okengine 0.5.1 → 0.6.1

package/src/kernel/app.ts

@@ -35,6 +35,10 @@ import {
   type GateOptions,
   type ResolvedGateConfig,
 } from "../elements/gate/config.ts";
+import type { TemplateCatalog } from "../elements/channel/runtime.ts";
+import { parseAcceptLanguage } from "../elements/channel/locale.ts";
+import { runWithLocale } from "../i18n/locale-context.ts";
+import { getMessageCatalogs, matchConfiguredLocale } from "../i18n/messages.ts";
 import { runDurable } from "../elements/clock/durable.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
 import { fxRetry } from "./concurrency.ts";
@@ -567,6 +571,9 @@ export function oke(options: OkeOptions): OkeApp {
       secret: authBinding.secret,
       sessions: authBinding.sessions,
       now: authBinding.now,
+      passwordPolicy: gateConfig.auth?.passwordPolicy,
+      password: gateConfig.auth?.password,
+      breachCheck: gateConfig.auth?.breachCheck,
     });
   } else {
     setActiveGateAuthContext(undefined);
@@ -663,11 +670,14 @@ export function oke(options: OkeOptions): OkeApp {
     const pluginSignals = pluginRegistry.signalContributions();
     const pluginClocks = pluginRegistry.clockContributions();
     const pluginChannelTemplates = pluginRegistry.channelTemplateContributions();
+    const pluginChannelCatalogs = pluginRegistry.channelCatalogContributions();
     if (pluginSecrets.length > 0) available.add("vault");
     if (pluginGates.length > 0) available.add("gate");
     if (pluginSignals.length > 0) available.add("signal");
     if (pluginClocks.length > 0) available.add("clock");
-    if (pluginChannelTemplates.length > 0) available.add("channel");
+    if (pluginChannelTemplates.length > 0 || pluginChannelCatalogs.length > 0) {
+      available.add("channel");
+    }
     // gate.auth (auto-absorbed auth plugin) satisfies `.needs("auth")`.
     if (gateConfig.auth) available.add("auth");
     assertPluginNeeds(caps, { pluginNames, available });
@@ -676,6 +686,7 @@ export function oke(options: OkeOptions): OkeApp {
     const baseSignals = overrides?.signals ?? options.signals ?? [];
     const baseClocks = overrides?.clocks ?? options.clocks ?? [];
     const baseChannel = overrides?.channel ?? options.channel;
+    const mergedCatalog = mergeTemplateCatalogs(baseChannel?.catalog, ...pluginChannelCatalogs);
 
     const merged: BootOptions = {
       env: bootEnv,
@@ -692,6 +703,11 @@ export function oke(options: OkeOptions): OkeApp {
       channel: {
         ...(baseChannel ?? {}),
         templates: [...(baseChannel?.templates ?? []), ...pluginChannelTemplates],
+        ...(mergedCatalog ? { catalog: mergedCatalog } : {}),
+        defaultLocale:
+          baseChannel?.defaultLocale ??
+          (overrides?.config ?? options.config)?.i18n?.default ??
+          "en",
       },
       ai: overrides?.ai ?? options.ai,
       runs: overrides?.runs ?? options.runs,
@@ -754,10 +770,52 @@ export function oke(options: OkeOptions): OkeApp {
       readonly principal?: ResolvedPrincipal;
       /** Frozen origin identity for {@link Fx.principal} across `fx.call`. */
       readonly originPrincipal?: FxPrincipal;
+      /** Explicit locale override for {@link Fx.t} / channel sends. */
+      readonly locale?: string;
     },
   ): Promise<ExecuteResult> {
     registerFlow(flowDef);
 
