        };
+      }
       return Reflect.get(target, prop, receiver);
     },
   }) as T;

package/src/cli/db.test.ts

@@ -11,9 +11,11 @@ import { createFx } from "../kernel/fx.ts";
 import { defineSeed, type SeedFn } from "../elements/store/seed.ts";
 import { EXIT_OK, EXIT_RUNTIME, EXIT_USAGE } from "./exit.ts";
 import {
+  createHintsForRenameOrCreate,
   dbCli,
   emitAbstractSchemaPrestep,
   executeSeedDef,
+  formatKitError,
   runSeedFns,
   runDb,
   runGenerate,
@@ -116,6 +118,13 @@ describe("oke db", () => {
     expect(out.join("")).toContain("0001_init.sql");
   });
 
+  test("formatKitError joins code message and sql", () => {
+    expect(formatKitError({ code: "query_error", message: "boom", sql: "CREATE TABLE t" })).toBe(
+      " — query_error — boom — CREATE TABLE t",
+    );
+    expect(formatKitError(undefined)).toBe("");
+  });
+
   test("missing_hints exits runtime", async () => {
     const out: string[] = [];
     const code = await runDb("push", {
@@ -131,6 +140,75 @@ describe("oke db", () => {
     expect(out.join("")).toContain("DROP TABLE leftover");
   });
 
+  test("createHintsForRenameOrCreate maps rename_or_create only", () => {
+    expect(
+      createHintsForRenameOrCreate([
+        { type: "rename_or_create", kind: "table", entity: ["public", "activity"] },
+        {
+          type: "confirm_data_loss",
+          kind: "table",
+          entity: ["public", "old"],
+          reason: "non_empty",
+        },
+      ]),
+    ).toEqual([{ type: "create", kind: "table", entity: ["public", "activity"] }]);
+  });
+
+  test("push retries rename_or_create as create", async () => {
+    const hints: unknown[] = [];
+    const out: string[] = [];
+    const code = await runPush("/tmp/drizzle.config.ts", (t) => out.push(t), {
+      skipEmit: true,
+      pushFn: async (opts) => {
+        hints.push(opts.hints);
+        if (!opts.hints) {
+          return {
+            status: "missing_hints",
+            unresolved: [{ type: "rename_or_create", kind: "table", entity: ["public", "notes"] }],
+          };
+        }
+        return { status: "ok" };
+      },
+    });
+    expect(code).toBe(EXIT_OK);
+    expect(hints[1]).toEqual([{ type: "create", kind: "table", entity: ["public", "notes"] }]);
+    expect(out.join("")).toContain("creating 1 new object");
+    expect(out.join("")).toContain("oke db push: ok");
+  });
+
+  test("push does not retry confirm_data_loss-only missing_hints", async () => {
+    let calls = 0;
+    const code = await runPush("/tmp/drizzle.config.ts", () => {}, {
+      skipEmit: true,
+      pushFn: async () => {
+        calls += 1;
+        return {
+          status: "missing_hints",
+          unresolved: [{ type: "confirm_data_loss", kind: "table", entity: ["public", "notes"] }],
+        };
+      },
+    });
+    expect(code).toBe(EXIT_RUNTIME);
+    expect(calls).toBe(1);
+  });
+
+  test("explain does not auto-create on missing_hints", async () => {
+    let calls = 0;
+    const code = await runPush("/tmp/drizzle.config.ts", () => {}, {
+      skipEmit: true,
+      explain: true,
+      pushFn: async () => {
+        calls += 1;
+        return {
+          status: "missing_hints",
+          unresolved: [{ type: "rename_or_create", kind: "table", entity: ["public", "notes"] }],
+        };
+      },
+    });
+    expect(code).toBe(EXIT_RUNTIME);
+    expect(calls).toBe(1);
+  });
+
   test("resolveDrizzleConfigPath uses db.config from oke.config", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-db-"));
     await writeFile(
@@ -551,6 +629,32 @@ describe("oke db seed", () => {
     expect(out.join("")).toContain("dev volume — upserted 0 · changed 1 · already-existed 0");
   });
 
