okengine 0.16.0 → 0.17.0

package/src/kernel/app.ts

@@ -17,6 +17,7 @@ import {
   type RoutesFromNamespace,
   type RuntimeRouteMap,
 } from "./adopt-routes.ts";
+import { liveExposureKey, liveGatesKey, liveMatchKeyFromPath } from "./live-http.ts";
 // `./boot.ts` pulls in every element + driver module (vault, store, signal,
 // clock, gate, channel, ai, runs) — a type-only import here keeps that whole
 // graph out of the cold-start path; `doBoot` below loads it lazily, only
@@ -33,25 +34,24 @@ import {
   type ResolvedGateConfig,
 } from "../elements/gate/config.ts";
 import { requirePackageModule } from "../shared/lazy-src.ts";
+import { lazyRequire } from "./lazy-require.ts";
+import type { DurableResult, RunDurableOptions } from "../elements/clock/durable.ts";
 import type { TemplateCatalog } from "../elements/channel/runtime.ts";
 import { parseAcceptLanguage } from "../elements/channel/locale.ts";
 import { runWithLocale } from "../i18n/locale-context.ts";
-import { runDurable } from "../elements/clock/durable.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
 import { failureFromUnknown, runCompensationPhase } from "./compensate.ts";
 import { withAbortSignal } from "./abort-scope.ts";
 import { fxRetry } from "./concurrency.ts";
-import {
-  createFxContext,
-  freezePrincipal,
-  isJsonStreamResult,
-  resolveName,
-  type CreateFxOptions,
-  type Fx,
-  type FxAuth,
-  type FxOperator,
-  type FxPrincipal,
-  type NamedRef,
+import type {
+  CreateFxOptions,
+  Fx,
+  FxAuth,
+  FxContext,
+  FxOperator,
+  FxPrincipal,
+  JsonStreamResult,
+  NamedRef,
 } from "./fx.ts";
 import {
   currentDevSurface,
@@ -152,6 +152,31 @@ function loadMessages(): typeof import("../i18n/messages.ts") {
   return requirePackageModule("i18n/messages", "messages");
 }
 
+/**
+ * `createFx` / JSON result helpers — loaded on first execute, not on Store-only
+ * `oke()` construction (same boundary as `boot.ts`).
+ */
+function loadFx(): {
+  createFxContext: (options: CreateFxOptions) => FxContext;
+  freezePrincipal: (p: FxPrincipal) => FxPrincipal;
+  isJsonStreamResult: (value: unknown) => value is JsonStreamResult;
+  resolveName: (ref: NamedRef) => string;
+} {
+  return lazyRequire(import.meta.dir, ["fx", "runtime"].join("-"));
+}
+
+/** App-shell tenancy wiring — loaded only when `gate.auth.tenant` is on. */
+function loadAppTenant(): { w: (kind: number, ...args: unknown[]) => unknown } {
+  return lazyRequire(import.meta.dir, ["app", "tenant"].join("-"));
+}
+
+/** Durable runner — statically imports `createFx`; keep it off Store-only `oke()`. */
+function loadDurable(): {
+  runDurable: (opts: RunDurableOptions) => Promise<DurableResult>;
+} {
+  return lazyRequire(import.meta.dir, ["clock", "durable"].join("-"));
+}
+
 /** Options for {@link oke}. */
 export interface OkeOptions {
   /** Application name (Manifest `app`). */
@@ -465,6 +490,8 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
       readonly parentId?: string;
       /** Explicit run / WideEvent id (defaults to a new UUID). */
       readonly runId?: string;
+      /** Tenant identity for cron / `fx.call` (propagated, unlike auth). */
+      readonly tenant?: { readonly id: string | null };
     },
   ): Promise<ExecuteResult>;
   /**
@@ -498,8 +525,12 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
    * Invoke all flows bound to an `every` interval.
    *
    * @param interval - Interval string (e.g. `"1h"`)
+   * @param extras - Optional tenant / parent for per-tenant clocks
    */
-  dispatchEvery(interval: string): Promise<ExecuteResult[]>;
+  dispatchEvery(
+    interval: string,
+    extras?: { readonly tenant?: { readonly id: string | null } },
+  ): Promise<ExecuteResult[]>;
   /**
    * Invoke all flows bound to a CDC table change.
    *
@@ -610,6 +641,57 @@ function assertHttpBindingReady(binding: Binding): void {
   }
 }
 
