okengine 0.15.2 → 0.17.0

package/src/compiler/extract.ts

@@ -80,6 +80,7 @@ type DeclaredSchemaTable = {
   readonly columns: Record<string, DeclaredColumn>;
   readonly rls?: boolean;
   readonly policies?: Record<string, TablePolicy>;
+  readonly tenantScoped?: boolean;
 };
 
 interface ProjectScope {
@@ -212,6 +213,9 @@ export async function extractManifest(options: ExtractManifestOptions = {}): Pro
   if (scope.topology) manifest.topology = scope.topology;
   if (scope.images) manifest.images = scope.images;
 
+  applyTenancyDefaults(manifest);
+  assertTenantSafeSchema(manifest);
+
   return manifest;
 }
 
@@ -258,7 +262,7 @@ function collectDeclarations(filePath: string, program: AstNode, scope: ProjectS
     }
   });
 
-  // oke({ name })
+  // oke({ name, gate: { auth: { tenant } } })
   walk(program, (node) => {
     if (node.type !== "CallExpression") return;
     const call = node as CallExpression;
@@ -266,6 +270,7 @@ function collectDeclarations(filePath: string, program: AstNode, scope: ProjectS
     const opts = objectArg(call.arguments[0]);
     const name = stringProp(opts, "name");
     if (name) scope.app = name;
+    applyOkeTenantConfig(opts, scope);
   });
 }
 
@@ -464,21 +469,24 @@ function tableFromDeclared(t: DeclaredSchemaTable): {
   columns: Record<string, DeclaredColumn>;
   rls?: boolean;
   policies?: Record<string, TablePolicy>;
+  tenantScoped?: boolean;
 } {
   return {
     columns: t.columns,
     ...(t.rls ? { rls: true } : {}),
     ...(t.policies ? { policies: t.policies } : {}),
+    ...(t.tenantScoped === false ? { tenantScoped: false } : {}),
   };
 }
 
 function parseSchemaTableExtras(
   node: AstNode | undefined,
-): Pick<DeclaredSchemaTable, "rls" | "policies"> {
+): Pick<DeclaredSchemaTable, "rls" | "policies" | "tenantScoped"> {
   if (!node || node.type !== "ArrayExpression") return {};
   const els = (node as AstNode & { elements?: AstNode[] }).elements ?? [];
   const policies: Record<string, TablePolicy> = {};
   let rls = false;
+  let tenantScoped: boolean | undefined;
   for (const el of els) {
     if (!el || el.type !== "CallExpression") continue;
     const extra = parseSchemaTableExtra(el as CallExpression);
@@ -487,18 +495,27 @@ function parseSchemaTableExtras(
       rls = true;
       continue;
     }
+    if (extra.kind === "unscoped") {
+      tenantScoped = false;
+      continue;
+    }
     policies[extra.name] = extra.policy;
     rls = true;
   }
   return {
     ...(rls ? { rls: true } : {}),
     ...(Object.keys(policies).length > 0 ? { policies } : {}),
+    ...(tenantScoped === false ? { tenantScoped: false } : {}),
   };
 }
 