+    const i18nConfig = options.config?.i18n;
+    const configuredLocales = i18nConfig?.locales ?? ["en", "ar"];
+    const defaultLocale = i18nConfig?.default ?? "en";
+    const acceptLanguage = extras?.request?.headers.get("accept-language") ?? undefined;
+    const resolvedLocale = matchConfiguredLocale(
+      extras?.locale ?? parseAcceptLanguage(acceptLanguage),
+      configuredLocales,
+      defaultLocale,
+    );
+
+    return runWithLocale({ locale: resolvedLocale, defaultLocale }, () =>
+      executeInLocale({
+        flowDef,
+        input,
+        trigger,
+        extras,
+        resolvedLocale,
+        defaultLocale,
+      }),
+    );
+  }
+
+  async function executeInLocale(args: {
+    readonly flowDef: AnyFlowDef;
+    readonly input: unknown;
+    readonly trigger: Trigger;
+    readonly extras?: {
+      readonly request?: Request;
+      readonly params?: Record<string, string>;
+      readonly validated?: boolean;
+      readonly auth?: ResolvedPrincipal | FxAuth;
+      readonly operator?: FxOperator;
+      readonly principal?: ResolvedPrincipal;
+      readonly originPrincipal?: FxPrincipal;
+      readonly locale?: string;
+    };
+    readonly resolvedLocale: string;
+    readonly defaultLocale: string;
+  }): Promise<ExecuteResult> {
+    const { flowDef, input, trigger, extras, resolvedLocale, defaultLocale } = args;
     const booted = await ensureBoot();
 
     const unitBag = flowDef.unit !== undefined ? unitHooks.get(flowDef.unit) : undefined;
@@ -860,6 +918,12 @@ export function oke(options: OkeOptions): OkeApp {
       effects: flowDef.effects,
       runTelemetry: telemetry,
       now,
+      i18n: {
+        locale: resolvedLocale,
+        defaultLocale,
+        catalogs: getMessageCatalogs(),
+        ...options.fx?.i18n,
+      },
       ...(principals ? { auth: principals.auth as FxAuth, operator: principals.operator } : {}),
       ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(capability ? { capability } : {}),
@@ -882,7 +946,10 @@ export function oke(options: OkeOptions): OkeApp {
           target,
           callInput,
           { kind: "internal" } satisfies InternalTrigger,
-          { originPrincipal: freezePrincipal(fx.principal) },
+          {
+            originPrincipal: freezePrincipal(fx.principal),
+            locale: resolvedLocale,
+          },
         );
         if (inner.failure) return inner.failure;
         return inner.output;
@@ -1300,5 +1367,28 @@ function archiveFromInput(
   return Object.keys(out).length > 0 ? out : undefined;
 }
 
+/**
+ * Deep-merge channel template catalogs (later parts win per locale).
+ *
+ * @param parts - Catalog fragments (undefined skipped)
+ */
+function mergeTemplateCatalogs(
+  ...parts: readonly (TemplateCatalog | undefined)[]
+): TemplateCatalog | undefined {
+  const out: Record<
+    string,
+    Record<string, { readonly subject?: string; readonly text?: string; readonly html?: string }>
+  > = {};
+  let any = false;
+  for (const part of parts) {
+    if (!part) continue;
+    any = true;
+    for (const [template, locales] of Object.entries(part)) {
+      out[template] = { ...(out[template] ?? {}), ...locales };
+    }
+  }
+  return any ? out : undefined;
+}
+
 /** @internal expose smart router type for tests */
 export type { HttpTrigger, SmartRouter };

