okengine 0.4.3 → 0.5.0

package/site/content/docs/reference/client.mdx

@@ -0,0 +1,331 @@
+---
+title: "Client"
+description: "Typed caller for your flows — createClient from okengine/client, zero codegen, errors as values."
+icon: "MonitorSmartphone"
+source: "docs/spec/unified-theory.md"
+---
+
+`okengine/client` is how a browser, CLI, or another service calls your app's flows. Adopt the unit, take `typeof app`, and `api.notes.get({ id })` is fully typed — same contracts the server already has, no separate schema project.
+
+<Callout title="The one rule">
+  Treat every call as a result envelope: `{ data, error }`. Flow failures are values you switch on
+  (`error.code`); they are never thrown. Only transport / protocol problems use
+  `code: "TransportError"`.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Adopt flows and export `App`
+
+```typescript title="src/app.ts"
+import { oke } from "okengine";
+import * as main from "./flows/main";
+
+export const app = oke({ name: "standard" }).adopt({ main });
+export type App = typeof app;
+```
+
+</Step>
+
+<Step>
+### Create the client
+
+Same repo — pass the app value so HTTP triggers hit REST (method + path from adopt):
+
+```typescript title="client"
+import { createClient } from "okengine/client";
+import { app } from "./app";
+
+const api = createClient(app, "http://localhost:6530");
+```
+
+Or type-only with `createClient<App>(url)` and pass `$routes: app.$routes` when you want REST
+instead of RPC.
+
+</Step>
+
+<Step>
+### Call a flow and narrow the result
+
+```typescript
+const { data, error } = await api.main.health();
+
+if (error) {
+  // TransportError or a declared flow code
+  return;
+}
+
+// data inferred from the flow's `out`
+console.log(data.ok);
+```
+
+With the starter, that is `GET /health` on port **6530** when `$routes` are wired.
+
+</Step>
+
+</Steps>
+
+## `createClient` forms
+
+| Form                            | Types from                             | Wire                                             |
+| ------------------------------- | -------------------------------------- | ------------------------------------------------ |
+| `createClient(app, url, opts?)` | `typeof app`                           | REST from `app.$routes`; untriggered flows → RPC |
+| `createClient<App>(url, opts?)` | Explicit `App` type                    | RPC unless `opts.$routes` or `opts.routes`       |
+| `createClient(url, opts?)`      | Ambient `Register` (`oke-client.d.ts`) | Same — pass routes for REST                      |
+
+`oke dev` regenerates `oke-client.d.ts` from `GET /_oke/client.json`. A separate frontend repo
+runs `oke client add <url>` (default out: `oke-client.d.ts`).
+
+```bash
+oke client add http://localhost:6530
+oke client add https://api.example.com --out ./types/oke-client.d.ts
+```
+
+## Options
+
+| Option          | Type                                           | Default            | Meaning                                                        |
+| --------------- | ---------------------------------------------- | ------------------ | -------------------------------------------------------------- |
+| `fetch`         | `(input, init?) => Promise<Response>`          | `globalThis.fetch` | Inject a fetch implementation                                  |
+| `headers`       | `Record<string, string>` \| pairs \| `() => …` | —                  | Static headers, or a getter per request                        |
+| `timeout`       | `number` (ms)                                  | —                  | Abort after this many milliseconds                             |
+| `retry.retries` | `number`                                       | `0`                | Extra attempts after the first (network / 5xx)                 |
+| `retry.delay`   | `number` (ms)                                  | `50`               | Initial backoff delay                                          |
+| `retry.backoff` | `number`                                       | `2`                | Multiplier after each retry                                    |
+| `auth.getToken` | `() => string \| null \| …`                    | —                  | Bearer access token (or null)                                  |
+| `auth.refresh`  | `() => Promise<string \| null \| …>`           | —                  | Runs once on HTTP 401, then the request retries                |
+| `$routes`       | `ClientRouteMap`                               | —                  | Runtime map from `app.$routes` (REST when method+path present) |
+| `routes`        | `Record<"unit.flow", { method, path }>`        | —                  | Flat REST table; wins over flattening `$routes`                |
+
+**Consequence:** `createClient<App>(url)` alone types the proxy but still posts
+`POST /_oke/{unit}/{flow}` until you pass the app value, `$routes`, or `routes`.
+
+## REST vs RPC
+
+| Situation                                          | Request                                                                                                  |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| HTTP trigger with method + path on `$routes`       | That method and path (`:id` filled from input; leftover fields → query on GET/HEAD, JSON body otherwise) |
+| Adopted flow with no HTTP trigger                  | `POST {base}/_oke/{unit}/{flow}` with JSON body                                                          |
