okengine 0.14.1 → 0.15.2

package/src/elements/store.ts

@@ -26,6 +26,11 @@ export {
   schema,
   schemaTable,
   schemaRelations,
+  schemaRls,
+  schemaPolicy,
+  schemaPolicyGate,
+  schemaPolicyOwner,
+  schemaPolicyScope,
   isSchemaTableDecl,
   isSchemaColumnDecl,
   isSchemaRelationsDecl,
@@ -43,6 +48,8 @@ export type {
   SchemaTableDecl,
   SchemaTableWithColumns,
   SchemaRelationsDecl,
+  SchemaPolicyDecl,
+  SchemaTableExtra,
   SchemaRelationEntry,
   SchemaRelationOne,
   SchemaRelationMany,
@@ -123,6 +130,13 @@ export type {
   WhereMap,
 } from "./store/sql-session.ts";
 
+export {
+  resolveRlsIdentity,
+  rlsIdentityFromAuth,
+  firstPolicyOrPublic,
+  policyGateForScopes,
+} from "./store/rls-identity.ts";
+export type { RlsIdentityRow, ResolveRlsIdentityInput } from "./store/rls-identity.ts";
 export { createStoreRuntime, putTier2 } from "./store/runtime.ts";
 export type {
   StoreRuntime,

package/src/http.ts

@@ -8,7 +8,7 @@
  * ```ts
  * import { on, flow, http, gate, oke, createBunRuntime } from "okengine/http";
  *
- * on(http.get("/").gate.public, flow("ping", { do: () => "Hi" }));
+ * on(http.get("/").public(), flow("ping", { do: () => "Hi" }));
  * const app = oke({ name: "ping" });
  * createBunRuntime().serve(app);
  * ```
@@ -24,15 +24,32 @@ export { fail, type FlowFailure } from "./kernel/errors.ts";
 export { isFlowFailure } from "./kernel/hooks.ts";
 export { plugin, isPlugin, type PluginDef } from "./kernel/plugin.ts";
 export { createBunRuntime, APP_PORT, type Runtime, type ServeOptions } from "./runtime/index.ts";
-export type { OkeApp, OkeOptions, ReadyState } from "./kernel/app.ts";
+export type {
+  OkeApp,
+  OkeOptions,
+  ReadyState,
+  RegisteredFlowUnits,
+  RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
+export { registerFlowUnits } from "./kernel/flow-units.ts";
+export { stampFlowName, stampHttpPath } from "./kernel/stamp-http.ts";
 
-import { oke as okeCore, type OkeApp, type OkeOptions } from "./kernel/app.ts";
+import {
+  oke as okeCore,
+  type OkeApp,
+  type OkeOptions,
+  type RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
 
 /**
  * Create an HTTP-oriented app — defaults `router` to `"edge"` when omitted.
  *
  * @param options - Application options
  */
+export function oke(
+  options: OkeOptions & { readonly registry: "ignore" },
+): OkeApp<Record<string, never>, Record<string, never>>;
+export function oke(options: OkeOptions): OkeApp<{}, RoutesFromRegisteredUnits>;
 export function oke(options: OkeOptions): OkeApp {
   return okeCore({
     ...options,

package/src/index.ts

@@ -14,10 +14,19 @@
  * @module
  */
 
-export { oke, type OkeApp, type OkeOptions, type ReadyState } from "./kernel/app.ts";
+export {
+  oke,
+  type OkeApp,
+  type OkeOptions,
+  type ReadyState,
+  type RegisteredFlowUnits,
+  type RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
 export { on, type Binding } from "./kernel/on.ts";
 export { flow, isFlow, type FlowDef } from "./kernel/flow.ts";
 export { http, every, internal, table } from "./kernel/triggers.ts";
+export { registerFlowUnits } from "./kernel/flow-units.ts";
+export { stampFlowName, stampHttpPath } from "./kernel/stamp-http.ts";
 export { fail, type FlowFailure, type FlowErrorValue } from "./kernel/errors.ts";
 export { isFlowFailure } from "./kernel/hooks.ts";
 export { plugin, isPlugin, type PluginDef, type PluginCapabilities } from "./kernel/plugin.ts";

