okengine 0.14.1 → 0.15.2

package/src/kernel/triggers.ts

@@ -7,8 +7,11 @@
 
 import { flattenGateArgs, GATE_PUBLIC_NAME, type GateAllDecl } from "../elements/gate/flatten.ts";
 import type { NamedRef } from "./fx.ts";
+import { HTTP_PATH_PENDING, type HttpPathPending } from "./http-path-pending.ts";
 import { lazyRequire } from "./lazy-require.ts";
 
+export { HTTP_PATH_PENDING, isPendingHttpPath, type HttpPathPending } from "./http-path-pending.ts";
+
 /** HTTP methods accepted by {@link http}. */
 export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "HEAD" | "QUERY";
 
@@ -18,15 +21,8 @@ export type GateRef = NamedRef;
 /** One `.gate(...)` argument — a named ref, an `all` handle, or an array. */
 export type GateArg = GateRef | GateAllDecl | readonly GateArg[];
 
-/**
- * Attach function on an HTTP trigger / resource mount.
- * Call it with members, or use `.public` for the unauthenticated sentinel.
- */
-export interface GateAttach<T> {
-  (...gates: GateArg[]): T;
-  /** Attach {@link gate.public} — same as `.gate(gate.public)`. */
-  readonly public: T;
-}
+/** Attach gates on an HTTP trigger / resource mount. */
+export type GateAttach<T> = (...gates: GateArg[]) => T;
 
 /**
  * HTTP trigger value. Method and path are literal type parameters so
@@ -44,9 +40,12 @@ export interface HttpTrigger<M extends HttpMethod = HttpMethod, P extends string
   readonly isLive: boolean;
   /**
    * Attach gates (registration order). `gate.all` handles and arrays flatten.
-   * `.gate.public` is the unauthenticated sentinel.
    */
   readonly gate: GateAttach<HttpTrigger<M, P>>;
+  /**
+   * Attach the unauthenticated public sentinel.
+   */
+  public(): HttpTrigger<M, P>;
   /**
    * Mark the HTTP trigger as live (push result to subscribers).
    */
@@ -93,7 +92,7 @@ export type Trigger = HttpTrigger | EveryTrigger | SignalAsTrigger | CdcTrigger
 export type TriggerKind = Trigger["kind"];
 
 /**
- * Callable `.gate(...)` plus `.gate.public` on a trigger or resource mount.
+ * Callable `.gate(...)` on a trigger or resource mount.
  *
  * @param apply - Rebuild the host with the flattened gate list
  * @param current - Gates already attached
@@ -102,19 +101,11 @@ export function createGateAttach<T>(
   apply: (next: readonly GateRef[]) => T,
   current: readonly GateRef[],
 ): GateAttach<T> {
-  const attach = ((...next: GateArg[]) =>
-    apply([...current, ...flattenGateArgs(next)])) as GateAttach<T>;
-  Object.defineProperty(attach, "public", {
-    get() {
-      return apply([...current, GATE_PUBLIC_NAME]);
-    },
-    enumerable: true,
-  });
-  return attach;
+  return (...next: GateArg[]) => apply([...current, ...flattenGateArgs(next)]);
 }
 