+| Incomplete proxy path (`api.notes()` with no flow) | Result error: `Incomplete path: api.notes(…)`                                                            |
+
+```typescript
+// REST — createClient(app, url) saw method/path from on(http.get("/notes/:id"), …)
+await api.notes.get({ id: "n_1" }); // GET /notes/n_1
+
+// RPC — untriggered flow named notes.stats
+await api.notes.stats({ id: "n_1" }); // POST /_oke/notes/stats
+```
+
+## Result envelope and helpers
+
+Success may include optional top-level `meta` (for example pagination). Declared flow errors and
+transport failures share the failure arm:
+
+```typescript
+import { isOk, isFail, isErrorCode, isTransportError } from "okengine/client";
+
+const result = await api.bookings.create({ flightId: "SK1", seats: 9 });
+
+if (isOk(result)) {
+  result.data.id;
+} else if (result.error.code === "FlightFull") {
+  result.error.data.seatsLeft; // narrowed
+} else if (isTransportError(result.error)) {
+  result.error.data.message;
+}
+
+isFail(result); // true when error !== null
+isErrorCode(result.error, "FlightFull"); // type predicate helper
+```
+
+Prefer `error?.code === "FlightFull"` for inference; use `isErrorCode` in shared helpers.
+
+## Auth on the client
+
+One client: `createClient`. With `gate.auth`, the app exposes `/auth/*` Flows
+(sign-in, refresh, me). Helpers under `okengine/client/auth` store tokens — they are
+**not** a second factory.
+
+```typescript
+import { createClient } from "okengine/client";
+import { memorySession } from "okengine/client/auth";
+import { app } from "./app";
+
+const session = memorySession();
+
+const api = createClient(app, "http://localhost:6530", {
+  auth: {
+    getToken: () => session.getToken(),
+    refresh: () => session.refresh(api),
+  },
+});
+
+const { data } = await api.auth.signInEmail({ email, password });
+if (data) session.set(data);
+```
+
+React: `useSession(api, session)` from `okengine/client-react`.
+
+| Step                   | What happens                                                     |
+| ---------------------- | ---------------------------------------------------------------- |
+| Every request          | `getToken()` → `Authorization: Bearer …` when a token is present |
+| HTTP **401**           | `refresh()` runs **once**, then the same call retries            |
+| HTTP **403** / **429** | No refresh — decode the failure envelope as usual                |
+
+**Consequence:** `refresh` must mutate whatever `getToken` reads. Returning a new string alone does
+nothing if storage was not updated.
+
+After a gated call, switch on the denial codes (values, not throws):
+
+| Code           | HTTP | `error.data`       | Typical fix                                                  |
+| -------------- | ---- | ------------------ | ------------------------------------------------------------ |
+| `Unauthorized` | 401  | `{}`               | Sign in, or let `auth.refresh` run; re-login if still denied |
+| `Forbidden`    | 403  | `{ gate, reason }` | Wrong scopes / policy — show denied                          |
+| `RateLimited`  | 429  | `{ retryAfterMs }` | Wait `retryAfterMs` before retrying                          |
+
+These gate codes are **not** listed in each Flow’s `errors` map — they can appear on any gated
+route.
+
+A 401 with no `{ data, error }` body becomes `TransportError` with `data.status: 401`.
+
+| Helper                      | Package                 | Role                                             |
+| --------------------------- | ----------------------- | ------------------------------------------------ |
+| `memorySession`             | `okengine/client/auth`  | In-memory access/refresh bag for `auth.getToken` |
+| `AUTH_ERROR_CODES`          | `okengine/client/auth`  | Common auth Flow / gate codes                    |
+| `useSession(api, session?)` | `okengine/client-react` | React status + `auth.me`                         |
+
+Core `okengine/client` stays under the size budget — helpers are separate exports. Not in
+core today: cookie jars or plugin `.client()` decorations. Browser apps: also see
+[CORS](/docs/plugins/cors) and [CSRF](/docs/plugins/csrf).
+
+## Elements from the client
+
+<Callout title="Flows only">
+  The client calls **Flows**. Every other element runs on the server through `fx`. You reach its
+  outcome by calling a Flow that uses it — or by handling a gate denial on that call.
+</Callout>
+
+| Element                           | On the client | How                                                                                     |
+| --------------------------------- | ------------- | --------------------------------------------------------------------------------------- |
+| [Flow](/docs/elements/flow)       | Direct        | `api.unit.flow(input)` — the only public surface                                        |
+| [Gate](/docs/elements/gate)       | Indirect      | Bearer via `auth`; denials as `Unauthorized` / `Forbidden` / `RateLimited`              |
+| [Store](/docs/elements/store)     | Via Flows     | `fx.store` inside Flows; `store.resource` + `on(http.resource…)` → five Flows you adopt |
+| [Signal](/docs/elements/signal)   | Via Flows     | Emit/consume server-side; no subscribe API on `okengine/client` yet                     |