package/src/kernel/boot-bind/ai.test.ts

@@ -0,0 +1,60 @@
+/**
+ * AI boot binder — shared driver switch + fail-loud resolution.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { mockAiDriver } from "../../drivers/ai-mock.ts";
+import { ollamaAiDriver } from "../../drivers/ai-ollama.ts";
+import { aiDriverFor, aiUrlFor, bindAi, resolveAiDriverId } from "./ai.ts";
+
+describe("ai boot binder", () => {
+  test("aiDriverFor maps protocol ids; unknown / reserved throw", () => {
+    expect(aiDriverFor("mock").id).toBe("mock");
+    expect(aiDriverFor("ollama")).toBe(ollamaAiDriver);
+    expect(() => aiDriverFor("bedrock")).toThrow(/not implemented/);
+    expect(() => aiDriverFor("nope")).toThrow(/unknown AI driver/);
+  });
+
+  test("resolveAiDriverId defaults to mock; honours config + OKE_AI_DRIVER in docker", () => {
+    expect(resolveAiDriverId({}, "local")).toBe("mock");
+    expect(resolveAiDriverId({ config: { drivers: { ai: { local: "ollama" } } } }, "local")).toBe(
+      "ollama",
+    );
+
+    const prev = process.env.OKE_AI_DRIVER;
+    process.env.OKE_AI_DRIVER = "ollama";
+    try {
+      expect(resolveAiDriverId({}, "local", true)).toBe("ollama");
+    } finally {
+      if (prev === undefined) delete process.env.OKE_AI_DRIVER;
+      else process.env.OKE_AI_DRIVER = prev;
+    }
+  });
+
+  test("aiUrlFor fails loud in docker without OKE_AI_URL", () => {
+    const prevUrl = process.env.OKE_AI_URL;
+    const prevHost = process.env.OLLAMA_HOST;
+    delete process.env.OKE_AI_URL;
+    delete process.env.OLLAMA_HOST;
+    try {
+      expect(() => aiUrlFor(true)).toThrow(/OKE_AI_URL/);
+      expect(aiUrlFor(false)).toBe("http://127.0.0.1:11434");
+    } finally {
+      if (prevUrl !== undefined) process.env.OKE_AI_URL = prevUrl;
+      if (prevHost !== undefined) process.env.OLLAMA_HOST = prevHost;
+    }
+  });
+
+  test("bindAi uses injected defaultDriver over config (tests stay on mock)", () => {
+    const runtime = bindAi(
+      {
+        config: { drivers: { ai: { local: "ollama" } } },
+        ai: { defaultDriver: mockAiDriver },
+      },
+      undefined,
+      () => 0,
+      "local",
+    );
+    expect(runtime.autoCacheDisabled).toBe(true);
+  });
+});

package/src/kernel/boot-bind/ai.ts

@@ -1,28 +1,151 @@
 /**
  * Lazy AI binder — loaded only when AI is declared.
+ *
+ * Resolves `drivers.ai` the same way store.index resolves its driver map:
+ * shared `aiDriverFor` switch, fail-loud on unknown / reserved-unimplemented
+ * ids, never a silent mock fallback when another driver is configured.
  */
 
+import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { anthropicAiDriver } from "../../drivers/ai-anthropic.ts";
 import { mockAiDriver } from "../../drivers/ai-mock.ts";
+import {
+  normalizeOllamaBaseUrl,
+  ollamaAiDriver,
+  OLLAMA_DEFAULT_BASE_URL,
+} from "../../drivers/ai-ollama.ts";
+import { openaiCompatibleAiDriver } from "../../drivers/ai-openai-compatible.ts";
+import type { AiDriver, AiOpenOptions } from "../../drivers/ai-types.ts";
 import { createAiRuntime, type AiRuntime } from "../../elements/ai.ts";
 import type { GateRuntime } from "../../elements/gate.ts";
 import type { BootOptions } from "../boot.ts";
 
