okengine 0.16.0 → 0.17.0

package/src/elements/store/sql-rls-isolation.test.ts

@@ -100,6 +100,45 @@ describe("sql-session RLS isolation (pglite)", () => {
       { id: "b", owner: "bob" },
     ]);
   });
+
+  test("tenant_id = oke.tenant() isolates concurrent tenants", async () => {
+    await conn.exec(`CREATE TABLE bookings (
+      id text PRIMARY KEY,
+      tenant_id text NOT NULL,
+      body text NOT NULL
+    )`);
+    await conn.exec(`INSERT INTO bookings VALUES ('1', 'acme', 'a'), ('2', 'globex', 'b')`);
+    await conn.exec(`ALTER TABLE bookings ENABLE ROW LEVEL SECURITY`);
+    await conn.exec(`GRANT SELECT, INSERT, UPDATE, DELETE ON bookings TO oke_app`);
+    await conn.exec(`CREATE POLICY tenant_all ON bookings
+      AS PERMISSIVE FOR ALL TO public
+      USING (tenant_id = oke.tenant())
+      WITH CHECK (tenant_id = oke.tenant())`);
+
+    const asAcme = createSqlStoreHandle("sql:app", {
+      connection: conn,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+      rls: { gate: "member", userId: "u1", scopes: ["member"], tenantId: "acme" },
+    });
+    const asGlobex = createSqlStoreHandle("sql:app", {
+      connection: conn,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+      rls: { gate: "member", userId: "u1", scopes: ["member"], tenantId: "globex" },
+    });
+
+    const [acme, globex, acmeAgain] = await Promise.all([
+      asAcme.raw(`SELECT id, tenant_id FROM bookings ORDER BY id`),
+      asGlobex.raw(`SELECT id, tenant_id FROM bookings ORDER BY id`),
+      asAcme.raw(`SELECT id, tenant_id FROM bookings ORDER BY id`),
+    ]);
+    expect(acme).toEqual([{ id: "1", tenant_id: "acme" }]);
+    expect(globex).toEqual([{ id: "2", tenant_id: "globex" }]);
+    expect(acmeAgain).toEqual([{ id: "1", tenant_id: "acme" }]);
+  });
 });
 
 const LIVE_PG =

package/src/elements/store.ts

@@ -31,6 +31,8 @@ export {
   schemaPolicyGate,
   schemaPolicyOwner,
   schemaPolicyScope,
+  schemaPolicyTenant,
+  schemaUnscoped,
   isSchemaTableDecl,
   isSchemaColumnDecl,
   isSchemaRelationsDecl,

package/src/elements/vault/builtin-adapter.ts

@@ -204,6 +204,18 @@ export interface BuiltinVaultAdapter extends VaultAdapter {
 /** Numeric column as any supported driver may hand it back. */
 type SqlNumber = number | string | bigint;
 
+/**
+ * First path segment when the contract is stored as `{tenantId}/{name}`.
+ *
+ * @param path - Canonical vault path
+ */
+function tenantIdFromVaultPath(path: string): string | null {
+  const i = path.indexOf("/");
+  if (i <= 0) return null;
+  const id = path.slice(0, i);
+  return id.length > 0 ? id : null;
+}
+
 /** `oke_vault_secrets` row as returned by the driver. */
 interface SecretRow {
   id: string;
@@ -539,8 +551,8 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
       updated_at: Date | string;
     }>(
       `INSERT INTO oke_vault_secrets
-         (path, encrypted_value, iv, auth_tag, version, metadata, algorithm, kek_version, expires_at)
-       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9)
+         (path, encrypted_value, iv, auth_tag, version, metadata, algorithm, kek_version, expires_at, tenant_id)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9, $10)
        RETURNING id, created_at, updated_at`,
       [
         path,
@@ -552,6 +564,7 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
         ALGORITHM,
         kekVersion,
         expiresAt ?? null,
+        tenantIdFromVaultPath(path),
       ],
     );
     const row = inserted[0];

package/src/elements/vault/declare.ts

@@ -24,6 +24,11 @@ export interface VaultSecretOptions {
    * in the clear. Defaults to `true` for secrets and `false` for config.
    */
   readonly sensitive?: boolean;
+  /**
+   * Resolve per `fx.tenant.id` at request time (not boot).
+   * Default true when `gate.auth.tenant` is on.
+   */
+  readonly perTenant?: boolean;
 }
 