 /**
- * Build an HTTP trigger with `.gate` / `.live`.
+ * Build an HTTP trigger with `.gate` / `.public` / `.live`.
  *
  * @param method - HTTP verb
  * @param path - Route path
@@ -134,6 +125,9 @@ export function createHttpTrigger<M extends HttpMethod, P extends string>(
     gates,
     isLive,
     gate: createGateAttach((next) => createHttpTrigger(method, path, next, isLive), gates),
+    public() {
+      return createHttpTrigger(method, path, [...gates, GATE_PUBLIC_NAME], isLive);
+    },
     live() {
       return createHttpTrigger(method, path, gates, true);
     },
@@ -156,7 +150,7 @@ export interface ResourceFlowBag {
 /**
  * A mounted resource — the single argument to the `on(http.resource(…))`
  * overload. Branded so `on` can tell it apart from a plain trigger.
- * Same chain as {@link HttpTrigger}: `.gate(...)` / `.live()`.
+ * Same chain as {@link HttpTrigger}: `.gate(...)` / `.public()` / `.live()`.
  */
 export interface ResourceMount {
   readonly [resourceMountBrand]: true;
@@ -166,9 +160,12 @@ export interface ResourceMount {
   readonly isLive: boolean;
   /**
    * Attach gates to every verb (registration order). `gate.all` and arrays flatten.
-   * `.gate.public` is the unauthenticated sentinel.
    */
   readonly gate: GateAttach<ResourceMount>;
+  /**
+   * Attach the unauthenticated public sentinel to every verb.
+   */
+  public(): ResourceMount;
   /**
    * Mark list and get as live (GET mounts). Mutations stay request/response.
    */
@@ -200,34 +197,55 @@ function loadHttpResource(): typeof import("./http-resource.ts") {
  * types for param extraction.
  */
 export interface HttpTriggerNamespace {
+  /**
+   * Pathless — file-tree stamp fills the URL. Unresolved sentinel fails boot.
+   */
+  get(): HttpTrigger<"GET", HttpPathPending>;
   /**
    * @param path - Route path (`/:id` params supported)
    */
   get<P extends string>(path: P): HttpTrigger<"GET", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  post(): HttpTrigger<"POST", HttpPathPending>;
   /**
    * @param path - Route path
    */
   post<P extends string>(path: P): HttpTrigger<"POST", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  put(): HttpTrigger<"PUT", HttpPathPending>;
   /**
    * @param path - Route path
    */
   put<P extends string>(path: P): HttpTrigger<"PUT", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  patch(): HttpTrigger<"PATCH", HttpPathPending>;
   /**
    * @param path - Route path
    */
   patch<P extends string>(path: P): HttpTrigger<"PATCH", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  delete(): HttpTrigger<"DELETE", HttpPathPending>;
   /**
    * @param path - Route path
    */
   delete<P extends string>(path: P): HttpTrigger<"DELETE", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  options(): HttpTrigger<"OPTIONS", HttpPathPending>;
   /**
    * @param path - Route path
    */
   options<P extends string>(path: P): HttpTrigger<"OPTIONS", P>;
+  /** Pathless — file-tree stamp fills the URL. */
+  head(): HttpTrigger<"HEAD", HttpPathPending>;
   /**
    * @param path - Route path
    */
   head<P extends string>(path: P): HttpTrigger<"HEAD", P>;
+  /**
+   * Safe, idempotent read that carries a JSON body (RFC 10008).
+   * Pathless — file-tree stamp fills the URL.
+   */
+  query(): HttpTrigger<"QUERY", HttpPathPending>;
   /**
    * Safe, idempotent read that carries a JSON body (RFC 10008).
    *
@@ -236,8 +254,8 @@ export interface HttpTriggerNamespace {
   query<P extends string>(path: P): HttpTrigger<"QUERY", P>;
   /**
    * Mount a CRUD resource (list/create on `path`, get/update/remove on
-   * `path/:id`) for the `on(http.resource(…))` overload. Chain `.gate(...)`
-   * and `.live()` like {@link HttpTrigger}.
+   * `path/:id`) for the `on(http.resource(…))` overload. Chain `.gate(...)`,
+   * `.public()`, and `.live()` like {@link HttpTrigger}.
    */
   resource<P extends string>(path: P, ops: ResourceFlowBag): ResourceMount;
 }
@@ -245,8 +263,15 @@ export interface HttpTriggerNamespace {
 /** Bind an HTTP verb constructor (`http.get`, `http.query`, …). */
 function httpVerb<M extends HttpMethod>(
   method: M,
-): <P extends string>(path: P) => HttpTrigger<M, P> {
-  return (path) => createHttpTrigger(method, path);
+): {
+  (): HttpTrigger<M, HttpPathPending>;
+  <P extends string>(path: P): HttpTrigger<M, P>;
+} {
+  return ((path?: string) =>
+    createHttpTrigger(method, path === undefined ? HTTP_PATH_PENDING : path)) as {
+    (): HttpTrigger<M, HttpPathPending>;
+    <P extends string>(path: P): HttpTrigger<M, P>;
+  };
 }
 