package/src/kernel/adopt-barrel-fresh.test.ts

@@ -89,7 +89,7 @@ describe("boot-level: stale barrel through a real oke() boot", () => {
         effects: {},
         do: () => ({ ok: true as const }),
       });
-      on(http.get("/health").gate.public, mainFlow);
+      on(http.get("/health").public(), mainFlow);
       const app = oke({ name: "stale-barrel", gate: { unguardedHttp: "allow" } });
 
       await expect(

package/src/kernel/adopt-routes.ts

@@ -39,10 +39,20 @@ export type AppFlowRoute<
       readonly path?: undefined;
     };
 
-/** Unit → flow → contract. */
+/**
+ * Unit → flow → contract. Leaf is the HTTP / call-only union — do not
+ * index with `AppFlowRoute<any, any, any, any, any>` (`any extends string`
+ * makes `method`/`path` required and rejects cron / signal flows).
+ */
 export type AppRouteMap = {
   readonly [unit: string]: {
-    readonly [flow: string]: AppFlowRoute<any, any, any, any, any>;
+    readonly [flow: string]: {
+      readonly in?: unknown;
+      readonly out?: unknown;
+      readonly errors?: unknown;
+      readonly method?: string;
+      readonly path?: string;
+    };
   };
 };
 
@@ -170,6 +180,7 @@ export function accumulateAdoptArgs(args: readonly unknown[], into: RuntimeRoute
       const unitBag = into[unit] ?? (into[unit] = {});
       for (const [flowName, flowDef] of Object.entries(value as Record<string, unknown>)) {
         if (!isFlow(flowDef)) continue;
+        stampAdoptedFlow(flowDef, unit, flowName);
         found.push(flowDef);
         unitBag[flowName] = runtimeRouteFromFlow(flowDef);
       }
@@ -178,3 +189,20 @@ export function accumulateAdoptArgs(args: readonly unknown[], into: RuntimeRoute
 
   return found;
 }
+
+/**
+ * Stamp `unit.export` on nameless flows — same rule as {@link unit}.
+ *
+ * @param flowDef - Flow to stamp
+ * @param unit - Client unit (folder / adopt key)
+ * @param exportName - Namespace export
+ */
+function stampAdoptedFlow(flowDef: AnyFlowDef, unit: string, exportName: string): void {
+  const f = flowDef as { name: string; unit: string | undefined };
+  if (!f.name || f.name.startsWith("flow_")) {
+    f.name = `${unit}.${exportName}`;
+  }
+  if (!f.unit) {
+    f.unit = unit;
+  }
+}

package/src/kernel/app.ts

@@ -14,6 +14,7 @@ import {
   accumulateAdoptArgs,
   type AppRouteMap,
   type RoutesFromAdoptArgs,
+  type RoutesFromNamespace,
   type RuntimeRouteMap,
 } from "./adopt-routes.ts";
 // `./boot.ts` pulls in every element + driver module (vault, store, signal,
@@ -59,7 +60,8 @@ import {
 } from "../runtime/dev-request-log.ts";
 import { asBrowserJsonCodeBlock, httpNavGroups } from "../runtime/json-code-block.ts";
 import { resolveDurationMs } from "./elapsed.ts";
-import { fail } from "./errors.ts";
+import { fail, throwOke } from "./errors.ts";
+import { consumeRegisteredFlowUnits, type FlowUnitBag } from "./flow-units.ts";
 import {
   isFlowFailure,
   mergeHooks,
@@ -91,6 +93,8 @@ import {
   aiModelRegistry,
   aiPromptRegistry,
   channelTemplateRegistry,
+  clockRegistry,
+  gateRegistry,
   requiredEnvRegistry,
   secretRegistry,
   signalRegistry,
@@ -99,6 +103,7 @@ import {
 import {
   applyPrincipal,
   createElementPipelineHooks,
+  gateNamesOf,
   type PrincipalBag,
   type ResolvedPrincipal,
 } from "./pipeline.ts";
@@ -118,6 +123,7 @@ import {
   type RouterPreset,
   type SmartRouter,
 } from "./router.ts";
+import { isPendingHttpPath } from "./http-path-pending.ts";
 import type {
   CdcTrigger,
   EveryTrigger,
@@ -299,6 +305,21 @@ export interface UnitHooks<D extends Record<string, unknown> = {}> {
   plug<P extends PluginDef>(pluginDef: P): UnitHooks<AccumulateDecorations<D, P>>;
 }
 