+/**
+ * Register one HTTP binding: unique method+path, unique live exposure key.
+ *
+ * @param binding - HTTP binding
+ * @param seenHttpRoutes - `METHOD path` keys
+ * @param seenLiveExposures - `(signal, gates, match)` keys
+ * @param smart - Router
+ * @param compiled - Compiled route map
+ * @param aot - AoT compile flag
+ */
+function registerHttpRoute(
+  binding: Binding,
+  seenHttpRoutes: Set<string>,
+  seenLiveExposures: Map<string, string>,
+  smart: { add(method: string, path: string, value: Binding): void },
+  compiled: WeakMap<Binding, CompiledRoute>,
+  aot: boolean,
+): void {
+  const trigger = binding.trigger;
+  if (trigger.kind !== "http") return;
+  const routeKey = `${trigger.method} ${trigger.path}`;
+  if (seenHttpRoutes.has(routeKey)) {
+    throwOke("HTTP_ROUTE_DUPLICATE", {
+      method: trigger.method,
+      path: trigger.path,
+      flow: binding.flow.name || "(unnamed)",
+    });
+  }
+  seenHttpRoutes.add(routeKey);
+  if (trigger.liveSignal !== undefined) {
+    const matchKey = binding.flow.liveCustomMatch
+      ? `custom:${binding.flow.name}`
+      : liveMatchKeyFromPath(trigger.path);
+    const exposure = liveExposureKey(
+      trigger.liveSignal.name,
+      liveGatesKey(trigger.gates),
+      matchKey,
+    );
+    if (seenLiveExposures.has(exposure)) {
+      throwOke("LIVE_EXPOSURE_DUPLICATE", {
+        signal: trigger.liveSignal.name,
+        gates: liveGatesKey(trigger.gates) || "(none)",
+        match: matchKey || "(firehose)",
+      });
+    }
+    seenLiveExposures.set(exposure, binding.flow.name);
+  }
+  smart.add(trigger.method, trigger.path, binding);
+  compiled.set(binding, compileHttpBinding(binding, aot));
+}
+
 /**
  * Fold `generated.ts` units into `$routes` and `flowsByName`.
  *
@@ -790,20 +872,11 @@ export function oke(options: OkeOptions): OkeApp {
 
   const smart = createRouter<Binding>(options.router ?? "default");
   const seenHttpRoutes = new Set<string>();
+  const seenLiveExposures = new Map<string, string>();
   for (const b of adopted) {
     if (b.trigger.kind === "http") {
       assertHttpBindingReady(b);
-      const key = `${b.trigger.method} ${b.trigger.path}`;
-      if (seenHttpRoutes.has(key)) {
-        throwOke("HTTP_ROUTE_DUPLICATE", {
-          method: b.trigger.method,
-          path: b.trigger.path,
-          flow: b.flow.name || "(unnamed)",
-        });
-      }
-      seenHttpRoutes.add(key);
-      smart.add(b.trigger.method, b.trigger.path, b);
-      compiled.set(b, compileHttpBinding(b, aot));
+      registerHttpRoute(b, seenHttpRoutes, seenLiveExposures, smart, compiled, aot);
     }
   }
   // Defer SmartRouter selection until first match so `.plug()` can still
@@ -815,17 +888,7 @@ export function oke(options: OkeOptions): OkeApp {
     registerFlow(b.flow);
     if (b.trigger.kind === "http") {
       assertHttpBindingReady(b);
-      const key = `${b.trigger.method} ${b.trigger.path}`;
-      if (seenHttpRoutes.has(key)) {
-        throwOke("HTTP_ROUTE_DUPLICATE", {
-          method: b.trigger.method,
-          path: b.trigger.path,
-          flow: b.flow.name || "(unnamed)",
-        });
-      }
-      seenHttpRoutes.add(key);
-      smart.add(b.trigger.method, b.trigger.path, b);
-      compiled.set(b, compileHttpBinding(b, aot));
+      registerHttpRoute(b, seenHttpRoutes, seenLiveExposures, smart, compiled, aot);
     }
   }
 
