okengine 0.15.2 → 0.17.0

package/src/kernel/app.ts

@@ -17,6 +17,7 @@ import {
   type RoutesFromNamespace,
   type RuntimeRouteMap,
 } from "./adopt-routes.ts";
+import { liveExposureKey, liveGatesKey, liveMatchKeyFromPath } from "./live-http.ts";
 // `./boot.ts` pulls in every element + driver module (vault, store, signal,
 // clock, gate, channel, ai, runs) — a type-only import here keeps that whole
 // graph out of the cold-start path; `doBoot` below loads it lazily, only
@@ -24,6 +25,7 @@ import {
 import type { BootOptions, BootResult, ElementRuntimes } from "./boot.ts";
 import type { CapabilityToken } from "./capability.ts";
 import type { AppAuthBinding } from "./auth-resolve.ts";
+import type { ApiKeyStore } from "../auth/api-keys.ts";
 import type { AuthHttpMaterialization } from "../auth/bindings.ts";
 import type { WiredGateAuth } from "./app-auth.ts";
 import {
@@ -32,25 +34,24 @@ import {
   type ResolvedGateConfig,
 } from "../elements/gate/config.ts";
 import { requirePackageModule } from "../shared/lazy-src.ts";
+import { lazyRequire } from "./lazy-require.ts";
+import type { DurableResult, RunDurableOptions } from "../elements/clock/durable.ts";
 import type { TemplateCatalog } from "../elements/channel/runtime.ts";
 import { parseAcceptLanguage } from "../elements/channel/locale.ts";
 import { runWithLocale } from "../i18n/locale-context.ts";
-import { runDurable } from "../elements/clock/durable.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
 import { failureFromUnknown, runCompensationPhase } from "./compensate.ts";
 import { withAbortSignal } from "./abort-scope.ts";
 import { fxRetry } from "./concurrency.ts";
-import {
-  createFxContext,
-  freezePrincipal,
-  isJsonStreamResult,
-  resolveName,
-  type CreateFxOptions,
-  type Fx,
-  type FxAuth,
-  type FxOperator,
-  type FxPrincipal,
-  type NamedRef,
+import type {
+  CreateFxOptions,
+  Fx,
+  FxAuth,
+  FxContext,
+  FxOperator,
+  FxPrincipal,
+  JsonStreamResult,
+  NamedRef,
 } from "./fx.ts";
 import {
   currentDevSurface,
@@ -151,6 +152,31 @@ function loadMessages(): typeof import("../i18n/messages.ts") {
   return requirePackageModule("i18n/messages", "messages");
 }
 
+/**
+ * `createFx` / JSON result helpers — loaded on first execute, not on Store-only
+ * `oke()` construction (same boundary as `boot.ts`).
+ */
+function loadFx(): {
+  createFxContext: (options: CreateFxOptions) => FxContext;
+  freezePrincipal: (p: FxPrincipal) => FxPrincipal;
+  isJsonStreamResult: (value: unknown) => value is JsonStreamResult;
+  resolveName: (ref: NamedRef) => string;
+} {
+  return lazyRequire(import.meta.dir, ["fx", "runtime"].join("-"));
+}
+
+/** App-shell tenancy wiring — loaded only when `gate.auth.tenant` is on. */
+function loadAppTenant(): { w: (kind: number, ...args: unknown[]) => unknown } {
+  return lazyRequire(import.meta.dir, ["app", "tenant"].join("-"));
+}
+
+/** Durable runner — statically imports `createFx`; keep it off Store-only `oke()`. */
+function loadDurable(): {
+  runDurable: (opts: RunDurableOptions) => Promise<DurableResult>;
+} {
+  return lazyRequire(import.meta.dir, ["clock", "durable"].join("-"));
+}
+
 /** Options for {@link oke}. */
 export interface OkeOptions {
   /** Application name (Manifest `app`). */
@@ -371,6 +397,8 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
    * Builtin auth binding after boot (session store + secret), when configured.
    */
   readonly authBinding: AppAuthBinding | undefined;
+  /** Shared API key store when `gate.auth` is enabled. */
+  readonly apiKeys: ApiKeyStore | undefined;
   /**
    * Attach a plugin app-wide. Scope is the attachment point.
    * Types accumulate — decorations are visible on downstream handlers.
@@ -462,6 +490,8 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
       readonly parentId?: string;
       /** Explicit run / WideEvent id (defaults to a new UUID). */
       readonly runId?: string;
+      /** Tenant identity for cron / `fx.call` (propagated, unlike auth). */
+      readonly tenant?: { readonly id: string | null };
     },
   ): Promise<ExecuteResult>;
   /**
@@ -495,8 +525,12 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
    * Invoke all flows bound to an `every` interval.
    *
    * @param interval - Interval string (e.g. `"1h"`)
+   * @param extras - Optional tenant / parent for per-tenant clocks
    */
-  dispatchEvery(interval: string): Promise<ExecuteResult[]>;
+  dispatchEvery(
+    interval: string,
+    extras?: { readonly tenant?: { readonly id: string | null } },
+  ): Promise<ExecuteResult[]>;
   /**
    * Invoke all flows bound to a CDC table change.
    *
@@ -607,6 +641,57 @@ function assertHttpBindingReady(binding: Binding): void {
   }
 }
 
