okengine 0.16.0 → 0.17.0

package/src/kernel/tenant-roles.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Tenant-role scope union is conditional — never JWT-melt, never on
+ * `tenantScoped: false` flows.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { createTenant, createTenantStore, upsertTenantRole } from "../auth/tenants.ts";
+import { gate } from "../elements/gate.ts";
+import { oke } from "./app.ts";
+import { flow, resetFlowSeq } from "./flow.ts";
+import { isFlowFailure } from "./hooks.ts";
+import { on, resetBindings } from "./on.ts";
+import { http } from "./triggers.ts";
+
+const SECRET = "tenant-roles-test-secret";
+
+describe("tenant-role scope union", () => {
+  test("tenant-granted scope does not authorize a tenantScoped: false route", async () => {
+    resetBindings();
+    resetFlowSeq();
+    const member = gate.policy("member", ({ auth }) => !!auth.verified);
+    const booking = gate.scope("booking:create");
+    const tenantStore = createTenantStore();
+    await createTenant(tenantStore, { name: "Acme", createdBy: "u1", id: "t1" });
+    upsertTenantRole(tenantStore, {
+      tenantId: "t1",
+      roleName: "member",
+      scopes: ["booking:create"],
+      catalog: ["booking:create", "member"],
+    });
+
+    on(
+      http.get("/global").gate(booking),
+      flow("global.ping", {
+        tenantScoped: false,
+        do: () => "global",
+      }),
+    );
+    on(
+      http.get("/tenant").gate(booking),
+      flow("tenant.ping", {
+        do: () => "tenant",
+      }),
+    );
+
+    const app = oke({
+      name: "tenant-roles",
+      env: "test",
+      startScheduler: false,
+      gate: {
+        policies: [member, booking],
+        auth: { secret: SECRET, tenant: true, tenantStore, http: false },
+      },
+    });
+    await app.boot({ env: "test", startScheduler: false });
+
+    const principal = {
+      plane: "user" as const,
+      userId: "u1",
+      scopes: [] as string[],
+      verified: true,
+      tenantId: "t1",
+    };
+
+    const leak = await app.execute(
+      app.flow("global.ping")!,
+      undefined,
+      http.get("/global").gate(booking),
+      { principal },
+    );
+    expect(leak.failure && isFlowFailure(leak.failure)).toBe(true);
+    if (leak.failure && isFlowFailure(leak.failure)) {
+      expect(leak.failure.error.code).toBe("Forbidden");
+    }
+
+    const allowed = await app.execute(
+      app.flow("tenant.ping")!,
+      undefined,
+      http.get("/tenant").gate(booking),
+      { principal },
+    );
+    expect(allowed.failure).toBeUndefined();
+    expect(allowed.output).toBe("tenant");
+
+    await app.bootResult?.close();
+  });
+});

package/src/kernel/triggers.ts

@@ -36,8 +36,10 @@ export interface HttpTrigger<M extends HttpMethod = HttpMethod, P extends string
   readonly method: M;
   readonly path: P;
   readonly gates: readonly GateRef[];
-  /** Whether `.live()` was applied. */
-  readonly isLive: boolean;
+  /**
+   * Signal this GET exposes as a live SSE feed (`undefined` when not a live route).
+   */
+  readonly liveSignal?: SignalSource;
   /**
    * Attach gates (registration order). `gate.all` handles and arrays flatten.
    */
@@ -47,9 +49,29 @@ export interface HttpTrigger<M extends HttpMethod = HttpMethod, P extends string
    */
   public(): HttpTrigger<M, P>;
   /**
-   * Mark the HTTP trigger as live (push result to subscribers).
+   * Expose a `delivery: "live"` signal as SSE on this GET.
+   *
+   * @param signal - Live signal handle
    */
-  live(): HttpTrigger<M, P>;
+  live(signal: SignalSource): LiveHttpTrigger<M, P>;
+}
+
+/**
+ * HTTP GET trigger that exposes a live signal (`on(trigger)` synthesizes the Flow).
+ *
+ * `.gate` / `.public` keep {@link LiveHttpTrigger.liveSignal} so
+ * `on(http.live(signal).gate(member))` typechecks.
+ *
+ * @typeParam M - HTTP method literal
+ * @typeParam P - Path template literal
+ */
+export interface LiveHttpTrigger<
+  M extends HttpMethod = "GET",
+  P extends string = string,
+> extends HttpTrigger<M, P> {
+  readonly liveSignal: SignalSource;
+  readonly gate: GateAttach<LiveHttpTrigger<M, P>>;
+  public(): LiveHttpTrigger<M, P>;
 }
 