 /**

package/src/manifest/types.ts

@@ -224,10 +224,23 @@ export interface DeclaredColumn extends ColumnClassification {
 /** Field classification value forms. */
 export type ClassificationValue = string | string[] | ColumnClassification;
 
+/** Declared Postgres RLS policy on a {@link Table}. */
+export interface TablePolicy {
+  as?: "permissive" | "restrictive";
+  to?: string | string[];
+  for?: "all" | "select" | "insert" | "update" | "delete";
+  using?: string;
+  withCheck?: string;
+}
+
 /** SQL table metadata. */
 export interface Table {
   columns?: Record<string, DeclaredColumn | ColumnClassification>;
   classifications?: Record<string, ClassificationValue>;
+  /** RLS enabled (`pgTable.withRLS` or any policy). */
+  rls?: boolean;
+  /** Policy name → Drizzle-shaped spec. */
+  policies?: Record<string, TablePolicy>;
 }
 
 /** One Store declaration. */

package/src/release/measure.ts

@@ -201,7 +201,7 @@ export async function measureHttpPingAppBytes(): Promise<HttpPingBudgetSample> {
   await Bun.write(
     anchor,
     `import { on, flow, http, gate, oke, createBunRuntime } from ${JSON.stringify(httpEntry)};\n` +
-      `on(http.get("/").gate.public, flow("ping", { do: () => "Hi" }));\n` +
+      `on(http.get("/").public(), flow("ping", { do: () => "Hi" }));\n` +
       `export const app = oke({ name: "ping" });\n` +
       `export const rt = createBunRuntime;\n`,
   );
@@ -362,7 +362,7 @@ const t0 = performance.now();
 const { createBunRuntime, oke, on, flow, http, gate } = await import(${JSON.stringify(httpEntry)});
 const { resetBindings } = await import(${JSON.stringify(`${import.meta.dir}/../kernel/on.ts`)});
 resetBindings();
-on(http.get("/ping").gate.public, flow("ping", { do: () => ({ ok: true }) }));
+on(http.get("/ping").public(), flow("ping", { do: () => ({ ok: true }) }));
 const app = oke({ name: "cold-start" });
 const rt = createBunRuntime();
 const server = rt.serve(app, { port: 0, hostname: "127.0.0.1" });

package/src/runtime/json-code-block.test.ts

@@ -255,7 +255,7 @@ describe("httpGetNavPaths", () => {
 describe("asBrowserJsonCodeBlock — HTTP", () => {
   test("Chrome GET / becomes the code block; curl stays JSON", async () => {
     on(
-      http.get("/").gate.public,
+      http.get("/").public(),
       flow("main.root", {
         do: () => ({ ok: true as const, app: "keel" }),
       }),
@@ -286,7 +286,7 @@ describe("asBrowserJsonCodeBlock — HTTP", () => {
   });
 
   test("?raw=1 stays on the traces page; format=json and Accept stay the envelope", async () => {
-    on(http.get("/health").gate.public, flow("main.health", { do: () => ({ ok: true as const }) }));
+    on(http.get("/health").public(), flow("main.health", { do: () => ({ ok: true as const }) }));
     const app = oke({ autoBoot: false, name: "keel" });
 
     const raw = await app.fetch(

package/src/runtime/serve.test.ts

@@ -55,13 +55,13 @@ function rawHttp(port: number, payload: string): Promise<string> {
 
 function buildApp() {
   on(
-    http.get("/ping").gate.public,
+    http.get("/ping").public(),
     flow("ping", {
       do: () => ({ ok: true as const, n: 1 }),
     }),
   );
   on(
-    http.get("/notes/:id").gate.public,
+    http.get("/notes/:id").public(),
     flow("notes.get", {
       do: ({ id }: { id: string }) => ({ id }),
     }),
@@ -157,13 +157,13 @@ describe("Bun.serve — real HTTP", () => {
 
   test("QUERY is omitted from native routes so Bun.serve still boots", async () => {
     on(
-      http.query("/search").gate.public,
+      http.query("/search").public(),
       flow("search.query", {
         do: () => ({ hits: 1 }),
       }),
     );
     on(
-      http.get("/search/suggest").gate.public,
+      http.get("/search/suggest").public(),
       flow("search.suggest", {
         do: () => ({ hits: 0 }),
       }),

