okengine 0.11.1 → 0.12.0

package/src/cli/hero-meta.test.ts

@@ -83,6 +83,43 @@ describe("hero-meta", () => {
     expect(decodeHeroSnapshot(encodeHeroSnapshot(snap))).toEqual(snap);
   });
 
+  test("sparse config (create-oke without --ai) still shows default compose drivers", () => {
+    const rows = resolveHeroElements(
+      {
+        drivers: {
+          store: { index: { test: "memory", prod: "meilisearch" } },
+          vault: { dev: "vault" },
+        },
+      },
+      { docker: true, sqlDriver: "postgres", kvDriver: "redis" },
+    );
+    const store = rows.find((r) => r.element === "store")?.detail ?? "";
+    expect(store).toContain("postgres");
+    expect(store).toContain("redis");
+    expect(store).toContain("files s3");
+    expect(store).toContain("index meilisearch");
+    expect(rows.find((r) => r.element === "signal")?.detail).toBe("redis");
+    expect(rows.find((r) => r.element === "clock")?.detail).toBe("postgres");
+    expect(rows.find((r) => r.element === "channel")?.detail).toContain("smtp");
+    expect(rows.find((r) => r.element === "vault")?.detail).toBe("vault");
+    expect(rows.find((r) => r.element === "ai")?.detail).toBe("—");
+  });
+
+  test("keel-shaped config with drivers.ai lights the eighth element", () => {
+    const rows = resolveHeroElements(
+      {
+        drivers: {
+          store: { index: { test: "memory", prod: "meilisearch" } },
+          vault: { dev: "vault" },
+          ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
+        },
+      },
+      { docker: true, sqlDriver: "postgres", kvDriver: "redis", aiModel: "granite3.3:2b" },
+    );
+    expect(rows.find((r) => r.element === "ai")?.detail).toBe("openai-compatible · granite3.3:2b");
+    expect(rows.find((r) => r.element === "ai")?.status).not.toBe("idle");
+  });
+
   test("hero AI row includes configured model id", () => {
     const snap = buildDevHeroSnapshot({
       config: SAMPLE,

package/src/cli/hero-meta.ts

@@ -3,6 +3,7 @@
  */
 
 import { release } from "node:os";
+import { resolveEffectiveDrivers } from "../config/driver-defaults.ts";
 import {
   resolveDriverId,
   type ConfigEnv,
@@ -163,11 +164,14 @@ export function resolveHeroElements(
   const drivers = config?.drivers;
   // `-d` reads the `docker` profile for every element (not a store-only override).
   const configEnv: ConfigEnv = options.configEnv ?? (options.docker ? "dev" : "test");
+  // Sparse `oke.config.ts` (create-oke / keel) only pins overrides — boot still
+  // uses DRIVER_DEFAULTS. The hero must show that same effective map.
+  const effective = resolveEffectiveDrivers(drivers);
 
   // Gate rates share `drivers.store.kv` (no separate drivers.gate).
   const gateKv =
     options.kvDriver ??
-    resolveDriverId(drivers?.store?.kv, configEnv) ??
+    resolveDriverId(effective.store.kv, configEnv) ??
     (options.docker ? "redis" : "memory");
 
   const aiDriver = resolveDriverId(drivers?.ai, configEnv);
@@ -177,15 +181,32 @@ export function resolveHeroElements(
   const byName: Record<string, string> = {
     // Status ● is rendered separately — flow has no driver id.
     flow: "",
-    signal: resolveDriverId(drivers?.signal, configEnv) ?? "—",
-    store: storeDetail(drivers?.store, configEnv, {
-      sql: options.sqlDriver,
-      kv: options.kvDriver,
-    }),
-    clock: resolveDriverId(drivers?.clock, configEnv) ?? "—",
+    signal: resolveDriverId(effective.signal, configEnv) ?? "—",
+    store: storeDetail(
+      {
+        sql: effective.store.sql,
+        kv: effective.store.kv,
+        files: effective.store.files,
+        index: drivers?.store?.index,
+      },
+      configEnv,
+      {
+        sql: options.sqlDriver,
+        kv: options.kvDriver,
+      },
+    ),
+    clock: resolveDriverId(effective.clock, configEnv) ?? "—",
     gate: gateKv,
-    vault: resolveDriverId(drivers?.vault, configEnv) ?? "—",
-    channel: channelDetail(drivers?.channel, configEnv),
+    vault: resolveDriverId(effective.vault, configEnv) ?? "—",
+    channel: channelDetail(
+      {
+        email: effective.channel.email,
+        sms: effective.channel.sms,
+        whatsapp: drivers?.channel?.whatsapp,
+        push: drivers?.channel?.push,
+      },
+      configEnv,
+    ),
     ai: aiDetail,
   };
 

package/src/cli/index.ts

@@ -10,6 +10,7 @@ import { branchCli } from "./branch.ts";
 import { buildCli } from "./build.ts";
 import { clientAddCli } from "./client-add.ts";
 import { completionCli } from "./completion.ts";
+import { consoleCli } from "./console-cmd.ts";
 import { dbCli } from "./db.ts";
 import { devCli } from "./dev.ts";
 import { doctorCli } from "./doctor.ts";
@@ -132,6 +133,10 @@ if (cmd === "gates" && sub === "list") {
   process.exit(await gatesListCli(rest));
 }
 