 /** Declared vault contract handle. */
@@ -38,6 +43,8 @@ export interface VaultSecretDecl {
   readonly dev?: string;
   /** Whether cleartext must never leave the runtime (default by kind). */
   readonly sensitive: boolean;
+  /** Request-time tenant path when true. */
+  readonly perTenant?: boolean;
 }
 
 /**
@@ -82,6 +89,7 @@ function declareSecret(name: string, options: VaultSecretOptions = {}): VaultSec
     ...(options.rotate !== undefined ? { rotate: options.rotate } : {}),
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
+    ...(options.perTenant !== undefined ? { perTenant: options.perTenant } : {}),
   };
   secretRegistry.push(decl);
   return decl;

package/src/elements/vault/runtime.ts

@@ -95,6 +95,10 @@ export interface CreateVaultRuntimeOptions {
   readonly allowGaps?: boolean;
   /** Clock for last-read timestamps (tests). */
   readonly now?: () => number;
+  /**
+   * When true, contracts with `perTenant !== false` are not boot-gap fatal.
+   */
+  readonly tenantEnabled?: boolean;
 }
 
 /** Vault runtime surface. */
@@ -244,6 +248,9 @@ export function createVaultRuntime(options: CreateVaultRuntimeOptions = {}): Vau
 
     const gaps: VaultGap[] = [];
     for (const c of contracts.values()) {
+      const perTenant =
+        c.perTenant === true || (options.tenantEnabled === true && c.perTenant !== false);
+      if (perTenant) continue;
       const value = merged.get(c.name);
       if (value === undefined || value.length === 0) {
         gaps.push({