 /** Clock / interval trigger (`every("1h")`). */
@@ -105,31 +127,43 @@ export function createGateAttach<T>(
 }
 
 /**
- * Build an HTTP trigger with `.gate` / `.public` / `.live`.
+ * Build an HTTP trigger with `.gate` / `.public` / `.live(signal)`.
  *
  * @param method - HTTP verb
  * @param path - Route path
  * @param gates - Attached gate refs
- * @param isLive - Live flag
+ * @param liveSignal - Live signal when `.live(signal)` was applied
  */
+export function createHttpTrigger<M extends HttpMethod, P extends string>(
+  method: M,
+  path: P,
+  gates: readonly GateRef[],
+  liveSignal: SignalSource,
+): LiveHttpTrigger<M, P>;
+export function createHttpTrigger<M extends HttpMethod, P extends string>(
+  method: M,
+  path: P,
+  gates?: readonly GateRef[],
+  liveSignal?: SignalSource,
+): HttpTrigger<M, P>;
 export function createHttpTrigger<M extends HttpMethod, P extends string>(
   method: M,
   path: P,
   gates: readonly GateRef[] = [],
-  isLive = false,
+  liveSignal?: SignalSource,
 ): HttpTrigger<M, P> {
   const trigger: HttpTrigger<M, P> = {
     kind: "http",
     method,
     path,
     gates,
-    isLive,
-    gate: createGateAttach((next) => createHttpTrigger(method, path, next, isLive), gates),
+    ...(liveSignal !== undefined ? { liveSignal } : {}),
+    gate: createGateAttach((next) => createHttpTrigger(method, path, next, liveSignal), gates),
     public() {
-      return createHttpTrigger(method, path, [...gates, GATE_PUBLIC_NAME], isLive);
+      return createHttpTrigger(method, path, [...gates, GATE_PUBLIC_NAME], liveSignal);
     },
-    live() {
-      return createHttpTrigger(method, path, gates, true);
+    live(signal: SignalSource) {
+      return createHttpTrigger(method, path, gates, signal);
     },
   };
   return trigger;
@@ -150,14 +184,12 @@ export interface ResourceFlowBag {
 /**
  * A mounted resource — the single argument to the `on(http.resource(…))`
  * overload. Branded so `on` can tell it apart from a plain trigger.
- * Same chain as {@link HttpTrigger}: `.gate(...)` / `.public()` / `.live()`.
+ * Same chain as {@link HttpTrigger}: `.gate(...)` / `.public()`.
  */
 export interface ResourceMount {
   readonly [resourceMountBrand]: true;
   readonly mounts: ReadonlyArray<{ readonly trigger: HttpTrigger; readonly flow: unknown }>;
   readonly gates: readonly GateRef[];
-  /** Whether `.live()` was applied (GET list + get). */
-  readonly isLive: boolean;
   /**
    * Attach gates to every verb (registration order). `gate.all` and arrays flatten.
    */
@@ -166,10 +198,6 @@ export interface ResourceMount {
    * Attach the unauthenticated public sentinel to every verb.
    */
   public(): ResourceMount;
-  /**
-   * Mark list and get as live (GET mounts). Mutations stay request/response.
-   */
-  live(): ResourceMount;
 }
 /** Brand for {@link ResourceMount}. */
 export const resourceMountBrand: unique symbol = Symbol.for("oke.resource.mount");
@@ -254,10 +282,16 @@ export interface HttpTriggerNamespace {
   query<P extends string>(path: P): HttpTrigger<"QUERY", P>;
   /**
    * Mount a CRUD resource (list/create on `path`, get/update/remove on
-   * `path/:id`) for the `on(http.resource(…))` overload. Chain `.gate(...)`,
-   * `.public()`, and `.live()` like {@link HttpTrigger}.
+   * `path/:id`) for the `on(http.resource(…))` overload. Chain `.gate(...)`
+   * and `.public()` like {@link HttpTrigger}.
    */
   resource<P extends string>(path: P, ops: ResourceFlowBag): ResourceMount;
+  /**
+   * Default live firehose: `GET /_oke/live/{signal}`. Chain `.gate(...)`.
+   *
+   * @param signal - `delivery: "live"` handle
+   */
+  live(signal: SignalSource): LiveHttpTrigger<"GET">;
 }
 
