okengine 0.5.0 → 0.6.0

package/src/kernel/boot-bind/ai.ts

@@ -1,28 +1,151 @@
 /**
  * Lazy AI binder — loaded only when AI is declared.
+ *
+ * Resolves `drivers.ai` the same way store.index resolves its driver map:
+ * shared `aiDriverFor` switch, fail-loud on unknown / reserved-unimplemented
+ * ids, never a silent mock fallback when another driver is configured.
  */
 
+import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { anthropicAiDriver } from "../../drivers/ai-anthropic.ts";
 import { mockAiDriver } from "../../drivers/ai-mock.ts";
+import {
+  normalizeOllamaBaseUrl,
+  ollamaAiDriver,
+  OLLAMA_DEFAULT_BASE_URL,
+} from "../../drivers/ai-ollama.ts";
+import { openaiCompatibleAiDriver } from "../../drivers/ai-openai-compatible.ts";
+import type { AiDriver, AiOpenOptions } from "../../drivers/ai-types.ts";
 import { createAiRuntime, type AiRuntime } from "../../elements/ai.ts";
 import type { GateRuntime } from "../../elements/gate.ts";
 import type { BootOptions } from "../boot.ts";
 
 /**
- * Construct an AI runtime (mock default; shares gate for agents).
+ * Construct an AI runtime from config / injection.
  *
  * @param options - Boot options
  * @param gate - Gate runtime for agent tool checks
  * @param now - Clock
+ * @param env - Active environment
+ * @param docker - Prefer compose AI URL when active
  */
 export function bindAi(
   options: BootOptions,
   gate: GateRuntime | undefined,
   now: () => number,
+  env: ConfigEnv = "local",
+  docker = false,
 ): AiRuntime {
+  const id = resolveAiDriverId(options, env, docker);
+  const driver =
+    options.ai?.defaultDriver ?? withOpenDefaults(aiDriverFor(id), openDefaultsFor(id, docker));
   return createAiRuntime({
     ...(options.ai ?? {}),
-    defaultDriver: options.ai?.defaultDriver ?? mockAiDriver,
+    defaultDriver: driver,
     gates: options.ai?.gates ?? gate,
     now,
   });
 }
+
+/**
+ * Resolve the configured AI driver for one environment.
+ *
+ * Dev / test default is `mock`. There is **no** production default — prod must
+ * declare. Docker may override via `OKE_AI_DRIVER`.
+ *
+ * @param options - Boot options
+ * @param env - Active environment
+ * @param docker - Docker mode
+ */
+export function resolveAiDriverId(options: BootOptions, env: ConfigEnv, docker = false): string {
+  const fromEnv = process.env.OKE_AI_DRIVER?.trim();
+  if (docker && fromEnv) return fromEnv;
+  const resolved = resolveDriverId(options.config?.drivers?.ai, env);
+  if (resolved) return resolved;
+  return "mock";
+}
+
+/**
+ * Single id → AI driver switch — shared by boot (and future Console) so
+ * resolution can never drift into two maintained copies.
+ *
+ * @param id - Protocol driver id
+ */
+export function aiDriverFor(id: string): AiDriver {
+  switch (id) {
+    case "mock":
+      return mockAiDriver;
+    case "anthropic":
+      return anthropicAiDriver;
+    case "openai-compatible":
+      return openaiCompatibleAiDriver;
+    case "ollama":
+      return ollamaAiDriver;
+    case "bedrock":
+    case "vertex":
+      throw new Error(`oke boot: AI driver "${id}" is reserved but not implemented yet`);
+    default:
+      throw new Error(`oke boot: unknown AI driver "${id}"`);
+  }
+}
+
+/**
+ * Open defaults for a resolved driver id (URL / key from env).
+ *
+ * @param id - Driver id
+ * @param docker - Docker mode
+ */
+export function openDefaultsFor(id: string, docker = false): AiOpenOptions {
+  if (id === "ollama") {
+    return {
+      baseUrl: aiUrlFor(docker),
+      ...(process.env.OKE_AI_MODEL?.trim() ? { model: process.env.OKE_AI_MODEL.trim() } : {}),
+    };
+  }
+  if (id === "anthropic") {
+    const apiKey = process.env.ANTHROPIC_API_KEY?.trim();
+    return {
+      ...(apiKey ? { apiKey } : {}),
+      ...(process.env.ANTHROPIC_MODEL?.trim() ? { model: process.env.ANTHROPIC_MODEL.trim() } : {}),
+    };
+  }
+  if (id === "openai-compatible") {
+    const apiKey = process.env.OPENAI_API_KEY?.trim();
+    const baseUrl = process.env.OPENAI_BASE_URL?.trim() || process.env.OKE_AI_URL?.trim();
+    return {
+      ...(apiKey ? { apiKey } : {}),
+      ...(baseUrl ? { baseUrl } : {}),
+    };
+  }
+  return {};
+}
+
+/**
+ * Ollama base URL — docker fails loud when compose did not write one.
+ *
+ * @param docker - Docker mode
+ */
+export function aiUrlFor(docker = false): string {
+  const raw = process.env.OKE_AI_URL?.trim() || process.env.OLLAMA_HOST?.trim();
+  if (raw) return normalizeOllamaBaseUrl(raw);
+  if (docker) {
+    throw new Error(
+      "oke boot: ollama driver needs OKE_AI_URL (did `oke dev -d` write docker/.env.docker?)",
+    );
+  }
+  return OLLAMA_DEFAULT_BASE_URL;
+}
+
+/**
+ * Merge fixed open defaults under per-call options.
+ *
+ * @param driver - Base driver
+ * @param defaults - Env-derived open options
+ */
+function withOpenDefaults(driver: AiDriver, defaults: AiOpenOptions): AiDriver {
+  if (Object.keys(defaults).length === 0) return driver;
+  return {
+    id: driver.id,
+    open: (opts = {}) => driver.open({ ...defaults, ...opts }),
+  };
+}