@@ -944,12 +1007,15 @@ export function oke(options: OkeOptions): OkeApp {
   }
 
   async function handleCronFire(name: string): Promise<void> {
-    await app.dispatchEvery(name);
+    const extras = gateConfig.auth?.tenant
+      ? (loadAppTenant().w(0, name) as { readonly tenant: { readonly id: string } } | undefined)
+      : undefined;
+    await app.dispatchEvery(name, extras);
     // Named clocks (e.g. `clock("expire-stale", { every: "1h" })`) reconcile
     // to a store row whose effective interval may differ from the cron name.
     const row = await bootResult?.clock?.store.get(name);
     if (row?.effectiveEvery && row.effectiveEvery !== name) {
-      await app.dispatchEvery(row.effectiveEvery);
+      await app.dispatchEvery(row.effectiveEvery, extras);
     }
   }
 
@@ -1004,15 +1070,20 @@ export function oke(options: OkeOptions): OkeApp {
         return;
       }
       const { store, instanceId, leaseMs } = activeJournal();
+      const existing = await store.get(runId);
       try {
-        await runDurable({
+        await loadDurable().runDurable({
           flow: flowDef,
           input,
           journalStore: store,
           runId,
           ...(hasJournalLease(store) ? { lease: { instanceId, leaseMs } } : {}),
           now,
-          fx: durableResumeFx(),
+          fx: {
+            ...durableResumeFx(),
+            ...(gateConfig.auth?.tenant ? (loadAppTenant().w(5, gateConfig.auth) as object) : {}),
+            ...(existing?.tenant ? { tenant: { id: existing.tenant } } : {}),
+          },
         });
       } catch (err) {
         if (isJournalLeaseBusy(err)) return;
@@ -1176,9 +1247,15 @@ export function oke(options: OkeOptions): OkeApp {
       onCronFire: overrides?.onCronFire ?? handleCronFire,
       onSignal: overrides?.onSignal ?? handleSignalFire,
       onDurableResume: overrides?.onDurableResume ?? handleDurableResume,
+      ...(gateConfig.auth?.tenantStore
+        ? (loadAppTenant().w(1, gateConfig.auth.tenantStore) as object)
+        : {}),
     };
     const result = await bootApplication(merged);
     bootResult = result;
+    if (gateConfig.auth?.tenantStore && result.clock) {
+      loadAppTenant().w(2, gateConfig.auth.tenantStore, result.clock.store, merged.clocks ?? []);
+    }
     if (gateConfig.auth?.apiKeyStore && result.store) {
       const { bindHostApiKeySqlFromStore } = await import("../auth/api-key-sql.ts");
       await bindHostApiKeySqlFromStore(result.store, gateConfig.auth.apiKeyStore);
@@ -1266,6 +1343,8 @@ export function oke(options: OkeOptions): OkeApp {
       readonly parentId?: string;
       /** Explicit run / WideEvent id (defaults to a new UUID). */
       readonly runId?: string;
+      /** Tenant identity for cron / `fx.call` (propagated, unlike auth). */
+      readonly tenant?: { readonly id: string | null };
     },
   ): Promise<ExecuteResult> {
     registerFlow(flowDef);
@@ -1290,8 +1369,8 @@ export function oke(options: OkeOptions): OkeApp {
           resolvedLocale,
           defaultLocale,
         });
-      const signal = extras?.request?.signal;
-      return signal ? withAbortSignal(signal, run) : run();
+      const abort = extras?.request?.signal;
+      return abort ? withAbortSignal(abort, run) : run();
     });
   }
 