+/**
+ * Register one HTTP binding: unique method+path, unique live exposure key.
+ *
+ * @param binding - HTTP binding
+ * @param seenHttpRoutes - `METHOD path` keys
+ * @param seenLiveExposures - `(signal, gates, match)` keys
+ * @param smart - Router
+ * @param compiled - Compiled route map
+ * @param aot - AoT compile flag
+ */
+function registerHttpRoute(
+  binding: Binding,
+  seenHttpRoutes: Set<string>,
+  seenLiveExposures: Map<string, string>,
+  smart: { add(method: string, path: string, value: Binding): void },
+  compiled: WeakMap<Binding, CompiledRoute>,
+  aot: boolean,
+): void {
+  const trigger = binding.trigger;
+  if (trigger.kind !== "http") return;
+  const routeKey = `${trigger.method} ${trigger.path}`;
+  if (seenHttpRoutes.has(routeKey)) {
+    throwOke("HTTP_ROUTE_DUPLICATE", {
+      method: trigger.method,
+      path: trigger.path,
+      flow: binding.flow.name || "(unnamed)",
+    });
+  }
+  seenHttpRoutes.add(routeKey);
+  if (trigger.liveSignal !== undefined) {
+    const matchKey = binding.flow.liveCustomMatch
+      ? `custom:${binding.flow.name}`
+      : liveMatchKeyFromPath(trigger.path);
+    const exposure = liveExposureKey(
+      trigger.liveSignal.name,
+      liveGatesKey(trigger.gates),
+      matchKey,
+    );
+    if (seenLiveExposures.has(exposure)) {
+      throwOke("LIVE_EXPOSURE_DUPLICATE", {
+        signal: trigger.liveSignal.name,
+        gates: liveGatesKey(trigger.gates) || "(none)",
+        match: matchKey || "(firehose)",
+      });
+    }
+    seenLiveExposures.set(exposure, binding.flow.name);
+  }
+  smart.add(trigger.method, trigger.path, binding);
+  compiled.set(binding, compileHttpBinding(binding, aot));
+}
+
 /**
  * Fold `generated.ts` units into `$routes` and `flowsByName`.
  *
@@ -787,20 +872,11 @@ export function oke(options: OkeOptions): OkeApp {
 
   const smart = createRouter<Binding>(options.router ?? "default");
   const seenHttpRoutes = new Set<string>();
+  const seenLiveExposures = new Map<string, string>();
   for (const b of adopted) {
     if (b.trigger.kind === "http") {
       assertHttpBindingReady(b);
-      const key = `${b.trigger.method} ${b.trigger.path}`;
-      if (seenHttpRoutes.has(key)) {
-        throwOke("HTTP_ROUTE_DUPLICATE", {
-          method: b.trigger.method,
-          path: b.trigger.path,
-          flow: b.flow.name || "(unnamed)",
-        });
-      }
-      seenHttpRoutes.add(key);
-      smart.add(b.trigger.method, b.trigger.path, b);
-      compiled.set(b, compileHttpBinding(b, aot));
+      registerHttpRoute(b, seenHttpRoutes, seenLiveExposures, smart, compiled, aot);
     }
   }
   // Defer SmartRouter selection until first match so `.plug()` can still
@@ -812,17 +888,7 @@ export function oke(options: OkeOptions): OkeApp {
     registerFlow(b.flow);
     if (b.trigger.kind === "http") {
       assertHttpBindingReady(b);
-      const key = `${b.trigger.method} ${b.trigger.path}`;
-      if (seenHttpRoutes.has(key)) {
-        throwOke("HTTP_ROUTE_DUPLICATE", {
-          method: b.trigger.method,
-          path: b.trigger.path,
-          flow: b.flow.name || "(unnamed)",
-        });
-      }
-      seenHttpRoutes.add(key);
-      smart.add(b.trigger.method, b.trigger.path, b);
-      compiled.set(b, compileHttpBinding(b, aot));
+      registerHttpRoute(b, seenHttpRoutes, seenLiveExposures, smart, compiled, aot);
     }
   }
 