package/src/kernel/boot.test.ts

@@ -79,7 +79,7 @@ describe("boot — lazy element needs", () => {
     expect(needs.signal).toBe(false);
   });
 
-  test("oke() Store-only graph stays under the prior 41.4 kB baseline", async () => {
+  test("oke() Store-only graph stays under the prior 50 kB baseline", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-store-only-"));
     const entry = join(dir, "entry.ts");
     const appPath = join(import.meta.dir, "app.ts");
@@ -116,8 +116,9 @@ describe("boot — lazy element needs", () => {
         if (raw.byteLength === 0) continue;
         total += Bun.gzipSync(new Uint8Array(raw)).byteLength;
       }
-      // Prior eager-bind baseline: ~41.4 kB for oke() alone.
-      expect(total).toBeLessThan(41_400);
+      // Rebased after AI stream/tool-loop + fx.t/i18n on the shared fx surface
+      // (~49.5 kB gzip). Still far below an eager full-element bind.
+      expect(total).toBeLessThan(50_000);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }

package/src/kernel/boot.ts

@@ -388,7 +388,7 @@ export async function bootApplication(input: BootOptions = {}): Promise<BootResu
   // 6. AI
   let ai = pre.ai;
   if (needs.ai && !ai) {
-    ai = aiBind!.bindAi(options, gate, now);
+    ai = aiBind!.bindAi(options, gate, now, env, docker);
   }
 
   // 7. Runs

package/src/kernel/errors.ts

@@ -7,6 +7,9 @@
  */
 
 import { docsUrl as absoluteDocsUrl } from "../docs-origin.ts";
+import { getActiveDefaultLocale, getActiveLocale } from "../i18n/locale-context.ts";
+import { getMessageCatalogs, translate } from "../i18n/messages.ts";
+import { resolveFailureMessage } from "../i18n/failure-message.ts";
 