+| [Clock](/docs/elements/clock)     | Via Flows     | Schedules fire on the server — the client never ticks a clock                           |
+| [Vault](/docs/elements/vault)     | Via Flows     | Secrets stay server-side; never ship them to the browser package                        |
+| [Channel](/docs/elements/channel) | Via Flows     | `fx.send` in a Flow — the client does not send email/SMS/push                           |
+| [AI](/docs/elements/ai)           | Via Flows     | `fx.ask` / `fx.run` inside a Flow; the client gets that Flow’s `out`                    |
+
+### Store resources
+
+Mount a resource, adopt the returned ops, then call the five Flows like any other:
+
+```typescript
+const notesR = store.resource(db, notes, {/* in, out, list, unit: "notes" */});
+const mounted = on(http.resource("/notes", notesR.all()));
+// .adopt({ notes: mounted }) →
+await api.notes.list({ limit: 20 }); // GET /notes?limit=20 — meta may carry nextCursor
+await api.notes.get({ id }); // GET /notes/:id — NotFound when missing
+await api.notes.remove({ id }); // DELETE → 204, data undefined
+```
+
+See [Store](/docs/elements/store) for the list query language and schemas. Auth posture for HTTP
+triggers is covered under [Gate](/docs/elements/gate).
+
+### Signal and live queries
+
+`delivery: "live"` and `http.get(…).live()` are Manifest / driver flags today. `okengine/client`
+does **not** expose WebSocket, SSE, or `api.*.subscribe`. Until that ships, poll or call an HTTP
+Flow that returns the current state.
+
+## Exports
+
+| Export                                       | Kind      | Role                                              |
+| -------------------------------------------- | --------- | ------------------------------------------------- |
+| `createClient`                               | function  | Typed proxy `api.unit.flow(input?)`               |
+| `flattenRoutes`                              | function  | `$routes` → flat `unit.flow` REST table           |
+| `createTransport`                            | function  | Low-level HTTP transport (timeout / retry / auth) |
+| `isOk` / `isFail`                            | function  | Envelope predicates                               |
+| `isErrorCode` / `isTransportError`           | function  | Error narrowing                                   |
+| `Client`, `ClientOptions`, `ClientResult`, … | types     | Contracts and options                             |
+| `Register`                                   | interface | Module-augmentation slot for ambient App types    |
+| `AppOf`                                      | type      | Brand a bare route map as an App                  |
+
+Budget: the `./client` export stays under the measured client-runtime cap (hard gate in CI).
+
+## Troubleshooting
+
+<Accordions>
+
+<Accordion title="api.main.health is not a function / type error">
+
+Confirm the flow is `export`ed from the module you `.adopt({ main })`, and that `createClient` is
+typed with that `App` (or ambient `Register` after `oke-client.d.ts` regenerates). Restart
+`oke dev` after renaming exports.
+
+</Accordion>
+
+<Accordion title="Calls hit /_oke/… instead of my HTTP path">
+
+Types alone do not choose REST. Pass `createClient(app, url)`, or
+`createClient(url, { $routes: app.$routes })`, or an explicit `routes` map.
+
+</Accordion>
+
+<Accordion title='error.code is "TransportError"'>
+
+Network failure, abort (`timeout`), non-JSON body, empty error response, or HTTP status without a
+`{ data, error }` envelope. Declared flow codes (`NotFound`, `FlightFull`, …) never use this code.
+Message text lives in `error.data.message`; HTTP status may appear as `error.data.status`.
+
+</Accordion>
+
+<Accordion title="401 loops or refresh never sticks">
+
+`auth.refresh` runs once per call on HTTP 401. It must update the store `getToken` reads — the
+return value is ignored. With `gate.auth`, `POST /auth/refresh` is built in; `memorySession.refresh(api)`
+calls `api.auth.refresh({ refreshToken })`. Re-login when rotation fails or no refresh token remains.
+
+</Accordion>
+
+<Accordion title="Failed to fetch …/_oke/client.json">
+
+`oke client add` needs a running app that serves the descriptor. Start the app (`oke dev` /
+`oke start`), check the URL, then retry. Usage when the URL is missing:
+`Usage: oke client add <url> [--out oke-client.d.ts]`.
+
+</Accordion>
+
+</Accordions>
+
+## Learn more
+
+- [Basic usage](/docs/get-started/basic-usage) — adopt → client → test loop
+- [Gate](/docs/elements/gate) — policies, `gate.public`, denials
+- [Store](/docs/elements/store) — `store.resource` and list query language
+- [Flow](/docs/elements/flow) — `in` / `out` / `errors` and `fx.fail`
+- [Errors](/docs/reference/errors) — framework codes vs failure values
+- [CORS](/docs/plugins/cors) · [CSRF](/docs/plugins/csrf) — browser callers
+- [CLI Reference](/docs/reference/cli) — `oke client add`, `oke dev`
+
+## Next
+
+<Cards>
+  <Card
+    title="Gate"
+    description="Auth policies and rate limits before any effect."
+    href="/docs/elements/gate"
+  />
+  <Card
+    title="Store"
+    description="Resources that become five typed client Flows."
+    href="/docs/elements/store"
+  />
+  <Card
+    title="Errors"
+    description="OKE codes, denials, and failure values."
+    href="/docs/reference/errors"
+  />
+</Cards>