@@ -941,12 +1007,15 @@ export function oke(options: OkeOptions): OkeApp {
   }
 
   async function handleCronFire(name: string): Promise<void> {
-    await app.dispatchEvery(name);
+    const extras = gateConfig.auth?.tenant
+      ? (loadAppTenant().w(0, name) as { readonly tenant: { readonly id: string } } | undefined)
+      : undefined;
+    await app.dispatchEvery(name, extras);
     // Named clocks (e.g. `clock("expire-stale", { every: "1h" })`) reconcile
     // to a store row whose effective interval may differ from the cron name.
     const row = await bootResult?.clock?.store.get(name);
     if (row?.effectiveEvery && row.effectiveEvery !== name) {
-      await app.dispatchEvery(row.effectiveEvery);
+      await app.dispatchEvery(row.effectiveEvery, extras);
     }
   }
 
@@ -1001,15 +1070,20 @@ export function oke(options: OkeOptions): OkeApp {
         return;
       }
       const { store, instanceId, leaseMs } = activeJournal();
+      const existing = await store.get(runId);
       try {
-        await runDurable({
+        await loadDurable().runDurable({
           flow: flowDef,
           input,
           journalStore: store,
           runId,
           ...(hasJournalLease(store) ? { lease: { instanceId, leaseMs } } : {}),
           now,
-          fx: durableResumeFx(),
+          fx: {
+            ...durableResumeFx(),
+            ...(gateConfig.auth?.tenant ? (loadAppTenant().w(5, gateConfig.auth) as object) : {}),
+            ...(existing?.tenant ? { tenant: { id: existing.tenant } } : {}),
+          },
         });
       } catch (err) {
         if (isJournalLeaseBusy(err)) return;
@@ -1173,9 +1247,19 @@ export function oke(options: OkeOptions): OkeApp {
       onCronFire: overrides?.onCronFire ?? handleCronFire,
       onSignal: overrides?.onSignal ?? handleSignalFire,
       onDurableResume: overrides?.onDurableResume ?? handleDurableResume,
+      ...(gateConfig.auth?.tenantStore
+        ? (loadAppTenant().w(1, gateConfig.auth.tenantStore) as object)
+        : {}),
     };
     const result = await bootApplication(merged);
     bootResult = result;
+    if (gateConfig.auth?.tenantStore && result.clock) {
+      loadAppTenant().w(2, gateConfig.auth.tenantStore, result.clock.store, merged.clocks ?? []);
+    }
+    if (gateConfig.auth?.apiKeyStore && result.store) {
+      const { bindHostApiKeySqlFromStore } = await import("../auth/api-key-sql.ts");
+      await bindHostApiKeySqlFromStore(result.store, gateConfig.auth.apiKeyStore);
+    }
     // otp() provider / app mode capability — fail loud at boot, never silent downgrade.
     if (result.channel) {
       const { assertOtpPluginCapability } = await import("../auth/otp-capability.ts");
@@ -1259,6 +1343,8 @@ export function oke(options: OkeOptions): OkeApp {
       readonly parentId?: string;
       /** Explicit run / WideEvent id (defaults to a new UUID). */
       readonly runId?: string;
+      /** Tenant identity for cron / `fx.call` (propagated, unlike auth). */
+      readonly tenant?: { readonly id: string | null };
     },
   ): Promise<ExecuteResult> {
     registerFlow(flowDef);
@@ -1283,8 +1369,8 @@ export function oke(options: OkeOptions): OkeApp {
           resolvedLocale,
           defaultLocale,
         });
-      const signal = extras?.request?.signal;
-      return signal ? withAbortSignal(signal, run) : run();
+      const abort = extras?.request?.signal;
+      return abort ? withAbortSignal(abort, run) : run();
     });
   }
 