 /** Numeric OKE error code (permanent once published). */
 export type OkeErrorCode = number;
@@ -43,10 +46,11 @@ export class OkeError extends Error {
   /**
    * @param definition - Registry entry
    * @param params - Values for `{placeholders}` in cause/fix
+   * @param locale - Optional locale (defaults to active request locale)
    */
-  constructor(definition: OkeErrorDefinition, params: OkeErrorParams = {}) {
-    const causeText = interpolate(definition.cause, params);
-    const fix = interpolate(definition.fix, params);
+  constructor(definition: OkeErrorDefinition, params: OkeErrorParams = {}, locale?: string) {
+    const causeText = localizeOkePart(definition.code, "cause", definition.cause, params, locale);
+    const fix = localizeOkePart(definition.code, "fix", definition.fix, params, locale);
     const docsUrl = absoluteDocsUrl(`/e/${definition.code}`);
     const message = formatOkeMessage(definition.code, causeText, fix, docsUrl);
     super(message);
@@ -184,13 +188,18 @@ export function lookupOkeError(code: OkeErrorCode): OkeErrorDefinition | undefin
 /**
  * Create a flow-boundary failure value (does not throw).
  *
+ * When `opts.message` is omitted, attaches a localized message from the
+ * built-in / app catalogs (`errors.{code}.{reason}` → `errors.{code}`) using
+ * the active request locale. Custom codes with no catalog entry stay
+ * message-less.
+ *
  * @param code - Declared error code from the flow's `errors` map
  * @param data - Error payload
  * @param opts - Optional message override
  */
 export function fail<E>(code: string, data: E, opts?: FailOptions): FlowFailure<E> {
-  const error: FlowErrorValue<E> =
-    opts?.message !== undefined ? { code, data, message: opts.message } : { code, data };
+  const message = opts?.message !== undefined ? opts.message : resolveFailureMessage(code, data);
+  const error: FlowErrorValue<E> = message !== undefined ? { code, data, message } : { code, data };
   return { data: null, error };
 }
 
@@ -216,3 +225,45 @@ function interpolate(template: string, params: OkeErrorParams): string {
     return params[key] ?? `{${key}}`;
   });
 }
+
+/**
+ * Localize one OKE cause/fix line from catalogs, falling back to the registry
+ * English template.
+ *
+ * @param code - Numeric OKE code
+ * @param part - `cause` or `fix`
+ * @param fallback - Registry English template
+ * @param params - Interpolation params
+ * @param locale - Optional locale override
+ */
+function localizeOkePart(
+  code: OkeErrorCode,
+  part: "cause" | "fix",
+  fallback: string,
+  params: OkeErrorParams,
+  locale?: string,
+): string {
+  const key = `oke.${code}.${part}`;
+  const catalogs = getMessageCatalogs();
+  const active = locale ?? getActiveLocale("en");
+  const defaultLocale = getActiveDefaultLocale("en");
+  if (catalogs[active]?.[key] === undefined && catalogs[defaultLocale]?.[key] === undefined) {
+    return interpolate(fallback, params);
+  }
+  const formatted = translate({
+    locale: active,
+    defaultLocale,
+    catalogs,
+    key,
+    values: params,
+  });
+  // Catalog returned uninterpolated ICU (missing args) → registry template.
+  if (
+    Object.keys(params).length === 0 ||
+    formatted.includes("{flow}") ||
+    formatted.includes("{resource}")
+  ) {
+    return interpolate(fallback, params);
+  }
+  return formatted;
+}

package/src/kernel/fx.test.ts

@@ -160,6 +160,7 @@ describe("fx — wholesale swap", () => {
         error() {},
       },
       t: (key) => key,
+      locale: "en",
       id: () => "fixed-id",
       auth: { userId: "u1", scopes: new Set(["a"]) },
       operator: { id: null },
@@ -216,6 +217,32 @@ describe("fx — wholesale swap", () => {
   });
 });
 
+describe("fx.t — catalogs", () => {
+  test("resolves locale then default with ICU values", () => {
+    const fx = createFx({
+      flow: "x",
+      effects: {},
+      i18n: {
+        locale: "ar",
+        defaultLocale: "en",
+        catalogs: {
+          en: {
+            "errors.notFound": "Not found",
+            greeting: "Hello, {name}",
+            items: "{count, plural, one {# item} other {# items}}",
+          },
+          ar: { greeting: "مرحباً، {name}" },
+        },
+      },
+    });
+    expect(fx.locale).toBe("ar");
+    expect(fx.t("greeting", { name: "Ada" })).toBe("مرحباً، Ada");
+    expect(fx.t("errors.notFound")).toBe("Not found");
+    expect(fx.t("items", { count: 2 })).toBe("2 items");
+    expect(fx.t("missing")).toBe("missing");
+  });
+});
+
 describe("errors — registry", () => {
   test("OKE1042 is reserved with the §21 shape", () => {
     const def = OKE_ERRORS.ORPHAN_EMIT;

package/src/kernel/fx.ts

@@ -32,7 +32,7 @@ import {
   touchDryRunStore,
 } from "./dry-run.ts";
 import { fail, type FailOptions, type FlowFailure } from "./errors.ts";
-import { currentAbortSignal } from "./abort-scope.ts";
+import { currentAbortSignal, linkAbort } from "./abort-scope.ts";
 import {
   fxAll,
   fxRace,
@@ -44,6 +44,8 @@ import {
 import { maskRedactedDeep, Redacted } from "./redacted.ts";
 import type { JournalSession } from "./journal.ts";
 import type { RunTelemetry } from "./run-telemetry.ts";
+import { translate, type MessageCatalogs } from "../i18n/messages.ts";
+import type { AppMessageKey, MessageValues } from "../i18n/types.ts";
 
 export type { FxRetryOptions, FxThunk } from "./concurrency.ts";
 
