okengine 0.3.6 → 0.5.0

package/src/plugins/cors.test.ts

@@ -29,7 +29,9 @@ function preflight(path = "/x", headers: Record<string, string> = {}): Request {
 describe("cors plugin — preflight", () => {
   test("answers preflight for a path bound to another method (edge)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-pre" }).plug(cors({ origin: "https://app.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-pre" }).plug(
+      cors({ origin: "https://app.example.com" }),
+    );
 
     const res = await app.fetch(preflight());
 
@@ -41,7 +43,9 @@ describe("cors plugin — preflight", () => {
 
   test("denied origins get a 204 without CORS headers — the browser blocks quietly", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-deny" }).plug(cors({ origin: "https://other.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-deny" }).plug(
+      cors({ origin: "https://other.example.com" }),
+    );
 
     const res = await app.fetch(preflight());
 
@@ -51,7 +55,7 @@ describe("cors plugin — preflight", () => {
 
   test("no origin configured answers nothing — cross-origin closed by default", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-closed" }).plug(cors());
+    const app = oke({ autoBoot: false, name: "cors-closed" }).plug(cors());
 
     const res = await app.fetch(preflight());
     expect(res.headers.get("access-control-allow-origin")).toBeNull();
@@ -59,7 +63,7 @@ describe("cors plugin — preflight", () => {
 
   test("a plain unmatched OPTIONS without preflight headers still 404s", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-404" }).plug(cors({ origin: "*" }));
+    const app = oke({ autoBoot: false, name: "cors-404" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x", { method: "OPTIONS" }));
     expect(res.status).toBe(404);
@@ -67,7 +71,7 @@ describe("cors plugin — preflight", () => {
 
   test("reflects request headers by default, honors configured lists and maxAge", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-hdr" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-hdr" }).plug(
       cors({ origin: "*", maxAge: 600, allowedHeaders: ["x-custom"] }),
     );
 
@@ -88,7 +92,7 @@ describe("cors plugin — preflight", () => {
 
   test("allowlist + credentials reflects only listed origins", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-cred" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-cred" }).plug(
       cors({ origin: ["https://app.example.com", "https://admin.example.com"], credentials: true }),
     );
 
@@ -106,7 +110,7 @@ describe("cors plugin — preflight", () => {
 describe("cors plugin — actual requests", () => {
   test("allowed origins get allow-origin (+ exposed headers) on matched responses", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-actual" }).plug(
       cors({ origin: ["https://app.example.com"], exposedHeaders: ["x-total"] }),
     );
 
@@ -121,7 +125,7 @@ describe("cors plugin — actual requests", () => {
 
   test("allowlist + credentials on matched responses reflects only listed origins", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual-cred" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-actual-cred" }).plug(
       cors({ origin: ["https://app.example.com"], credentials: true }),
     );
 
@@ -142,7 +146,9 @@ describe("cors plugin — actual requests", () => {
 
   test("denied origins get no CORS headers on matched responses", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual-deny" }).plug(cors({ origin: "https://ok.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-actual-deny" }).plug(
+      cors({ origin: "https://ok.example.com" }),
+    );
 
     const res = await app.fetch(
       new Request("http://localhost/x", { headers: { origin: "https://evil.example.com" } }),
@@ -154,7 +160,7 @@ describe("cors plugin — actual requests", () => {
 
   test("requests without an Origin header are untouched", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-no-origin" }).plug(cors({ origin: "*" }));
+    const app = oke({ autoBoot: false, name: "cors-no-origin" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
     expect(res.headers.get("access-control-allow-origin")).toBeNull();

package/src/plugins/csrf.test.ts

@@ -22,7 +22,7 @@ function mutating(headers: Record<string, string> = {}): Request {
 function appWith(options: Parameters<typeof csrf>[0]) {
   on(http.post("/transfer"), flow({ name: "transfer.create", do: () => ({ moved: true }) }));
   on(http.get("/balance"), flow({ name: "balance.get", do: () => ({ balance: 5 }) }));
-  return oke({ name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
+  return oke({ autoBoot: false, name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
 }
 
