okengine 0.14.1 → 0.16.0

package/src/elements/store/sql-rls-stamp.test.ts

@@ -0,0 +1,117 @@
+/**
+ * RLS stamps on pooled postgres must `reserve()` one slot, then BEGIN/SET
+ * on that slot. `begin()` + parent `unsafe()` checkouts a second slot and
+ * deadlocks a tiny pool (`checkout timeout` from PgDog).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { connectPostgres, type PostgresClientLike } from "../../drivers/postgres.ts";
+import { createSqlStoreHandle } from "./sql-session.ts";
+
+/**
+ * Two-slot pool. `reserve()` holds a slot until `release()`. Unreserved
+ * `BEGIN` occupies a slot until COMMIT on that same checkout.
+ */
+function createTinyPoolClient(size = 2): PostgresClientLike & {
+  readonly reserveCalls: { n: number };
+  readonly rootBegins: { n: number };
+} {
+  const slots = Array.from({ length: size }, () => ({ held: false }));
+  const reserveCalls = { n: 0 };
+  const rootBegins = { n: 0 };
+
+  function checkout(): { held: boolean } {
+    const idle = slots.find((slot) => !slot.held);
+    if (!idle) {
+      throw new Error("checkout timeout");
+    }
+    return idle;
+  }
+
+  function rowsFor(sql: string): Record<string, unknown>[] {
+    return /select/i.test(sql) && !/set_config/i.test(sql) ? [{ id: "a", owner: "alice" }] : [];
+  }
+
+  const client: PostgresClientLike & {
+    readonly reserveCalls: { n: number };
+    readonly rootBegins: { n: number };
+  } = {
+    reserveCalls,
+    rootBegins,
+    async reserve() {
+      reserveCalls.n += 1;
+      const slot = checkout();
+      slot.held = true;
+      return {
+        async unsafe(sql) {
+          return rowsFor(sql);
+        },
+        release() {
+          slot.held = false;
+        },
+      };
+    },
+    async unsafe(sql) {
+      const slot = checkout();
+      const head = sql.trim().split(/\s+/)[0]?.toUpperCase();
+      if (head === "BEGIN") {
+        rootBegins.n += 1;
+        slot.held = true;
+        return [];
+      }
+      if (head === "COMMIT" || head === "ROLLBACK") {
+        slot.held = false;
+        return [];
+      }
+      return rowsFor(sql);
+    },
+  };
+  return client;
+}
+
+describe("sql-session RLS stamp on pooled postgres", () => {
+  test("pins the stamp through reserve — no leaked root BEGIN", async () => {
+    const pool = createTinyPoolClient(2);
+    const connection = await connectPostgres({ client: pool, role: "primary" });
+    const handle = createSqlStoreHandle("sql:app", {
+      connection,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+      rls: { gate: "member", userId: "alice", scopes: ["member"] },
+    });
+
+    const [a, b] = await Promise.all([
+      handle.raw(`SELECT id, owner FROM notes`),
+      handle.raw(`SELECT id, owner FROM notes`),
+    ]);
+
+    expect(a).toEqual([{ id: "a", owner: "alice" }]);
+    expect(b).toEqual([{ id: "a", owner: "alice" }]);
+    expect(pool.reserveCalls.n).toBe(2);
+    expect(pool.rootBegins.n).toBe(0);
+  });
+
+  test("table browse SELECT pins through reserve like any other stamped query", async () => {
+    const pool = createTinyPoolClient(2);
+    const connection = await connectPostgres({ client: pool, role: "primary" });
+    const handle = createSqlStoreHandle("sql:app", {
+      connection,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+      rls: { gate: "member", userId: "alice", scopes: ["member"] },
+    });
+    const rows = await handle.raw(`SELECT * FROM "notes" LIMIT 50`);
+    expect(rows).toEqual([{ id: "a", owner: "alice" }]);
+    expect(pool.reserveCalls.n).toBe(1);
+    expect(pool.rootBegins.n).toBe(0);
+  });
+
+  test("standalone BEGIN on a 2-slot pool reproduces checkout timeout", async () => {
+    const pool = createTinyPoolClient(2);
+    await expect(pool.unsafe("BEGIN")).resolves.toEqual([]);
+    await expect(pool.unsafe("BEGIN")).resolves.toEqual([]);
+    await expect(pool.unsafe("SET LOCAL ROLE oke_app")).rejects.toThrow("checkout timeout");
+  });
+});