@@ -1307,12 +1393,15 @@ export function oke(options: OkeOptions): OkeApp {
       readonly locale?: string;
       readonly parentId?: string;
       readonly runId?: string;
+      readonly tenant?: { readonly id: string | null };
     };
     readonly resolvedLocale: string;
     readonly defaultLocale: string;
   }): Promise<ExecuteResult> {
     const { flowDef, input, trigger, extras, resolvedLocale, defaultLocale } = args;
     const booted = await ensureBoot();
+    const tenantEnabled = gateConfig.auth?.tenant !== undefined;
+    const flowTenantScoped = flowDef.tenantScoped ?? tenantEnabled;
 
     const unitBag = flowDef.unit !== undefined ? unitHooks.get(flowDef.unit) : undefined;
     // app (hooks + plugs) → unit (hooks + plugs) → flow (hooks + plugs)
@@ -1365,8 +1454,10 @@ export function oke(options: OkeOptions): OkeApp {
           userId: options.fx?.auth?.userId ?? null,
           scopes: new Set(options.fx?.auth?.scopes ?? []),
           verified: options.fx?.auth?.verified,
+          apiKeyId: options.fx?.auth?.apiKeyId,
         },
         operator: { id: options.fx?.operator?.id ?? null },
+        tenant: { id: extras?.tenant?.id ?? options.fx?.tenant?.id ?? null },
       };
 
       // Principal injection: test harness (`env: "test"`) OR console-trusted
@@ -1383,6 +1474,8 @@ export function oke(options: OkeOptions): OkeApp {
       const cookieOpts = gateConfig.auth?.cookies;
       const cookieToken = wiredAuth?.tokenFromCookieHeader;
       const apiKeyStore = gateConfig.auth?.apiKeyStore;
+      const tenantEnabled = gateConfig.auth?.tenant !== undefined;
+      const flowTenantScoped = flowDef.tenantScoped ?? tenantEnabled;
       const elementHooks = createElementPipelineHooks({
         gates: booted.gate,
         principals,
@@ -1393,7 +1486,8 @@ export function oke(options: OkeOptions): OkeApp {
           : {}),
         verifyBearer:
           binding && wiredAuth
-            ? async (token) => wiredAuth.verifyBearerOrApiKey(binding, token, apiKeyStore)
+            ? (token, request) =>
+                wiredAuth.verifyBearerOrApiKey(binding, token, apiKeyStore, request)
             : undefined,
         // Phase 1a: opt-in cookie → Bearer when Authorization is absent.
         resolveToken:
@@ -1406,13 +1500,29 @@ export function oke(options: OkeOptions): OkeApp {
                 return cookieToken(request.headers.get("cookie"), cookieOpts);
               }
             : undefined,
+        ...(gateConfig.auth?.tenant && gateConfig.auth.tenantStore
+          ? (loadAppTenant().w(
+              3,
+              gateConfig.auth.tenant,
+              gateConfig.auth.tenantStore,
+              flowTenantScoped,
+              flowDef.plane,
+            ) as object)
+          : {}),
       });
 
       // Element hooks run first in the app-level onAuth/beforeHandle chain —
       // principal resolution and gate checks precede user-registered hooks.
       hooks = mergeHooks(
         {
-          onAuth: [elementHooks.onAuth],
+          onAuth: [
+            elementHooks.onAuth,
+            async () => {
+              if (journalSession && principals?.tenant.id) {
+                await journalSession.stampTenant(principals.tenant.id);
+              }
+            },
+          ],
           beforeHandle: [elementHooks.beforeHandle],
         },
         composedHooks,
@@ -1437,12 +1547,13 @@ export function oke(options: OkeOptions): OkeApp {
     }
 