package/src/term.test.ts

@@ -6,6 +6,7 @@ import { describe, expect, test } from "bun:test";
 import {
   formatAppReadyLine,
   formatBootWarn,
+  formatBoundSurfaces,
   formatClaimNote,
   formatDevNote,
   formatCliChrome,
@@ -14,6 +15,7 @@ import {
   formatDevLogSeparator,
   formatOkeWordmark,
   formatServiceLine,
+  formatSurfaceBox,
   formatRequestLine,
   formatStackSummary,
   countTermLines,
@@ -61,8 +63,8 @@ describe("term", () => {
     expect(out).toContain("elements");
     expect(out).toContain("store");
     expect(out).toContain("postgres");
-    expect(out).toContain("● flow");
-    expect(out).toContain("● ai");
+    expect(out).toContain("●  flow");
+    expect(out).toContain("●  ai");
     expect(out).toContain("Starting");
     expect(out).not.toContain("Ready");
     expect(out).not.toContain("on(Trigger)");
@@ -134,6 +136,7 @@ describe("term", () => {
       appUrl: "http://127.0.0.1:6530",
       consoleUrl: "http://127.0.0.1:6533",
       mcpUrl: "http://127.0.0.1:6535",
+      docsMcpUrl: "http://127.0.0.1:6536",
       profile: "local",
       runtimeEnv: "local",
       system: "darwin 25.4.0 · bun 1.3.14",
@@ -145,11 +148,38 @@ describe("term", () => {
     expect(out).toContain("Backend");
     expect(out).toContain("Console");
     expect(out).toContain("MCP");
+    expect(out).toContain("Docs MCP");
     expect(out).toContain("http://127.0.0.1:6530");
+    expect(out).toContain("Your flows, served from the Manifest.");
     expect(out).toContain("└");
     expect(out).toContain("Logs");
   });
 
+  test("formatSurfaceBox prints url and purpose", () => {
+    const out = formatSurfaceBox({
+      label: "Backend",
+      url: "http://127.0.0.1:6530",
+      color: false,
+    });
+    expect(out).toContain("Backend");
+    expect(out).toContain("http://127.0.0.1:6530");
+    expect(out).toContain("Your flows, served from the Manifest.");
+    expect(out).toMatch(/● {2}Backend\n│ {2}http:\/\/127\.0\.0\.1:6530\n│ {2}Your flows/);
+  });
+
+  test("formatBoundSurfaces skips unbound MCP and Docs MCP", () => {
+    const out = formatBoundSurfaces({
+      appUrl: "http://127.0.0.1:6530",
+      consoleUrl: "http://127.0.0.1:6533",
+      color: false,
+    });
+    expect(out).toContain("Backend");
+    expect(out).toContain("Console");
+    expect(out).toContain("Panels, traces, and the effect graph.");
+    expect(out).not.toContain("Docs MCP");
+    expect(out).not.toContain("The same Manifest, for agents.");
+  });
+
   test("formatDevLogSeparator closes hero and titles Logs", () => {
     const out = formatDevLogSeparator(false);
     expect(out).toContain("│");
@@ -280,10 +310,28 @@ describe("term", () => {
     expect(out).toContain("Docker");
     expect(out).toContain(":15975");
     expect(out).toContain("gemma4:e4b-q4_K_M");
-    expect(out).toContain("● postgres");
-    expect(out).toContain("● ai");
+    expect(out).toContain("●  postgres");
+    expect(out).toContain("●  ai");
     // Blank │ row separates the Docker header from whatever sits above.
     expect(out).toMatch(/│\n◇ {2}Docker/);
     expect(out).not.toMatch(/\u001b\[/);
   });
+
+  test("formatStackSummary aligns name and port columns", () => {
+    const out = formatStackSummary({
+      project: "oke-dev-a3f791",
+      services: [
+        { label: "ai", hostPort: 23850, status: "ready" },
+        { label: "store.index", hostPort: 8550, status: "ready" },
+        { label: "postgres", hostPort: 15850, status: "ready" },
+      ],
+      color: false,
+    });
+    const portCols = out
+      .split("\n")
+      .filter((line) => /●\s+\S/.test(line) && line.includes(":"))
+      .map((line) => line.search(/:\d/));
+    expect(portCols.length).toBe(3);
+    expect(new Set(portCols).size).toBe(1);
+  });
 });

package/src/term.ts

@@ -112,6 +112,32 @@ export type DevHeroElement = {
   readonly status?: DevStatus;
 };
 