package/src/elements/store/sql-select.types.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Type-level proof: `select().from(store.schema.table())` resolves to the
+ * declared column JS shape — not `SqlRow`.
+ */
+import { describe, expect, test } from "bun:test";
+
+import type { SqlRow } from "../../drivers/types.ts";
+import { field, schemaTable } from "./schema-decl.ts";
+import type { InferSelectRow, SqlStoreHandle } from "./sql-session.ts";
+import { defineTable } from "./table.ts";
+
+/** Compile-time equality. */
+type Eq<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+type Assert<T extends true> = T;
+
+const items = schemaTable("items", {
+  id: field.text().primaryKey(),
+  title: field.text().notNull(),
+  note: field.text(),
+  count: field.integer().notNull(),
+  score: field.integer(),
+});
+
+type ExpectedRow = {
+  id: string;
+  title: string;
+  note: string | null;
+  count: number;
+  score: number | null;
+};
+
+async function selectAll(db: SqlStoreHandle) {
+  return db.select().from(items);
+}
+
+async function selectWhere(db: SqlStoreHandle) {
+  return db.select().from(items).where({ id: "x" });
+}
+
+async function selectOrder(db: SqlStoreHandle) {
+  return db.select().from(items).orderBy(items.title);
+}
+
+async function selectLimit(db: SqlStoreHandle) {
+  return db.select().from(items).limit(1);
+}
+
+async function selectProj(db: SqlStoreHandle) {
+  return db.select({ title: items.title }).from(items);
+}
+
+const bare = defineTable("bare", { id: { name: "id" } });
+
+async function selectBare(db: SqlStoreHandle) {
+  return db.select().from(bare);
+}
+
+type _Infer = Assert<Eq<InferSelectRow<typeof items>, ExpectedRow>>;
+type _All = Assert<Eq<Awaited<ReturnType<typeof selectAll>>, ExpectedRow[]>>;
+type _Where = Assert<Eq<Awaited<ReturnType<typeof selectWhere>>, ExpectedRow[]>>;
+type _Order = Assert<Eq<Awaited<ReturnType<typeof selectOrder>>, ExpectedRow[]>>;
+type _Limit = Assert<Eq<Awaited<ReturnType<typeof selectLimit>>, ExpectedRow[]>>;
+type _Proj = Assert<Eq<Awaited<ReturnType<typeof selectProj>>, SqlRow[]>>;
+type _Bare = Assert<Eq<Awaited<ReturnType<typeof selectBare>>, SqlRow[]>>;
+
+describe("select().from() row inference", () => {
+  test("type-level row shape matches declared columns", () => {
+    const _keep: _Infer & _All & _Where & _Order & _Limit & _Proj & _Bare = true;
+    expect(_keep).toBe(true);
+  });
+});

package/src/elements/store/sql-session.ts

@@ -7,6 +7,12 @@
 
 import type { DomainDdlMode } from "../../config/index.ts";
 import type { ClassificationMap, SqlConnection, SqlRow } from "../../drivers/types.ts";
+import {
+  buildRlsIdentityPreludeSql,
+  installOkeRlsHelpers,
+  RLS_CONTEXT_DRIVERS,
+  type RlsIdentity,
+} from "../../drivers/pg-rls.ts";
 import { throwOke } from "../../kernel/errors.ts";
 import { maskRows, tableFromSql } from "./classify.ts";
 import { isMissingDomainRelationError } from "./missing-relation.ts";
@@ -28,6 +34,54 @@ import {
 
 export type { WhereMap } from "./sql-condition.ts";
 