package/src/elements/vault/sql-rls-isolation.test.ts

@@ -0,0 +1,145 @@
+/**
+ * `oke_vault_secrets` tenant RLS — same concurrent-identity proof as
+ * domain tables: two tenants, one shared PGlite connection, row-level
+ * isolation via `oke.tenant()`.
+ *
+ * Policy is installed by production DDL ({@link ensureVaultTables} /
+ * {@link installOkeRlsHelpers}), not by this file.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { connectPglite } from "../../drivers/pglite.ts";
+import { installOkeRlsHelpers } from "../../drivers/pg-rls.ts";
+import type { SqlConnection } from "../../drivers/types.ts";
+import { createSqlStoreHandle, type SqlStoreHandle } from "../store/sql-session.ts";
+import { sqlConnectionAsExec } from "./builtin-adapter.ts";
+import { ensureVaultTables } from "./storage.ts";
+
+const CIPHER = String.raw`'\x00'::bytea`;
+
+const SEED = `
+INSERT INTO oke_vault_secrets (path, encrypted_value, iv, auth_tag, version, tenant_id)
+VALUES
+  ('acme/stripe', ${CIPHER}, ${CIPHER}, ${CIPHER}, 1, 'acme'),
+  ('globex/stripe', ${CIPHER}, ${CIPHER}, ${CIPHER}, 1, 'globex'),
+  ('GLOBAL_KEY', ${CIPHER}, ${CIPHER}, ${CIPHER}, 1, NULL)
+`;
+
+/** File-scoped warmed PGlite. */
+let conn: SqlConnection;
+/** Stamped as tenant acme. */
+let asAcme: SqlStoreHandle;
+/** Stamped as tenant globex. */
+let asGlobex: SqlStoreHandle;
+/** No stamp — table-owner / superuser bypass (ENABLE without FORCE). */
+let asOwner: SqlStoreHandle;
+
+beforeAll(async () => {
+  conn = await connectPglite({ url: "memory://vault-sql-rls-isolation", role: "primary" });
+  await installOkeRlsHelpers((sql) => conn.exec(sql));
+  await ensureVaultTables(sqlConnectionAsExec(conn));
+  await conn.exec(SEED);
+  asAcme = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+    rls: { gate: "member", userId: "u1", scopes: ["member"], tenantId: "acme" },
+  });
+  asGlobex = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+    rls: { gate: "member", userId: "u1", scopes: ["member"], tenantId: "globex" },
+  });
+  asOwner = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+  });
+}, 15_000);
+
+afterAll(async () => {
+  await conn.close();
+});
+
+describe("oke_vault_secrets tenant RLS (pglite)", () => {
+  test("production DDL installed oke_vault_secrets_tenant", async () => {
+    const rows = await conn.query(
+      `SELECT policyname FROM pg_policies
+       WHERE tablename = 'oke_vault_secrets' AND policyname = 'oke_vault_secrets_tenant'`,
+    );
+    expect(rows).toEqual([{ policyname: "oke_vault_secrets_tenant" }]);
+  });
+
+  test("sequential identities see own tenant plus global NULL rows", async () => {
+    const acme = await asAcme.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`);
+    const globex = await asGlobex.raw(
+      `SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`,
+    );
+    expect(acme).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+    ]);
+    expect(globex).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "globex/stripe", tenant_id: "globex" },
+    ]);
+  });
+
+  test("concurrent identities do not leak across the shared connection", async () => {
+    const [acme, globex, acmeAgain] = await Promise.all([
+      asAcme.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`),
+      asGlobex.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`),
+      asAcme.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`),
+    ]);
+    expect(acme).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+    ]);
+    expect(globex).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "globex/stripe", tenant_id: "globex" },
+    ]);
+    expect(acmeAgain).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+    ]);
+  });
+
+  test("unstamped owner still sees every ciphertext row", async () => {
+    const rows = await asOwner.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`);
+    expect(rows).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+      { path: "globex/stripe", tenant_id: "globex" },
+    ]);
+  });
+});
+
+describe("oke_vault_secrets tenant RLS — tables before helpers", () => {
+  test("helper install attaches the policy after the table exists", async () => {
+    const late = await connectPglite({
+      url: "memory://vault-sql-rls-late-helpers",
+      role: "primary",
+    });
+    try {
+      await ensureVaultTables(sqlConnectionAsExec(late));
+      const before = await late.query(
+        `SELECT COUNT(*)::text AS n FROM pg_policies
+         WHERE tablename = 'oke_vault_secrets' AND policyname = 'oke_vault_secrets_tenant'`,
+      );
+      expect(before[0]?.n).toBe("0");
+      await installOkeRlsHelpers((sql) => late.exec(sql));
+      const after = await late.query(
+        `SELECT COUNT(*)::text AS n FROM pg_policies
+         WHERE tablename = 'oke_vault_secrets' AND policyname = 'oke_vault_secrets_tenant'`,
+      );
+      expect(after[0]?.n).toBe("1");
+    } finally {
+      await late.close();
+    }
+  });
+});

package/src/elements/vault/storage.ts

@@ -14,6 +14,7 @@ import type { AuditAction, AuditEntry, AuditWriter } from "./audit.ts";
 import { VaultError } from "./errors.ts";
 import type { VaultErrorCode } from "./errors.ts";
 import type { VaultActorType } from "./types.ts";
+import { ensureVaultSecretsTenantRls } from "../../drivers/pg-vault-rls.ts";
 