+  test("runSeedFns tallies kv.set as keys", async () => {
+    const out: string[] = [];
+    const fx = {
+      store: () => ({
+        set: async () => undefined,
+      }),
+    } as unknown as ReturnType<typeof createFx>;
+    await runSeedFns(
+      "dev",
+      [
+        async function volume(seedFx) {
+          const kv = seedFx.store("kv" as never) as unknown as {
+            set: (key: string, value: unknown) => Promise<void>;
+          };
+          await kv.set("ENG-12", { title: "SSO" });
+          await kv.set("ENG-14", { title: "Polish" });
+        },
+      ],
+      fx,
+      (t) => out.push(t),
+    );
+    expect(out.join("")).toContain(
+      "dev volume — upserted 0 · changed 0 · already-existed 0 · keys 2",
+    );
+  });
+
   test("executeSeedDef is the category source of truth", async () => {
     const order: string[] = [];
     const out: string[] = [];

package/src/cli/db.ts

@@ -8,6 +8,7 @@
  */
 
 import { resolve } from "node:path";
+import type { Hint as DrizzleKitHint } from "drizzle-kit/cli";
 import {
   dialectFromDriverId,
   maybeEmitDomainSchema,
@@ -17,6 +18,7 @@ import { loadPluginTablesFromAppEntry } from "../elements/store/load-plugin-tabl
 import { resolveDriverId, type ConfigEnv, type OkeConfig } from "../config/index.ts";
 import type { TableContribution } from "../kernel/plugin.ts";
 import { runSeed, type SeedOptions } from "./db-seed.ts";
+import { installOkeRlsHelpers as runOkeRlsHelperStatements } from "../drivers/pg-rls.ts";
 import { resolveDrizzleKitEnv } from "./drizzle-env.ts";
 import { resolveDevSqlEnv } from "./resolve-dev-sql-env.ts";
 import { EXIT_OK, EXIT_RUNTIME, EXIT_USAGE } from "./exit.ts";
@@ -90,7 +92,10 @@ export interface DbOptions {
   readonly config?: string;
   readonly write?: (text: string) => void;
   /** Injectable push (tests). */
-  readonly pushFn?: (opts: { config: string }) => Promise<DbKitResult>;
+  readonly pushFn?: (opts: {
+    config: string;
+    hints?: readonly DbKitHint[];
+  }) => Promise<DbKitResult>;
   /** Injectable generate (tests). */
   readonly generateFn?: (opts: {
     config: string;
@@ -129,13 +134,61 @@ export interface DbOptions {
   readonly stdinIsTTY?: boolean;
 }
 
+/** drizzle-kit SDK hint — create vs rename vs confirm data loss. */
+export type DbKitHint =
+  | {
+      readonly type: "create";
+      readonly kind: string;
+      readonly entity: readonly string[];
+    }
+  | {
+      readonly type: "rename";
+      readonly kind: string;
+      readonly from: readonly string[];
+      readonly to: readonly string[];
+    }
+  | {
+      readonly type: "confirm_data_loss";
+      readonly kind: string;
+      readonly entity: readonly string[];
+    };
+
 /** Minimal drizzle-kit envelope we handle. */
 export interface DbKitResult {
   readonly status: "ok" | "no_changes" | "missing_hints" | "error" | string;
-  readonly error?: { readonly code?: string; readonly message?: string };
+  readonly error?: {
+    readonly code?: string;
+    readonly message?: string;
+    readonly sql?: string;
+  };
   readonly unresolved?: readonly unknown[];
 }
 