+/**
+ * Inferred select-row shape for a table handle.
+ *
+ * Uses `$inferSelect` when present (OKE `store.schema.table()` and Drizzle
+ * `pgTable()` / `sqliteTable()`). Bare {@link TableHandle} / `unknown` stay
+ * {@link SqlRow}.
+ */
+export type InferSelectRow<T> = T extends { readonly $inferSelect: infer R } ? R : SqlRow;
+
+/** Serialize stamp frames on a shared connection so concurrent identities cannot interleave. */
+const rlsStampTails = new WeakMap<SqlConnection, Promise<unknown>>();
+
+/**
+ * True when SQL must not enter an RLS identity frame (txn control or DDL).
+ *
+ * @param sql - Statement
+ */
+export function isRlsStampExemptSql(sql: string): boolean {
+  return /^\s*(begin|commit|rollback|create|alter|drop|truncate|grant|revoke|comment)\b/i.test(sql);
+}
+
+/**
+ * Run `fn` after any in-flight stamp on `connection` finishes.
+ *
+ * @param connection - Shared SQL connection
+ * @param fn - Stamp frame
+ */
+async function withRlsStampLock<T>(connection: SqlConnection, fn: () => Promise<T>): Promise<T> {
+  const prev = rlsStampTails.get(connection) ?? Promise.resolve();
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  rlsStampTails.set(
+    connection,
+    prev.then(
+      () => gate,
+      () => gate,
+    ),
+  );
+  await prev.catch(() => undefined);
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+
 /** Options for a SQL session. */
 export interface SqlSessionOptions {
   /** Open connection (already role-routed). */
@@ -44,50 +98,52 @@ export interface SqlSessionOptions {
    * and local+autoPush). Default `ensure` for backward-compatible tests.
    */
   readonly domainDdl?: DomainDdlMode;
+  /** Gate identity — stamps `oke.*` on postgres / pglite. */
+  readonly rls?: RlsIdentity;
 }
 
 /**
  * Continuations after `.orderBy(...)` — awaitable, optional `.limit` /
  * `.offset`.
  */
-export interface SelectOrderBuilder extends PromiseLike<SqlRow[]> {
+export interface SelectOrderBuilder<TRow = SqlRow> extends PromiseLike<TRow[]> {
   /**
    * Cap the number of returned rows.
    *
    * @param n - Max rows
    */
-  limit(n: number): Promise<SqlRow[]>;
+  limit(n: number): Promise<TRow[]>;
   /**
    * Skip the first `n` rows (`LIMIT … OFFSET …`).
    *
    * @param n - Rows to skip
    */
-  offset(n: number): Promise<SqlRow[]>;
+  offset(n: number): Promise<TRow[]>;
 }
 
 /**
  * Continuations after `.where(...)` on a select — awaitable, optional
  * `.orderBy(...)` / `.limit(...)` / `.offset(...)`.
  */
-export interface SelectWhereBuilder extends PromiseLike<SqlRow[]> {
+export interface SelectWhereBuilder<TRow = SqlRow> extends PromiseLike<TRow[]> {
   /**
    * Order rows with Drizzle `asc()` / `desc()` terms.
    *
    * @param orders - Order terms
    */
-  orderBy(...orders: readonly unknown[]): SelectOrderBuilder;
+  orderBy(...orders: readonly unknown[]): SelectOrderBuilder<TRow>;
   /**
    * Cap the number of returned rows.
    *
    * @param n - Max rows
    */
-  limit(n: number): Promise<SqlRow[]>;
+  limit(n: number): Promise<TRow[]>;
   /**
    * Skip the first `n` rows.
    *
    * @param n - Rows to skip
    */
-  offset(n: number): Promise<SqlRow[]>;
+  offset(n: number): Promise<TRow[]>;
 }
 
 /**
@@ -95,42 +151,49 @@ export interface SelectWhereBuilder extends PromiseLike<SqlRow[]> {
  * `.where(...)` / `.orderBy(...)` / `.limit(...)` / `.offset(...)` in any
  * order.
  */
-export interface SelectFromBuilder extends PromiseLike<SqlRow[]> {
+export interface SelectFromBuilder<TRow = SqlRow> extends PromiseLike<TRow[]> {
   /**
    * Filter with a plain equality map or a Drizzle SQL condition
    * (`eq`, `and`, `or`, `lt`, `like`, …).
    *
    * @param where - Condition
    */
-  where(where: unknown): SelectWhereBuilder;
+  where(where: unknown): SelectWhereBuilder<TRow>;
   /**
    * Order rows with Drizzle `asc()` / `desc()` terms.
    *
    * @param orders - Order terms
    */
-  orderBy(...orders: readonly unknown[]): SelectOrderBuilder;
+  orderBy(...orders: readonly unknown[]): SelectOrderBuilder<TRow>;
   /**
    * Cap the number of returned rows.
    *
    * @param n - Max rows
    */
-  limit(n: number): Promise<SqlRow[]>;
+  limit(n: number): Promise<TRow[]>;
   /**
    * Skip the first `n` rows.
    *
    * @param n - Rows to skip
    */
-  offset(n: number): Promise<SqlRow[]>;
+  offset(n: number): Promise<TRow[]>;
 }
 
