okengine 0.14.1 → 0.15.2

package/src/kernel/effects-stamping.test.ts

@@ -47,7 +47,7 @@ const CreateOut = z.object({ ok: z.boolean() });
 
 function buildUnannotatedCreateFlow(db: ReturnType<typeof store.sql>) {
   return on(
-    http.post("/notes").gate.public,
+    http.post("/notes").public(),
     flow("notes.create", {
       in: CreateIn,
       out: CreateOut,
@@ -140,7 +140,7 @@ describe("boot-level: table-ref resolution stays backward compatible", () => {
     resetFlowSeq();
     const db = store.sql("app", { schema: { notes } });
     const create = on(
-      http.post("/notes").gate.public,
+      http.post("/notes").public(),
       flow("notes.create", {
         in: CreateIn,
         out: CreateOut,
@@ -193,7 +193,7 @@ import { on, flow, http, gate } from "okengine";
 const db = {} as any;
 const notes = {} as any;
 export const create = on(
-  http.post("/notes").gate.public,
+  http.post("/notes").public(),
   flow("notes.create", {
     do: async (input, fx) => {
       await fx.store(db).insert(notes).values({ id: input.id, title: input.title, createdAt: 1 });

package/src/kernel/element-registries.ts

@@ -1,8 +1,9 @@
 /**
- * Module-evaluation registries for `store.sql` / `store.files`, `vault.secret`,
- * `vault.env.required`, `signal()`, `channel.<medium>().template()`, and
- * `ai.model` / `.prompt` / `ai.embed` / `ai.agent` / `ai.mcpServer` — the plain arrays behind
- * each declare module's `listX()` / `resetX()` pair (mirrors `on.ts`'s
+ * Module-evaluation registries for `store.*`, `vault.secret`,
+ * `vault.env.required`, `signal()`, `clock()`, `gate.policy` / `.scope` /
+ * `.rate`, `channel.<medium>().template()`, and `ai.model` / `.prompt` /
+ * `ai.embed` / `ai.agent` / `ai.mcpServer` — the plain arrays behind each
+ * declare module's `listX()` / `resetX()` pair (mirrors `on.ts`'s
  * trigger-drain `bindings` array).
  *
  * Lives here, not in the declare modules themselves, so {@link oke} can read
@@ -24,8 +25,10 @@ import type { StoreDecl } from "../elements/store/declare.ts";
 import type { VaultSecretDecl } from "../elements/vault/declare.ts";
 import type { SignalDecl } from "../elements/signal/declare.ts";
 import type { ChannelTemplateDecl } from "../elements/channel/declare.ts";
+import type { ClockDecl } from "../elements/clock/declare.ts";
+import type { GateDecl } from "../elements/gate/declare.ts";
 
-/** `store.sql` / `store.files` declarations since the last reset. */
+/** `store.sql` / `store.kv` / `store.files` / `store.index` declarations since the last reset. */
 export const storeRegistry: StoreDecl[] = [];
 /** `vault.secret` declarations since the last reset. */
 export const secretRegistry: VaultSecretDecl[] = [];
@@ -33,6 +36,10 @@ export const secretRegistry: VaultSecretDecl[] = [];
 export const requiredEnvRegistry: string[] = [];
 /** `signal()` declarations since the last reset. */
 export const signalRegistry: SignalDecl[] = [];
+/** `clock()` declarations since the last reset. */
+export const clockRegistry: ClockDecl[] = [];
+/** `gate.policy` / `gate.scope` / `gate.rate` declarations since the last reset. */
+export const gateRegistry: GateDecl[] = [];
 /** Medium-binder `.template()` declarations since the last reset. */
 export const channelTemplateRegistry: ChannelTemplateDecl[] = [];
 /** `ai.model` declarations since the last reset. */