@@ -1314,12 +1393,15 @@ export function oke(options: OkeOptions): OkeApp {
       readonly locale?: string;
       readonly parentId?: string;
       readonly runId?: string;
+      readonly tenant?: { readonly id: string | null };
     };
     readonly resolvedLocale: string;
     readonly defaultLocale: string;
   }): Promise<ExecuteResult> {
     const { flowDef, input, trigger, extras, resolvedLocale, defaultLocale } = args;
     const booted = await ensureBoot();
+    const tenantEnabled = gateConfig.auth?.tenant !== undefined;
+    const flowTenantScoped = flowDef.tenantScoped ?? tenantEnabled;
 
     const unitBag = flowDef.unit !== undefined ? unitHooks.get(flowDef.unit) : undefined;
     // app (hooks + plugs) → unit (hooks + plugs) → flow (hooks + plugs)
@@ -1375,6 +1457,7 @@ export function oke(options: OkeOptions): OkeApp {
           apiKeyId: options.fx?.auth?.apiKeyId,
         },
         operator: { id: options.fx?.operator?.id ?? null },
+        tenant: { id: extras?.tenant?.id ?? options.fx?.tenant?.id ?? null },
       };
 
       // Principal injection: test harness (`env: "test"`) OR console-trusted
@@ -1391,6 +1474,8 @@ export function oke(options: OkeOptions): OkeApp {
       const cookieOpts = gateConfig.auth?.cookies;
       const cookieToken = wiredAuth?.tokenFromCookieHeader;
       const apiKeyStore = gateConfig.auth?.apiKeyStore;
+      const tenantEnabled = gateConfig.auth?.tenant !== undefined;
+      const flowTenantScoped = flowDef.tenantScoped ?? tenantEnabled;
       const elementHooks = createElementPipelineHooks({
         gates: booted.gate,
         principals,
@@ -1415,13 +1500,29 @@ export function oke(options: OkeOptions): OkeApp {
                 return cookieToken(request.headers.get("cookie"), cookieOpts);
               }
             : undefined,
+        ...(gateConfig.auth?.tenant && gateConfig.auth.tenantStore
+          ? (loadAppTenant().w(
+              3,
+              gateConfig.auth.tenant,
+              gateConfig.auth.tenantStore,
+              flowTenantScoped,
+              flowDef.plane,
+            ) as object)
+          : {}),
       });
 
       // Element hooks run first in the app-level onAuth/beforeHandle chain —
       // principal resolution and gate checks precede user-registered hooks.
       hooks = mergeHooks(
         {
-          onAuth: [elementHooks.onAuth],
+          onAuth: [
+            elementHooks.onAuth,
+            async () => {
+              if (journalSession && principals?.tenant.id) {
+                await journalSession.stampTenant(principals.tenant.id);
+              }
+            },
+          ],
           beforeHandle: [elementHooks.beforeHandle],
         },
         composedHooks,
@@ -1446,12 +1547,13 @@ export function oke(options: OkeOptions): OkeApp {
     }
 