-/** Fluent select builder. */
-export interface SelectBuilder {
+/**
+ * Fluent select builder.
+ *
+ * `TLocked` is `undefined` for `select()` (row type inferred from `.from`)
+ * and {@link SqlRow} for `select({ alias: col })` projections.
+ */
+export interface SelectBuilder<TLocked extends SqlRow | undefined = undefined> {
   /**
    * Choose the source table.
    *
    * @param table - Table handle or Drizzle table
    */
-  from(table: TableHandle | unknown): SelectFromBuilder;
+  from<TTable>(
+    table: TTable,
+  ): SelectFromBuilder<TLocked extends undefined ? InferSelectRow<TTable> : TLocked>;
 }
 
 /** Fluent insert builder. */
@@ -197,12 +260,13 @@ export interface SqlStoreHandle {
   /** Underlying driver id. */
   readonly driverId: SqlConnection["driverId"];
   /**
-   * Start a select. Optional column map projects / aliases columns
-   * (`select({ clicks: links.clicks })`).
+   * Start a select. No-arg form infers the row from `.from(table)`.
+   * A column map (`select({ clicks: links.clicks })`) stays {@link SqlRow}.
    *
    * @param columns - Optional `{ alias: drizzleColumn }` map
    */
-  select(columns?: unknown): SelectBuilder;
+  select(): SelectBuilder<undefined>;
+  select(columns: unknown): SelectBuilder<SqlRow>;
   /**
    * Start an insert into `table`.
    *
@@ -339,8 +403,9 @@ export function createSqlStoreHandle(
   ref: `sql:${string}`,
   options: SqlSessionOptions,
 ): SqlStoreHandle {
-  const { connection, classifications, revealPii } = options;
+  const { connection, classifications, revealPii, rls } = options;
   const domainDdl: DomainDdlMode = options.domainDdl ?? "ensure";
+  let helpersReady = false;
 
   function mask(rows: SqlRow[], table?: string): SqlRow[] {
     return maskRows(rows, { classifications, table, revealPii });
@@ -362,11 +427,41 @@ export function createSqlStoreHandle(
   }
 
   function query(sql: string, params: readonly unknown[] = []): Promise<SqlRow[]> {
-    return withSchemaGuard(() => connection.query(sql, params));
+    return withSchemaGuard(() => withRlsStamp((conn) => conn.query(sql, params), sql));
   }
 
   function exec(sql: string, params: readonly unknown[] = []): Promise<{ changes: number }> {
-    return withSchemaGuard(() => connection.exec(sql, params));
+    return withSchemaGuard(() => withRlsStamp((conn) => conn.exec(sql, params), sql));
+  }
+
+  async function withRlsStamp<T>(fn: (conn: SqlConnection) => Promise<T>, sql: string): Promise<T> {
+    if (!rls || !RLS_CONTEXT_DRIVERS.has(connection.driverId)) return fn(connection);
+    if (isRlsStampExemptSql(sql)) return fn(connection);
+    const run = (): Promise<T> => applyRlsStamp(fn);
+    // PGlite is one backend session — concurrent identities must not interleave.
+    // Pooled postgres pins each stamp via `transaction()` instead.
+    if (connection.driverId === "pglite") {
+      return withRlsStampLock(connection, run);
+    }
+    return run();
+  }
+
+  async function applyRlsStamp<T>(fn: (conn: SqlConnection) => Promise<T>): Promise<T> {
+    if (!rls) return fn(connection);
+    if (!helpersReady) {
+      await installOkeRlsHelpers((sql) => connection.exec(sql));
+      helpersReady = true;
+    }
+    const frame = async (tx: SqlConnection): Promise<T> => {
+      for (const stmt of buildRlsIdentityPreludeSql(rls)) {
+        await tx.exec(stmt.sql, stmt.params ?? []);
+      }
+      return fn(tx);
+    };
+    if (!connection.transaction) {
+      throw new Error("RLS stamp needs SqlConnection.transaction to pin SET LOCAL");
+    }
+    return connection.transaction(frame);
   }
 
   async function ensureFromMeta(table: TableHandle | unknown): Promise<void> {
@@ -522,20 +617,20 @@ export function createSqlStoreHandle(
     };
   }
 
-  const handle: SqlStoreHandle = {
+  const handle = {
     ref,
     routedRole: options.routedRole,
     driverId: connection.driverId,
 