package/src/kernel/errors.ts

@@ -183,6 +183,30 @@ export const OKE_ERRORS = {
     cause: "src/flows/{unit} exists on disk but adopted no flows — the .adopt() barrel is stale.",
     fix: "Run `oke dev` or `oke build` to regenerate `src/flows/generated.ts`.",
   },
+  /**
+   * `http.get()` was never stamped from the file tree — refuse a silent `/`.
+   */
+  HTTP_PATH_UNRESOLVED: {
+    code: 1010,
+    cause: 'Flow "{flow}" bound {method} with no path — the file-tree stamp never ran.',
+    fix: 'Put the file under `src/flows/<unit>/` and import `@/flows/generated`, or pass an explicit path to `http.{method}("/…")`.',
+  },
+  /**
+   * Two HTTP bindings share method + path — last-add-wins is the opposite of this DX.
+   */
+  HTTP_ROUTE_DUPLICATE: {
+    code: 1011,
+    cause: '{method} {path} is bound twice (flow "{flow}").',
+    fix: "Give each HTTP flow a unique method + path.",
+  },
+  /**
+   * Adopted HTTP flow still has no name (`flow({ do })` outside a unit).
+   */
+  HTTP_FLOW_UNNAMED: {
+    code: 1012,
+    cause: "An HTTP flow on {method} {path} has no name.",
+    fix: 'Use `flow("unit.export", {…})` or export it from a `src/flows/<unit>/` file so the tree can stamp `unit.export`.',
+  },
   /**
    * Emit target has no subscriber (unified-theory §21).
    * Thrown at emit when `optional` is false and nobody is subscribed.

package/src/kernel/flow-units.ts

@@ -0,0 +1,64 @@
+/**
+ * Module-evaluation registry for `src/flows/generated.ts`.
+ *
+ * Same consume/ignore posture as `on()` / `listBindings()`: generated.ts
+ * calls {@link registerFlowUnits}; {@link oke} drains the bag into `$routes`
+ * unless `registry: "ignore"`.
+ */
+
+import type { AnyFlowDef } from "./flow.ts";
+import { isFlow } from "./flow.ts";
+
+/** Unit name → export name → Flow. */
+export type FlowUnitBag = {
+  readonly [exportName: string]: unknown;
+};
+
+const pending: Record<string, FlowUnitBag> = {};
+
+/**
+ * Record generated flow units for the next {@link oke} construction.
+ *
+ * @param units - `{ notes, main, … }` from `generated.ts`
+ */
+export function registerFlowUnits(units: Record<string, FlowUnitBag>): void {
+  Object.assign(pending, units);
+}
+
+/**
+ * Drain registered units (consume). Clears the registry.
+ */
+export function consumeRegisteredFlowUnits(): Record<string, FlowUnitBag> {
+  const snap: Record<string, FlowUnitBag> = { ...pending };
+  resetRegisteredFlowUnits();
+  return snap;
+}
+
+/**
+ * Snapshot without clearing (keep / tests).
+ */
+export function peekRegisteredFlowUnits(): Record<string, FlowUnitBag> {
+  return { ...pending };
+}
+
+/**
+ * Clear the unit registry (tests / `registry: "consume"` after drain).
+ */
+export function resetRegisteredFlowUnits(): void {
+  for (const key of Object.keys(pending)) {
+    delete pending[key];
+  }
+}
+
+/**
+ * Collect FlowDefs from a unit bag (skip non-flow exports).
+ *
+ * @param bag - Namespace object
+ */
+export function flowsInUnitBag(bag: FlowUnitBag): AnyFlowDef[] {
+  const found: AnyFlowDef[] = [];
+  for (const value of Object.values(bag)) {
+    if (isFlow(value)) found.push(value);
+  }
+  return found;
+}