 /** Bind an HTTP verb constructor (`http.get`, `http.query`, …). */
@@ -287,6 +321,10 @@ export const http: HttpTriggerNamespace = {
   head: httpVerb("HEAD"),
   query: httpVerb("QUERY"),
   resource: (path, ops) => loadHttpResource().httpResource(path, ops),
+  live(signal) {
+    const path = `/_oke/live/${encodeURIComponent(signal.name)}`;
+    return createHttpTrigger("GET", path, [], signal);
+  },
 };
 
 /**

package/src/manifest/diff.test.ts

@@ -139,6 +139,15 @@ describe("diffManifest — fixture pairs", () => {
     expect(hasCategory(result.changes, "contract-breaking", "delivery")).toBe(true);
   });
 
+  test("10b · live retention change is contract-breaking", async () => {
+    const before = await loadBase();
+    before.signals!["order-placed"]!.delivery = "live";
+    const after = clone(before);
+    after.signals!["order-placed"]!.retention = { maxCount: 10 };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "retention")).toBe(true);
+  });
+
   test("11 · rate limit expression widened is permission-widening", async () => {
     const before = await loadBase();
     const after = clone(before);
@@ -257,7 +266,7 @@ describe("diffManifest — additional branches", () => {
       properties: { id: { type: "number" } },
     };
     flow.durable = true;
-    flow.live = true;
+    flow.live = "order-status";
     flow.plane = "operator";
     flow.cost = { estimatePerCall: 1, budget: 2 };
     flow.pii = "allow";
@@ -598,7 +607,7 @@ describe("diffManifest — line coverage sweep", () => {
     after.flows!["orders.create"]!.steps = ["a"];
     after.flows!["orders.create"]!.nondeterministic = false;
     after.flows!["orders.create"]!.cost = { budget: 1 };
-    after.flows!["orders.create"]!.live = false;
+    delete after.flows!["orders.create"]!.live;
     after.flows!["orders.create"]!.durable = false;
     after.flows!["orders.create"]!.in = "CreateOrderV2";
     after.flows!["orders.create"]!.out = {

package/src/manifest/diff.ts

@@ -218,7 +218,7 @@ function diffFlow(before: Flow, after: Flow, path: string, out: ManifestChange[]
     out.push(
       change(
         `${path}/live`,
-        after.live === true ? "effect-widening" : "no-impact",
+        after.live !== undefined && after.live !== before.live ? "effect-widening" : "no-impact",
         kindOf(before.live, after.live),
         before.live,
         after.live,
@@ -760,6 +760,18 @@ function diffSignal(before: Signal, after: Signal, path: string, out: ManifestCh
       ),
     );
   }
+  if (!deepEqual(before.retention, after.retention)) {
+    out.push(
+      change(
+        `${path}/retention`,
+        "contract-breaking",
+        kindOf(before.retention, after.retention),
+        before.retention,
+        after.retention,
+        "live retention changed",
+      ),
+    );
+  }
 }
 