 /**
  * Minimal SQL surface the Vault needs.
@@ -75,6 +76,7 @@ CREATE TABLE IF NOT EXISTS oke_vault_secrets (
   updated_at timestamptz NOT NULL DEFAULT now(),
   expires_at timestamptz,
   deleted_at timestamptz,
+  tenant_id text,
   CONSTRAINT oke_vault_secrets_path_version_key UNIQUE (path, version)
 )`;
 
@@ -168,6 +170,8 @@ const POST_DDL_STATEMENTS: readonly string[] = [
   `ALTER TABLE oke_vault_status ADD COLUMN IF NOT EXISTS rewrap_key_hash text`,
   `ALTER TABLE oke_vault_status ADD COLUMN IF NOT EXISTS rotate_locked_by text`,
   `ALTER TABLE oke_vault_status ADD COLUMN IF NOT EXISTS rotate_lease_expires_at bigint`,
+  `ALTER TABLE oke_vault_secrets ADD COLUMN IF NOT EXISTS tenant_id text`,
+  `CREATE INDEX IF NOT EXISTS oke_vault_secrets_tenant_idx ON oke_vault_secrets (tenant_id)`,
   `CREATE INDEX IF NOT EXISTS oke_vault_audit_seq_idx ON oke_vault_audit (seq)`,
   `CREATE INDEX IF NOT EXISTS oke_vault_audit_created_idx ON oke_vault_audit (created_at, id)`,
   `CREATE INDEX IF NOT EXISTS oke_vault_audit_path_idx ON oke_vault_audit (path)`,
@@ -200,6 +204,11 @@ export async function ensureVaultTables(db: SqlExec): Promise<void> {
       throw new VaultError("BACKEND_ERROR", "vault: failed to ensure vault tables");
     }
   }
+  try {
+    await ensureVaultSecretsTenantRls((sql: string) => db.execute(sql));
+  } catch {
+    throw new VaultError("BACKEND_ERROR", "vault: failed to ensure vault tables");
+  }
 }
 
 /**

package/src/elements/vault/test-helpers.ts

@@ -251,7 +251,8 @@ function isDdl(text: string): boolean {
   return (
     text.startsWith("create table") ||
     text.startsWith("alter table") ||
-    text.startsWith("create index")
+    text.startsWith("create index") ||
+    text.startsWith("do $oke_vault_rls$")
   );
 }
 

package/src/i18n/catalogs/ar.ts

@@ -36,6 +36,22 @@ export const builtinAr = {
       cause: 'التدفق "{flow}" يُصدِر الإشارة "{resource}" بلا مشترك.',
       fix: "أضف on({resource}, …) أو عيّن الإشارة '{'optional: true'}'.",
     },
+    "1014": {
+      cause: 'مؤشر البث "{afterId}" ليس على شريط "{signal}".',
+      fix: "أعد الاتصال بدون Last-Event-ID لإعادة تشغيل الشريط المتبقي.",
+    },
+    "1015": {
+      cause: "هذه العملية تحتاج مستأجراً، ولم يُحدَّد مستأجر لهذا الطلب.",
+      fix: "استدعِ fx.auth.switchTenant(id) أو أرسل مطالبة tid موقّعة أو رأس المستأجر.",
+    },
+    "1016": {
+      cause: 'المتصل ليس عضواً في المستأجر "{tenant}".',
+      fix: "اختر مستأجراً من fx.auth.listTenants() أو أضف المستخدم كعضو.",
+    },
+    "1017": {
+      cause: 'نطاق دور المستأجر "{scope}" ليس نطاقاً تطبيقياً معلناً.',
+      fix: "استخدم اسماً من كتالوج البيان لهذا التطبيق (وليس console:*).",
+    },
     "1101": {
       cause: "جدول النطاق غير موجود — لم تُطبَّق الترحيلات.",
       fix: "شغّل `oke db migrate` على هذه البيئة.",
@@ -62,6 +78,9 @@ export const builtinAr = {
     "Forbidden.ip_denied": "عنوان IP الخاص بك محظور.",
     "Forbidden.ip_not_allowed": "عنوان IP الخاص بك غير مسموح.",
     "Forbidden.policy_denied": "رفضت السياسة هذا الطلب.",
+    "Forbidden.tenant_required": "هذا الطلب يحتاج مستأجراً.",
+    "Forbidden.not_member": "لست عضواً في ذلك المستأجر.",
+    "Forbidden.unknown_scope": "نطاق دور المستأجر هذا ليس نطاقاً تطبيقياً معلناً.",
     "AuthRateLimited.rate_limited": "محاولات مصادقة كثيرة جداً. حاول لاحقاً.",
   },
 } as const;