+/**
+ * Module-augmentation slot filled by `src/flows/generated.ts`.
+ * Kernel tests do not import an app generated file, so this stays `{}`.
+ */
+export interface RegisteredFlowUnits {}
+
+/**
+ * `$routes` derived from {@link RegisteredFlowUnits} after `import generated`.
+ *
+ * @typeParam U - Augmented unit map
+ */
+export type RoutesFromRegisteredUnits<U = RegisteredFlowUnits> = {
+  [K in keyof U]: U[K] extends Record<string, unknown> ? RoutesFromNamespace<U[K]> : never;
+};
+
 /**
  * Application instance — adopts flows, routes HTTP, runs the pipeline.
  *
@@ -435,6 +456,8 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
        * Takes effect only with {@link trustedInvoke}.
        */
       readonly revealPii?: boolean;
+      /** Forced RLS bag (Console / Call API). Operator omit = no stamp. */
+      readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
       /** Parent WideEvent id when this execution was caused by another. */
       readonly parentId?: string;
       /** Explicit run / WideEvent id (defaults to a new UUID). */
@@ -562,11 +585,57 @@ function mergeAiOptions(
   };
 }
 
+/**
+ * Refuse an unresolved path sentinel or a nameless HTTP flow.
+ *
+ * @param binding - HTTP binding
+ */
+function assertHttpBindingReady(binding: Binding): void {
+  const trigger = binding.trigger;
+  if (trigger.kind !== "http") return;
+  if (isPendingHttpPath(trigger.path)) {
+    throwOke("HTTP_PATH_UNRESOLVED", {
+      flow: binding.flow.name || "(unnamed)",
+      method: trigger.method,
+    });
+  }
+  if (!binding.flow.name || binding.flow.name.startsWith("flow_")) {
+    throwOke("HTTP_FLOW_UNNAMED", {
+      method: trigger.method,
+      path: trigger.path,
+    });
+  }
+}
+
+/**
+ * Fold `generated.ts` units into `$routes` and `flowsByName`.
+ *
+ * @param units - Drained {@link registerFlowUnits} bag
+ * @param routes - Runtime `$routes`
+ * @param registerFlow - App flow index
+ */
+function drainGeneratedUnits(
+  units: Record<string, FlowUnitBag>,
+  routes: RuntimeRouteMap,
+  registerFlow: (flowDef: AnyFlowDef) => void,
+): void {
+  if (Object.keys(units).length === 0) return;
+  const flows = accumulateAdoptArgs([units], routes);
+  for (const flowDef of flows) {
+    registerFlow(flowDef);
+  }
+}
+
 /**
  * Create an application. Adopts bindings registered via {@link on}.
+ * Drains {@link registerFlowUnits} into `$routes` unless `registry: "ignore"`.
  *
  * @param options - App name and router preset
  */
+export function oke(
+  options: OkeOptions & { readonly registry: "ignore" },
+): OkeApp<Record<string, never>, Record<string, never>>;
+export function oke(options: OkeOptions): OkeApp<{}, RoutesFromRegisteredUnits>;
 export function oke(options: OkeOptions): OkeApp {
   const aot = options.aot !== false;
   const registry = options.registry ?? "consume";
@@ -576,11 +645,12 @@ export function oke(options: OkeOptions): OkeApp {
       : [...listBindings(), ...(options.bindings ?? [])];
   if (registry === "consume") resetBindings();
 