     const effects = flowDef.effects ?? capability?.declared;
-    const { fx, ledger } = createFxContext({
+    const { fx, ledger } = loadFx().createFxContext({
       ...options.fx,
       flow: flowDef.name,
       effects,
       runTelemetry: telemetry,
       runId,
+      lastEventId: extras?.request?.headers.get("last-event-id") || undefined,
       now,
       i18n: {
         locale: resolvedLocale,
@@ -1450,7 +1561,28 @@ export function oke(options: OkeOptions): OkeApp {
         catalogs: loadMessages().getMessageCatalogs(),
         ...options.fx?.i18n,
       },
-      ...(principals ? { auth: principals.auth as FxAuth, operator: principals.operator } : {}),
+      ...(principals
+        ? {
+            auth: principals.auth,
+            operator: principals.operator,
+            tenant: principals.tenant,
+          }
+        : extras?.tenant
+          ? { tenant: { id: extras.tenant.id } }
+          : {}),
+      apiKeyStore: gateConfig.auth?.apiKeyStore,
+      sessions: authBinding?.sessions,
+      manifest: options.manifest,
+      ...(tenantEnabled || extras?.tenant
+        ? (loadAppTenant().w(4, {
+            enabled: tenantEnabled,
+            store: gateConfig.auth?.tenantStore,
+            scoped: flowTenantScoped,
+            plane: flowDef.plane,
+            tenant: principals?.tenant ?? (extras?.tenant ? { id: extras.tenant.id } : undefined),
+            bind: authBinding,
+          }) as object)
+        : {}),
       ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(extras?.trustedInvoke === true && extras.revealPii === true ? { revealPii: true } : {}),
       rlsGateNames: gateNamesOf(trigger),
@@ -1478,9 +1610,10 @@ export function oke(options: OkeOptions): OkeApp {
           callInput,
           { kind: "internal" } satisfies InternalTrigger,
           {
-            originPrincipal: freezePrincipal(fx.principal),
+            originPrincipal: loadFx().freezePrincipal(fx.principal),
             locale: resolvedLocale,
             parentId: runId,
+            ...(tenantEnabled ? { tenant: { id: fx.tenant.id } } : {}),
             ...(extras?.trustedInvoke === true && extras.revealPii === true
               ? { trustedInvoke: true, revealPii: true }
               : {}),
@@ -1582,7 +1715,7 @@ export function oke(options: OkeOptions): OkeApp {
                   durable: flowDef.durable,
                   effects: putEffects,
                 });
-              if (storeAfter && output !== undefined && !isJsonStreamResult(output)) {
+              if (storeAfter && output !== undefined && !loadFx().isJsonStreamResult(output)) {
                 const ttlMs =
                   typeof flowDef.cache === "string" ? cache.parseTtlMs(flowDef.cache) : undefined;
                 storeRt.putTier1(
@@ -1604,6 +1737,7 @@ export function oke(options: OkeOptions): OkeApp {
           }
           return await invoke(ctx.input);
         } catch (err) {
+          if (isFlowFailure(err)) return err;
           // A durable sleep that has not yet elapsed suspends the run — this
           // is a park, not a pipeline failure, so it must not throw upward.
           if (flowDef.durable && journalSession && isJournalSuspend(err)) {
@@ -1630,7 +1764,7 @@ export function oke(options: OkeOptions): OkeApp {
 
     const endedAt = now();
     const durationMs = resolveDurationMs(endedAt - startedAt, performance.now() - startedHr);
-    const streamOut = isJsonStreamResult(result.output) ? result.output : undefined;
+    const streamOut = loadFx().isJsonStreamResult(result.output) ? result.output : undefined;
 
     const finalizeRun = async (): Promise<void> => {
       // Stream rows land in Traces only after close. Measure wall time then
@@ -1699,7 +1833,11 @@ export function oke(options: OkeOptions): OkeApp {
       }
     };
 