     const effects = flowDef.effects ?? capability?.declared;
-    const { fx, ledger } = createFxContext({
+    const { fx, ledger } = loadFx().createFxContext({
       ...options.fx,
       flow: flowDef.name,
       effects,
       runTelemetry: telemetry,
       runId,
+      lastEventId: extras?.request?.headers.get("last-event-id") || undefined,
       now,
       i18n: {
         locale: resolvedLocale,
@@ -1459,8 +1561,28 @@ export function oke(options: OkeOptions): OkeApp {
         catalogs: loadMessages().getMessageCatalogs(),
         ...options.fx?.i18n,
       },
-      ...(principals ? { auth: principals.auth, operator: principals.operator } : {}),
+      ...(principals
+        ? {
+            auth: principals.auth,
+            operator: principals.operator,
+            tenant: principals.tenant,
+          }
+        : extras?.tenant
+          ? { tenant: { id: extras.tenant.id } }
+          : {}),
       apiKeyStore: gateConfig.auth?.apiKeyStore,
+      sessions: authBinding?.sessions,
+      manifest: options.manifest,
+      ...(tenantEnabled || extras?.tenant
+        ? (loadAppTenant().w(4, {
+            enabled: tenantEnabled,
+            store: gateConfig.auth?.tenantStore,
+            scoped: flowTenantScoped,
+            plane: flowDef.plane,
+            tenant: principals?.tenant ?? (extras?.tenant ? { id: extras.tenant.id } : undefined),
+            bind: authBinding,
+          }) as object)
+        : {}),
       ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(extras?.trustedInvoke === true && extras.revealPii === true ? { revealPii: true } : {}),
       rlsGateNames: gateNamesOf(trigger),
@@ -1488,9 +1610,10 @@ export function oke(options: OkeOptions): OkeApp {
           callInput,
           { kind: "internal" } satisfies InternalTrigger,
           {
-            originPrincipal: freezePrincipal(fx.principal),
+            originPrincipal: loadFx().freezePrincipal(fx.principal),
             locale: resolvedLocale,
             parentId: runId,
+            ...(tenantEnabled ? { tenant: { id: fx.tenant.id } } : {}),
             ...(extras?.trustedInvoke === true && extras.revealPii === true
               ? { trustedInvoke: true, revealPii: true }
               : {}),
@@ -1592,7 +1715,7 @@ export function oke(options: OkeOptions): OkeApp {
                   durable: flowDef.durable,
                   effects: putEffects,
                 });
-              if (storeAfter && output !== undefined && !isJsonStreamResult(output)) {
+              if (storeAfter && output !== undefined && !loadFx().isJsonStreamResult(output)) {
                 const ttlMs =
                   typeof flowDef.cache === "string" ? cache.parseTtlMs(flowDef.cache) : undefined;
                 storeRt.putTier1(
@@ -1641,7 +1764,7 @@ export function oke(options: OkeOptions): OkeApp {
 
     const endedAt = now();
     const durationMs = resolveDurationMs(endedAt - startedAt, performance.now() - startedHr);
-    const streamOut = isJsonStreamResult(result.output) ? result.output : undefined;
+    const streamOut = loadFx().isJsonStreamResult(result.output) ? result.output : undefined;
 
     const finalizeRun = async (): Promise<void> => {
       // Stream rows land in Traces only after close. Measure wall time then
@@ -1710,7 +1833,11 @@ export function oke(options: OkeOptions): OkeApp {
       }
     };
 
-    if (streamOut && !isTerminalFailure(result)) {
+    if (
+      streamOut &&
+      !isTerminalFailure(result) &&
+      result.response?.headers.get("content-type")?.includes("text/event-stream")
+    ) {
       streamOut.finalize = finalizeRun;
     } else {
       await finalizeRun();
@@ -1817,7 +1944,7 @@ export function oke(options: OkeOptions): OkeApp {
       for (const [runId, sleeper] of [...sleepingRuns.entries()]) {
         if (t < sleeper.wakeAt) continue;
         sleepingRuns.delete(runId);
-        const result = await runDurable({
+        const result = await loadDurable().runDurable({
           flow: sleeper.flow,
           input: sleeper.input,
           journalStore: store,
@@ -1873,7 +2000,7 @@ export function oke(options: OkeOptions): OkeApp {
     },
     flow(ref) {
       if (isFlow(ref)) return flowsByName.get(ref.name) ?? ref;
-      return flowsByName.get(resolveName(ref as NamedRef));
+      return flowsByName.get(loadFx().resolveName(ref as NamedRef));
     },
     adopt(...args: readonly unknown[]) {
       const flows = accumulateAdoptArgs(args, routes);
@@ -1969,7 +2096,7 @@ export function oke(options: OkeOptions): OkeApp {
           );
           runLabel = internalResult.runId;
           cacheLabel = internalResult.cache;
-          return respond(encodeExecuteResult(internalResult));
+          return respond(await encodeExecuteResult(internalResult));
         }
       }
 