 function diffStore(before: Store, after: Store, path: string, out: ManifestChange[]): void {
@@ -1233,18 +1245,48 @@ function diffTenancy(
     );
     return;
   }
+  if (before?.enabled === true && after?.enabled !== true) {
+    out.push(
+      change(
+        "/tenancy/enabled",
+        "permission-widening",
+        "changed",
+        true,
+        after?.enabled,
+        "tenancy disabled",
+      ),
+    );
+  } else if (before?.enabled !== true && after?.enabled === true) {
+    out.push(
+      change("/tenancy/enabled", "no-impact", "changed", before?.enabled, true, "tenancy enabled"),
+    );
+  }
+  if (before?.membershipRequired === true && after?.membershipRequired !== true) {
+    out.push(
+      change(
+        "/tenancy/membershipRequired",
+        "permission-widening",
+        "changed",
+        true,
+        after?.membershipRequired,
+        "tenant membership no longer required",
+      ),
+    );
+  }
   const b = before?.isolation ? ISOLATION_RANK[before.isolation] : undefined;
   const a = after?.isolation ? ISOLATION_RANK[after.isolation] : undefined;
-  out.push(
-    change(
-      "/tenancy/isolation",
-      b !== undefined && a !== undefined && a < b ? "permission-widening" : "no-impact",
-      "changed",
-      before?.isolation,
-      after?.isolation,
-      `tenancy isolation ${before?.isolation} → ${after?.isolation}`,
-    ),
-  );
+  if (before?.isolation !== after?.isolation) {
+    out.push(
+      change(
+        "/tenancy/isolation",
+        b !== undefined && a !== undefined && a < b ? "permission-widening" : "no-impact",
+        "changed",
+        before?.isolation,
+        after?.isolation,
+        `tenancy isolation ${before?.isolation} → ${after?.isolation}`,
+      ),
+    );
+  }
 }
 
 function diffI18n(before: I18n | undefined, after: I18n | undefined, out: ManifestChange[]): void {

package/src/manifest/fixtures/skyport.excerpt.json

@@ -17,7 +17,7 @@
       "slo": { "availability": "99.9%", "latency": { "p99": "200ms" } },
       "source": "src/flows/bookings/index.ts:18"
     },
-    "bookings.mine": { "live": true, "cacheKeys": "computed:sql:bookings/userId" },
+    "bookings.mine": { "cacheKeys": "computed:sql:bookings/userId" },
     "payments.chargeBooking": {
       "durable": true,
       "steps": ["create-intent", "confirm"],

package/src/manifest/fixtures/skyport.manifest.json

@@ -34,7 +34,6 @@
     "bookings.mine": {
       "trigger": { "http": { "method": "GET", "path": "/bookings" } },
       "gates": ["member"],
-      "live": true,
       "cacheKeys": "computed:sql:bookings/userId",
       "effects": {
         "reads": ["sql:bookings"]

package/src/manifest/types.ts

@@ -53,7 +53,13 @@ export type RunsResourceRef = "runs";
 export type AuthApiKeysResourceRef = "auth:api-keys";
 