@@ -217,11 +219,21 @@ export interface FxSendOptions {
   readonly to?: string;
   readonly via?: readonly NamedRef[];
   readonly data?: Record<string, unknown>;
+  /** Explicit recipient locale (wins over profile / Accept-Language). */
+  readonly locale?: string;
+  /** Profile locale for the channel resolution chain. */
+  readonly profileLocale?: string;
+  /** Raw `Accept-Language` header value. */
+  readonly acceptLanguage?: string;
 }
 
 /** Options for {@link Fx.ask}. */
 export interface FxAskOptions {
   readonly via?: readonly NamedRef[];
+  /** Flow refs offered as tools — each model call goes through `fx.call`. */
+  readonly tools?: readonly NamedRef[];
+  /** Bound on tool invocations (default 6). */
+  readonly maxSteps?: number;
 }
 
 /** Options for {@link Fx.search}. */
@@ -349,12 +361,18 @@ export interface Fx {
   /** Logger. */
   readonly log: FxLog;
   /**
-   * i18n stub — returns the key, optionally with JSON params suffix.
+   * Localized ICU message from registered `defineLocale` catalogs.
+   * Falls back through the active locale → `i18n.default` → the key.
    *
-   * @param key - Message key
-   * @param params - Interpolation params
+   * Augment `Register` (`declare module "okengine"`) with `messages` for
+   * key autocomplete and compile-time typos.
+   *
+   * @param key - Dot-separated message key
+   * @param values - ICU values (interpolation, plurals, select, rich tags)
    */
-  t(key: string, params?: Record<string, unknown>): string;
+  t(key: AppMessageKey, values?: MessageValues): string;
+  /** Active locale for {@link Fx.t} and default channel sends. */
+  readonly locale: string;
   /** Generate a unique id (UUID). */
   id(): string;
   /** User-plane auth principal. */
@@ -515,6 +533,15 @@ export interface CreateFxOptions {
   readonly journal?: JournalSession;
   /** When true (or when `journal` is set), journal every fx call. */
   readonly durable?: boolean;
+  /**
+   * i18n for {@link Fx.t}. When omitted, `fx.t` returns the key
+   * (optionally with a JSON params suffix) — same as an empty catalog.
+   */
+  readonly i18n?: {
+    readonly locale?: string;
+    readonly defaultLocale?: string;
+    readonly catalogs?: MessageCatalogs;
+  };
 }
 