 /**
- * Construct an AI runtime (mock default; shares gate for agents).
+ * Construct an AI runtime from config / injection.
  *
  * @param options - Boot options
  * @param gate - Gate runtime for agent tool checks
  * @param now - Clock
+ * @param env - Active environment
+ * @param docker - Prefer compose AI URL when active
  */
 export function bindAi(
   options: BootOptions,
   gate: GateRuntime | undefined,
   now: () => number,
+  env: ConfigEnv = "local",
+  docker = false,
 ): AiRuntime {
+  const id = resolveAiDriverId(options, env, docker);
+  const driver =
+    options.ai?.defaultDriver ?? withOpenDefaults(aiDriverFor(id), openDefaultsFor(id, docker));
   return createAiRuntime({
     ...(options.ai ?? {}),
-    defaultDriver: options.ai?.defaultDriver ?? mockAiDriver,
+    defaultDriver: driver,
     gates: options.ai?.gates ?? gate,
     now,
   });
 }
+
+/**
+ * Resolve the configured AI driver for one environment.
+ *
+ * Dev / test default is `mock`. There is **no** production default — prod must
+ * declare. Docker may override via `OKE_AI_DRIVER`.
+ *
+ * @param options - Boot options
+ * @param env - Active environment
+ * @param docker - Docker mode
+ */
+export function resolveAiDriverId(options: BootOptions, env: ConfigEnv, docker = false): string {
+  const fromEnv = process.env.OKE_AI_DRIVER?.trim();
+  if (docker && fromEnv) return fromEnv;
+  const resolved = resolveDriverId(options.config?.drivers?.ai, env);
+  if (resolved) return resolved;
+  return "mock";
+}
+
+/**
+ * Single id → AI driver switch — shared by boot (and future Console) so
+ * resolution can never drift into two maintained copies.
+ *
+ * @param id - Protocol driver id
+ */
+export function aiDriverFor(id: string): AiDriver {
+  switch (id) {
+    case "mock":
+      return mockAiDriver;
+    case "anthropic":
+      return anthropicAiDriver;
+    case "openai-compatible":
+      return openaiCompatibleAiDriver;
+    case "ollama":
+      return ollamaAiDriver;
+    case "bedrock":
+    case "vertex":
+      throw new Error(`oke boot: AI driver "${id}" is reserved but not implemented yet`);
+    default:
+      throw new Error(`oke boot: unknown AI driver "${id}"`);
+  }
+}
+
+/**
+ * Open defaults for a resolved driver id (URL / key from env).
+ *
+ * @param id - Driver id
+ * @param docker - Docker mode
+ */
+export function openDefaultsFor(id: string, docker = false): AiOpenOptions {
+  if (id === "ollama") {
+    return {
+      baseUrl: aiUrlFor(docker),
+      ...(process.env.OKE_AI_MODEL?.trim() ? { model: process.env.OKE_AI_MODEL.trim() } : {}),
+    };
+  }
+  if (id === "anthropic") {
+    const apiKey = process.env.ANTHROPIC_API_KEY?.trim();
+    return {
+      ...(apiKey ? { apiKey } : {}),
+      ...(process.env.ANTHROPIC_MODEL?.trim() ? { model: process.env.ANTHROPIC_MODEL.trim() } : {}),
+    };
+  }
+  if (id === "openai-compatible") {
+    const apiKey = process.env.OPENAI_API_KEY?.trim();
+    const baseUrl = process.env.OPENAI_BASE_URL?.trim() || process.env.OKE_AI_URL?.trim();
+    return {
+      ...(apiKey ? { apiKey } : {}),
+      ...(baseUrl ? { baseUrl } : {}),
+    };
+  }
+  return {};
+}
+
+/**
+ * Ollama base URL — docker fails loud when compose did not write one.
+ *
+ * @param docker - Docker mode
+ */
+export function aiUrlFor(docker = false): string {
+  const raw = process.env.OKE_AI_URL?.trim() || process.env.OLLAMA_HOST?.trim();
+  if (raw) return normalizeOllamaBaseUrl(raw);
+  if (docker) {
+    throw new Error(
+      "oke boot: ollama driver needs OKE_AI_URL (did `oke dev -d` write docker/.env.docker?)",
+    );
+  }
+  return OLLAMA_DEFAULT_BASE_URL;
+}
+
+/**
+ * Merge fixed open defaults under per-call options.
+ *
+ * @param driver - Base driver
+ * @param defaults - Env-derived open options
+ */
+function withOpenDefaults(driver: AiDriver, defaults: AiOpenOptions): AiDriver {
+  if (Object.keys(defaults).length === 0) return driver;
+  return {
+    id: driver.id,
+    open: (opts = {}) => driver.open({ ...defaults, ...opts }),
+  };
+}

package/src/kernel/boot-bind/channel.test.ts

@@ -1,15 +1,34 @@
 /**
- * Channel binder — profile selection + SMTP env parsing.
+ * Channel binder — profile selection + env parsing.
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
-import { resolveEmailDriverId, smtpOptionsFromEnv } from "./channel.ts";
+import {
+  msegatOptionsFromEnv,
+  resendOptionsFromEnv,
+  resolveEmailDriverId,
+  resolveSmsDriverId,
+  smtpOptionsFromEnv,
+  sndrOptionsFromEnv,
+  taqnyatOptionsFromEnv,
+  unifonicOptionsFromEnv,
+} from "./channel.ts";
 