-    if (streamOut && !isTerminalFailure(result)) {
+    if (
+      streamOut &&
+      !isTerminalFailure(result) &&
+      result.response?.headers.get("content-type")?.includes("text/event-stream")
+    ) {
       streamOut.finalize = finalizeRun;
     } else {
       await finalizeRun();
@@ -1780,6 +1918,7 @@ export function oke(options: OkeOptions): OkeApp {
     get authBinding() {
       return authBinding;
     },
+    apiKeys: gateConfig.auth?.apiKeyStore,
     async resumeDurable(now) {
       const t = now ?? bootResult?.clock?.now() ?? options.fx?.now?.() ?? Date.now();
       const { store, instanceId, leaseMs } = activeJournal();
@@ -1805,7 +1944,7 @@ export function oke(options: OkeOptions): OkeApp {
       for (const [runId, sleeper] of [...sleepingRuns.entries()]) {
         if (t < sleeper.wakeAt) continue;
         sleepingRuns.delete(runId);
-        const result = await runDurable({
+        const result = await loadDurable().runDurable({
           flow: sleeper.flow,
           input: sleeper.input,
           journalStore: store,
@@ -1861,7 +2000,7 @@ export function oke(options: OkeOptions): OkeApp {
     },
     flow(ref) {
       if (isFlow(ref)) return flowsByName.get(ref.name) ?? ref;
-      return flowsByName.get(resolveName(ref as NamedRef));
+      return flowsByName.get(loadFx().resolveName(ref as NamedRef));
     },
     adopt(...args: readonly unknown[]) {
       const flows = accumulateAdoptArgs(args, routes);
@@ -1957,7 +2096,7 @@ export function oke(options: OkeOptions): OkeApp {
           );
           runLabel = internalResult.runId;
           cacheLabel = internalResult.cache;
-          return respond(encodeExecuteResult(internalResult));
+          return respond(await encodeExecuteResult(internalResult));
         }
       }
 
@@ -2036,10 +2175,10 @@ export function oke(options: OkeOptions): OkeApp {
       runLabel = result.runId;
       cacheLabel = result.cache;
 
-      return respond(encodeExecuteResult(result));
+      return respond(await encodeExecuteResult(result));
     },
     async dispatchSignal(signal, payload, meta) {
-      const name = resolveName(signal);
+      const name = loadFx().resolveName(signal);
       const results: ExecuteResult[] = [];
       for (const b of adopted) {
         if (b.trigger.kind === "signal" && b.trigger.name === name) {
@@ -2052,11 +2191,11 @@ export function oke(options: OkeOptions): OkeApp {
       }
       return results;
     },
-    async dispatchEvery(interval) {
+    async dispatchEvery(interval, extras) {
       const results: ExecuteResult[] = [];
       for (const b of adopted) {
         if (b.trigger.kind === "every" && b.trigger.interval === interval) {
-          results.push(await execute(b.flow, undefined, b.trigger as EveryTrigger));
+          results.push(await execute(b.flow, undefined, b.trigger as EveryTrigger, extras));
         }
       }
       return results;
@@ -2077,7 +2216,7 @@ export function oke(options: OkeOptions): OkeApp {
     async call(ref, input) {
       const flowDef = isFlow(ref)
         ? (flowsByName.get(ref.name) ?? ref)
-        : flowsByName.get(resolveName(ref as NamedRef));
+        : flowsByName.get(loadFx().resolveName(ref as NamedRef));
       if (!flowDef) {
         return undefined;
       }

package/src/kernel/auth-resolve.ts

@@ -6,7 +6,7 @@
  * separately in the pipeline (`allowTestPrincipals`).
  */
 
-import { authenticateApiKey, type ApiKeyStore } from "../auth/api-keys.ts";
+import { authenticateApiKey, clientIpFromRequest, type ApiKeyStore } from "../auth/api-keys.ts";
 import type { ApiKeyRow } from "../auth/tables.ts";
 import {
   createSessionStore,
@@ -84,12 +84,15 @@ export function claimsToPrincipal(claims: AccessClaims): ResolvedPrincipal {
     userId: claims.sub,
     scopes: claims.scopes,
     verified: true,
+    ...(claims.tid !== undefined ? { tenantId: claims.tid } : {}),
   };
 }
 
 /**
  * Map an authenticated API key row to the pipeline principal shape.
- * Uses the bare key id so Access `runTouchesKey` matches `WideEvent.principal`.
+ *
+ * The key is the issuer with fewer gates: `userId` / `operatorId` is
+ * {@link ApiKeyRow.creatorId}. The credential id is {@link ResolvedPrincipal.apiKeyId}.
  *
  * @param row - Authenticated key
  */
@@ -97,19 +100,21 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
   if (row.plane === "operator") {
     return {
       plane: "operator",
-      operatorId: row.id,
+      operatorId: row.creatorId,
       userId: null,
       scopes: row.scopes,
       verified: true,
       apiKeyId: row.id,
+      ...(row.tenantId !== undefined ? { tenantId: row.tenantId } : {}),
     };
   }
   return {
     plane: "user",
-    userId: row.id,
+    userId: row.creatorId,
     scopes: row.scopes,
     verified: true,
     apiKeyId: row.id,
+    ...(row.tenantId !== undefined ? { tenantId: row.tenantId } : {}),
   };
 }
 