 /** Bundle returned by {@link createFxContext}. */
@@ -560,6 +587,9 @@ export function createFxContext(options: CreateFxOptions): FxContext {
   };
   const operator: FxOperator = options.operator ?? { id: null };
   const tenant: FxTenant = options.tenant ?? { id: null };
+  const defaultLocale = options.i18n?.defaultLocale ?? "en";
+  const locale = options.i18n?.locale ?? defaultLocale;
+  const catalogs = options.i18n?.catalogs ?? {};
   const principal: FxPrincipal =
     options.principal ??
     ({
@@ -1030,6 +1060,9 @@ export function createFxContext(options: CreateFxOptions): FxContext {
             to: opts?.to ?? "",
             data: opts?.data,
             via: opts?.via?.map(resolveName),
+            locale: opts?.locale ?? locale,
+            profileLocale: opts?.profileLocale,
+            acceptLanguage: opts?.acceptLanguage,
           });
           return { ok: result.ok as true };
         }
@@ -1047,6 +1080,10 @@ export function createFxContext(options: CreateFxOptions): FxContext {
         if (options.aiRuntime) {
           return options.aiRuntime.ask(name, input, {
             via: opts?.via?.map(resolveName),
+            tools: opts?.tools?.map(resolveName),
+            maxSteps: opts?.maxSteps,
+            // Host fx.call — same capability / ledger / Runs path as any call.
+            callTool: (tool, toolInput) => fx.call(tool, toolInput),
           });
         }
         return {};
@@ -1093,6 +1130,7 @@ export function createFxContext(options: CreateFxOptions): FxContext {
               scopes: auth.scopes,
               verified: auth.verified,
             },
+            callTool: (tool, toolInput) => fx.call(tool, toolInput),
           });
         }
         return { ok: true, steps: 0, denials: [], output: input };
@@ -1102,27 +1140,45 @@ export function createFxContext(options: CreateFxOptions): FxContext {
       const name = resolveName(model);
       const chunks = (async function* () {
         await gated("ask", name, async () => undefined);
-        const text =
-          typeof opts?.data === "object" && opts?.data !== null
-            ? JSON.stringify(opts.data)
-            : String(opts?.prompt ?? "");
-        if (text.length === 0) {
-          yield "";
+        if (isDryRun()) {
+          recordWouldHaveFired("ask", name);
           return;
         }
-        // Chunk for clients that consume streaming tokens.
-        const size = Math.max(1, Math.ceil(text.length / 3));
-        for (let i = 0; i < text.length; i += size) {
-          yield text.slice(i, i + size);
+        if (!options.aiRuntime) {
+          throw new Error(`fx.stream: AI runtime is not configured for model "${name}"`);
+        }
+        // One cancellation channel: ambient ALS signal (Prompt 57) + local
+        // controller aborted when the consumer stops iterating.
+        const ambient = currentAbortSignal();
+        const local = new AbortController();
+        const unlink = linkAbort(ambient, local);
+        try {
+          for await (const text of options.aiRuntime.stream(name, {
+            prompt: opts?.prompt,
+            data: opts?.data,
+            signal: local.signal,
+          })) {
+            if (local.signal.aborted) break;
+            yield text;
+          }
+        } finally {
+          unlink();
+          if (!local.signal.aborted) local.abort();
         }
       })();
       return chunks;
     },
     log,
-    t(key, params) {
-      if (params === undefined) return key;
-      return `${key}:${JSON.stringify(params)}`;
+    t(key, values) {
+      return translate({
+        locale,
+        defaultLocale,
+        catalogs,
+        key,
+        values,
+      });
     },
+    locale,
     id() {
       return crypto.randomUUID();
     },

package/src/kernel/pipeline.test.ts

@@ -33,6 +33,7 @@ describe("gateDenialFailure", () => {
       },
     );
     expect(anon.error.code).toBe("Unauthorized");
+    expect(anon.error.message).toBe("Authentication required.");
 
     const forbid = gateDenialFailure(
       { name: "order:create", kind: "policy", allowed: false },
@@ -42,6 +43,8 @@ describe("gateDenialFailure", () => {
       },
     );
     expect(forbid.error.code).toBe("Forbidden");
+    expect(forbid.error.data).toEqual({ gate: "order:create", reason: "policy_denied" });
+    expect(forbid.error.message).toBe("Policy denied this request.");
 
     const rate = gateDenialFailure(
       {
@@ -58,6 +61,7 @@ describe("gateDenialFailure", () => {
     );
     expect(rate.error.code).toBe("RateLimited");
     expect(rate.error.data).toEqual({ retryAfterMs: 1500 });
+    expect(rate.error.message).toBe("Too many requests. Try again later.");
   });
 });
 

package/src/kernel/pipeline.ts

@@ -94,7 +94,7 @@ export function gateDenialFailure(evaluation: GateEvaluation, ctx: GatePolicyCon
   }
   return fail("Forbidden", {
     gate: evaluation.name,
-    reason: evaluation.reason ?? "policy denied",
+    reason: evaluation.reason ?? "policy_denied",
   });
 }
 

package/src/kernel/plugin.ts

@@ -15,6 +15,7 @@
  */
 
 import type { ChannelTemplateDecl } from "../elements/channel/declare.ts";
+import type { TemplateCatalog } from "../elements/channel/runtime.ts";
 import type { ClockDecl } from "../elements/clock/declare.ts";
 import type { GateDecl } from "../elements/gate/declare.ts";
 import type { SignalDecl } from "../elements/signal/declare.ts";
@@ -288,6 +289,12 @@ export interface PluginApi {
    * @param decl - Template from `channel.email.template(...)` etc.
    */
   channelTemplate(decl: ChannelTemplateDecl): PluginApi;
+  /**
+   * Contribute template body catalog entries (merged into boot channel catalog).
+   *
+   * @param catalog - Locale bodies keyed by template name (`{{field}}` interpolation)
+   */
+  channelCatalog(catalog: TemplateCatalog): PluginApi;
 }
 