 const previous = {
   url: process.env.SMTP_URL,
   user: process.env.SMTP_USER,
   password: process.env.SMTP_PASSWORD,
   okeUrl: process.env.OKE_CHANNEL_EMAIL_URL,
+  resend: process.env.RESEND_API_KEY,
+  sndr: process.env.SNDR_API_KEY,
+  sndrBase: process.env.SNDR_BASE_URL,
+  taqBearer: process.env.TAQNYAT_BEARER_TOKEN,
+  taqSender: process.env.TAQNYAT_SENDER,
+  msegatUser: process.env.MSEGAT_USERNAME,
+  msegatKey: process.env.MSEGAT_API_KEY,
+  msegatSender: process.env.MSEGAT_SENDER,
+  unifonicSid: process.env.UNIFONIC_APPSID,
+  unifonicSender: process.env.UNIFONIC_SENDER,
 };
 
 afterEach(() => {
@@ -17,6 +36,16 @@ afterEach(() => {
   restoreEnv("SMTP_USER", previous.user);
   restoreEnv("SMTP_PASSWORD", previous.password);
   restoreEnv("OKE_CHANNEL_EMAIL_URL", previous.okeUrl);
+  restoreEnv("RESEND_API_KEY", previous.resend);
+  restoreEnv("SNDR_API_KEY", previous.sndr);
+  restoreEnv("SNDR_BASE_URL", previous.sndrBase);
+  restoreEnv("TAQNYAT_BEARER_TOKEN", previous.taqBearer);
+  restoreEnv("TAQNYAT_SENDER", previous.taqSender);
+  restoreEnv("MSEGAT_USERNAME", previous.msegatUser);
+  restoreEnv("MSEGAT_API_KEY", previous.msegatKey);
+  restoreEnv("MSEGAT_SENDER", previous.msegatSender);
+  restoreEnv("UNIFONIC_APPSID", previous.unifonicSid);
+  restoreEnv("UNIFONIC_SENDER", previous.unifonicSender);
 });
 
 describe("bindChannel driver resolution", () => {
@@ -24,7 +53,8 @@ describe("bindChannel driver resolution", () => {
     config: {
       drivers: {
         channel: {
-          email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
+          email: { local: "console", docker: "smtp", test: "console", prod: "sndr" },
+          sms: { local: "console", docker: "taqnyat", test: "msegat", prod: "taqnyat" },
         },
       },
     },
@@ -33,6 +63,13 @@ describe("bindChannel driver resolution", () => {
   test("uses console locally and smtp in docker", () => {
     expect(resolveEmailDriverId(options, "local", false)).toBe("console");
     expect(resolveEmailDriverId(options, "docker", true)).toBe("smtp");
+    expect(resolveEmailDriverId(options, "prod", false)).toBe("sndr");
+  });
+
+  test("resolves sms driver ids", () => {
+    expect(resolveSmsDriverId(options, "local")).toBe("console");
+    expect(resolveSmsDriverId(options, "docker")).toBe("taqnyat");
+    expect(resolveSmsDriverId(options, "test")).toBe("msegat");
   });
 
   test("parses SMTP_URL and optional auth overrides", () => {
@@ -52,6 +89,34 @@ describe("bindChannel driver resolution", () => {
     delete process.env.OKE_CHANNEL_EMAIL_URL;
     expect(() => smtpOptionsFromEnv(true)).toThrow("docker/.env.docker");
   });
+
+  test("resend and sndr env helpers", () => {
+    process.env.RESEND_API_KEY = "re_x";
+    expect(resendOptionsFromEnv()).toEqual({ apiKey: "re_x" });
+    process.env.SNDR_API_KEY = "sndr_test_x";
+    process.env.SNDR_BASE_URL = "https://api.example.test";
+    expect(sndrOptionsFromEnv()).toEqual({
+      apiKey: "sndr_test_x",
+      url: "https://api.example.test",
+    });
+  });
+
+  test("taqnyat, msegat, and unifonic env helpers", () => {
+    process.env.TAQNYAT_BEARER_TOKEN = "bearer";
+    process.env.TAQNYAT_SENDER = "Brand";
+    expect(taqnyatOptionsFromEnv()).toEqual({ bearerToken: "bearer", sender: "Brand" });
+    process.env.MSEGAT_USERNAME = "user";
+    process.env.MSEGAT_API_KEY = "key";
+    process.env.MSEGAT_SENDER = "Brand";
+    expect(msegatOptionsFromEnv()).toEqual({
+      userName: "user",
+      apiKey: "key",
+      sender: "Brand",
+    });
+    process.env.UNIFONIC_APPSID = "sid";
+    process.env.UNIFONIC_SENDER = "Brand";
+    expect(unifonicOptionsFromEnv()).toEqual({ appSid: "sid", sender: "Brand" });
+  });
 });
 