 function parseSchemaTableExtra(
   call: CallExpression,
-): { kind: "rls" } | { kind: "policy"; name: string; policy: TablePolicy } | undefined {
+):
+  | { kind: "rls" }
+  | { kind: "unscoped" }
+  | { kind: "policy"; name: string; policy: TablePolicy }
+  | undefined {
   const callee = call.callee;
   if (callee.type !== "MemberExpression") return undefined;
   const member = callee as AstNode & { object: AstNode; property: AstNode };
@@ -506,13 +523,16 @@ function parseSchemaTableExtra(
   if (method === "rls" && isStoreSchemaCallee(member.object)) {
     return { kind: "rls" };
   }
+  if (method === "unscoped" && isStoreSchemaCallee(member.object)) {
+    return { kind: "unscoped" };
+  }
   if (method === "policy" && isStoreSchemaCallee(member.object)) {
     const name = stringArg(call.arguments[0]);
     if (!name) return undefined;
     return { kind: "policy", name, policy: parseTablePolicyOptions(objectArg(call.arguments[1])) };
   }
   if (
-    (method === "gate" || method === "owner" || method === "scope") &&
+    (method === "gate" || method === "owner" || method === "scope" || method === "tenant") &&
     isStoreSchemaPolicyCallee(member.object)
   ) {
     const key = stringArg(call.arguments[0]);
@@ -521,9 +541,11 @@ function parseSchemaTableExtra(
     const command = (stringProp(opts, "for") ??
       (method === "owner"
         ? "all"
-        : method === "scope"
-          ? "insert"
-          : "select")) as TablePolicy["for"];
+        : method === "tenant"
+          ? "all"
+          : method === "scope"
+            ? "insert"
+            : "select")) as TablePolicy["for"];
     const slug = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "");
     const name = `${method}_${slug}_${command}`;
     const lit = `'${key.replaceAll("'", "''")}'`;
@@ -532,7 +554,9 @@ function parseSchemaTableExtra(
         ? `oke.gate() = ${lit}`
         : method === "owner"
           ? `${key} = oke.user()`
-          : `oke.has_scope(${lit})`;
+          : method === "tenant"
+            ? `${key} = oke.tenant()`
+            : `oke.has_scope(${lit})`;
     const policy: TablePolicy = {
       for: command,
       ...(command === "insert"
@@ -798,6 +822,8 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
           namespaces.add(storeName);
           storeEntry.namespaces = [...namespaces].sort();
           if (boolProp(storeOpts, "durable")) storeEntry.durable = true;
+          if (boolProp(storeOpts, "tenantScoped") === false) storeEntry.tenantScoped = false;
+          else if (boolProp(storeOpts, "tenantScoped") === true) storeEntry.tenantScoped = true;
         } else if (facet === "files") {
           const buckets = new Set(storeEntry.buckets ?? []);
           buckets.add(storeName);
@@ -844,6 +870,24 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
       }
     }
 
+    if (obj === "clock" && prop === "perTenant") {
+      const name = stringArg(call.arguments[0]);
+      const opts = objectArg(call.arguments[1]);
+      if (name) {
+        scope.clocks[name] = {
+          ...(stringProp(opts, "every") ? { every: stringProp(opts, "every") } : {}),
+          ...(stringProp(opts, "cron") ? { cron: stringProp(opts, "cron") } : {}),
+          ...(boolProp(opts, "overridable") !== undefined
+            ? { overridable: boolProp(opts, "overridable") }
+            : {}),
+          ...(stringProp(opts, "description")
+            ? { description: stringProp(opts, "description") }
+            : {}),
+          perTenant: true,
+        };
+      }
+    }
+
     if (obj === "gate" && prop === "policy") {
       const policyName = stringArg(call.arguments[0]);
       if (policyName) {
@@ -1070,6 +1114,8 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
             : {}),
           ...(stringProp(opts, "rotate") ? { rotate: stringProp(opts, "rotate") } : {}),
           ...(prop === "config" ? { sensitive: false } : {}),
+          ...(boolProp(opts, "perTenant") === true ? { perTenant: true } : {}),
+          ...(boolProp(opts, "perTenant") === false ? { perTenant: false } : {}),
         };
         const bindingName = enclosingConstName(call, program);
         if (bindingName) {
@@ -1089,6 +1135,16 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
     if (signalName) {
       const delivery = stringProp(opts, "delivery") as SignalDelivery | undefined;
       if (delivery) {
+        const retentionObj = objectProp(opts, "retention");
+        const maxAge = retentionObj ? stringProp(retentionObj, "maxAge") : undefined;
+        const maxCount = retentionObj ? numberProp(retentionObj, "maxCount") : undefined;
+        const retention =
+          maxAge !== undefined || maxCount !== undefined
+            ? {
+                ...(maxAge !== undefined ? { maxAge } : {}),
+                ...(maxCount !== undefined ? { maxCount } : {}),
+              }
+            : undefined;
         const signal: Signal = {
           delivery,
           ...(stringProp(opts, "description")
@@ -1100,6 +1156,7 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
           ...(boolProp(opts, "deadLetter") !== undefined
             ? { deadLetter: boolProp(opts, "deadLetter") }
             : {}),
+          ...(retention !== undefined ? { retention } : {}),
         };
         scope.signals[signalName] = signal;
         const bindingName = enclosingConstName(call, program);
@@ -1127,6 +1184,7 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
         ...(stringProp(opts, "description")
           ? { description: stringProp(opts, "description") }
           : {}),
+        ...(boolProp(opts, "perTenant") === true ? { perTenant: true } : {}),
       };
     }
   }
@@ -1177,6 +1235,8 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
           ? { description: stringProp(opts, "description") }
           : {}),
         ...(stringProp(opts, "rotate") ? { rotate: stringProp(opts, "rotate") } : {}),
+        ...(boolProp(opts, "perTenant") === true ? { perTenant: true } : {}),
+        ...(boolProp(opts, "perTenant") === false ? { perTenant: false } : {}),
       };
       const bindingName = enclosingConstName(call, program);
       if (bindingName) {
@@ -1250,7 +1310,7 @@ function collectConfig(opts: AstNode | undefined, scope: ProjectScope): void {
   if (tenancy) {
     const isolation = stringProp(tenancy, "isolation");
     if (isolation === "row" || isolation === "schema" || isolation === "database") {
-      scope.tenancy = { isolation };
+      scope.tenancy = { ...scope.tenancy, isolation };
     }
   }
 