package/site/content/docs/reference/fx.mdx

@@ -48,6 +48,10 @@ See [Store](/docs/elements/store) for the query-builder surface.
 | `fx.signal`                  | —       | Ambient `AbortSignal` for the current branch          |
 | `fx.fail(code, data, opts?)` | —       | Typed failure value (`opts.message` overrides)        |
 
+`fx.call` starts the callee with an **empty** `fx.auth` (fail-closed for authorization). For
+audit/attribution only, read `fx.principal` — it propagates the originating identity without
+copying into `fx.auth`. Gates never consult `fx.principal`.
+
 ## Concurrency and retry
 
 Pass **thunks** to `all` / `race` — not already-started Promises — so each branch gets an abort scope before work begins.
@@ -157,11 +161,22 @@ Returning a plain value instead answers 200 with `{ data: value, error: null }`
 
 ## Principals
 
-| Property      | Shape                                                                 |
-| ------------- | --------------------------------------------------------------------- |
-| `fx.auth`     | `{ userId: string \| null, scopes: Set<string>, verified?: boolean }` |
-| `fx.operator` | `{ id: string \| null }` — Console plane                              |
-| `fx.tenant`   | `{ id: string \| null }` — active tenant                              |
+| Property       | Shape                                                                     |
+| -------------- | ------------------------------------------------------------------------- |
+| `fx.auth`      | `{ userId: string \| null, scopes: Set<string>, verified?: boolean }`     |
+| `fx.operator`  | `{ id: string \| null }` — Console plane                                  |
+| `fx.principal` | Read-only origin: `userId`, `operatorId`, `scopes`, `verified?`, `plane?` |
+| `fx.tenant`    | `{ id: string \| null }` — active tenant                                  |
+
+**Consequence:** use `fx.auth` / gates for authorization; use `fx.principal` only when a callee
+must log who started the call chain.
+
+## Not on `fx`
+
+<Callout title="No fx.metric">
+  Investigated and declined. [Runs](/docs/console/runs) already own per-invocation observability as
+  wide events; a parallel counter/gauge API would be a second instrumentation path without a sink.
+</Callout>
 