package/src/kernel/flow.ts

@@ -239,13 +239,34 @@ export const flowBrand: unique symbol = Symbol("oke.flow");
  * Input / output types are inferred from Standard Schema `in` / `out` when
  * present; otherwise from the `do` handler signature.
  *
+ * A nameless `flow({ do })` is stamped `unit.export` by the file-tree
+ * generator, {@link unit}, or `.adopt()`. Explicit `flow("notes.get", {…})`
+ * still wins.
+ *
+ * @param options - Contract and handler (name stamped later)
+ */
+export function flow<Opts extends FlowOptions<any, any, any>>(
+  options: Opts,
+): FlowDef<InferFlowIn<Opts>, InferFlowOut<Opts>, InferFlowErrors<Opts>>;
+/**
  * @param name - Stable name (used by `fx.call` and the Manifest)
  * @param options - Contract and handler
  */
 export function flow<Opts extends FlowOptions<any, any, any>>(
   name: string,
   options: Opts & { readonly name?: never },
-): FlowDef<InferFlowIn<Opts>, InferFlowOut<Opts>, InferFlowErrors<Opts>> {
+): FlowDef<InferFlowIn<Opts>, InferFlowOut<Opts>, InferFlowErrors<Opts>>;
+export function flow(
+  nameOrOptions: string | FlowOptions<any, any, any>,
+  maybeOptions?: FlowOptions<any, any, any> & { readonly name?: never },
+): FlowDef {
+  const named = typeof nameOrOptions === "string";
+  const name = named ? nameOrOptions : "";
+  const options = (named ? maybeOptions : nameOrOptions) as FlowOptions<any, any, any> | undefined;
+  if (!options || typeof options.do !== "function") {
+    throw new TypeError("flow() expected an options bag with a do handler");
+  }
+
   const triggers: Trigger[] = [];
   const hooks: Partial<Record<HookStage, HookFn[]>> = {};
   const pendingPlugins: PluginDef[] = [];
@@ -253,13 +274,13 @@ export function flow<Opts extends FlowOptions<any, any, any>>(
   const dot = name.indexOf(".");
   const unit = dot > 0 ? name.slice(0, dot) : undefined;
 
-  const def: FlowDef<InferFlowIn<Opts>, InferFlowOut<Opts>, InferFlowErrors<Opts>> = {
+  const def: FlowDef = {
     [flowBrand]: true,
     name,
     unit,
     in: options.in,
     out: options.out,
-    errors: (options.errors ?? undefined) as InferFlowErrors<Opts> | undefined,
+    errors: (options.errors ?? undefined) as FlowErrorMap | undefined,
     effects: options.effects,
     durable: options.durable ?? false,
     retry: options.retry,
@@ -268,17 +289,8 @@ export function flow<Opts extends FlowOptions<any, any, any>>(
     slo: options.slo,
     plane: options.plane,
     breaking: options.breaking ?? false,
-    compensate: options.compensate as
-      | ((
-          ctx: {
-            readonly input: InferFlowIn<Opts>;
-            readonly error: unknown;
-            readonly completedSteps: readonly string[];
-          },
-          fx: import("./fx.ts").Fx,
-        ) => unknown | Promise<unknown>)
-      | undefined,
-    do: options.do as FlowHandler<InferFlowIn<Opts>, InferFlowOut<Opts>>,
+    compensate: options.compensate as FlowDef["compensate"],
+    do: options.do as FlowHandler,
     triggers,
     $trigger: undefined,
     hooks,
@@ -320,9 +332,9 @@ export function isFlow(value: unknown): value is AnyFlowDef {
 }
 
 /**
- * No-op. `name` is a required positional argument now, so there is no
- * auto-name sequence left to reset — kept so existing test `beforeEach`
- * blocks don't need touching.
+ * No-op. Nameless flows start as `""` and are stamped by unit / adopt /
+ * the file-tree generator — kept so existing test `beforeEach` blocks
+ * don't need touching.
  *
  * @internal
  */

package/src/kernel/fx.ts

@@ -27,6 +27,8 @@ import type {
   StoreRuntime,
   SqlStoreHandle,
 } from "../elements/store.ts";
+import { rlsIdentityFromAuth } from "../elements/store.ts";
+import type { RlsIdentity } from "../drivers/pg-rls.ts";
 import type { SqlRow } from "../drivers/types.ts";
 import type { SignalDecl, SignalRuntime } from "../elements/signal.ts";
 import type { DeadLetter, SignalEmitOptions } from "../drivers/signal-types.ts";
@@ -911,6 +913,12 @@ export interface CreateFxOptions {
   readonly runId?: string;
   /** Reveal PII through the store runtime (requires `pii:reveal` upstream). */
   readonly revealPii?: boolean;
+  /** Trigger gate names for RLS (`oke.gate` = first policy/public). */
+  readonly rlsGateNames?: readonly string[];
+  /** Skip RLS stamp (Operator / `bypassGates` / operator-plane flows). */
+  readonly rlsBypass?: boolean;
+  /** Forced bag (Console / Call API). Wins over {@link rlsGateNames}. */
+  readonly rls?: import("../drivers/pg-rls.ts").RlsIdentity;
   /**
    * Active journal session when the flow is durable. Every `fx` call is
    * recorded; `step` / `sleep` replay from the journal on resume.
@@ -1025,6 +1033,19 @@ export function createFxContext(options: CreateFxOptions): FxContext {
     } satisfies FxPrincipal);
   const journal = options.journal;
 