+/** Name column for Ready / Docker / bind rows — fits `store.index`. */
+const HERO_NAME_MIN = 12;
+
+/**
+ * Widest name column that still fits every label (never below {@link HERO_NAME_MIN}).
+ *
+ * @param names - Row labels in the table
+ */
+function heroNameWidth(names: readonly string[]): number {
+  let width = HERO_NAME_MIN;
+  for (const name of names) {
+    if (name.length > width) width = name.length;
+  }
+  return width;
+}
+
+/**
+ * Left-align a table cell.
+ *
+ * @param value - Cell text
+ * @param width - Column width
+ */
+function padHeroCol(value: string, width: number): string {
+  return value.padEnd(width);
+}
+
 /** Shared options for the `oke dev` hero / banner. */
 export type DevHeroMeta = {
   /** `local` · `docker` · `test` · `production` */
@@ -158,18 +184,24 @@ export function formatOkeWordmark(color: boolean = termColorEnabled()): string {
 export function formatDevHeroDetails(options: DevHeroMeta = {}): string {
   const s = termStyle(options.color ?? termColorEnabled());
   const bar = `${s.dim}│${s.reset}`;
-  const label = (name: string) => `${s.dim}${name.padEnd(9)}${s.reset}`;
+  const elements = options.elements ?? [];
+  const nameWidth = heroNameWidth([
+    ...(options.profile ? ["profile"] : []),
+    ...(options.runtimeEnv ? ["env"] : []),
+    ...(options.system ? ["system"] : []),
+    ...elements.map((row) => row.element),
+  ]);
+  const label = (name: string) => `${s.dim}${padHeroCol(name, nameWidth)}${s.reset}`;
   const lines: string[] = [];
   if (options.profile) {
-    lines.push(`${bar}  ${label("profile")} ${s.cyan}${options.profile}${s.reset}`);
+    lines.push(`${bar}  ${label("profile")}  ${s.cyan}${options.profile}${s.reset}`);
   }
   if (options.runtimeEnv) {
-    lines.push(`${bar}  ${label("env")} ${s.cyan}${options.runtimeEnv}${s.reset}`);
+    lines.push(`${bar}  ${label("env")}  ${s.cyan}${options.runtimeEnv}${s.reset}`);
   }
   if (options.system) {
-    lines.push(`${bar}  ${label("system")} ${s.dim}${options.system}${s.reset}`);
+    lines.push(`${bar}  ${label("system")}  ${s.dim}${options.system}${s.reset}`);
   }
-  const elements = options.elements ?? [];
   if (elements.length > 0) {
     lines.push(`${bar}  ${s.dim}elements${s.reset}`);
     const color = options.color ?? termColorEnabled();
@@ -182,8 +214,10 @@ export function formatDevHeroDetails(options: DevHeroMeta = {}): string {
           ? ""
           : `${s.dim}—${s.reset}`
         : `${s.cyan}${row.detail}${s.reset}`;
-      const detailPart = detail ? ` ${detail}` : "";
-      lines.push(`${bar}  ${dot} ${s.dim}${row.element.padEnd(9)}${s.reset}${detailPart}`);
+      const detailPart = detail ? `  ${detail}` : "";
+      lines.push(
+        `${bar}  ${dot}  ${s.dim}${padHeroCol(row.element, nameWidth)}${s.reset}${detailPart}`,
+      );
     }
   }
   return lines.length > 0 ? `${lines.join("\n")}\n` : "";
@@ -454,7 +488,19 @@ export function createAnchoredBoard(
 }
 