@@ -2048,10 +2175,10 @@ export function oke(options: OkeOptions): OkeApp {
       runLabel = result.runId;
       cacheLabel = result.cache;
 
-      return respond(encodeExecuteResult(result));
+      return respond(await encodeExecuteResult(result));
     },
     async dispatchSignal(signal, payload, meta) {
-      const name = resolveName(signal);
+      const name = loadFx().resolveName(signal);
       const results: ExecuteResult[] = [];
       for (const b of adopted) {
         if (b.trigger.kind === "signal" && b.trigger.name === name) {
@@ -2064,11 +2191,11 @@ export function oke(options: OkeOptions): OkeApp {
       }
       return results;
     },
-    async dispatchEvery(interval) {
+    async dispatchEvery(interval, extras) {
       const results: ExecuteResult[] = [];
       for (const b of adopted) {
         if (b.trigger.kind === "every" && b.trigger.interval === interval) {
-          results.push(await execute(b.flow, undefined, b.trigger as EveryTrigger));
+          results.push(await execute(b.flow, undefined, b.trigger as EveryTrigger, extras));
         }
       }
       return results;
@@ -2089,7 +2216,7 @@ export function oke(options: OkeOptions): OkeApp {
     async call(ref, input) {
       const flowDef = isFlow(ref)
         ? (flowsByName.get(ref.name) ?? ref)
-        : flowsByName.get(resolveName(ref as NamedRef));
+        : flowsByName.get(loadFx().resolveName(ref as NamedRef));
       if (!flowDef) {
         return undefined;
       }

package/src/kernel/auth-resolve.ts

@@ -84,6 +84,7 @@ export function claimsToPrincipal(claims: AccessClaims): ResolvedPrincipal {
     userId: claims.sub,
     scopes: claims.scopes,
     verified: true,
+    ...(claims.tid !== undefined ? { tenantId: claims.tid } : {}),
   };
 }
 
@@ -104,6 +105,7 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
       scopes: row.scopes,
       verified: true,
       apiKeyId: row.id,
+      ...(row.tenantId !== undefined ? { tenantId: row.tenantId } : {}),
     };
   }
   return {
@@ -112,6 +114,7 @@ export function apiKeyRowToPrincipal(row: ApiKeyRow): ResolvedPrincipal {
     scopes: row.scopes,
     verified: true,
     apiKeyId: row.id,
+    ...(row.tenantId !== undefined ? { tenantId: row.tenantId } : {}),
   };
 }
 

package/src/kernel/boot-bind/clock.ts

@@ -60,12 +60,16 @@ export async function bindClock(
   if (prebuilt) {
     clock = prebuilt;
   } else if (clockDriver === "frozen" || env === "test") {
-    clock = createTestClockRuntime(now(), { instanceId: options.instanceId });
+    clock = createTestClockRuntime(now(), {
+      instanceId: options.instanceId,
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
+    });
   } else if (clockDriver === "memory") {
     clock = createClockRuntime({
       instanceId: options.instanceId,
       now,
       store: createMemoryCronStore(),
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
     });
   } else if (clockDriver === "file") {
     const path = resolve(process.cwd(), DEFAULT_FILE_CRON_PATH);
@@ -74,6 +78,7 @@ export async function bindClock(
       instanceId: options.instanceId,
       now,
       store: createFileCronStore(path),
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
     });
   } else if (clockDriver === "postgres") {
     const url = process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL ?? undefined;
@@ -89,6 +94,7 @@ export async function bindClock(
       instanceId: options.instanceId,
       now,
       store,
+      ...(options.tenantIds ? { tenantIds: options.tenantIds } : {}),
     });
   } else {
     throw new Error(
@@ -118,8 +124,8 @@ export async function bindClock(
   if (options.onCronFire) {
     const fire = options.onCronFire;
     for (const name of clockDecls.keys()) {
-      clock.onCron(name, async () => {
-        await fire(name);
+      clock.onCron(name, async (row) => {
+        await fire(row.name);
       });
     }
   }