 /**
- * Dead-letter read capability for `fx.deadLetters` — not a store facet.
+ * Auth tenant-management capability for `fx.auth` list/switch/create/….
+ * Not a store facet — do not declare `sql:oke_tenants`.
+ */
+export type AuthTenantsResourceRef = "auth:tenants";
+
+/**
+ * Dead-letter / live-stream read capability — not a store facet.
  * Declare on `effects.reads` (never `writes`).
  */
 export type SignalResourceRef = `signal:${string}`;
@@ -86,10 +92,16 @@ export type JsonSchema = string | Record<string, unknown>;
  * `sends` / `asks` are irreversible (asks also nondeterministic + cost).
  */
 export interface Effects {
-  /** Store reads, plus `"runs"` for `fx.runs` and `signal:name` for `fx.deadLetters`. */
-  reads?: Array<ResourceRef | RunsResourceRef | SignalResourceRef | AuthApiKeysResourceRef>;
-  /** Store writes, plus `"auth:api-keys"` for `fx.auth` mutations. */
-  writes?: Array<ResourceRef | AuthApiKeysResourceRef>;
+  /** Store reads, plus `"runs"` for `fx.runs` and `signal:name` for `fx.deadLetters` / `fx.live`. */
+  reads?: Array<
+    | ResourceRef
+    | RunsResourceRef
+    | SignalResourceRef
+    | AuthApiKeysResourceRef
+    | AuthTenantsResourceRef
+  >;
+  /** Store writes, plus `"auth:api-keys"` / `"auth:tenants"` for `fx.auth` mutations. */
+  writes?: Array<ResourceRef | AuthApiKeysResourceRef | AuthTenantsResourceRef>;
   /** Emitted signals. */
   emits?: SignalRef[];
   /** Channel template sends (irreversible). */
@@ -162,7 +174,8 @@ export interface Flow {
   source?: string;
   plane?: FlowPlane;
   durable?: boolean;
-  live?: boolean;
+  /** Live signal name when this flow streams `delivery: "live"` SSE. */
+  live?: string;
   cache?: boolean | string;
   cacheKeys?: string;
   slo?: Slo;
@@ -178,6 +191,19 @@ export interface Flow {
   allowPii?: boolean;
   /** Author acknowledges an intentional contract break. */
   breaking?: boolean;
+  /**
+   * When `false`, skip tenant-role scope union.
+   * Default `true` when `gate.auth.tenant` is on.
+   */
+  tenantScoped?: boolean;
+}
+
+/** Live-tape cap. Omit both fields (or omit `retention`) for an unbounded tape. */
+export interface SignalRetention {
+  /** Drop events older than this duration (`"7d"`, `"1h"`, `"30s"`, …). */
+  maxAge?: string;
+  /** Keep only the newest N live events. */
+  maxCount?: number;
 }
 
 /** One Signal declaration. */
@@ -189,6 +215,8 @@ export interface Signal {
   deadLetter?: boolean;
   schema?: JsonSchema;
   optional?: boolean;
+  /** Live-tape cap (`delivery: "live"` only). Omitted = unbounded. */
+  retention?: SignalRetention;
 }
 
 /** Column / field classification for privacy and retention. */
@@ -247,6 +275,8 @@ export interface Table {
   rls?: boolean;
   /** Policy name → Drizzle-shaped spec. */
   policies?: Record<string, TablePolicy>;
+  /** When `false`, skip fail-loud tenant-policy requirement. */
+  tenantScoped?: boolean;
 }
 
 /** One Store declaration. */
@@ -264,6 +294,11 @@ export interface Store {
    * Distinct from Flow `durable` (journaled steps).
    */
   durable?: boolean;
+  /**
+   * KV only — prefix keys with `{tenantId}:` when tenancy is on.
+   * Default `true` then; `false` is the global-namespace opt-out.
+   */
+  tenantScoped?: boolean;
 }
 
 /** Named clock / schedule. */
@@ -274,6 +309,8 @@ export interface Clock {
   overridable?: boolean;
   /** Optional human description (falls back to the clock map key). */
   description?: string;
+  /** Expand one `oke_crons` row per tenant. */
+  perTenant?: boolean;
 }
 
 /** Named gate — policy, rate, or a flattened `gate.all` handle. */
@@ -305,6 +342,11 @@ export interface SecretContract {
    * in the clear. Defaults to `true` (secret).
    */
   sensitive?: boolean;
+  /**
+   * Resolve per `fx.tenant.id` at request time (not boot).
+   * Default `true` when `gate.auth.tenant` is on.
+   */
+  perTenant?: boolean;
 }
 