-    select(columns?) {
+    select(columns?: unknown) {
       return {
-        from(table) {
+        from(table: TableHandle | unknown) {
           return selectFrom(table, columns);
         },
       };
     },
 
-    insert(table): InsertBuilder {
+    insert(table: TableHandle | unknown): InsertBuilder {
       const name = resolveTableName(table);
       return {
         values(row) {
@@ -570,7 +665,7 @@ export function createSqlStoreHandle(
       };
     },
 
-    update(table): UpdateBuilder {
+    update(table: TableHandle | unknown): UpdateBuilder {
       const name = resolveTableName(table);
       return {
         set(row) {
@@ -597,7 +692,7 @@ export function createSqlStoreHandle(
       };
     },
 
-    async findById(table, idValue) {
+    async findById(table: TableHandle | unknown, idValue: string) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const pk = resolvePkColumn(table);
@@ -638,7 +733,7 @@ export function createSqlStoreHandle(
       return builder;
     }) as SqlStoreHandle["delete"],
 
-    async exists(table, idOrWhere) {
+    async exists(table: TableHandle | unknown, idOrWhere: string | WhereMap) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const where: WhereMap =
@@ -656,7 +751,12 @@ export function createSqlStoreHandle(
       return rows.length > 0;
     },
 
-    async upsert(table, matchOn, values, upsertOptions) {
+    async upsert(
+      table: TableHandle | unknown,
+      matchOn: WhereMap | unknown,
+      values: SqlRow,
+      upsertOptions?: { readonly onExisting?: "update" },
+    ) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const compiled = compileTableWhere(table, matchOn);
@@ -688,7 +788,7 @@ export function createSqlStoreHandle(
       return { status: "changed" as const };
     },
 
-    async increment(table, idValue, column, by = 1) {
+    async increment(table: TableHandle | unknown, idValue: string, column: string, by = 1) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const pk = resolvePkColumn(table);
@@ -707,7 +807,7 @@ export function createSqlStoreHandle(
       return asNumber(row[sqlCol], sqlCol);
     },
 
-    async raw(sql, params = []) {
+    async raw(sql: string, params: readonly unknown[] = []) {
       const table = tableFromSql(sql);
       // Memory SQL (console-next seed) implements DML on `exec`, not `query`.
       // SELECT / RETURNING still go through `query` so callers get rows.
@@ -719,7 +819,7 @@ export function createSqlStoreHandle(
       return mask(rows, table);
     },
 
-    async count(table, where) {
+    async count(table: TableHandle | unknown, where?: unknown) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       let sql = `SELECT COUNT(*) AS "count" FROM ${quoteIdent(name)}`;
@@ -735,7 +835,7 @@ export function createSqlStoreHandle(
       return asNumber(rows[0]?.count ?? rows[0]?.COUNT ?? 0, "count");
     },
 
-    async page(table, options) {
+    async page(table: TableHandle | unknown, options: SqlPageOptions) {
       if (options.after !== undefined && options.before !== undefined) {
         throw new Error("page(): after and before (keyset) cannot combine");
       }
@@ -760,7 +860,7 @@ export function createSqlStoreHandle(
       });
     },
 
-    async ensureTable(table) {
+    async ensureTable(table: TableHandle) {
       const cols = Object.values(table.columns);
       const pk = resolvePkColumn(table);
       const intType =
@@ -785,7 +885,7 @@ export function createSqlStoreHandle(
     },
   };
 
-  return handle;
+  return handle as SqlStoreHandle;
 }
 
 /**

package/src/elements/store/upsert-app.test.ts

@@ -45,7 +45,7 @@ describe("fx.store(db).upsert via app.fetch (real boot)", () => {
     const db = store.sql("app", { schema: { notes } });
 
     const seed = on(
-      http.post("/seed").gate.public,
+      http.post("/seed").public(),
       flow("notes.seed", {
         in: UpsertIn,
         out: UpsertOut,