+  function rlsInvokeContext(): { rls?: RlsIdentity } {
+    if (options.rlsBypass === true) return {};
+    if (options.rls) return { rls: options.rls };
+    const identity = rlsIdentityFromAuth({
+      userId: auth.userId,
+      scopes: auth.scopes,
+      gateNames: options.rlsGateNames ?? [],
+      bypass: false,
+      operator: false,
+    });
+    return identity ? { rls: identity } : {};
+  }
+
   async function gated<T>(
     kind: Parameters<CapabilityToken["assert"]>[0],
     resource: string,
@@ -1342,6 +1363,7 @@ export function createFxContext(options: CreateFxOptions): FxContext {
           cache.handle = await runtime.open(decl, {
             effects: options.effects ?? {},
             revealPii: options.revealPii,
+            ...rlsInvokeContext(),
           });
         }
         return cache.handle;
@@ -1361,6 +1383,7 @@ export function createFxContext(options: CreateFxOptions): FxContext {
           {
             effects: options.effects ?? {},
             revealPii: options.revealPii,
+            ...rlsInvokeContext(),
           },
           {
             gate: gated,

package/src/kernel/horizontal-child.ts

@@ -190,11 +190,11 @@ const charge = flow("horizontal.charge", {
 });
 
 const bindings: Binding[] = [
-  { trigger: http.get("/ping").gate.public, flow: ping as AnyFlowDef },
+  { trigger: http.get("/ping").public(), flow: ping as AnyFlowDef },
   { trigger: http.get("/rate").gate(rateGate), flow: rate as AnyFlowDef },
-  { trigger: http.post("/write").gate.public, flow: write as AnyFlowDef },
-  { trigger: http.post("/emit").gate.public, flow: emit as AnyFlowDef },
-  { trigger: http.post("/charge").gate.public, flow: charge as AnyFlowDef },
+  { trigger: http.post("/write").public(), flow: write as AnyFlowDef },
+  { trigger: http.post("/emit").public(), flow: emit as AnyFlowDef },
+  { trigger: http.post("/charge").public(), flow: charge as AnyFlowDef },
 ];
 
 const app = oke({

package/src/kernel/http-path-pending.ts

@@ -0,0 +1,20 @@
+/**
+ * Branded sentinel for `http.get()` with no path — never `"/"`.
+ * Lives in a leaf module so `oke()` can refuse leftovers without pulling
+ * the HTTP trigger constructors onto a Store-only graph.
+ */
+
+/** Unresolved path token. {@link stampHttpPath} replaces it from the file tree. */
+export const HTTP_PATH_PENDING = "__oke_http_path_pending__" as const;
+
+/** Type of {@link HTTP_PATH_PENDING}. */
+export type HttpPathPending = typeof HTTP_PATH_PENDING;
+
+/**
+ * True when an HTTP trigger still carries the unresolved path sentinel.
+ *
+ * @param path - Trigger path
+ */
+export function isPendingHttpPath(path: string): boolean {
+  return path === HTTP_PATH_PENDING;
+}

package/src/kernel/http-resource.ts

@@ -3,6 +3,7 @@
  * apps do not pay for the five-verb CRUD helper.
  */
 
+import { GATE_PUBLIC_NAME } from "../elements/gate/flatten.ts";
 import {
   createGateAttach,
   createHttpTrigger,
@@ -47,6 +48,9 @@ export function httpResource<P extends string>(
       { trigger: verb("DELETE", id, false), flow: ops.remove },
     ],
     gate: createGateAttach((next) => httpResource(path, ops, next, isLive), gates),
+    public() {
+      return httpResource(path, ops, [...gates, GATE_PUBLIC_NAME], isLive);
+    },
     live() {
       return httpResource(path, ops, gates, true);
     },