 /** Channel template. */
@@ -400,7 +442,11 @@ export interface Plugin {
 
 /** Tenancy configuration (resolver is code; isolation is data). */
 export interface Tenancy {
+  /** `gate.auth.tenant` is on. */
+  enabled?: boolean;
   isolation?: TenancyIsolation;
+  /** Pure B2B — every user-plane request needs a tenant. */
+  membershipRequired?: boolean;
 }
 
 /** i18n configuration. */

package/src/release/build-lib.ts

@@ -24,9 +24,21 @@ const ENTRIES: readonly { readonly src: string; readonly out: string }[] = [
   { src: "src/journal-entry.ts", out: "dist/journal-entry.js" },
   // Lazy sync chunks — loaded via requirePackageModule / computed require
   // when the feature actually runs (auth, list page, auto-cache).
-  { src: "src/kernel/app-auth.ts", out: "dist/app-auth.js" },
+  { src: "src/kernel/fx-runtime.ts", out: "dist/fx-runtime.js" },
   { src: "src/auth/config.ts", out: "dist/auth-config.js" },
   { src: "src/kernel/fx-auth-keys.ts", out: "dist/fx-auth-keys.js" },
+  { src: "src/kernel/fx-auth-tenants.ts", out: "dist/fx-auth-tenants.js" },
+  { src: "src/kernel/fx-tenant-store.ts", out: "dist/fx-tenant-store.js" },
+  { src: "src/drivers/pg-vault-rls.ts", out: "dist/pg-vault-rls.js" },
+  { src: "src/kernel/app-tenant.ts", out: "dist/app-tenant.js" },
+  { src: "src/kernel/pipeline-tenant.ts", out: "dist/pipeline-tenant.js" },
+  { src: "src/kernel/fx-live-stream.ts", out: "dist/fx-live-stream.js" },
+  { src: "src/kernel/errors-live-resume.ts", out: "dist/errors-live-resume.js" },
+  { src: "src/kernel/errors-tenant.ts", out: "dist/errors-tenant.js" },
+  { src: "src/kernel/clock-durable.ts", out: "dist/clock-durable.js" },
+  { src: "src/kernel/clock-reconcile.ts", out: "dist/clock-reconcile.js" },
+  { src: "src/kernel/clock-per-tenant-name.ts", out: "dist/clock-per-tenant-name.js" },
+  { src: "src/elements/store/schema-tenant.ts", out: "dist/schema-tenant.js" },
   { src: "src/kernel/list-page.ts", out: "dist/list-page.js" },
   { src: "src/kernel/http-resource.ts", out: "dist/http-resource.js" },
   { src: "src/elements/store/cache.ts", out: "dist/store-cache.js" },

package/src/release/limits.ts

@@ -5,10 +5,10 @@
  */
 
 /** Kernel (edge profile) — gzipped minified bundle. */
-export const KERNEL_EDGE_BUDGET_BYTES = 15 * 1024;
+export const KERNEL_EDGE_BUDGET_BYTES = 16 * 1024;
 
 /** Client runtime — gzipped minified bundle. */
-export const CLIENT_BUDGET_BYTES = 3 * 1024;
+export const CLIENT_BUDGET_BYTES = 4 * 1024;
 
 /** Console initial load — gzipped html + entry js/css (ui-next SPA, no panel-* split). */
 export const CONSOLE_BUDGET_BYTES = 700 * 1024;