@@ -119,17 +124,20 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
  * @param auth - Session binding
  * @param token - Raw Bearer token
  * @param apiKeys - Optional key store
+ * @param request - Incoming request (allowlist IP is read here, not in `oke()`)
  */
 export async function verifyBearerOrApiKey(
   auth: AppAuthBinding,
   token: string,
   apiKeys?: ApiKeyStore,
+  request?: Request,
 ): Promise<ResolvedPrincipal> {
   try {
     return await verifyBearerToken(auth, token);
   } catch (err) {
     if (apiKeys) {
-      const row = await authenticateApiKey(apiKeys, token, auth.now);
+      const ip = request ? clientIpFromRequest(request) : undefined;
+      const row = await authenticateApiKey(apiKeys, token, { now: auth.now, ip });
       if (row) return apiKeyRowToPrincipal(row);
     }
     throw err;

package/src/kernel/boot-bind/clock.ts

@@ -60,12 +60,16 @@ export async function bindClock(
   if (prebuilt) {
     clock = prebuilt;
   } else if (clockDriver === "frozen" || env === "test") {
-    clock = createTestClockRuntime(now(), { instanceId: options.instanceId });
+    clock = createTestClockRuntime(now(), {
+      instanceId: options.instanceId,
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
+    });
   } else if (clockDriver === "memory") {
     clock = createClockRuntime({
       instanceId: options.instanceId,
       now,
       store: createMemoryCronStore(),
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
     });
   } else if (clockDriver === "file") {
     const path = resolve(process.cwd(), DEFAULT_FILE_CRON_PATH);
@@ -74,6 +78,7 @@ export async function bindClock(
       instanceId: options.instanceId,
       now,
       store: createFileCronStore(path),
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
     });
   } else if (clockDriver === "postgres") {
     const url = process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL ?? undefined;
@@ -89,6 +94,7 @@ export async function bindClock(
       instanceId: options.instanceId,
       now,
       store,
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
     });
   } else {
     throw new Error(
@@ -118,8 +124,8 @@ export async function bindClock(
   if (options.onCronFire) {
     const fire = options.onCronFire;
     for (const name of clockDecls.keys()) {
-      clock.onCron(name, async () => {
-        await fire(name);
+      clock.onCron(name, async (row) => {
+        await fire(row.name);
       });
     }
   }

package/src/kernel/boot.test.ts

@@ -79,7 +79,7 @@ describe("boot — lazy element needs", () => {
     expect(needs.signal).toBe(false);
   });
 
-  test("oke() Store-only graph stays under the prior 48 kB baseline", async () => {
+  test("oke() Store-only graph stays under the prior 50 kB baseline", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-store-only-"));
     const entry = join(dir, "entry.ts");
     const appPath = join(import.meta.dir, "app.ts");
@@ -116,9 +116,9 @@ describe("boot — lazy element needs", () => {
         if (raw.byteLength === 0) continue;
         total += Bun.gzipSync(new Uint8Array(raw)).byteLength;
       }
-      // Rebased after clock / gate / kv / index auto-drain on `oke()`.
-      // (~48.3 kB gzip with export externals).
-      expect(total).toBeLessThan(49_000);
+      // Rebased after host API-key persist + allowlist on `oke()`.
+      // (~50.3 kB gzip with export externals).
+      expect(total).toBeLessThan(51_000);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }

package/src/kernel/boot.ts

@@ -152,6 +152,8 @@ export interface BootOptions {
    * @param name - Cron name or every-interval
    */
   readonly onCronFire?: (name: string) => void | Promise<void>;
+  /** Tenant ids for per-tenant clock expansion at reconcile. */
+  readonly tenantIds?: () => readonly string[] | Promise<readonly string[]>;
   /**
    * Dispatch a signal message to bound flows.
    *