 /**
- * One service URL line (Console / MCP after bind).
+ * One-line purpose for each `oke dev` bind surface.
+ *
+ * Same wording as the site PORTS mnemonic — keep them in lockstep.
+ */
+export const DEV_SURFACE_DETAILS: Readonly<Record<string, string>> = {
+  Backend: "Your flows, served from the Manifest.",
+  Console: "Panels, traces, and the effect graph.",
+  MCP: "The same Manifest, for agents.",
+  "Docs MCP": "Read-only docs search for agents.",
+};
+
+/**
+ * One service URL line (Console / MCP after bind, before the ready board).
  *
  * @param label - Surface name
  * @param url - Absolute URL
@@ -466,19 +512,73 @@ export function formatServiceLine(
   color: boolean = termColorEnabled(),
 ): string {
   const s = termStyle(color);
-  const pad = label.padEnd(7);
+  const pad = padHeroCol(label, HERO_NAME_MIN);
   return `${s.dim}│${s.reset}  ${s.dim}${pad}${s.reset}  ${s.cyan}${url}${s.reset}\n`;
 }
 
 /**
  * Backend child ready line (`bun --hot` soft reload).
  *
+ * Stays one line so Logs do not fill with surface boxes on every reload.
+ *
  * @param url - Backend base URL
  * @param color - Color on/off
  */
 export function formatAppReadyLine(url: string, color: boolean = termColorEnabled()): string {
   const s = termStyle(color);
-  return `${s.green}●${s.reset}  ${s.dim}${"Backend".padEnd(7)}${s.reset}  ${s.cyan}${url}${s.reset}\n`;
+  return `${s.green}●${s.reset}  ${s.dim}${padHeroCol("Backend", HERO_NAME_MIN)}${s.reset}  ${s.cyan}${url}${s.reset}\n`;
+}
+
+/**
+ * One bound-surface box on the ready board — title, URL, purpose.
+ *
+ * @param options - Label, URL, optional detail override
+ */
+export function formatSurfaceBox(options: {
+  readonly label: string;
+  readonly url: string;
+  readonly detail?: string;
+  readonly color?: boolean;
+}): string {
+  const s = termStyle(options.color ?? termColorEnabled());
+  const bar = `${s.dim}│${s.reset}`;
+  const detail = (options.detail ?? DEV_SURFACE_DETAILS[options.label] ?? "").trim();
+  const lines = [
+    `${s.green}●${s.reset}  ${s.bold}${options.label}${s.reset}`,
+    `${bar}  ${s.cyan}${options.url}${s.reset}`,
+  ];
+  if (detail.length > 0) {
+    lines.push(`${bar}  ${s.dim}${detail}${s.reset}`);
+  }
+  lines.push(bar);
+  return `${lines.join("\n")}\n`;
+}
+
+/**
+ * Backend · Console · MCP · Docs MCP boxes after bind.
+ *
+ * Pass `mcpUrl` / `docsMcpUrl` only when that surface came up — omitted
+ * URLs skip the box.
+ *
+ * @param options - Bound surface URLs
+ */
+export function formatBoundSurfaces(options: {
+  readonly appUrl: string;
+  readonly consoleUrl: string;
+  readonly mcpUrl?: string | null;
+  readonly docsMcpUrl?: string | null;
+  readonly color?: boolean;
+}): string {
+  const color = options.color ?? termColorEnabled();
+  let out = formatSurfaceBox({ label: "Backend", url: options.appUrl, color });
+  out += formatSurfaceBox({ label: "Console", url: options.consoleUrl, color });
+  if (options.mcpUrl) {
+    out += formatSurfaceBox({ label: "MCP", url: options.mcpUrl, color });
+  }
+  if (options.docsMcpUrl) {
+    out += formatSurfaceBox({ label: "Docs MCP", url: options.docsMcpUrl, color });
+  }
+  return out;
 }
 