 ## Learn more
 

package/site/content/docs/reference/index.mdx

@@ -0,0 +1,45 @@
+---
+title: "Reference"
+description: "Lookup pages — config, fx, client, env vars, errors, plugins API, CLI, and Console security."
+icon: "BookMarked"
+source: "docs/spec/unified-theory.md"
+---
+
+Dense tables and command lists. Reach for these when you already know what you are looking for.
+
+## Pages
+
+<Cards>
+  <Card
+    title="Configuration"
+    description="Every option in oke.config.ts."
+    href="/docs/reference/configuration"
+  />
+  <Card title="fx" description="The complete fx surface and effects." href="/docs/reference/fx" />
+  <Card
+    title="Client"
+    description="Typed createClient — REST, RPC, envelope helpers."
+    href="/docs/reference/client"
+  />
+  <Card
+    title="Environment Variables"
+    description="Every variable OKE reads."
+    href="/docs/reference/environment-variables"
+  />
+  <Card title="Errors" description="OKE codes, denials, fixes." href="/docs/reference/errors" />
+  <Card
+    title="Plugins"
+    description="Plugin API — hooks, schemas, identity."
+    href="/docs/reference/plugins"
+  />
+  <Card
+    title="CLI Reference"
+    description="oke and create-oke commands."
+    href="/docs/reference/cli"
+  />
+  <Card
+    title="Security"
+    description="Console Host, Origin, MCP posture."
+    href="/docs/reference/security"
+  />
+</Cards>

package/site/content/docs/reference/meta.json

@@ -1,5 +1,15 @@
 {
   "title": "Reference",
   "icon": "BookMarked",
-  "pages": ["configuration", "fx", "environment-variables", "errors", "plugins", "cli", "security"]
+  "pages": [
+    "index",
+    "configuration",
+    "fx",
+    "client",
+    "environment-variables",
+    "errors",
+    "plugins",
+    "cli",
+    "security"
+  ]
 }

package/site/content/docs/reference/plugins.mdx

@@ -66,20 +66,26 @@ Every method below exists on both the fluent definition and the boot-time builde
 
 | Method                           | Contributes                                                                                   |
 | -------------------------------- | --------------------------------------------------------------------------------------------- |
-| `.flow(def)`                     | An ordinary flow — Manifest, Console, client types                                            |
+| `.flow(def)`                     | An ordinary flow — Manifest / Console metadata (does **not** join the HTTP router alone)      |
+| `.binding({ trigger, flow })`    | A real Binding — joins `adopted` + the router on `app.plug()` (auth method plugins)           |
 | `.hook(stage, fn)`               | A per-request intercept at one pipeline stage                                                 |
 | `.edge(fn)`                      | A handler for HTTP requests that match **no** flow                                            |
 | `.decorate(key, value)`          | A typed context decoration, visible to flows                                                  |
-| `.element({ kind, name })`       | An element contribution (e.g. `store.sql` facet)                                              |
+| `.element({ kind, name })`       | An opaque element contribution (e.g. `store.sql` facet)                                       |
+| `.vault(secret)`                 | A vault secret/config contract — merged into boot secrets                                     |
+| `.clock(decl)`                   | A named clock schedule — merged into boot clocks                                              |
+| `.signal(decl)`                  | A signal declaration — merged into boot signals                                               |
+| `.gate(decl)`                    | A gate declaration — merged into boot gates                                                   |
+| `.channelTemplate(decl)`         | A channel template — merged into boot channel templates                                       |
 | `.driver(id, impl)`              | A protocol-named driver for an existing element                                               |
 | `.image(role, recipe)`           | An image recipe for a docker role                                                             |
 | `.table(name, columns, options)` | A whole DB table, merged into the generated schema (`options.description` / `plane` optional) |
 | `.errors(map)`                   | Typed errors flows can fail with                                                              |
-| `.client(name, ext)`             | A typed client extension                                                                      |
+| `.client(name, ext)`             | A typed client extension (reserved seam — not yet merged into `createClient`)                 |
 | `.consolePanel(panel)`           | A Console panel (ESM entry loaded at runtime)                                                 |
 | `.cli(name, handler)`            | An `oke <name>` CLI command                                                                   |
 | `.config(schema)`                | A config schema; values live on the plugin identity                                           |
-| `.needs(dep)`                    | A declared dependency (e.g. `"store.kv"`)                                                     |
+| `.needs(dep)`                    | Runtime dependency — plugin name or element/driver id; unmet → `PluginNeedsError` at boot     |
 
 New infrastructure is a **driver** for an existing element, never a ninth element — plugins follow the same law.
 