+/**
+ * Auto-resolve drizzle-kit `rename_or_create` as create (dev push).
+ * Leaves `confirm_data_loss` for the caller to fail on.
+ *
+ * @param unresolved - Kit `missing_hints` payload
+ */
+export function createHintsForRenameOrCreate(
+  unresolved: readonly unknown[] | undefined,
+): DbKitHint[] {
+  const hints: DbKitHint[] = [];
+  if (!unresolved) return hints;
+  for (const item of unresolved) {
+    if (!item || typeof item !== "object") continue;
+    const rec = item as Record<string, unknown>;
+    if (rec.type !== "rename_or_create") continue;
+    if (typeof rec.kind !== "string" || !Array.isArray(rec.entity)) continue;
+    hints.push({
+      type: "create",
+      kind: rec.kind,
+      entity: rec.entity.map((part) => String(part)),
+    });
+  }
+  return hints;
+}
+
 /**
  * Resolve the drizzle config path for a project.
  *
@@ -295,19 +348,30 @@ export async function runPush(
 
   const pushFn =
     options.pushFn ??
-    (async (opts: { config: string }) => {
+    (async (opts: { config: string; hints?: readonly DbKitHint[] }) => {
       const { push } = await import("drizzle-kit/cli");
       return (await push({
         config: opts.config,
         ...(options.explain ? { explain: true } : {}),
+        ...(opts.hints && opts.hints.length > 0
+          ? { hints: [...opts.hints] as DrizzleKitHint[] }
+          : {}),
       })) as DbKitResult;
     });
 
   let result: DbKitResult;
   try {
-    result = await withDrizzleKitEnv(cwd, loaded?.config, env, () =>
-      pushFn({ config: configPath }),
-    );
+    result = await withDrizzleKitEnv(cwd, loaded?.config, env, async () => {
+      await installOkeRlsHelpers(write);
+      const first = await pushFn({ config: configPath });
+      if (options.explain || first.status !== "missing_hints") return first;
+      const createHints = createHintsForRenameOrCreate(first.unresolved);
+      if (createHints.length === 0) return first;
+      write(
+        `oke db push: creating ${createHints.length} new ${createHints.length === 1 ? "object" : "objects"}\n`,
+      );
+      return pushFn({ config: configPath, hints: createHints });
+    });
   } catch (err) {
     write(`oke db push: ${err instanceof Error ? err.message : String(err)}\n`);
     write("         → install drizzle-kit and ensure drizzle.config.ts exists\n");
@@ -402,7 +466,9 @@ export async function runMigrate(
     });
 
   const { overlay } = await resolveDrizzleKitEnv(cwd, loaded?.config, env);
+  const restore = applyDrizzleEnvOverlay(overlay);
   try {
+    await installOkeRlsHelpers(write);
     const code = await migrateFn({
       config: configPath,
       cwd,
@@ -417,6 +483,8 @@ export async function runMigrate(
   } catch (err) {
     write(`oke db migrate: ${err instanceof Error ? err.message : String(err)}\n`);
     return EXIT_RUNTIME;
+  } finally {
+    restore();
   }
 }
 
@@ -523,7 +591,7 @@ Not the same as \`oke schema generate\` (core/plugin stub tables).
   push       Apply schema to the live local DB (dev; no migration files)
   generate   Write versioned SQL under drizzle/ for review
   migrate    Apply generated migrations (explicit; never automatic in prod)
-  seed       Run defineSeed (essential + env category); never at boot
+  seed       Run defineSeed (essential + env category) — standard CLI path
   studio     Open drizzle-kit Studio (long-running)
 
   --env      Override config env (dev|test|prod)
@@ -571,6 +639,39 @@ Not the same as \`oke schema generate\` (core/plugin stub tables).
   return runDb(sub, { config, env, force, entry });
 }
 