package/src/release/measure.ts

@@ -5,7 +5,7 @@
 import { mkdtemp, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { createRouter } from "../kernel/router.ts";
+import { lazyRequire } from "../kernel/lazy-require.ts";
 import {
   type BudgetGroup,
   OFFICIAL_PLUGIN_BUDGETS,
@@ -228,6 +228,16 @@ export async function measureHttpPingAppBytes(): Promise<HttpPingBudgetSample> {
  * Gzip size of the kernel edge profile bundle.
  */
 export async function measureKernelEdgeGzipBytes(): Promise<number> {
+  try {
+    return await gzipKernelEdgeInProcess();
+  } catch {
+    // bun test's in-process Bun.build cannot always resolve the kernel graph.
+    return gzipKernelEdgeSpawn();
+  }
+}
+
+/** In-process edge gzip — used outside `bun test`. */
+async function gzipKernelEdgeInProcess(): Promise<number> {
   const entry = `${import.meta.dir}/../kernel/budget-entry.ts`;
   // Browser target matches the historical edge-profile gate.
   const result = await Bun.build({
@@ -246,6 +256,46 @@ export async function measureKernelEdgeGzipBytes(): Promise<number> {
   return Bun.gzipSync(new Uint8Array(raw)).byteLength;
 }
 
+/** Subprocess edge gzip — bun test cannot always resolve this graph in-process. */
+async function gzipKernelEdgeSpawn(): Promise<number> {
+  const entry = resolve(ROOT, "src/kernel/budget-entry.ts");
+  const probe = `
+const result = await Bun.build({
+  entrypoints: ${JSON.stringify([entry])},
+  minify: true,
+  target: "browser",
+  format: "esm",
+  external: ${JSON.stringify([...BUILD_EXTERNALS])},
+});
+if (!result.success) {
+  console.error(result.logs.map(String).join("\\n"));
+  process.exit(1);
+}
+const artifact = result.outputs[0];
+if (!artifact) { console.error("no output"); process.exit(1); }
+const raw = await artifact.arrayBuffer();
+process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
+`;
+  const proc = Bun.spawn(["bun", "-e", probe], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`kernel edge build failed:\n${stderr || stdout}`);
+  }
+  const n = Number(stdout.trim());
+  if (!Number.isFinite(n) || n <= 0) {
+    throw new Error(`kernel edge measure produced ${stdout}`);
+  }
+  return n;
+}
+
 /**
  * Gzip size of the client runtime bundle.
  */
@@ -418,6 +468,10 @@ export async function measureColdStartMedianMs(): Promise<number> {
  */
 export function measureRoutingP99Ms(): number {
   const N = 200;
+  const { createRouter } = lazyRequire<typeof import("../kernel/router.ts")>(
+    `${import.meta.dir}/../kernel`,
+    "router",
+  );
   const router = createRouter<number>("default");
   for (let i = 0; i < N; i++) {
     router.add("GET", `/r${i}/:id/leaf`, i);

package/src/client/live-gap.test.ts

@@ -1,35 +0,0 @@
-/**
- * Evidence: createClient has no live-signal subscription today.
- *
- * `delivery: "live"` is consumed server-side via `bus.live()` (and
- * `on(signal, flow)` for flow subscribers). `okengine/client` exposes only
- * HTTP REST / RPC — no SSE, WebSocket, or `api.live(…)`.
- *
- * Design for `client.live(signalName)` is tracked with the Signal docs page;
- * do not treat this file as a stub to fill — ship the real surface when ready.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import * as client from "./index.ts";
-import { createClient } from "./create.ts";
-
-describe("createClient — live signal gap", () => {
-  test("public client module exports no live / subscribe helpers", () => {
-    const keys = Object.keys(client).sort();
-    expect(keys).not.toContain("live");
-    expect(keys).not.toContain("subscribe");
-    expect(keys).toContain("createClient");
-    expect(keys).toContain("createTransport");
-  });
-
-  test("createClient builds an HTTP call proxy only (no live method on the root)", async () => {
-    const api = createClient("http://app.test", {
-      fetch: async () => Response.json({ data: null, error: { code: "NotFound", data: {} } }),
-    });
-    // Root is a callable proxy for unit.flow — live is not a first-class API.
-    expect(typeof api).toBe("function");
-    expect(Object.prototype.hasOwnProperty.call(api, "live")).toBe(false);
-    expect("live" in (api as object)).toBe(false);
-  });
-});