-  // Same registry mode drains store.sql/store.files, vault.secret, signal(),
-  // channel.<medium>().template(), and ai.model/prompt/embed/agent/mcpServer —
-  // module-evaluation registries that mirror `on`'s trigger drain
-  // (`listBindings`/`resetBindings` above). Explicit `options.stores` /
-  // `secrets` / `signals` / `channel.templates` / `ai` are additive, never
+  // Same registry mode drains store.*, vault.secret, signal(), clock(),
+  // gate.policy/scope/rate, channel.<medium>().template(), and
+  // ai.model/prompt/embed/agent/mcpServer — module-evaluation registries
+  // that mirror `on`'s trigger drain (`listBindings`/`resetBindings` above).
+  // Explicit `options.stores` / `secrets` / `signals` / `clocks` /
+  // `gate.policies` / `channel.templates` / `ai` are additive, never
   // silently ignored — deduped by reference so an explicitly-passed decl
   // that is also in the registry is not doubled.
   const registrySnapshot =
@@ -590,6 +660,8 @@ export function oke(options: OkeOptions): OkeApp {
           secrets: [],
           requiredEnv: [],
           signals: [],
+          clocks: [],
+          gates: [],
           channelTemplates: [],
           aiModels: [],
           aiPrompts: [],
@@ -602,6 +674,8 @@ export function oke(options: OkeOptions): OkeApp {
           secrets: secretRegistry.slice(),
           requiredEnv: requiredEnvRegistry.slice(),
           signals: signalRegistry.slice(),
+          clocks: clockRegistry.slice(),
+          gates: gateRegistry.slice(),
           channelTemplates: channelTemplateRegistry.slice(),
           aiModels: aiModelRegistry.slice(),
           aiPrompts: aiPromptRegistry.slice(),
@@ -614,6 +688,8 @@ export function oke(options: OkeOptions): OkeApp {
     secretRegistry.length = 0;
     requiredEnvRegistry.length = 0;
     signalRegistry.length = 0;
+    clockRegistry.length = 0;
+    gateRegistry.length = 0;
     channelTemplateRegistry.length = 0;
     aiModelRegistry.length = 0;
     aiPromptRegistry.length = 0;
@@ -624,6 +700,8 @@ export function oke(options: OkeOptions): OkeApp {
   const effectiveStores = mergeUnique(options.stores, registrySnapshot.stores);
   const effectiveSecrets = mergeUnique(options.secrets, registrySnapshot.secrets);
   const effectiveSignals = mergeUnique(options.signals, registrySnapshot.signals);
+  const effectiveClocks = mergeUnique(options.clocks, registrySnapshot.clocks);
+  const effectivePolicies = mergeUnique(options.gate?.policies, registrySnapshot.gates);
   /**
    * Fold registered `vault.env.required` names into the vault boot options so
    * boot reports missing env vars in the same gap list as missing secrets.
@@ -658,16 +736,23 @@ export function oke(options: OkeOptions): OkeApp {
 
   // Resolve Gate bag early so auth HTTP Bindings join `adopted` + the router
   // before posture audit (same ensureBoot → doBoot path — never a side channel).
+  const mergedGate: GateOptions | undefined =
+    effectivePolicies.length > 0 ? { ...options.gate, policies: effectivePolicies } : options.gate;
   const gateConfig: ResolvedGateConfig = resolveGateConfig({
-    gate: options.gate,
+    gate: mergedGate,
     env: options.env,
   });
 
-  /** Retained for test harness / boot merges (includes auto-drained AI decls). */
-  const $options: OkeOptions =
-    effectiveAi === undefined || options.ai === effectiveAi
-      ? options
-      : { ...options, ai: effectiveAi };
+  /** Retained for test harness / boot merges (includes auto-drained decls). */
+  const $options: OkeOptions = {
+    ...options,
+    ...(effectiveAi !== undefined ? { ai: effectiveAi } : {}),
+    ...(effectiveStores.length > 0 ? { stores: effectiveStores } : {}),
+    ...(effectiveSecrets.length > 0 ? { secrets: effectiveSecrets } : {}),
+    ...(effectiveSignals.length > 0 ? { signals: effectiveSignals } : {}),
+    ...(effectiveClocks.length > 0 ? { clocks: effectiveClocks } : {}),
+    ...(mergedGate !== undefined ? { gate: mergedGate } : {}),
+  };
 
   const appHooks: HookMap = {};
   const unitHooks = new Map<string, HookMap>();
@@ -701,8 +786,19 @@ export function oke(options: OkeOptions): OkeApp {
   }
 