 function restoreEnv(key: string, value: string | undefined): void {

package/src/kernel/boot-bind/channel.ts

@@ -4,7 +4,12 @@
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
 import { openConsoleChannel } from "../../drivers/channel-console.ts";
+import { openMsegatChannel } from "../../drivers/channel-msegat.ts";
+import { openResendChannel } from "../../drivers/channel-resend.ts";
 import { openSmtpChannel } from "../../drivers/channel-smtp.ts";
+import { openSndrChannel } from "../../drivers/channel-sndr.ts";
+import { openTaqnyatChannel } from "../../drivers/channel-taqnyat.ts";
+import { openUnifonicChannel } from "../../drivers/channel-unifonic.ts";
 import type { ChannelDriver, ChannelOpenOptions } from "../../drivers/channel-types.ts";
 import { createChannelRuntime, type ChannelRuntime } from "../../elements/channel.ts";
 import type { BootOptions } from "../boot.ts";
@@ -12,6 +17,9 @@ import type { BootOptions } from "../boot.ts";
 /**
  * Construct a Channel runtime (console inbox default).
  *
+ * When `options.channel.drivers` is omitted, opens the configured email driver
+ * and, if `drivers.channel.sms` resolves, appends that SMS driver to the chain.
+ *
  * @param options - Boot options
  * @param env - Active environment
  * @param now - Clock
@@ -25,18 +33,36 @@ export function bindChannel(
 ): ChannelRuntime {
   return createChannelRuntime({
     ...(options.channel ?? {}),
-    drivers: options.channel?.drivers ?? [channelDriverFor(options, env, docker)],
+    drivers: options.channel?.drivers ?? defaultDrivers(options, env, docker),
     now,
   });
 }
 
-function channelDriverFor(options: BootOptions, env: ConfigEnv, docker: boolean): ChannelDriver {
+function defaultDrivers(options: BootOptions, env: ConfigEnv, docker: boolean): ChannelDriver[] {
+  const drivers: ChannelDriver[] = [emailDriverFor(options, env, docker)];
+  const sms = smsDriverFor(options, env);
+  if (sms) drivers.push(sms);
+  return drivers;
+}
+
+function emailDriverFor(options: BootOptions, env: ConfigEnv, docker: boolean): ChannelDriver {
   const id = resolveEmailDriverId(options, env, docker);
   if (id === "console") return openConsoleChannel();
   if (id === "smtp") return openSmtpChannel(smtpOptionsFromEnv(docker));
+  if (id === "resend") return openResendChannel(resendOptionsFromEnv());
+  if (id === "sndr") return openSndrChannel(sndrOptionsFromEnv());
   throw new Error(`oke boot: unknown email channel driver "${id}"`);
 }
 
+function smsDriverFor(options: BootOptions, env: ConfigEnv): ChannelDriver | undefined {
+  const id = resolveSmsDriverId(options, env);
+  if (!id || id === "console") return undefined;
+  if (id === "taqnyat") return openTaqnyatChannel(taqnyatOptionsFromEnv());
+  if (id === "msegat") return openMsegatChannel(msegatOptionsFromEnv());
+  if (id === "unifonic") return openUnifonicChannel(unifonicOptionsFromEnv());
+  throw new Error(`oke boot: unknown sms channel driver "${id}"`);
+}
+
 /**
  * Resolve the configured email driver for one environment.
  *
@@ -54,6 +80,16 @@ export function resolveEmailDriverId(
   );
 }
 