@@ -202,13 +208,13 @@ Extending an existing **app-owned** table with plugin columns is not supported i
 
 ## Identity, config, and dependencies
 
-| Concept    | Rule                                                                           |
-| ---------- | ------------------------------------------------------------------------------ |
-| Name       | Stable plugin id — the Manifest key and conflict namespace                     |
-| `version`  | Semver string recorded in the Manifest                                         |
-| `config`   | Snapshot for identity dedup: same name + same config → no-op re-plug           |
-| Conflict   | Same name + **different** config → loud boot error, never a silent merge       |
-| `.needs()` | Declares runtime dependencies so boot fails early when a capability is missing |
+| Concept    | Rule                                                                                         |
+| ---------- | -------------------------------------------------------------------------------------------- |
+| Name       | Stable plugin id — the Manifest key and conflict namespace                                   |
+| `version`  | Semver string recorded in the Manifest                                                       |
+| `config`   | Snapshot for identity dedup: same name + same config → no-op re-plug                         |
+| Conflict   | Same name + **different** config → loud boot error, never a silent merge                     |
+| `.needs()` | Declares runtime dependencies (plugin name or element/driver id); unmet → `PluginNeedsError` |
 
 ## Troubleshooting
 
@@ -227,11 +233,16 @@ Extending an existing **app-owned** table with plugin columns is not supported i
     table above, and confirm the flow you expect actually reaches that stage (a gate denial never
     reaches `beforeHandle`).
   </Accordion>
+  <Accordion title="Boot: plugin boot failed — unmet .needs() dependencies">
+    A plugged plugin declared `.needs("auth")` or `.needs("store.sql")` (or another token) and
+    nothing satisfied it. For `"auth"`, enable `oke({ gate: { auth } })`. Otherwise plug the peer
+    plugin, or ensure the element/driver is available (tables imply `store.sql`, and so on).
+  </Accordion>
 </Accordions>
 
 ## Learn more
 
-- [Security Headers](/docs/plugins/security-headers) · [CORS](/docs/plugins/cors) · [CSRF](/docs/plugins/csrf) · [Compression](/docs/plugins/compression) · [Maintenance Mode](/docs/plugins/maintenance-mode) · [IP Allowlist](/docs/plugins/ip-allowlist) — first-party plugins built on exactly this API
+- [Plugins](/docs/plugins) — [username](/docs/plugins/username) · [anonymous](/docs/plugins/anonymous) · [magic link](/docs/plugins/magic-link) · [email OTP](/docs/plugins/email-otp) · [phone](/docs/plugins/phone-number) · [two-factor](/docs/plugins/two-factor) · [passkey](/docs/plugins/passkey) · [Headers](/docs/plugins/headers) · [CORS](/docs/plugins/cors) · [CSRF](/docs/plugins/csrf) · [Compression](/docs/plugins/compression) · [Maintenance Mode](/docs/plugins/maintenance-mode) · [IP Allowlist](/docs/plugins/ip-allowlist)
 - [Flow](/docs/elements/flow) — what plugin flows and hooks plug into
 - [Store](/docs/elements/store) — `field.*` builders and schema sync
 - [Configuration](/docs/reference/configuration) — where plugin config is declared
@@ -240,9 +251,9 @@ Extending an existing **app-owned** table with plugin columns is not supported i
 
 <Cards>
   <Card
-    title="Security Headers"
+    title="Headers"
     description="The full secure-headers set on every response."
-    href="/docs/plugins/security-headers"
+    href="/docs/plugins/headers"
   />
   <Card title="CORS" description="Cross-origin rules at the edge." href="/docs/plugins/cors" />
   <Card title="Flow" description="Triggers, effects, and durability." href="/docs/elements/flow" />

package/src/auth/auth.test.ts

@@ -75,6 +75,9 @@ describe("auth plugin", () => {
         tables.push(name);
         return this;
       },
+      binding() {
+        return this;
+      },
       flow() {
         return this;
       },
@@ -84,6 +87,21 @@ describe("auth plugin", () => {
       config() {
         return this;
       },
+      vault() {
+        return this;
+      },
+      clock() {
+        return this;
+      },
+      signal() {
+        return this;
+      },
+      gate() {
+        return this;
+      },
+      channelTemplate() {
+        return this;
+      },
     });
     expect(tables).toContain("oke_operators");
     expect(tables).toContain("oke_operator_credentials");
@@ -218,7 +236,7 @@ describe("operator plane", () => {
     const op = await createOperator(store, {
       email: "ops@example.com",
       name: "Ops",
-      password: "correct horse battery staple",
+      password: "correct horse battery staple 1",
     });
 
     expect(store.credentials.has(op.id)).toBe(true);
@@ -231,7 +249,7 @@ describe("operator plane", () => {
     const authed = await authenticateOperator(
       store,
       "ops@example.com",
-      "correct horse battery staple",
+      "correct horse battery staple 1",
     );
     expect(authed?.id).toBe(op.id);
   });