   const smart = createRouter<Binding>(options.router ?? "default");
+  const seenHttpRoutes = new Set<string>();
   for (const b of adopted) {
     if (b.trigger.kind === "http") {
+      assertHttpBindingReady(b);
+      const key = `${b.trigger.method} ${b.trigger.path}`;
+      if (seenHttpRoutes.has(key)) {
+        throwOke("HTTP_ROUTE_DUPLICATE", {
+          method: b.trigger.method,
+          path: b.trigger.path,
+          flow: b.flow.name || "(unnamed)",
+        });
+      }
+      seenHttpRoutes.add(key);
       smart.add(b.trigger.method, b.trigger.path, b);
       compiled.set(b, compileHttpBinding(b, aot));
     }
@@ -715,6 +811,16 @@ export function oke(options: OkeOptions): OkeApp {
     adopted.push(b);
     registerFlow(b.flow);
     if (b.trigger.kind === "http") {
+      assertHttpBindingReady(b);
+      const key = `${b.trigger.method} ${b.trigger.path}`;
+      if (seenHttpRoutes.has(key)) {
+        throwOke("HTTP_ROUTE_DUPLICATE", {
+          method: b.trigger.method,
+          path: b.trigger.path,
+          flow: b.flow.name || "(unnamed)",
+        });
+      }
+      seenHttpRoutes.add(key);
       smart.add(b.trigger.method, b.trigger.path, b);
       compiled.set(b, compileHttpBinding(b, aot));
     }
@@ -788,6 +894,11 @@ export function oke(options: OkeOptions): OkeApp {
     registerFlow(b.flow);
   }
 
+  if (registry !== "ignore") {
+    const generatedUnits = consumeRegisteredFlowUnits();
+    drainGeneratedUnits(generatedUnits, routes, registerFlow);
+  }
+
   // --- boot (vault → store → signal → clock → channel → AI → runs → caps) ---
   let bootResult: BootResult | undefined;
   let bootPromise: Promise<BootResult> | undefined;
@@ -963,7 +1074,7 @@ export function oke(options: OkeOptions): OkeApp {
       vault: withRequiredEnv(overrides?.vault ?? options.vault),
       gates: [...baseGates, ...authGates],
       signals: overrides?.signals ?? effectiveSignals,
-      clocks: overrides?.clocks ?? options.clocks,
+      clocks: overrides?.clocks ?? effectiveClocks,
       stores: overrides?.stores ?? effectiveStores,
       channel: overrides?.channel ?? effectiveChannel,
       ai: overrides?.ai ?? effectiveAi,
@@ -1019,7 +1130,7 @@ export function oke(options: OkeOptions): OkeApp {
 
     const baseSecrets = overrides?.secrets ?? effectiveSecrets;
     const baseSignals = overrides?.signals ?? effectiveSignals;
-    const baseClocks = overrides?.clocks ?? options.clocks ?? [];
+    const baseClocks = overrides?.clocks ?? effectiveClocks;
     const baseChannel = overrides?.channel ?? effectiveChannel;
     const mergedCatalog = mergeTemplateCatalogs(baseChannel?.catalog, ...pluginChannelCatalogs);
 
@@ -1138,6 +1249,8 @@ export function oke(options: OkeOptions): OkeApp {
       readonly bypassGates?: boolean;
       /** Console Call API — cleartext store PII. Requires {@link trustedInvoke}. */
       readonly revealPii?: boolean;
+      /** Forced RLS bag (Console / Call API). Operator omit = no stamp. */
+      readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
       /** Frozen origin identity for {@link Fx.principal} across `fx.call`. */
       readonly originPrincipal?: FxPrincipal;
       /** Explicit locale override for {@link Fx.t} / channel sends. */
@@ -1189,6 +1302,7 @@ export function oke(options: OkeOptions): OkeApp {
       readonly trustedInvoke?: boolean;
       readonly bypassGates?: boolean;
       readonly revealPii?: boolean;
+      readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
       readonly originPrincipal?: FxPrincipal;
       readonly locale?: string;
       readonly parentId?: string;
@@ -1339,6 +1453,9 @@ export function oke(options: OkeOptions): OkeApp {
       ...(principals ? { auth: principals.auth as FxAuth, operator: principals.operator } : {}),
       ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(extras?.trustedInvoke === true && extras.revealPii === true ? { revealPii: true } : {}),
+      rlsGateNames: gateNamesOf(trigger),
+      rlsBypass: extras?.bypassGates === true || flowDef.plane === "operator",
+      ...(extras?.rls ? { rls: extras.rls } : {}),
       ...(capability ? { capability } : {}),
       ...(booted
         ? {