package/src/kernel/http-stream.test.ts

@@ -83,12 +83,12 @@ describe("fx.json.stream HTTP SSE", () => {
   test("encodes token chunks as SSE and leaves JSON flows buffered", async () => {
     const smart = ai.model("smart");
     on(
-      http.get("/chat").gate.public,
+      http.get("/chat").public(),
       flow("chat.stream", {
         do: (_input, fx) => fx.json.stream(fx.stream(smart, { prompt: "hi" })),
       }),
     );
-    on(http.get("/ping").gate.public, flow("ping", { do: () => ({ ok: true as const }) }));
+    on(http.get("/ping").public(), flow("ping", { do: () => ({ ok: true as const }) }));
 
     const app = oke({
       name: "http-stream",
@@ -111,7 +111,7 @@ describe("fx.json.stream HTTP SSE", () => {
     let providerAborted = false;
     const smart = ai.model("smart");
     on(
-      http.get("/slow").gate.public,
+      http.get("/slow").public(),
       flow("chat.slow", {
         do: (_input, fx) => fx.json.stream(fx.stream(smart, { prompt: "long" })),
       }),
@@ -139,7 +139,7 @@ describe("fx.json.stream HTTP SSE", () => {
     await runs.open();
     const smart = ai.model("smart");
     on(
-      http.get("/chat").gate.public,
+      http.get("/chat").public(),
       flow("chat.stream", {
         do: (_input, fx) => fx.json.stream(fx.stream(smart, { prompt: "hi" })),
       }),

package/src/kernel/pipeline.test.ts

@@ -65,9 +65,9 @@ describe("gateDenialFailure", () => {
   });
 });
 
-describe("http trigger — .gate.public", () => {
+describe("http trigger — .public()", () => {
   test("attaches the public sentinel without calling gate()", () => {
-    const trigger = http.get("/health").gate.public;
+    const trigger = http.get("/health").public();
     expect(trigger.gates.map((g) => (typeof g === "string" ? g : g.name))).toEqual(["public"]);
     expect(trigger.live().isLive).toBe(true);
   });

package/src/kernel/plugin-elements.test.ts

@@ -32,7 +32,7 @@ describe("plugin element contributions", () => {
       .table("otp_codes")
       .needs("store.sql");
 
-    on(http.get("/ok").gate.public, flow("ok", { do: () => ({ ok: true }) }));
+    on(http.get("/ok").public(), flow("ok", { do: () => ({ ok: true }) }));
 
     const app = oke({
       name: "plugin-elements",

package/src/kernel/plugin-needs.test.ts

@@ -75,7 +75,7 @@ describe("plugin .needs() resolution", () => {
   test("boot fails when plugin needs missing peer plugin", async () => {
     resetBindings();
     resetFlowSeq();
-    on(http.get("/x").gate.public, flow("x", { do: () => ({ ok: true }) }));
+    on(http.get("/x").public(), flow("x", { do: () => ({ ok: true }) }));
     const dependent = plugin("needs-auth", { version: "0.0.1" }).needs("auth");
     const app = oke({ name: "needs-boot", gate: { policies: [gate.public] } }).plug(dependent);
     await expect(app.boot({ env: "test" })).rejects.toThrow(PluginNeedsError);

package/src/kernel/ready.test.ts

@@ -38,7 +38,7 @@ describe("GET /_/ready", () => {
     });
     const bindings: Binding[] = [
       {
-        trigger: http.post("/charge").gate.public,
+        trigger: http.post("/charge").public(),
         flow: charge as AnyFlowDef,
       },
     ];
@@ -82,7 +82,7 @@ describe("GET /_oke/client.json", () => {
       startScheduler: false,
       env: "test",
       gate: { unguardedHttp: "allow" },
-      bindings: [{ trigger: http.get("/ping").gate.public, flow: ping as AnyFlowDef }],
+      bindings: [{ trigger: http.get("/ping").public(), flow: ping as AnyFlowDef }],
     });
     await app.boot();
     const res = await app.fetch(new Request("http://127.0.0.1/_oke/client.json"));

package/src/kernel/resource-mount.test.ts

@@ -63,6 +63,20 @@ describe("http.resource — gate / live", () => {
     expect(remove?.isLive).toBe(false);
   });
 