package/src/elements/store.ts

@@ -26,6 +26,11 @@ export {
   schema,
   schemaTable,
   schemaRelations,
+  schemaRls,
+  schemaPolicy,
+  schemaPolicyGate,
+  schemaPolicyOwner,
+  schemaPolicyScope,
   isSchemaTableDecl,
   isSchemaColumnDecl,
   isSchemaRelationsDecl,
@@ -42,7 +47,11 @@ export type {
   SchemaColumnInput,
   SchemaTableDecl,
   SchemaTableWithColumns,
+  InferColumnJs,
+  FinalizeColumn,
   SchemaRelationsDecl,
+  SchemaPolicyDecl,
+  SchemaTableExtra,
   SchemaRelationEntry,
   SchemaRelationOne,
   SchemaRelationMany,
@@ -114,6 +123,7 @@ export type {
   SelectFromBuilder,
   SelectWhereBuilder,
   SelectOrderBuilder,
+  InferSelectRow,
   InsertBuilder,
   InsertValuesBuilder,
   SqlSessionOptions,
@@ -123,6 +133,13 @@ export type {
   WhereMap,
 } from "./store/sql-session.ts";
 
+export {
+  resolveRlsIdentity,
+  rlsIdentityFromAuth,
+  firstPolicyOrPublic,
+  policyGateForScopes,
+} from "./store/rls-identity.ts";
+export type { RlsIdentityRow, ResolveRlsIdentityInput } from "./store/rls-identity.ts";
 export { createStoreRuntime, putTier2 } from "./store/runtime.ts";
 export type {
   StoreRuntime,

package/src/http.ts

@@ -8,7 +8,7 @@
  * ```ts
  * import { on, flow, http, gate, oke, createBunRuntime } from "okengine/http";
  *
- * on(http.get("/").gate.public, flow("ping", { do: () => "Hi" }));
+ * on(http.get("/").public(), flow("ping", { do: () => "Hi" }));
  * const app = oke({ name: "ping" });
  * createBunRuntime().serve(app);
  * ```
@@ -24,15 +24,32 @@ export { fail, type FlowFailure } from "./kernel/errors.ts";
 export { isFlowFailure } from "./kernel/hooks.ts";
 export { plugin, isPlugin, type PluginDef } from "./kernel/plugin.ts";
 export { createBunRuntime, APP_PORT, type Runtime, type ServeOptions } from "./runtime/index.ts";
-export type { OkeApp, OkeOptions, ReadyState } from "./kernel/app.ts";
+export type {
+  OkeApp,
+  OkeOptions,
+  ReadyState,
+  RegisteredFlowUnits,
+  RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
+export { registerFlowUnits } from "./kernel/flow-units.ts";
+export { stampFlowName, stampHttpPath } from "./kernel/stamp-http.ts";
 
-import { oke as okeCore, type OkeApp, type OkeOptions } from "./kernel/app.ts";
+import {
+  oke as okeCore,
+  type OkeApp,
+  type OkeOptions,
+  type RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
 
 /**
  * Create an HTTP-oriented app — defaults `router` to `"edge"` when omitted.
  *
  * @param options - Application options
  */
+export function oke(
+  options: OkeOptions & { readonly registry: "ignore" },
+): OkeApp<Record<string, never>, Record<string, never>>;
+export function oke(options: OkeOptions): OkeApp<{}, RoutesFromRegisteredUnits>;
 export function oke(options: OkeOptions): OkeApp {
   return okeCore({
     ...options,

package/src/index.ts

@@ -14,10 +14,19 @@
  * @module
  */
 
-export { oke, type OkeApp, type OkeOptions, type ReadyState } from "./kernel/app.ts";
+export {
+  oke,
+  type OkeApp,
+  type OkeOptions,
+  type ReadyState,
+  type RegisteredFlowUnits,
+  type RoutesFromRegisteredUnits,
+} from "./kernel/app.ts";
 export { on, type Binding } from "./kernel/on.ts";
 export { flow, isFlow, type FlowDef } from "./kernel/flow.ts";
 export { http, every, internal, table } from "./kernel/triggers.ts";
+export { registerFlowUnits } from "./kernel/flow-units.ts";
+export { stampFlowName, stampHttpPath } from "./kernel/stamp-http.ts";
 export { fail, type FlowFailure, type FlowErrorValue } from "./kernel/errors.ts";
 export { isFlowFailure } from "./kernel/hooks.ts";
 export { plugin, isPlugin, type PluginDef, type PluginCapabilities } from "./kernel/plugin.ts";
@@ -53,6 +62,7 @@ export {
   type StoreDecl,
   type StoreRuntime,
   type SqlStoreHandle,
+  type InferSelectRow,
   type TableHandle,
   type SchemaTableDecl,
   type SchemaColumnDecl,