@@ -1363,8 +1423,9 @@ function collectFlows(file: SourceFile, program: AstNode, scope: ProjectScope):
       const flowNode = call.arguments[1];
       if (!triggerNode) return;
 
-      // on(http.resource(path, bag)) — expand the mount into five bindings.
+      // on(http.resource(...)) or on(http.get(...).live(signal))
       if (!flowNode) {
+        if (registerLiveHttpMount(call, triggerNode, file, program, scope)) return;
         registerResourceMount(call, triggerNode, file, program, scope);
         return;
       }
@@ -1523,7 +1584,7 @@ function registerFlow(args: {
   flow.source = `${args.file.path}:${line}`;
 
   if (boolProp(opts, "durable")) flow.durable = true;
-  if (boolProp(opts, "live") || liveFromTrigger) flow.live = true;
+  if (typeof liveFromTrigger === "string") flow.live = liveFromTrigger;
   if (boolProp(opts, "breaking")) flow.breaking = true;
 
   const slo = parseSlo(objectProp(opts, "slo"));
@@ -1573,6 +1634,8 @@ function registerFlow(args: {
 
   const plane = stringProp(opts, "plane");
   if (plane === "user" || plane === "operator") flow.plane = plane;
+  if (boolProp(opts, "tenantScoped") === false) flow.tenantScoped = false;
+  else if (boolProp(opts, "tenantScoped") === true) flow.tenantScoped = true;
 
   if (inferred.cacheIneligible) {
     flow.cache = false;
@@ -1592,7 +1655,7 @@ function registerFlow(args: {
   const cacheKeys = stringProp(opts, "cacheKeys");
   if (cacheKeys) {
     flow.cacheKeys = cacheKeys;
-  } else if (flow.live && inferred.readsUserId && effects?.reads?.[0]) {
+  } else if (inferred.readsUserId && effects?.reads?.[0]) {
     flow.cacheKeys = `computed:${effects.reads[0]}/userId`;
   }
 