+  test(".public().live() stamps the sentinel on every verb", () => {
+    resetBindings();
+    resetFlowSeq();
+    on(http.resource("/notes", bag()).public().live());
+    expect(httpOf("/notes", "GET")?.gates.map((g) => (typeof g === "string" ? g : g.name))).toEqual(
+      ["public"],
+    );
+    expect(
+      httpOf("/notes", "POST")?.gates.map((g) => (typeof g === "string" ? g : g.name)),
+    ).toEqual(["public"]);
+    expect(httpOf("/notes", "GET")?.isLive).toBe(true);
+    expect(httpOf("/notes", "POST")?.isLive).toBe(false);
+  });
+
   test(".live().gate(member) order does not matter", () => {
     resetBindings();
     resetFlowSeq();

package/src/kernel/run-duration.test.ts

@@ -23,7 +23,7 @@ describe("execute run duration", () => {
     await runs.open();
 
     on(
-      http.get("/ping").gate.public,
+      http.get("/ping").public(),
       flow("demo.ping", {
         do: () => ({ ok: true }),
       }),
@@ -68,7 +68,7 @@ describe("execute run duration", () => {
     await runs.open();
     try {
       on(
-        http.get("/ping").gate.public,
+        http.get("/ping").public(),
         flow("demo.ping", {
           do: () => ({ ok: true }),
         }),

package/src/kernel/stamp-http.test.ts

@@ -0,0 +1,79 @@
+/**
+ * In-place path / name stamps and fail-loud HTTP boot.
+ */
+
+import { describe, expect, test, beforeEach } from "bun:test";
+import type { RuntimeRouteMap } from "./adopt-routes.ts";
+import { oke } from "./app.ts";
+import { flow, resetFlowSeq } from "./flow.ts";
+import { resetRegisteredFlowUnits, registerFlowUnits } from "./flow-units.ts";
+import { listBindings, on, resetBindings } from "./on.ts";
+import { stampFlowName, stampHttpPath } from "./stamp-http.ts";
+import { HTTP_PATH_PENDING } from "./http-path-pending.ts";
+import { http } from "./triggers.ts";
+
+beforeEach(() => {
+  resetBindings();
+  resetFlowSeq();
+  resetRegisteredFlowUnits();
+});
+
+describe("stampHttpPath", () => {
+  test("mutates the on() binding in place — listBindings sees the stamped path", () => {
+    const f = on(http.get().public(), flow({ do: () => ({ ok: true }) }));
+    expect(f.$trigger && f.$trigger.kind === "http" && f.$trigger.path).toBe(HTTP_PATH_PENDING);
+    stampHttpPath(f, "/notes/:id");
+    expect(f.$trigger && f.$trigger.kind === "http" && f.$trigger.path).toBe("/notes/:id");
+    const bound = listBindings()[0];
+    expect(bound?.trigger.kind === "http" && bound.trigger.path).toBe("/notes/:id");
+  });
+
+  test("explicit http.get('/x') wins — stamp does not overwrite", () => {
+    const f = on(http.get("/me/tasks").public(), flow("notes.get", { do: () => 1 }));
+    stampHttpPath(f, "/notes/:id");
+    expect(f.$trigger && f.$trigger.kind === "http" && f.$trigger.path).toBe("/me/tasks");
+  });
+});
+
+describe("stampFlowName", () => {
+  test("fills a nameless flow as unit.export", () => {
+    const f = flow({ do: () => 1 });
+    expect(f.name).toBe("");
+    stampFlowName(f, "notes.get");
+    expect(f.name).toBe("notes.get");
+    expect(f.unit).toBe("notes");
+  });
+
+  test("explicit flow('notes.get') wins", () => {
+    const f = flow("notes.get", { do: () => 1 });
+    stampFlowName(f, "notes.list");
+    expect(f.name).toBe("notes.get");
+  });
+});
+
+describe("oke — unresolved sentinel and duplicate routes", () => {
+  test("unresolved http.get() fails construction", () => {
+    on(http.get().public(), flow("notes.get", { do: () => 1 }));
+    expect(() => oke({ name: "t", autoBoot: false })).toThrow(/OKE1010/);
+  });
+
+  test("duplicate GET /notes fails construction", () => {
+    on(http.get("/notes").public(), flow("notes.list", { do: () => 1 }));
+    on(http.get("/notes").public(), flow("notes.also", { do: () => 1 }));
+    expect(() => oke({ name: "t", autoBoot: false })).toThrow(/OKE1011/);
+  });
+
+  test("nameless HTTP flow fails construction", () => {
+    on(http.get("/notes").public(), flow({ do: () => 1 }));
+    expect(() => oke({ name: "t", autoBoot: false })).toThrow(/OKE1012/);
+  });
+
+  test("registerFlowUnits drains into $routes; registry ignore does not", () => {
+    const get = on(http.get("/notes/:id").public(), flow("notes.get", { do: () => 1 }));
+    registerFlowUnits({ notes: { get } });
+    const ignored = oke({ name: "t", autoBoot: false, registry: "ignore" });
+    expect(ignored.$routes).toEqual({});
+    const app = oke({ name: "t", autoBoot: false });
+    expect((app.$routes as RuntimeRouteMap).notes?.get?.path).toBe("/notes/:id");
+  });
+});