+/**
+ * Resolve the configured SMS driver for one environment.
+ *
+ * @param options - Boot options
+ * @param env - Active environment
+ */
+export function resolveSmsDriverId(options: BootOptions, env: ConfigEnv): string | undefined {
+  return resolveDriverId(options.config?.drivers?.channel?.sms, env);
+}
+
 /**
  * Resolve SMTP connection options from `SMTP_URL` plus optional auth overrides.
  *
@@ -81,3 +117,58 @@ export function smtpOptionsFromEnv(docker = false): ChannelOpenOptions {
     ...(pass ? { pass } : {}),
   };
 }
+
+/**
+ * Resolve Resend options from env.
+ */
+export function resendOptionsFromEnv(): ChannelOpenOptions {
+  const apiKey = process.env.RESEND_API_KEY?.trim();
+  if (!apiKey) throw new Error("oke boot: resend channel needs RESEND_API_KEY");
+  return { apiKey };
+}
+
+/**
+ * Resolve SNDR options from env.
+ */
+export function sndrOptionsFromEnv(): ChannelOpenOptions {
+  const apiKey = process.env.SNDR_API_KEY?.trim();
+  if (!apiKey) throw new Error("oke boot: sndr channel needs SNDR_API_KEY");
+  const url = process.env.SNDR_BASE_URL?.trim();
+  return { apiKey, ...(url ? { url } : {}) };
+}
+
+/**
+ * Resolve Taqnyat SMS options from env.
+ */
+export function taqnyatOptionsFromEnv(): ChannelOpenOptions {
+  const bearerToken = process.env.TAQNYAT_BEARER_TOKEN?.trim() ?? process.env.TAQNYAT_TOKEN?.trim();
+  const sender = process.env.TAQNYAT_SENDER?.trim();
+  if (!bearerToken) {
+    throw new Error("oke boot: taqnyat channel needs TAQNYAT_BEARER_TOKEN");
+  }
+  if (!sender) throw new Error("oke boot: taqnyat channel needs TAQNYAT_SENDER");
+  return { bearerToken, sender };
+}
+
+/**
+ * Resolve Msegat SMS options from env.
+ */
+export function msegatOptionsFromEnv(): ChannelOpenOptions {
+  const userName = process.env.MSEGAT_USERNAME?.trim();
+  const apiKey = process.env.MSEGAT_API_KEY?.trim();
+  const sender = process.env.MSEGAT_SENDER?.trim();
+  if (!userName) throw new Error("oke boot: msegat channel needs MSEGAT_USERNAME");
+  if (!apiKey) throw new Error("oke boot: msegat channel needs MSEGAT_API_KEY");
+  if (!sender) throw new Error("oke boot: msegat channel needs MSEGAT_SENDER");
+  return { userName, apiKey, sender };
+}
+
+/**
+ * Resolve Unifonic SMS options from env.
+ */
+export function unifonicOptionsFromEnv(): ChannelOpenOptions {
+  const appSid = process.env.UNIFONIC_APPSID?.trim() ?? process.env.UNIFONIC_APP_SID?.trim();
+  const sender = process.env.UNIFONIC_SENDER?.trim();
+  if (!appSid) throw new Error("oke boot: unifonic channel needs UNIFONIC_APPSID");
+  return { appSid, ...(sender ? { sender } : {}) };
+}

package/src/kernel/boot.test.ts

@@ -79,7 +79,7 @@ describe("boot — lazy element needs", () => {
     expect(needs.signal).toBe(false);
   });
 
-  test("oke() Store-only graph stays under the prior 41.4 kB baseline", async () => {
+  test("oke() Store-only graph stays under the prior 50 kB baseline", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-store-only-"));
     const entry = join(dir, "entry.ts");
     const appPath = join(import.meta.dir, "app.ts");
@@ -116,8 +116,9 @@ describe("boot — lazy element needs", () => {
         if (raw.byteLength === 0) continue;
         total += Bun.gzipSync(new Uint8Array(raw)).byteLength;
       }
-      // Prior eager-bind baseline: ~41.4 kB for oke() alone.
-      expect(total).toBeLessThan(41_400);
+      // Rebased after AI stream/tool-loop + fx.t/i18n on the shared fx surface
+      // (~49.5 kB gzip). Still far below an eager full-element bind.
+      expect(total).toBeLessThan(50_000);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }

package/src/kernel/boot.ts

@@ -388,7 +388,7 @@ export async function bootApplication(input: BootOptions = {}): Promise<BootResu
   // 6. AI
   let ai = pre.ai;
   if (needs.ai && !ai) {
-    ai = aiBind!.bindAi(options, gate, now);
+    ai = aiBind!.bindAi(options, gate, now, env, docker);
   }
 
   // 7. Runs