+/**
+ * Install `oke.gate()` / `oke.user()` / `oke.has_scope()` before drizzle-kit
+ * so `CREATE POLICY … oke.gate()` succeeds.
+ *
+ * @param write - Output
+ */
+async function installOkeRlsHelpers(write: (text: string) => void): Promise<void> {
+  const url = process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL;
+  const pgliteUrl = process.env.OKE_PGLITE_URL;
+  try {
+    if (pgliteUrl && !url) {
+      const { connectPglite } = await import("../drivers/pglite.ts");
+      const conn = await connectPglite({ url: pgliteUrl });
+      try {
+        await runOkeRlsHelperStatements((sql) => conn.exec(sql));
+      } finally {
+        await conn.close();
+      }
+      return;
+    }
+    if (!url) return;
+    const { connectPostgres } = await import("../drivers/postgres.ts");
+    const conn = await connectPostgres({ url });
+    try {
+      await runOkeRlsHelperStatements((sql) => conn.exec(sql));
+    } finally {
+      await conn.close();
+    }
+  } catch (err) {
+    write(`oke db: oke.* helpers skipped — ${err instanceof Error ? err.message : String(err)}\n`);
+  }
+}
+
 function parseConfigEnv(value: string | undefined): ConfigEnv | undefined {
   if (value === "dev" || value === "test" || value === "prod") return value;
   // Soft-compat for older CLI flags / docs.
@@ -616,8 +717,19 @@ function reportKitResult(verb: string, result: DbKitResult, write: (text: string
     if (detail) write(detail);
     return EXIT_RUNTIME;
   }
-  write(
-    `oke db ${verb}: ${result.status}${result.error?.message ? ` — ${result.error.message}` : ""}\n`,
-  );
+  write(`oke db ${verb}: ${result.status}${formatKitError(result.error)}\n`);
   return EXIT_RUNTIME;
 }
+
+/**
+ * Format a drizzle-kit `error` object for the CLI line.
+ *
+ * @param error - Kit envelope error
+ */
+export function formatKitError(error: DbKitResult["error"] | undefined): string {
+  if (!error) return "";
+  const parts = [error.code, error.message, error.sql].filter(
+    (part): part is string => typeof part === "string" && part.length > 0,
+  );
+  return parts.length > 0 ? ` — ${parts.join(" — ")}` : "";
+}

package/src/cli/dev-controls.test.ts

@@ -14,6 +14,7 @@ describe("dev-controls", () => {
     expect(parseDevControlKey("?")).toBe("?");
     expect(parseDevControlKey("h")).toBe("?");
     expect(parseDevControlKey("r")).toBe("r");
+    expect(parseDevControlKey("s")).toBe("s");
     expect(parseDevControlKey("u")).toBe("u");
     expect(parseDevControlKey("x")).toBe("x");
     expect(parseDevControlKey("c")).toBeNull();
@@ -33,6 +34,9 @@ describe("dev-controls", () => {
     expect(formatDevControlsHint(false)).toContain("quit");
     expect(formatDevControlsHint(false)).not.toContain("services");
     expect(formatDevControlsHelp(false)).toContain("refresh");
+    expect(formatDevControlsHint(false)).toContain("seed");
+    expect(formatDevControlsHint(false)).not.toContain("restart");
+    expect(formatDevControlsHelp(false)).toContain("oke db seed");
     expect(formatDevControlsHelp(false)).not.toContain("select service");
   });
 
@@ -77,6 +81,22 @@ describe("dev-controls", () => {
     d.stop();
   });
 
+  test("dispatcher s runs onSeed", async () => {
+    let seeded = 0;
+    const d = createDevControlDispatcher({
+      write: () => {},
+      onQuit: () => {},
+      onSeed: () => {
+        seeded += 1;
+      },
+      composeAction: async () => {},
+    });
+    d.handleKey("s");
+    await Bun.sleep(10);
+    expect(seeded).toBe(1);
+    d.stop();
+  });
+
   test("busy compose action ignores a concurrent key press", async () => {
     let running = 0;
     let maxConcurrent = 0;