@@ -1600,7 +1663,50 @@ function registerFlow(args: {
 }
 
 /**
- * `http.resource(path, bag).gate(...).public().live()` — find the resource call
+ * Synthesize a Manifest flow for one-arg `on(http.get(path).live(signal))`.
+ *
+ * @param onCall - The outer `on(…)` call
+ * @param triggerNode - HTTP trigger expression
+ * @param file - Source file
+ * @param program - Program root (for export-name lookup)
+ * @param scope - Project scope
+ * @returns True when a live HTTP exposure was registered
+ */
+function registerLiveHttpMount(
+  onCall: CallExpression,
+  triggerNode: AstNode,
+  file: SourceFile,
+  program: AstNode,
+  scope: ProjectScope,
+): boolean {
+  const parsed = parseHttpTrigger(triggerNode, scope, file.path);
+  if (typeof parsed?.live !== "string" || parsed.trigger.http === undefined) {
+    return false;
+  }
+  const exportName = enclosingConstName(onCall, program);
+  const name =
+    nameFromFlowFile(file.path, exportName) ??
+    exportName ??
+    `flow_${Object.keys(scope.flows).length + 1}`;
+  if (exportName) {
+    scope.flowExports.set(exportName, name);
+    scope.bindings.set(exportName, { kind: "flow", ref: name });
+  }
+  scope.bindings.set(name, { kind: "flow", ref: name });
+  const line = lineAt(file.source, onCall.start ?? 0);
+  const flow: Flow = {
+    trigger: { http: parsed.trigger.http },
+    live: parsed.live,
+    effects: { reads: [`signal:${parsed.live}`] },
+    source: `${file.path}:${line}`,
+  };
+  if (parsed.gates && parsed.gates.length > 0) flow.gates = parsed.gates;
+  scope.flows[name] = flow;
+  return true;
+}
+
+/**
+ * `http.resource(path, bag).gate(...).public()` — find the resource call
  * and collect the same chain {@link parseHttpTrigger} reads on a single verb.
  *
  * @param node - First argument to `on(…)`
@@ -1609,11 +1715,10 @@ function registerFlow(args: {
 function unwrapResourceMount(
   node: AstNode,
   scope: ProjectScope,
-): { httpCall: CallExpression; gates?: string[]; live?: boolean } | undefined {
+): { httpCall: CallExpression; gates?: string[] } | undefined {
   const chain = flattenMemberCallChain(node);
   let httpCall: CallExpression | undefined;
   const gateNames: string[] = [];
-  let live = false;
   for (const item of chain) {
     if (item.type === "CallExpression") {
       const c = item as CallExpression;
@@ -1633,14 +1738,12 @@ function unwrapResourceMount(
         continue;
       }
       if (prop === "public") gateNames.push("public");
-      if (prop === "live") live = true;
     }
   }
   if (!httpCall) return undefined;
   return {
     httpCall,
     gates: gateNames.length > 0 ? gateNames : undefined,
-    live: live || undefined,
   };
 }
 
@@ -1666,7 +1769,7 @@ function registerResourceMount(
 ): void {
   const parsed = unwrapResourceMount(triggerNode, scope);
   if (!parsed) return;
-  const { httpCall, gates, live } = parsed;
+  const { httpCall, gates } = parsed;
 
   const path = stringArg(httpCall.arguments[0]);
   if (!path) return;
@@ -1713,7 +1816,6 @@ function registerResourceMount(
       trigger: { http: { method: v.method as never, path: v.p } },
       ...(v.eff ? { effects: v.eff as Effects } : {}),
       ...(gates && gates.length > 0 ? { gates } : {}),
-      ...(live && v.method === "GET" ? { live: true } : {}),
       ...(resource?.breaking ? { breaking: true } : {}),
       source: `${file.path}:${line}`,
     };
@@ -1753,7 +1855,6 @@ function registerNamedTableCrud(call: CallExpression, file: SourceFile, scope: P
     : undefined;
   const idPath = `${path}/:id`;
   const line = lineAt(file.source, call.start ?? 0);
-  const live = boolProp(opts, "liveList") === true;
   const skipCreate = boolProp(opts, "skipCreate") === true;
   const ctx = schemaExpandContext(scope, file.path);
   const createIn = jsonSchemaFromAst(objectProp(opts, "createIn"), ctx);
@@ -1775,7 +1876,6 @@ function registerNamedTableCrud(call: CallExpression, file: SourceFile, scope: P
     readonly method: string;
     readonly p: string;
     readonly eff: Effects | undefined;
-    readonly live?: boolean;
     readonly in?: JsonSchema;
     readonly out?: JsonSchema;
   }[] = [
@@ -1784,7 +1884,6 @@ function registerNamedTableCrud(call: CallExpression, file: SourceFile, scope: P
       method: "GET",
       p: path,
       eff: storeRef ? { reads: [storeRef] } : undefined,
-      live,
       in: defaultListInSchema(),
       ...(itemOut ? { out: { type: "array", items: itemOut } } : {}),
     },
@@ -1831,7 +1930,6 @@ function registerNamedTableCrud(call: CallExpression, file: SourceFile, scope: P
     const flow: Flow = {
       trigger: { http: { method: v.method as never, path: v.p } },
       ...(v.eff ? { effects: v.eff as Effects } : {}),
-      ...(v.live ? { live: true } : {}),
       ...(v.in !== undefined ? { in: v.in } : {}),
       ...(v.out !== undefined ? { out: v.out } : {}),
       source: `${file.path}:${line}`,
@@ -1844,7 +1942,8 @@ function registerNamedTableCrud(call: CallExpression, file: SourceFile, scope: P
 interface ParsedTrigger {
   trigger: Trigger;
   gates?: string[];
-  live?: boolean;
+  /** Live signal name from `.live(signal)` / `http.live(signal)`. */
+  live?: string;
 }
 