package/src/kernel/auto-cache.test.ts

@@ -44,7 +44,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         effects: { reads: ["sql:notes"] },
@@ -80,7 +80,7 @@ describe("automatic tier-1 cache from effects", () => {
     resetFlowSeq();
     const db = store.sql("app", { schema: { notes } });
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         effects: { reads: ["sql:notes"] },
@@ -115,7 +115,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         cache: false,
         effects: { reads: ["sql:notes"] },
@@ -146,7 +146,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         do: async (_input, fx) => {
@@ -191,7 +191,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         effects: { reads: ["sql:notes"] },
         do: () => {
@@ -201,7 +201,7 @@ describe("automatic tier-1 cache from effects", () => {
       }),
     );
     const create = on(
-      http.post("/notes").gate.public,
+      http.post("/notes").public(),
       flow("notes.create", {
         in: z.object({ title: z.string() }),
         effects: { writes: ["sql:notes"] },
@@ -231,7 +231,7 @@ describe("automatic tier-1 cache from effects", () => {
     const db = store.sql("app", { schema: { notes } });
     let lists = 0;
     const list = on(
-      http.get("/notes").gate.public,
+      http.get("/notes").public(),
       flow("notes.list", {
         out: z.array(NoteOut),
         do: async (_input, fx) => {
@@ -242,7 +242,7 @@ describe("automatic tier-1 cache from effects", () => {
       }),
     );
     const create = on(
-      http.post("/notes").gate.public,
+      http.post("/notes").public(),
       flow("notes.create", {
         in: z.object({ title: z.string() }),
         do: async (input, fx) => {

package/src/kernel/auto-registry.test.ts

@@ -1,17 +1,21 @@
 /**
- * `oke({...})` auto-populates `stores` / `secrets` / `signals` /
- * `channel.templates` from the same kind of module-evaluation registry
- * already proven for `on()`'s trigger drain (`registry-isolation.test.ts`).
+ * `oke({...})` auto-populates `stores` / `secrets` / `signals` / `clocks` /
+ * `gate.policies` / `channel.templates` from the same kind of
+ * module-evaluation registry already proven for `on()`'s trigger drain
+ * (`registry-isolation.test.ts`).
  *
- * `store.sql` / `store.files`, `vault.secret`, `signal()`, and medium-binder
- * `.template()` push into a shared registry (`src/kernel/element-registries.ts`)
- * at call time — zero change to how developers call them. `oke()` drains it
- * at construction under the same `registry: "consume" | "keep" | "ignore"`
- * switch that already governs bindings.
+ * `store.*`, `vault.secret`, `signal()`, `clock()`, `gate.policy` / `.scope`
+ * / `.rate`, and medium-binder `.template()` push into a shared registry
+ * (`src/kernel/element-registries.ts`) at call time — zero change to how
+ * developers call them. `oke()` drains it at construction under the same
+ * `registry: "consume" | "keep" | "ignore"` switch that already governs
+ * bindings.
  */
 
 import { describe, expect, test } from "bun:test";
 import { channel } from "../elements/channel/declare.ts";
+import { clock } from "../elements/clock/declare.ts";
+import { gate } from "../elements/gate/declare.ts";
 import { signal } from "../elements/signal/declare.ts";
 import { store } from "../elements/store/declare.ts";
 import { vault } from "../elements/vault/declare.ts";
@@ -20,7 +24,7 @@ import { flow } from "./flow.ts";
 import { on, resetBindings } from "./on.ts";
 import { http } from "./triggers.ts";
 
-describe("oke() auto-registry — stores/secrets/signals/channel.templates/ai", () => {
+describe("oke() auto-registry — stores/secrets/signals/clocks/gates/channel.templates/ai", () => {
   test("before/after: zero explicit arrays boots identically to the explicit-array form", async () => {
     resetBindings();
 