package/src/i18n/catalogs/en.ts

@@ -36,6 +36,22 @@ export const builtinEn = {
       cause: 'Flow "{flow}" emits signal "{resource}" with no subscriber.',
       fix: "Add on({resource}, …) or mark the signal '{'optional: true'}'.",
     },
+    "1014": {
+      cause: 'Live cursor "{afterId}" is not on the tape for "{signal}".',
+      fix: "Reconnect without Last-Event-ID to replay the remaining tape.",
+    },
+    "1015": {
+      cause: "This operation needs a tenant, but none is resolved for this request.",
+      fix: "Call fx.auth.switchTenant(id), send a signed tid claim, or pass the tenant header.",
+    },
+    "1016": {
+      cause: 'The caller is not a member of tenant "{tenant}".',
+      fix: "Pick a tenant from fx.auth.listTenants() or add the user as a member.",
+    },
+    "1017": {
+      cause: 'Tenant role scope "{scope}" is not a declared application scope.',
+      fix: "Use a name from this app's Manifest catalog (never console:*).",
+    },
     "1101": {
       cause: "domain table not found — migrations have not been applied.",
       fix: "run `oke db migrate` against this environment.",
@@ -63,6 +79,9 @@ export const builtinEn = {
     "Forbidden.ip_denied": "Your IP address is blocked.",
     "Forbidden.ip_not_allowed": "Your IP address is not allowed.",
     "Forbidden.policy_denied": "Policy denied this request.",
+    "Forbidden.tenant_required": "This request needs a tenant.",
+    "Forbidden.not_member": "You are not a member of that tenant.",
+    "Forbidden.unknown_scope": "That tenant role scope is not a declared application scope.",
     "AuthRateLimited.rate_limited": "Too many authentication attempts. Try again later.",
   },
 } as const;

package/src/index.ts

@@ -80,6 +80,7 @@ export {
   createSignalRuntime,
   type SignalDecl,
   type SignalOptions,
+  type SignalRetention,
   type SignalRuntime,
   type DeadLetter,
   type SignalFailureReason,

package/src/kernel/adopt-routes.ts

@@ -8,7 +8,8 @@
 import type { InferSchemaOutput } from "../validation/standard-schema.ts";
 import type { AnyFlowDef, FlowDef, FlowErrorMap } from "./flow.ts";
 import { isFlow } from "./flow.ts";
-import type { HttpTrigger, Trigger } from "./triggers.ts";
+import type { HttpTrigger, LiveHttpTrigger, Trigger } from "./triggers.ts";
+import { httpPathParams } from "./live-http.ts";
 
 /**
  * One flow's route contract on `app.$routes` (compatible with client
@@ -52,6 +53,10 @@ export type AppRouteMap = {
       readonly errors?: unknown;
       readonly method?: string;
       readonly path?: string;
+      readonly live?: string;
+      readonly matchKey?: readonly string[];
+      readonly gates?: readonly string[];
+      readonly stream?: true;
     };
   };
 };
@@ -73,6 +78,28 @@ export type ErrorDataOf<E extends FlowErrorMap> = {
   [K in keyof E]: InferSchemaOutput<E[K]>;
 };
 