 function parseTrigger(
@@ -1864,7 +1963,7 @@ function parseTrigger(
       return { trigger: {} };
     }
 
-    // http.post("/x").gate(...).live() / http.get("/x").public()
+    // http.post("/x").gate(...) / http.get("/x").live(signal) / http.live(signal)
     const http = parseHttpTrigger(call, scope, filePath);
     if (http) return http;
 
@@ -1894,16 +1993,27 @@ function parseTrigger(
   return undefined;
 }
 
+function resolveSignalName(node: AstNode | undefined, scope: ProjectScope): string | undefined {
+  const lit = stringArg(node);
+  if (lit) return lit;
+  const id = identifierName(node);
+  if (!id) return undefined;
+  const binding = scope.bindings.get(id);
+  if (binding?.kind === "signal") return binding.ref;
+  if (scope.signals[id]) return id;
+  return id;
+}
+
 function parseHttpTrigger(
   leaf: AstNode,
   scope: ProjectScope,
   filePath?: string,
 ): ParsedTrigger | undefined {
-  // Walk: http.METHOD(path).gate(...).live() / .public()
+  // Walk: http.METHOD(path).gate(...).live(signal) / http.live(signal) / .public()
   const chain = flattenMemberCallChain(leaf);
   let method: string | undefined;
   let path: string | undefined;
-  let live = false;
+  let live: string | undefined;
   const gateNames: string[] = [];
 
   for (const node of chain) {
@@ -1916,6 +2026,15 @@ function parseHttpTrigger(
       const obj = member.object;
 
       if (obj.type === "Identifier" && (obj as Identifier).name === "http" && prop) {
+        if (prop === "live") {
+          method = "GET";
+          const signalName = resolveSignalName(c.arguments[0], scope);
+          if (signalName) {
+            live = signalName;
+            path = `/_oke/live/${encodeURIComponent(signalName)}`;
+          }
+          continue;
+        }
         method = prop.toUpperCase();
         path = stringArg(c.arguments[0]);
         continue;
@@ -1929,7 +2048,10 @@ function parseHttpTrigger(
       }
 
       if (prop === "public") gateNames.push("public");
-      if (prop === "live") live = true;
+      if (prop === "live") {
+        const signalName = resolveSignalName(c.arguments[0], scope);
+        if (signalName) live = signalName;
+      }
     }
   }
 
@@ -1959,7 +2081,7 @@ function parseHttpTrigger(
       },
     },
     gates: gateNames.length > 0 ? gateNames : undefined,
-    live: live || undefined,
+    ...(live !== undefined ? { live } : {}),
   };
 }
 
@@ -2126,7 +2248,7 @@ function schemaProp(
 
 // ── AST helpers ────────────────────────────────────────────────────────────
 
-/** Leaf-to-root walk of `http.get("/x").public().live()`. */
+/** Leaf-to-root walk of `http.get("/x").public().live(signal)`. */
 function flattenMemberCallChain(leaf: AstNode): AstNode[] {
   const chain: AstNode[] = [];
   let current: AstNode = leaf;
@@ -2334,6 +2456,64 @@ export function lineAt(source: string, offset: number): number {
   return line;
 }
 