 describe("csrf plugin", () => {

package/src/plugins/email-otp.ts

@@ -0,0 +1,161 @@
+/**
+ * Email OTP Gate auth method plugin.
+ */
+
+import {
+  createIdentityStore,
+  normalizeEmail,
+  type IdentityStore,
+  type UserIdentityRow,
+} from "../auth/identity.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import {
+  createVerificationStore,
+  findActiveVerification,
+  generateOtp,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+
+/** Options for {@link emailOtp}. */
+export interface EmailOtpOptions extends AuthMethodOptions {
+  /** Challenge TTL (default 10m). */
+  readonly ttlMs?: number;
+  readonly identities?: IdentityStore;
+  readonly verifications?: VerificationStore;
+  /** Return raw OTP in the request response (test / local). */
+  readonly exposeDevOtp?: boolean;
+}
+
+/**
+ * Email OTP request + verify (6-digit, hashed, 5 attempts).
+ *
+ * @param opts - TTL / stores / dev OTP
+ */
+export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const identities = opts.identities ?? createIdentityStore();
+  const verifications = opts.verifications ?? createVerificationStore();
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  const request = flow({
+    name: "auth.requestEmailOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ email: z.string().min(3) }),
+    out: z.object({
+      ok: z.literal(true),
+      devOtp: z.string().optional(),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
+      const otp = generateOtp(6);
+      const now = runtime.now();
+      // Invalidate prior active challenges for this email.
+      for (const row of verifications.rows.values()) {
+        if (row.identifier === `email-otp:${email}` && row.consumedAt === null) {
+          row.consumedAt = now;
+        }
+      }
+      putVerification(verifications, {
+        id: crypto.randomUUID(),
+        identifier: `email-otp:${email}`,
+        value: await hashChallenge(otp),
+        expiresAt: now + ttlMs,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return {
+        ok: true as const,
+        ...(opts.exposeDevOtp ? { devOtp: otp } : {}),
+      };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.verifyEmailOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      email: z.string().min(3),
+      otp: z.string().min(4).max(8),
+    }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      const now = runtime.now();
+      const row = findActiveVerification(verifications, `email-otp:${email}`, now);
+      if (!row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      if (row.attempts >= MAX_ATTEMPTS) {
+        row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      const hash = await hashChallenge(input.otp.trim());
+      if (hash !== row.value) {
+        row.attempts += 1;
+        if (row.attempts >= MAX_ATTEMPTS) row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      row.consumedAt = now;
+      const user = ensureUserByEmail(identities, email, now);
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: user.id,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: user.id,
+      };
+    },
+  });
+
+  return plugin("emailOtp", { version: "0.0.1", config: { method: "email-otp" } })
+    .needs("auth")
+    .binding(bindPublicAuth("/email-otp/request", request, "otp"))
+    .binding(bindPublicAuth("/email-otp/verify", verify, "otp"));
+}
+
+function ensureUserByEmail(store: IdentityStore, email: string, now: number): UserIdentityRow {
+  const existingId = store.byEmail.get(email);
+  if (existingId) {
+    const existing = store.users.get(existingId);
+    if (existing) return existing;
+  }
+  const id = crypto.randomUUID();
+  const user: UserIdentityRow = {
+    id,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: now,
+    updatedAt: now,
+    extra: {},
+  };
+  store.users.set(id, user);
+  store.byEmail.set(email, id);
+  return user;
+}

package/src/plugins/index.ts

@@ -4,6 +4,7 @@
  * `.plug()`.
  */
 
+export { anonymous, type AnonymousPluginOptions } from "./anonymous.ts";
 export { compression, type CompressionOptions } from "./compression.ts";
 export {
   configSource,
@@ -15,8 +16,23 @@ export {
 } from "./config-source.ts";
 export { cors, type CorsOptions } from "./cors.ts";
 export { csrf, type CsrfOptions } from "./csrf.ts";
+export { emailOtp, type EmailOtpOptions } from "./email-otp.ts";
 export { ipAllowlist, type IpAllowlistOptions } from "./ip-allowlist.ts";
+export { magicLink, type MagicLinkOptions } from "./magic-link.ts";
 export { maintenanceMode, type MaintenanceModeOptions } from "./maintenance-mode.ts";
+export {
+  createPasskeyStore,
+  passkey,
+  type PasskeyCredential,
+  type PasskeyOptions,
+  type PasskeyStore,
+} from "./passkey.ts";
+export {
+  createPhoneStore,
+  phoneNumber,
+  type PhoneNumberOptions,
+  type PhoneStore,
+} from "./phone-number.ts";
 export {
   defaultCspDirectives,
   securityHeaders,
@@ -24,3 +40,18 @@ export {
   type HstsOptions,
   type SecurityHeadersOptions,
 } from "./security-headers.ts";
+export {
+  createTwoFactorStore,
+  twoFactor,
+  verifyTotp,
+  type TwoFactorOptions,
+  type TwoFactorRow,
+  type TwoFactorStore,
+} from "./two-factor.ts";
+export {
+  createUsernameStore,
+  username,
+  type UsernamePluginOptions,
+  type UsernameRow,
+  type UsernameStore,
+} from "./username.ts";

package/src/plugins/ip-allowlist.test.ts

@@ -26,7 +26,7 @@ function get(ip?: string): Request {
 describe("ipAllowlist plugin", () => {
   test("allow list: listed IPs pass, others get 403 Forbidden", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
+    const app = oke({ autoBoot: false, name: "ips" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
 