 /** Captured capability lists for the Manifest. */
@@ -328,6 +335,7 @@ export interface PluginRegistration {
   readonly signals: readonly SignalDecl[];
   readonly gates: readonly GateDecl[];
   readonly channelTemplates: readonly ChannelTemplateDecl[];
+  readonly channelCatalogs: readonly TemplateCatalog[];
 }
 
 /**
@@ -467,6 +475,8 @@ export interface PluginDef<D extends Record<string, unknown> = {}> {
   gate(decl: GateDecl): PluginDef<D>;
   /** Queue a channel template. */
   channelTemplate(decl: ChannelTemplateDecl): PluginDef<D>;
+  /** Queue channel template body catalog entries. */
+  channelCatalog(catalog: TemplateCatalog): PluginDef<D>;
 }
 
 /** Extract accumulated decoration types from a {@link PluginDef}. */
@@ -624,6 +634,12 @@ export function plugin(name: string, options: PluginOptions): PluginDef {
       });
       return def;
     },
+    channelCatalog(catalog) {
+      steps.push((api) => {
+        api.channelCatalog(catalog);
+      });
+      return def;
+    },
   };
 
   return def;

package/src/kernel/registry.ts

@@ -13,6 +13,7 @@
  */
 
 import type { ChannelTemplateDecl } from "../elements/channel/declare.ts";
+import type { TemplateCatalog } from "../elements/channel/runtime.ts";
 import type { ClockDecl } from "../elements/clock/declare.ts";
 import type { GateDecl } from "../elements/gate/declare.ts";
 import type { SignalDecl } from "../elements/signal/declare.ts";
@@ -85,6 +86,7 @@ export function createRecordingApi(identity: { readonly name: string; readonly v
   const signals: SignalDecl[] = [];
   const gates: GateDecl[] = [];
   const channelTemplates: ChannelTemplateDecl[] = [];
+  const channelCatalogs: TemplateCatalog[] = [];
   const needs: string[] = [];
   const declares: string[] = [];
   const intercepts: string[] = [];
@@ -204,6 +206,13 @@ export function createRecordingApi(identity: { readonly name: string; readonly v
       pushDeclare(`channel:${decl.name}`);
       return api;
     },
+    channelCatalog(catalog) {
+      channelCatalogs.push(catalog);
+      for (const name of Object.keys(catalog)) {
+        pushDeclare(`channel-catalog:${name}`);
+      }
+      return api;
+    },
   };
 
   return {
@@ -238,6 +247,7 @@ export function createRecordingApi(identity: { readonly name: string; readonly v
         signals: signals.slice(),
         gates: gates.slice(),
         channelTemplates: channelTemplates.slice(),
+        channelCatalogs: channelCatalogs.slice(),
       };
     },
   };
@@ -318,6 +328,8 @@ export interface PluginRegistry {
   gateContributions(): readonly GateDecl[];
   /** Channel templates from installed plugins. */
   channelTemplateContributions(): readonly ChannelTemplateDecl[];
+  /** Channel template body catalogs from installed plugins. */
+  channelCatalogContributions(): readonly TemplateCatalog[];
   /** HTTP Bindings from installed plugins (auth method plugins). */
   bindingContributions(): readonly Binding[];
 }
@@ -489,6 +501,9 @@ export function createPluginRegistry(): PluginRegistry {
     channelTemplateContributions() {
       return firstPerPlugin(installed, (r) => r.channelTemplates);
     },
+    channelCatalogContributions() {
+      return firstPerPlugin(installed, (r) => r.channelCatalogs);
+    },
     bindingContributions() {
       return firstPerPlugin(installed, (r) => r.bindings);
     },

package/src/plugins/auth/shared.ts

@@ -14,7 +14,11 @@ import type { Binding } from "../../kernel/on.ts";
 import { http } from "../../kernel/triggers.ts";
 import { createEnv } from "../../runtime/primitives.ts";
 
-export const AuthFailed = z.object({ reason: z.string().optional() });
+export const AuthFailed = z.object({
+  reason: z.string().optional(),
+  /** Policy failure details (`username_policy` / `password_policy`). */
+  reasons: z.array(z.string()).optional(),
+});
 export const AuthRateLimited = z.object({ reason: z.string() });
 
 export const SessionTokensOut = z.object({