+function applyOkeTenantConfig(opts: AstNode | undefined, scope: ProjectScope): void {
+  const gate = objectProp(opts, "gate");
+  const auth = objectProp(gate, "auth");
+  const tenant = objectProp(auth, "tenant");
+  if (!tenant) return;
+  if (tenant.type === "Literal" && (tenant as Literal).value === true) {
+    scope.tenancy = {
+      ...scope.tenancy,
+      enabled: true,
+      isolation: scope.tenancy?.isolation ?? "row",
+      membershipRequired: false,
+    };
+    return;
+  }
+  if (tenant.type === "ObjectExpression") {
+    scope.tenancy = {
+      ...scope.tenancy,
+      enabled: true,
+      isolation: scope.tenancy?.isolation ?? "row",
+      membershipRequired: boolProp(tenant, "required") === true,
+    };
+  }
+}
+
+function applyTenancyDefaults(manifest: Manifest): void {
+  if (manifest.tenancy?.enabled !== true) return;
+  for (const flow of Object.values(manifest.flows ?? {})) {
+    if (flow.tenantScoped === undefined) flow.tenantScoped = true;
+  }
+  for (const store of Object.values(manifest.stores ?? {})) {
+    if (store.facet === "kv" && store.tenantScoped === undefined) store.tenantScoped = true;
+  }
+  for (const secret of Object.values(manifest.vault ?? {})) {
+    if (secret.perTenant === undefined) secret.perTenant = true;
+  }
+}
+
+function assertTenantSafeSchema(manifest: Manifest): void {
+  if (manifest.tenancy?.enabled !== true) return;
+  for (const [storeName, store] of Object.entries(manifest.stores ?? {})) {
+    if (store.facet !== "sql" || !store.tables) continue;
+    for (const [tableName, table] of Object.entries(store.tables)) {
+      if (table.tenantScoped === false) continue;
+      const policies = Object.values(table.policies ?? {});
+      const hasTenant = policies.some(
+        (p) =>
+          (typeof p.using === "string" && p.using.includes("oke.tenant()")) ||
+          (typeof p.withCheck === "string" && p.withCheck.includes("oke.tenant()")),
+      );
+      if (!hasTenant) {
+        throw new Error(
+          `extract: table "${storeName}.${tableName}" needs store.schema.policy.tenant(...) or store.schema.unscoped() when gate.auth.tenant is on`,
+        );
+      }
+    }
+  }
+}
+
 function sortRecord<T>(record: Record<string, T>): Record<string, T> {
   const out: Record<string, T> = {};
   for (const key of Object.keys(record).sort()) {

package/src/compiler/fixtures/skyport/src/flows/bookings/index.ts

@@ -33,9 +33,8 @@ export const create = on(
 );
 
 export const mine = on(
-  http.get("/bookings").gate(member).live(),
+  http.get("/bookings").gate(member),
   flow("bookings.mine", {
-    live: true,
     do: (_, fx) =>
       fx
         .store(db)

package/src/compiler/fixtures/skyport.expected.json

@@ -32,7 +32,7 @@
       "effects": {
         "reads": ["sql:bookings"]
       },
-      "source": "src/flows/bookings/index.ts:48"
+      "source": "src/flows/bookings/index.ts:47"
     },
     "bookings.mine": {
       "trigger": {
@@ -46,7 +46,6 @@
         "reads": ["sql:bookings"]
       },
       "source": "src/flows/bookings/index.ts:37",
-      "live": true,
       "cacheKeys": "computed:sql:bookings/userId"
     },
     "bookings.refundBooking": {
@@ -54,7 +53,7 @@
         "reads": ["sql:bookings"],
         "writes": ["sql:bookings"]
       },
-      "source": "src/flows/bookings/index.ts:52"
+      "source": "src/flows/bookings/index.ts:51"
     },
     "payments.chargeBooking": {
       "effects": {

package/src/compiler/response.ts

@@ -5,8 +5,9 @@
  */
 
 import type { FlowFailure } from "../kernel/errors.ts";
-import { isJsonResult, isJsonStreamResult, type JsonStreamResult } from "../kernel/fx.ts";
+import type { JsonResult, JsonStreamResult, SseFrame } from "../kernel/fx.ts";
 import { isFlowFailure } from "../kernel/hooks.ts";
+import { lazyRequire } from "../kernel/lazy-require.ts";
 import { VALIDATION_ERROR_CODE } from "../validation/standard-schema.ts";
 