     const ok = await app.fetch(get("203.0.113.7"));
     expect(ok.status).toBe(200);
@@ -40,7 +40,9 @@ describe("ipAllowlist plugin", () => {
 
   test("deny list: blocked IPs get 403 ip_denied, others pass", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-deny" }).plug(ipAllowlist({ deny: ["198.51.100.9"] }));
+    const app = oke({ autoBoot: false, name: "ips-deny" }).plug(
+      ipAllowlist({ deny: ["198.51.100.9"] }),
+    );
 
     const blocked = await app.fetch(get("198.51.100.9"));
     expect(blocked.status).toBe(403);
@@ -53,7 +55,7 @@ describe("ipAllowlist plugin", () => {
 
   test("deny wins over allow on overlap", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-both" }).plug(
+    const app = oke({ autoBoot: false, name: "ips-both" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], deny: ["203.0.113.7"] }),
     );
 
@@ -63,7 +65,9 @@ describe("ipAllowlist plugin", () => {
 
   test("XFF last hop is the client; a spoofed first hop cannot bypass allow", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-xff" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
+    const app = oke({ autoBoot: false, name: "ips-xff" }).plug(
+      ipAllowlist({ allow: ["203.0.113.7"] }),
+    );
 
     // Attacker-controlled first hop + trusted proxy appended the real client (last).
     const spoofedFirst = await app.fetch(get("203.0.113.7, 198.51.100.9"));
@@ -75,7 +79,9 @@ describe("ipAllowlist plugin", () => {
 
   test("spoofed first hop cannot bypass a deny rule", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-xff-deny" }).plug(ipAllowlist({ deny: ["198.51.100.9"] }));
+    const app = oke({ autoBoot: false, name: "ips-xff-deny" }).plug(
+      ipAllowlist({ deny: ["198.51.100.9"] }),
+    );
 
     // Spoof a non-denied IP first; proxy appended the real (denied) client last.
     const spoofed = await app.fetch(get("203.0.113.7, 198.51.100.9"));
@@ -88,7 +94,7 @@ describe("ipAllowlist plugin", () => {
   test("trustedProxyDepth selects the hop behind N trusted proxies", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     // Chain: spoofed, real-client, cdn-egress — depth 2 skips the nearest proxy hop.
-    const app = oke({ name: "ips-depth" }).plug(
+    const app = oke({ autoBoot: false, name: "ips-depth" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], trustedProxyDepth: 2 }),
     );
 
@@ -108,7 +114,9 @@ describe("ipAllowlist plugin", () => {
 
   test("missing header: denied when allow is set, permitted for deny-only", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const strict = oke({ name: "ips-missing-allow" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
+    const strict = oke({ autoBoot: false, name: "ips-missing-allow" }).plug(
+      ipAllowlist({ allow: ["203.0.113.7"] }),
+    );
 
     const denied = await strict.fetch(get());
     expect(denied.status).toBe(403);
@@ -117,14 +125,16 @@ describe("ipAllowlist plugin", () => {
     resetFlowSeq();
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
 
-    const lax = oke({ name: "ips-missing-deny" }).plug(ipAllowlist({ deny: ["198.51.100.9"] }));
+    const lax = oke({ autoBoot: false, name: "ips-missing-deny" }).plug(
+      ipAllowlist({ deny: ["198.51.100.9"] }),
+    );
     const ok = await lax.fetch(get());
     expect(ok.status).toBe(200);
   });
 
   test("custom header name is honored", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-custom" }).plug(
+    const app = oke({ autoBoot: false, name: "ips-custom" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], header: "x-real-ip" }),
     );
 