@@ -161,6 +165,42 @@ describe("oke() auto-registry — stores/secrets/signals/channel.templates/ai",
     expect(app.bootResult?.vault?.contracts.has("IGNORED_SECRET")).toBeFalsy();
   });
 
+  test("store.kv / store.index / clock() / gate.policy auto-drain — no explicit oke() arrays", async () => {
+    resetBindings();
+    store.kv("drafts", { description: "Compose drafts" });
+    store.index("tasks", { description: "Task search" });
+    clock("daily-digest", { cron: "0 8 * * *", every: "1d", timezone: "UTC" });
+    const member = gate.policy("member", ({ auth }) => !!auth.verified);
+    gate.scope("task:write");
+    gate.rate({ max: 60, per: "1m", keyBy: "user" });
+
+    const ping = flow("auto.ping", {
+      do: () => ({ ok: true as const }),
+    });
+    on(http.get("/auto-ping").gate(member), ping);
+
+    const app = oke({
+      name: "auto-kv-clock-gate",
+      autoBoot: false,
+      startScheduler: false,
+    });
+
+    expect(app.$options.stores?.some((s) => s.ref === "kv:drafts")).toBe(true);
+    expect(app.$options.stores?.some((s) => s.ref === "index:tasks")).toBe(true);
+    expect(app.$options.clocks?.some((c) => c.name === "daily-digest")).toBe(true);
+    expect(app.$options.gate?.policies?.some((g) => "name" in g && g.name === "member")).toBe(true);
+    expect(app.$options.gate?.policies?.some((g) => "name" in g && g.name === "task:write")).toBe(
+      true,
+    );
+
+    await app.boot({ env: "test" });
+    expect(app.bootResult?.store?.declarations.has("kv:drafts")).toBe(true);
+    expect(app.bootResult?.store?.declarations.has("index:tasks")).toBe(true);
+    expect(app.bootResult?.clock?.declarations.has("daily-digest")).toBe(true);
+    expect(app.bootResult?.gate?.gates.has("member")).toBe(true);
+    expect(app.bootResult?.gate?.gates.has("task:write")).toBe(true);
+  });
+
   test('registry: "consume" (default) drains stores/secrets/signals/channel.templates — a later app does not inherit them', async () => {
     store.sql("leak-app", { schema: {} });
     vault.secret("LEAK_SECRET", { dev: "dev-leak" });

package/src/kernel/boot.test.ts

@@ -116,9 +116,9 @@ describe("boot — lazy element needs", () => {
         if (raw.byteLength === 0) continue;
         total += Bun.gzipSync(new Uint8Array(raw)).byteLength;
       }
-      // Rebased after 0.12.0 store/http graph growth
-      // (~47.6 kB gzip with export externals).
-      expect(total).toBeLessThan(48_000);
+      // Rebased after clock / gate / kv / index auto-drain on `oke()`.
+      // (~48.3 kB gzip with export externals).
+      expect(total).toBeLessThan(49_000);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }
@@ -227,7 +227,7 @@ describe("boot — HTTP gate wiring on the default path", () => {
     resetBindings();
     resetFlowSeq();
     on(
-      http.get("/ping").gate.public,
+      http.get("/ping").public(),
       flow("ping-public", {
         do: () => ({ ok: true }),
       }),

package/src/kernel/boot.ts

@@ -101,10 +101,10 @@ export interface BootOptions {
   readonly gates?: readonly GateDecl[];
   /**
    * HTTP auth-posture enforcement at boot.
-   * - `"deny"` (default) — every HTTP trigger must carry a gate or `.gate.public`
+   * - `"deny"` (default) — every HTTP trigger must carry a gate or `.public()`
    * - `"allow"` — skips the audit **only** when {@link env} is `"test"`;
    *   ignored in local/prod/docker (never a production-wide bypass).
-   *   Migrate real apps with per-trigger `.gate.public`.
+   *   Migrate real apps with per-trigger `.public()`.
    */
   readonly unguardedHttp?: "deny" | "allow";
   /** Signal declarations. */