+/**
+ * HTTP live exposure on `$routes` so `createClient(app)` types
+ * `api.unit.flow(input, { onEvent })` as subscribe, not JSON RPC.
+ *
+ * @typeParam I - Input
+ * @typeParam O - Output
+ * @typeParam E - Error map
+ * @typeParam M - HTTP method
+ * @typeParam P - Path
+ */
+export type LiveAppFlowRoute<
+  I = unknown,
+  O = unknown,
+  E extends Record<string, unknown> = Record<string, unknown>,
+  M extends string = string,
+  P extends string = string,
+> = AppFlowRoute<I, O, E, M, P> & {
+  readonly live: string;
+  readonly stream: true;
+  readonly matchKey: readonly string[];
+};
+
 /**
  * Derive a client route contract from a {@link FlowDef} (trigger → REST).
  *
@@ -80,9 +107,11 @@ export type ErrorDataOf<E extends FlowErrorMap> = {
  */
 export type RouteFromFlow<F> =
   F extends FlowDef<infer I, infer O, infer E, any, infer T>
-    ? [T] extends [HttpTrigger<infer M, infer P>]
-      ? AppFlowRoute<I, O, ErrorDataOf<E>, M, P>
-      : AppFlowRoute<I, O, ErrorDataOf<E>>
+    ? [T] extends [LiveHttpTrigger<infer M, infer P>]
+      ? LiveAppFlowRoute<I, O, ErrorDataOf<E>, M, P>
+      : [T] extends [HttpTrigger<infer M, infer P>]
+        ? AppFlowRoute<I, O, ErrorDataOf<E>, M, P>
+        : AppFlowRoute<I, O, ErrorDataOf<E>>
     : never;
 
 /**
@@ -130,6 +159,14 @@ export type RoutesFromAdoptArgs<Args extends readonly unknown[]> = Args extends
 export interface RuntimeFlowRoute {
   readonly method?: string;
   readonly path?: string;
+  /** SSE live signal name when the trigger used `.live(signal)`. */
+  readonly live?: string;
+  /** Sorted auto-match path-param names (empty = firehose). */
+  readonly matchKey?: readonly string[];
+  /** Flattened gate names on the HTTP trigger. */
+  readonly gates?: readonly string[];
+  /** True when this flow returns `text/event-stream`. */
+  readonly stream?: true;
 }
 
 /** Runtime `$routes` table (values; types live on {@link OkeApp}). */
@@ -146,10 +183,21 @@ export type RuntimeRouteMap = {
  */
 export function runtimeRouteFromFlow(flowDef: AnyFlowDef): RuntimeFlowRoute {
   const trigger: Trigger | undefined = flowDef.$trigger ?? flowDef.triggers[0];
-  if (trigger?.kind === "http") {
-    return { method: trigger.method, path: trigger.path };
-  }
-  return {};
+  if (trigger?.kind !== "http") return {};
+  const liveName = trigger.liveSignal?.name ?? flowDef.live;
+  const gates = trigger.gates.map((g) => (typeof g === "string" ? g : g.name));
+  return {
+    method: trigger.method,
+    path: trigger.path,
+    ...(liveName !== undefined
+      ? {
+          live: liveName,
+          stream: true as const,
+          matchKey: httpPathParams(trigger.path),
+          ...(gates.length > 0 ? { gates } : {}),
+        }
+      : {}),
+  };
 }
 