 /** Successful envelope. */
@@ -53,10 +54,11 @@ export function statusForFailure(failure: FlowFailure): number {
  * @param output - Handler output (`undefined` → 204)
  */
 export function encodeSuccess(output: unknown): Response {
-  if (isJsonStreamResult(output)) {
+  const json = loadFxJson();
+  if (json.isJsonStreamResult(output)) {
     return encodeSseStream(output);
   }
-  if (isJsonResult(output)) {
+  if (json.isJsonResult(output)) {
     if (output.status === 204) {
       return new Response(null, { status: 204 });
     }
@@ -81,23 +83,46 @@ export function encodeFailure(failure: FlowFailure): Response {
   });
 }
 
+function loadFxLiveStream(): typeof import("../kernel/fx-live-stream.ts") {
+  return lazyRequire(`${import.meta.dir}/../kernel`, ["fx", "live", "stream"].join("-"));
+}
+
+function loadFxJson(): {
+  isJsonResult: (value: unknown) => value is JsonResult;
+  isJsonStreamResult: (value: unknown) => value is JsonStreamResult;
+  isSseFrame: (value: unknown) => value is SseFrame;
+} {
+  return lazyRequire(`${import.meta.dir}/../kernel`, ["fx", "runtime"].join("-"));
+}
+
 /**
  * Encode an execute-style result (response / failure / output).
  *
+ * Awaits {@link JsonStreamResult.ready} before the 200 SSE body so OKE1014
+ * can return 410 instead of a half-open stream.
+ *
  * @param result - Pipeline outcome pieces
  */
-export function encodeExecuteResult(result: {
+export async function encodeExecuteResult(result: {
   readonly response?: Response | undefined;
   readonly failure?: FlowFailure | undefined;
   readonly output?: unknown;
   readonly error?: unknown;
-}): Response {
+}): Promise<Response> {
   if (result.response) return result.response;
   if (result.failure) return encodeFailure(result.failure);
   if (result.error !== undefined) {
     if (isFlowFailure(result.error)) {
       return encodeFailure(result.error);
     }
+    const gap =
+      result.error !== null &&
+      typeof result.error === "object" &&
+      "code" in result.error &&
+      (result.error as { code: unknown }).code === 1014
+        ? loadFxLiveStream().encodeGap(result.error)
+        : undefined;
+    if (gap) return gap;
     // Unhandled throws must never look like success (`undefined` → 204).
     return Response.json(
       {
@@ -111,14 +136,13 @@ export function encodeExecuteResult(result: {
       { status: 500 },
     );
   }
+  if (loadFxJson().isJsonStreamResult(result.output) && result.output.ready) {
+    const early = await loadFxLiveStream().awaitLiveReady(result.output);
+    if (early) return early;
+  }
   return encodeSuccess(result.output);
 }
 
-/**
- * Encode {@link JsonStreamResult} as SSE (`text/event-stream`).
- *
- * @param carrier - Stream carrier from `fx.json.stream`
- */
 function encodeSseStream(carrier: JsonStreamResult): Response {
   const encoder = new TextEncoder();
   let finalized = false;
@@ -131,7 +155,13 @@ function encodeSseStream(carrier: JsonStreamResult): Response {
     async start(controller) {
       try {
         for await (const chunk of carrier.chunks) {
-          controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}\n\n`));
+          const frame = loadFxJson().isSseFrame(chunk)
+            ? chunk
+            : { data: chunk as unknown, id: undefined as string | undefined };
+          const lines: string[] = [];
+          if (frame.id !== undefined) lines.push(`id: ${frame.id}`);
+          lines.push(`data: ${JSON.stringify(frame.data)}`);
+          controller.enqueue(encoder.encode(`${lines.join("\n")}\n\n`));
         }
         controller.enqueue(encoder.encode("data: [DONE]\n\n"));
         controller.close();