package/src/plugins/magic-link.ts

@@ -0,0 +1,163 @@
+/**
+ * Magic-link Gate auth method plugin.
+ *
+ * Delivery via Channel is optional in v1 — when {@link MagicLinkOptions.exposeDevToken}
+ * is set, the request response includes `devToken` for tests / local DX.
+ */
+
+import {
+  createIdentityStore,
+  normalizeEmail,
+  type IdentityStore,
+  type UserIdentityRow,
+} from "../auth/identity.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import {
+  createVerificationStore,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+
+/** Options for {@link magicLink}. */
+export interface MagicLinkOptions extends AuthMethodOptions {
+  /** Challenge TTL (default 10m). */
+  readonly ttlMs?: number;
+  /** Identity store for email → user. */
+  readonly identities?: IdentityStore;
+  /** Verification / challenge store. */
+  readonly verifications?: VerificationStore;
+  /** Return raw token in the request response (test / local). */
+  readonly exposeDevToken?: boolean;
+}
+
+/**
+ * Magic-link request + verify (`oke_verifications` challenge rows).
+ *
+ * @param opts - TTL / stores / dev token
+ */
+export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const identities = opts.identities ?? createIdentityStore();
+  const verifications = opts.verifications ?? createVerificationStore();
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  const request = flow({
+    name: "auth.requestMagicLink",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ email: z.string().min(3) }),
+    out: z.object({
+      ok: z.literal(true),
+      devToken: z.string().optional(),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
+      const token = `ml_${crypto.randomUUID().replace(/-/g, "")}`;
+      const now = runtime.now();
+      putVerification(verifications, {
+        id: crypto.randomUUID(),
+        identifier: `magic:${email}`,
+        value: await hashChallenge(token),
+        expiresAt: now + ttlMs,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return {
+        ok: true as const,
+        ...(opts.exposeDevToken ? { devToken: token } : {}),
+      };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.verifyMagicLink",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ token: z.string().min(1) }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const hash = await hashChallenge(input.token);
+      const now = runtime.now();
+      let row:
+        | {
+            id: string;
+            identifier: string;
+            value: string;
+            expiresAt: number;
+            consumedAt: number | null;
+            attempts: number;
+          }
+        | undefined;
+      for (const candidate of verifications.rows.values()) {
+        if (!candidate.identifier.startsWith("magic:")) continue;
+        if (candidate.consumedAt !== null) continue;
+        if (candidate.expiresAt <= now) continue;
+        if (candidate.value === hash) {
+          row = candidate;
+          break;
+        }
+      }
+      if (!row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      row.consumedAt = now;
+      const email = row.identifier.slice("magic:".length);
+      const user = ensureUserByEmail(identities, email, now);
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: user.id,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: user.id,
+      };
+    },
+  });
+
+  return plugin("magicLink", { version: "0.0.1", config: { method: "magic-link" } })
+    .needs("auth")
+    .binding(bindPublicAuth("/magic-link/request", request, "otp"))
+    .binding(bindPublicAuth("/magic-link/verify", verify, "otp"));
+}
+
+function ensureUserByEmail(store: IdentityStore, email: string, now: number): UserIdentityRow {
+  const existingId = store.byEmail.get(email);
+  if (existingId) {
+    const existing = store.users.get(existingId);
+    if (existing) return existing;
+  }
+  const id = crypto.randomUUID();
+  const user: UserIdentityRow = {
+    id,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: now,
+    updatedAt: now,
+    extra: {},
+  };
+  store.users.set(id, user);
+  store.byEmail.set(email, id);
+  return user;
+}

package/src/plugins/maintenance-mode.test.ts

@@ -18,7 +18,7 @@ beforeEach(() => {
 describe("maintenanceMode plugin", () => {
   test("returns 503 with ServiceUnavailable envelope and Retry-After", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint" }).plug(maintenanceMode({ retryAfter: 120 }));
+    const app = oke({ autoBoot: false, name: "maint" }).plug(maintenanceMode({ retryAfter: 120 }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -36,7 +36,9 @@ describe("maintenanceMode plugin", () => {
 
   test("enabled: false passes traffic through", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-off" }).plug(maintenanceMode({ enabled: false }));
+    const app = oke({ autoBoot: false, name: "maint-off" }).plug(
+      maintenanceMode({ enabled: false }),
+    );
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -46,7 +48,9 @@ describe("maintenanceMode plugin", () => {
   test("allowPaths prefixes keep serving", async () => {
     on(http.get("/health"), flow({ name: "health.get", do: () => ({ up: true }) }));
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-allow" }).plug(maintenanceMode({ allowPaths: ["/health"] }));
+    const app = oke({ autoBoot: false, name: "maint-allow" }).plug(
+      maintenanceMode({ allowPaths: ["/health"] }),
+    );
 
     const health = await app.fetch(new Request("http://localhost/health"));
     expect(health.status).toBe(200);
@@ -57,7 +61,7 @@ describe("maintenanceMode plugin", () => {
 
   test("bypass header lets operators through (any non-empty value)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-bypass" }).plug(
+    const app = oke({ autoBoot: false, name: "maint-bypass" }).plug(
       maintenanceMode({ bypassHeader: "x-ops-token" }),
     );
 
@@ -72,7 +76,7 @@ describe("maintenanceMode plugin", () => {
 
   test("the 503 still flows through onResponse (other plugins stamp it)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-stamp" }).plug(maintenanceMode());
+    const app = oke({ autoBoot: false, name: "maint-stamp" }).plug(maintenanceMode());
     app.hook("onResponse", (ctx) => {
       if (!ctx.response) return;
       const headers = new Headers(ctx.response.headers);