 /**
@@ -499,6 +599,7 @@ export function formatDevHero(
     readonly appUrl: string;
     readonly consoleUrl: string;
     readonly mcpUrl: string;
+    readonly docsMcpUrl?: string;
   },
 ): string {
   const color = options.color ?? termColorEnabled();
@@ -511,9 +612,13 @@ export function formatDevHero(
     `\n${bar}\n` +
     formatDevHeroDetails({ ...options, color }) +
     `${bar}\n` +
-    formatAppReadyLine(options.appUrl, color) +
-    formatServiceLine("Console", options.consoleUrl, color) +
-    formatServiceLine("MCP", options.mcpUrl, color) +
+    formatBoundSurfaces({
+      appUrl: options.appUrl,
+      consoleUrl: options.consoleUrl,
+      mcpUrl: options.mcpUrl,
+      docsMcpUrl: options.docsMcpUrl,
+      color,
+    }) +
     formatDevLogSeparator(color)
   );
 }
@@ -767,25 +872,28 @@ export function formatStackSummary(options: {
 }): string {
   const s = termStyle(options.color ?? termColorEnabled());
   const bar = `${s.dim}│${s.reset}`;
-  const pad = (label: string) => label.padEnd(8);
+  const nameWidth = heroNameWidth(["Docker", "app", ...options.services.map((svc) => svc.label)]);
+  const portWidth = Math.max(6, ...options.services.map((svc) => `:${svc.hostPort}`.length));
+  const pad = (label: string) => padHeroCol(label, nameWidth);
   const color = options.color ?? termColorEnabled();
   const lines: string[] = [
     `${s.dim}│${s.reset}`,
-    `${s.green}◇${s.reset}  ${s.bold}Docker${s.reset}     ${s.cyan}${options.project}${s.reset}`,
+    `${s.green}◇${s.reset}  ${s.bold}${pad("Docker")}${s.reset}  ${s.cyan}${options.project}${s.reset}`,
   ];
   for (const svc of options.services) {
     const detail = svc.detail?.trim();
     const status = svc.status ?? "pending";
     const dot = formatStatusDot(status, color);
+    const port = `:${svc.hostPort}`.padEnd(portWidth);
     lines.push(
-      `${bar}  ${dot} ${s.dim}${pad(svc.label)}${s.reset}  ${s.cyan}:${svc.hostPort}${s.reset}` +
+      `${bar}  ${dot}  ${s.dim}${pad(svc.label)}${s.reset}  ${s.cyan}${port}${s.reset}` +
         (detail ? `  ${s.dim}${detail}${s.reset}` : ""),
     );
   }
   const drivers = options.appDrivers ?? [];
   const appDetail = drivers.length > 0 ? `host Bun · ${drivers.join(" + ")}` : "host Bun";
   const appDot = formatStatusDot("ready", color);
-  lines.push(`${bar}  ${appDot} ${s.dim}${pad("app")}${s.reset}  ${s.dim}${appDetail}${s.reset}`);
+  lines.push(`${bar}  ${appDot}  ${s.dim}${pad("app")}${s.reset}  ${s.dim}${appDetail}${s.reset}`);
   lines.push(bar);
   return `${lines.join("\n")}\n`;
 }

package/src/test/reset-element-registries.ts

@@ -1,7 +1,8 @@
 /**
- * Global safety net for the `store.sql` / `store.files` / `vault.secret` /
- * `signal()` / `channel.<medium>().template()` / `ai.model`·prompt·embed·agent
- * auto-registries (`src/kernel/element-registries.ts`).
+ * Global safety net for the `store.*` / `vault.secret` / `signal()` /
+ * `clock()` / `gate.policy`·scope·rate / `channel.<medium>().template()` /
+ * `ai.model`·prompt·embed·agent auto-registries
+ * (`src/kernel/element-registries.ts`).
  *
  * Unlike `on()` bindings — created almost exclusively to wire a real app —
  * these factories are called throughout the suite as bare value constructors,
@@ -23,6 +24,8 @@ import {
   aiModelRegistry,
   aiPromptRegistry,
   channelTemplateRegistry,
+  clockRegistry,
+  gateRegistry,
   requiredEnvRegistry,
   secretRegistry,
   signalRegistry,
@@ -34,6 +37,8 @@ afterEach(() => {
   secretRegistry.length = 0;
   requiredEnvRegistry.length = 0;
   signalRegistry.length = 0;
+  clockRegistry.length = 0;
+  gateRegistry.length = 0;
   channelTemplateRegistry.length = 0;
   aiModelRegistry.length = 0;
   aiPromptRegistry.length = 0;