package/src/kernel/boot.ts

@@ -152,6 +152,8 @@ export interface BootOptions {
    * @param name - Cron name or every-interval
    */
   readonly onCronFire?: (name: string) => void | Promise<void>;
+  /** Tenant ids for per-tenant clock expansion at reconcile. */
+  readonly tenantIds?: () => readonly string[] | Promise<readonly string[]>;
   /**
    * Dispatch a signal message to bound flows.
    *

package/src/kernel/budget.test.ts

@@ -1,6 +1,6 @@
 /**
  * Kernel edge profile budget — AGENTS.md / unified-theory §24.
- * Limit: < 15 kB gzipped (minified bundle).
+ * Limit: < 16 kB gzipped (minified bundle).
  */
 
 import { describe, expect, test } from "bun:test";

package/src/kernel/clock-durable.ts

@@ -0,0 +1,8 @@
+/**
+ * Durable runner — lazy chunk off Store-only `oke()` construction.
+ *
+ * `runDurable` statically imports `createFx`; keeping that edge off graphs
+ * that never run a durable Flow.
+ */
+
+export { runDurable } from "../elements/clock/durable.ts";

package/src/kernel/clock-per-tenant-name.ts

@@ -0,0 +1,5 @@
+/**
+ * Parse `{template}#{tenantId}` — lazy chunk off Store-only `oke()` graphs.
+ */
+
+export { parsePerTenantCronName } from "../elements/clock/declare.ts";

package/src/kernel/clock-reconcile.ts

@@ -0,0 +1,8 @@
+/**
+ * Clock per-tenant row hooks — lazy chunk.
+ *
+ * A static import from `app.ts` would pin Clock reconcile on every `oke()`
+ * graph, including Store-only apps that never enable `gate.auth.tenant`.
+ */
+
+export { orphanPerTenantCronRows, putPerTenantCronRows } from "../elements/clock/reconcile.ts";

package/src/kernel/errors-live-resume.ts

@@ -0,0 +1,15 @@
+/**
+ * OKE1014 — kept off the Store-only `oke()` graph.
+ *
+ * Signal drivers throw this when a Last-Event-ID is missing from the tape.
+ * Loaded via computed `import.meta.require` from {@link lookupOkeError}.
+ */
+
+import type { OkeErrorDefinition } from "./errors.ts";
+
+/** Last-Event-ID is missing from the retained live tape. */
+export const LIVE_RESUME_GAP: OkeErrorDefinition = {
+  code: 1014,
+  cause: 'Cursor "{afterId}" missing on "{signal}".',
+  fix: "Reconnect without Last-Event-ID.",
+};

package/src/kernel/errors-tenant.ts

@@ -0,0 +1,29 @@
+/**
+ * OKE1015–1017 — kept off the Store-only `oke()` graph.
+ *
+ * Tenant KV/vault and membership failures. Loaded via computed
+ * `import.meta.require` from {@link throwOke} / {@link lookupOkeError}.
+ */
+
+import type { OkeErrorDefinition } from "./errors.ts";
+
+/** Tenant-scoped op ran with no resolved `fx.tenant.id`. */
+export const TENANT_REQUIRED: OkeErrorDefinition = {
+  code: 1015,
+  cause: "This operation needs a tenant, but none is resolved for this request.",
+  fix: "Call fx.auth.switchTenant(id), send a signed tid claim, or pass the tenant header.",
+};
+
+/** Client-supplied tenant id is not a real membership. */
+export const TENANT_NOT_MEMBER: OkeErrorDefinition = {
+  code: 1016,
+  cause: 'The caller is not a member of tenant "{tenant}".',
+  fix: "Pick a tenant from fx.auth.listTenants() or add the user as a member.",
+};
+
+/** Tenant role mapped an invented or operator-plane scope. */
+export const TENANT_UNKNOWN_SCOPE: OkeErrorDefinition = {
+  code: 1017,
+  cause: 'Tenant role scope "{scope}" is not a declared application scope.',
+  fix: "Use a name from this app's Manifest catalog (never console:*).",
+};