 /**

package/src/kernel/app-tenant.ts

@@ -0,0 +1,122 @@
+/**
+ * App-shell tenancy wiring — lazy chunk.
+ *
+ * One `w` dispatcher so Store-only `oke()` graphs do not spell Clock /
+ * pipeline tenant field names.
+ */
+
+import type { ResolvedTenantAuth } from "../auth/tenant-config.ts";
+import type { TenantStore } from "../auth/tenants.ts";
+import type { ClockDecl } from "../elements/clock/declare.ts";
+import { parsePerTenantCronName } from "./clock-per-tenant-name.ts";
+import { orphanPerTenantCronRows, putPerTenantCronRows } from "./clock-reconcile.ts";
+import type { AnyFlowDef } from "./flow.ts";
+import type { PipelineTenantDeps } from "./pipeline.ts";
+
+function cron(name: string): { readonly tenant: { readonly id: string } } | undefined {
+  const parsed = parsePerTenantCronName(name);
+  return parsed ? { tenant: { id: parsed.tenantId } } : undefined;
+}
+
+function boot(store: TenantStore): { readonly tenantIds: () => string[] } {
+  return { tenantIds: () => [...store.tenants.keys()] };
+}
+
+function clock(
+  tenantStore: TenantStore,
+  clockStore: Parameters<typeof putPerTenantCronRows>[0],
+  templates: readonly ClockDecl[],
+): void {
+  tenantStore.hooks = {
+    onCreate: (row) => putPerTenantCronRows(clockStore, templates, row.id),
+    onDelete: (row) => orphanPerTenantCronRows(clockStore, templates, row.id),
+  };
+}
+
+function resume(auth: { readonly tenant?: unknown; readonly tenantStore?: TenantStore }): {
+  readonly tenantEnabled: boolean;
+  readonly tenantStore: TenantStore | undefined;
+} {
+  return {
+    tenantEnabled: auth.tenant !== undefined,
+    tenantStore: auth.tenantStore,
+  };
+}
+
+function pipe(
+  tenant: ResolvedTenantAuth,
+  store: TenantStore,
+  flowTenantScoped: boolean,
+  flowPlane: AnyFlowDef["plane"],
+): { readonly tenant: PipelineTenantDeps } {
+  return {
+    tenant: {
+      config: tenant,
+      store,
+      flowTenantScoped,
+      flowPlane,
+    },
+  };
+}
+
+function fx(args: {
+  readonly enabled: boolean;
+  readonly store: TenantStore | undefined;
+  readonly scoped: boolean;
+  readonly plane: AnyFlowDef["plane"];
+  readonly tenant: { readonly id: string | null } | undefined;
+  readonly bind?: { readonly secret: string; readonly now: () => number };
+}): {
+  readonly tenantStore: TenantStore | undefined;
+  readonly tenantEnabled: boolean;
+  readonly flowTenantScoped: boolean;
+  readonly flowPlane: AnyFlowDef["plane"];
+  readonly sessionCrypto?: { readonly secret: string; readonly now: () => number };
+  readonly tenant?: { readonly id: string | null };
+} {
+  return {
+    tenantStore: args.store,
+    tenantEnabled: args.enabled,
+    flowTenantScoped: args.scoped,
+    flowPlane: args.plane,
+    ...(args.bind ? { sessionCrypto: { secret: args.bind.secret, now: args.bind.now } } : {}),
+    ...(args.tenant ? { tenant: args.tenant } : {}),
+  };
+}
+
+/**
+ * Dispatch tenancy wiring.
+ *
+ * 0 cron · 1 boot · 2 clock · 3 pipe · 4 fx · 5 resume
+ *
+ * @param kind - Operation
+ * @param args - Kind-specific arguments
+ */
+export function w(kind: number, ...args: unknown[]): unknown {
+  switch (kind) {
+    case 0:
+      return cron(args[0] as string);
+    case 1:
+      return boot(args[0] as TenantStore);
+    case 2:
+      clock(
+        args[0] as TenantStore,
+        args[1] as Parameters<typeof putPerTenantCronRows>[0],
+        args[2] as readonly ClockDecl[],
+      );
+      return undefined;
+    case 3:
+      return pipe(
+        args[0] as ResolvedTenantAuth,
+        args[1] as TenantStore,
+        args[2] as boolean,
+        args[3] as AnyFlowDef["plane"],
+      );
+    case 4:
+      return fx(args[0] as Parameters<typeof fx>[0]);
+    case 5:
+      return resume(args[0] as Parameters<typeof resume>[0]);
+    default:
+      return undefined;
+  }
+}