package/src/cli/dev-controls.ts

@@ -30,6 +30,10 @@ export type StartDevControlsOptions = {
    * After a compose up/stop — sync health into the board.
    */
   readonly onComposeSettled?: () => void | Promise<void>;
+  /**
+   * Run `oke db seed` (tests / non-Ink dispatcher).
+   */
+  readonly onSeed?: () => void | Promise<void>;
   /**
    * Run a compose control action against the whole stack.
    *
@@ -50,6 +54,7 @@ export function formatDevControlsHint(color: boolean = termColorEnabled()): stri
     `${s.dim}│${s.reset}  ${s.dim}keys${s.reset}  ` +
     `${s.cyan}?${s.reset} help · ` +
     `${s.cyan}r${s.reset} refresh · ` +
+    `${s.cyan}s${s.reset} seed · ` +
     `${s.cyan}q${s.reset} quit · ` +
     `${s.cyan}u${s.reset} up · ` +
     `${s.cyan}x${s.reset} stop` +
@@ -72,6 +77,7 @@ export function formatDevControlsHelp(color: boolean = termColorEnabled()): stri
     `${s.green}◇${s.reset}  ${s.bold}Keys${s.reset}`,
     k("?", "help"),
     k("r", "refresh — clear logs, show latest ●"),
+    k("s", "oke db seed"),
     k("q", "quit oke dev"),
     k("u", "compose up -d (all)"),
     k("x", "compose stop (all)"),
@@ -140,6 +146,13 @@ export function createDevControlDispatcher(opts: StartDevControlsOptions): DevCo
         void Promise.resolve(opts.onShowPanel?.(body) ?? opts.write(body));
         return;
       }
+      if (key === "s") {
+        void Promise.resolve(opts.onSeed?.()).catch((err: unknown) => {
+          const msg = err instanceof Error ? err.message : String(err);
+          opts.write(formatStatusLine(`seed failed — ${msg}`, color, "error"));
+        });
+        return;
+      }
       if (key === "u" || key === "x") {
         void runAction(key === "u" ? "up" : "stop");
       }

package/src/cli/dev.test.ts

@@ -19,7 +19,7 @@ import type { Manifest } from "../manifest/types.ts";
 import type { WideEvent } from "../runs/types.ts";
 import { isDataEnvelope, MCP_DATA_KIND } from "../mcp/data.ts";
 import { mintMcpSession } from "../mcp/session.ts";
-import { runDev, type DevOptions, type DevSession } from "./dev.ts";
+import { isFlowsTreeWatchPath, runDev, type DevOptions, type DevSession } from "./dev.ts";
 import { mcpContextFromConsole } from "./mcp-from-console.ts";
 
 /** Repo public entry — absolute import so temp apps need no install. */
@@ -519,11 +519,11 @@ async function writePingApp(dir: string, version: string): Promise<void> {
     join(dir, "src/flows/ping.ts"),
     `import { on, flow, http, gate } from ${JSON.stringify(OKE_INDEX)};
 
-export const ping = on(http.get("/ping").gate.public, flow("ping", {
+export const ping = on(http.get("/ping").public(), flow("ping", {
   do: () => ({ version: ${JSON.stringify(version)} as const }),
 }));
 
-export const slow = on(http.get("/slow").gate.public, flow("slow", {
+export const slow = on(http.get("/slow").public(), flow("slow", {
   do: async () => {
     const started = ${JSON.stringify(version)};
     await Bun.sleep(800);
@@ -725,7 +725,8 @@ describe("oke dev syncAdoptBarrel atomic write", () => {
 
     const barrelPath = join(dir, "src/flows", ADOPT_BARREL_FILE);
     const text = await Bun.file(barrelPath).text();
-    expect(text).toContain('export * as notes from "./notes/index.ts";');
+    expect(text).toContain('import * as notes from "./notes/index.ts";');
+    expect(text).toContain("export { notes }");
     expect(text).not.toContain("stale stub");
     expect(await Bun.file(`${barrelPath}.tmp`).exists()).toBe(false);
     const leftovers = (await readdir(join(dir, "src/flows"))).filter((f) => f.includes(".tmp"));
@@ -789,6 +790,16 @@ describe("oke dev syncAdoptBarrel atomic write", () => {
   });
 });
 
+describe("isFlowsTreeWatchPath", () => {
+  test("flows tree files trigger regen; generated.ts does not", () => {
+    expect(isFlowsTreeWatchPath("flows/notes/[id]/get.ts")).toBe(true);
+    expect(isFlowsTreeWatchPath("flows\\notes\\list.ts")).toBe(true);
+    expect(isFlowsTreeWatchPath("flows/generated.ts")).toBe(false);
+    expect(isFlowsTreeWatchPath("flows/generated.ts.tmp")).toBe(false);
+    expect(isFlowsTreeWatchPath("core.ts")).toBe(false);
+  });
+});
+
 describe("oke dev Docker-first", () => {
   test("dryRun always plans compose (no mode ask)", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-dev-always-compose-"));