package/src/kernel/stamp-http.ts

@@ -0,0 +1,75 @@
+/**
+ * In-place HTTP path + Flow name stamps.
+ *
+ * `on()` already registered the trigger (possibly still on the pending-path
+ * sentinel). A wrapper that returned a new trigger would leave `listBindings()`
+ * on the sentinel — mutate the existing object.
+ */
+
+import { isFlow, type AnyFlowDef, type FlowDef } from "./flow.ts";
+import { isPendingHttpPath, type HttpPathPending } from "./http-path-pending.ts";
+import type { HttpTrigger, Trigger } from "./triggers.ts";
+
+/**
+ * Replace a pending HTTP path on {@link FlowDef} with the file-tree stamp.
+ *
+ * Explicit `http.get("/x")` wins — the pending sentinel is the only path
+ * this function overwrites. Returns the same object with a tighter trigger
+ * type when the original path was pending.
+ *
+ * @param flow - Bound flow (already passed through `on()`)
+ * @param path - Inferred URL (`/notes/:id`)
+ */
+export function stampHttpPath<F extends AnyFlowDef, P extends string>(
+  flow: F,
+  path: P,
+): StampHttpPath<F, P> {
+  if (!isFlow(flow)) return flow as StampHttpPath<F, P>;
+  const apply = (trigger: Trigger): void => {
+    if (trigger.kind !== "http") return;
+    if (!isPendingHttpPath(trigger.path)) return;
+    (trigger as { path: string }).path = path;
+  };
+  if (flow.$trigger) apply(flow.$trigger);
+  for (const trigger of flow.triggers) apply(trigger);
+  return flow as StampHttpPath<F, P>;
+}
+
+/**
+ * Stamp `unit.export` onto a nameless (or `flow_*`) Flow.
+ *
+ * Explicit `flow("notes.get")` wins. Fills `unit` when missing.
+ *
+ * @param flow - Flow definition
+ * @param name - `notes.get`
+ */
+export function stampFlowName<F extends AnyFlowDef>(flow: F, name: string): F {
+  if (!isFlow(flow)) return flow;
+  const f = flow as { name: string; unit: string | undefined };
+  if (!f.name || f.name.startsWith("flow_")) {
+    f.name = name;
+  }
+  if (!f.unit) {
+    const resolved = f.name || name;
+    const dot = resolved.indexOf(".");
+    f.unit = dot > 0 ? resolved.slice(0, dot) : resolved;
+  }
+  return flow;
+}
+
+/**
+ * Type-level path replacement — only when the bound trigger is still pending.
+ *
+ * @typeParam F - Flow definition
+ * @typeParam P - Stamped path
+ */
+export type StampHttpPath<F, P extends string> =
+  F extends FlowDef<infer I, infer O, infer E, infer D, infer T>
+    ? T extends HttpTrigger<infer M, infer Cur>
+      ? [Cur] extends [HttpPathPending]
+        ? FlowDef<I, O, E, D, HttpTrigger<M, P>>
+        : F
+      : F
+    : F;
+
+export { HTTP_PATH_PENDING, isPendingHttpPath } from "./http-path-pending.ts";