+if (cmd === "console") {
+  process.exit(await consoleCli(sub ? [sub, ...rest] : rest));
+}
+
 if (cmd === "completion") {
   process.exit(completionCli(sub ? [sub, ...rest] : rest));
 }

package/src/cli/load-config.images.test.ts

@@ -18,21 +18,21 @@ describe("flattenImagesConfig", () => {
           sql: "postgres:18-alpine",
           kv: "redis:8-alpine",
           files: "rustfs/rustfs:1.0.0",
-          index: "getmeili/meilisearch:v1.37",
+          index: "getmeili/meilisearch:v1.53",
         },
-        channel: { email: "axllent/mailpit:v1.22.3" },
-        ai: "ollama/ollama:0.32.6",
-        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+        channel: { email: "axllent/mailpit:v1.30.7" },
+        ai: "ollama/ollama:0.32.13",
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
         proxy: "caddy:2-alpine",
       }),
     ).toEqual({
       "store.sql": "postgres:18-alpine",
       "store.kv": "redis:8-alpine",
       "store.files": "rustfs/rustfs:1.0.0",
-      "store.index": "getmeili/meilisearch:v1.37",
-      "channel.email": "axllent/mailpit:v1.22.3",
-      ai: "ollama/ollama:0.32.6",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      "store.index": "getmeili/meilisearch:v1.53",
+      "channel.email": "axllent/mailpit:v1.30.7",
+      ai: "ollama/ollama:0.32.13",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       proxy: "caddy:2-alpine",
     });
   });
@@ -55,7 +55,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       "store.kv": "redis:8-alpine",
     });
   });
@@ -70,7 +70,7 @@ describe("defaultImagesFromConfig", () => {
       },
     });
     expect(images["store.sql"]).toBe("pgvector/pgvector:pg17");
-    expect(images.pgdog).toBe("ghcr.io/pgdogdev/pgdog:v0.1.51");
+    expect(images.pgdog).toBe("ghcr.io/pgdogdev/pgdog:v0.1.53");
   });
 
   test("clock postgres alone pulls store.sql image", () => {
@@ -81,7 +81,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
     });
   });
 
@@ -93,7 +93,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
     });
   });
 

package/src/cli/load-config.ts

@@ -15,7 +15,7 @@ import type { Manifest } from "../manifest/types.ts";
 /** Default image pins when `images` is omitted but prod drivers need containers. */
 const DEFAULT_SQL_IMAGE = "postgres:18-alpine";
 const DEFAULT_PGVECTOR_IMAGE = "pgvector/pgvector:pg17";
-const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.51";
+const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.53";
 const DEFAULT_KV_IMAGE = "redis:8-alpine";
 
 /**

package/src/cli/project-state.test.ts

@@ -0,0 +1,54 @@
+/**
+ * Tests for durable `.oke/state.json` project markers.
+ */
+
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+import {
+  isProjectSeeded,
+  LEGACY_SEEDED_MARKER,
+  markProjectSeeded,
+  PROJECT_STATE_REL,
+  readProjectState,
+} from "./project-state.ts";
+
+describe("project-state", () => {
+  test("markProjectSeeded writes seededAt under .oke/state.json", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "oke-state-"));
+    try {
+      expect(await isProjectSeeded(dir)).toBe(false);
+      await markProjectSeeded(dir, { seed: "keel", at: "2026-01-02T03:04:05.000Z" });
+      expect(await isProjectSeeded(dir, "keel")).toBe(true);
+      expect(await isProjectSeeded(dir, "notes")).toBe(false);
+      const state = await readProjectState(dir);
+      expect(state.seededAt).toBe("2026-01-02T03:04:05.000Z");
+      expect(state.seed).toBe("keel");
+      expect(existsSync(join(dir, PROJECT_STATE_REL))).toBe(true);
+      expect(existsSync(join(dir, LEGACY_SEEDED_MARKER))).toBe(false);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("migrates legacy .oke/seeded into state.json and removes marker", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "oke-state-"));
+    try {
+      mkdirSync(join(dir, ".oke"), { recursive: true });
+      writeFileSync(join(dir, LEGACY_SEEDED_MARKER), "2025-12-01T00:00:00.000Z\n");
+      const state = await readProjectState(dir);
+      expect(state.seededAt).toBe("2025-12-01T00:00:00.000Z");
+      expect(existsSync(join(dir, PROJECT_STATE_REL))).toBe(true);
+      expect(existsSync(join(dir, LEGACY_SEEDED_MARKER))).toBe(false);
+      const raw = JSON.parse(readFileSync(join(dir, PROJECT_STATE_REL), "utf8")) as {
+        seededAt?: string;
+      };
+      expect(raw.seededAt).toBe("2025-12-01T00:00:00.000Z");
+      expect(await isProjectSeeded(dir)).toBe(true);
+      expect(await isProjectSeeded(dir, "keel")).toBe(false);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/cli/project-state.ts

@@ -0,0 +1,139 @@
+/**
+ * `.oke/state.json` — durable local project markers (survive across `oke dev`
+ * sessions). Distinct from `.oke/dev.json` (live session lock) and
+ * `.oke/console.secret` (Console session signing key).
+ */
+
+import { mkdir, unlink } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+
+/** Relative path under the project root. */
+export const PROJECT_STATE_REL = ".oke/state.json";
+
+/**
+ * Legacy one-shot seed marker (pre-state.json). Migrated on read then removed.
+ * @deprecated Prefer {@link PROJECT_STATE_REL} `seededAt`.
+ */
+export const LEGACY_SEEDED_MARKER = ".oke/seeded";
+
+/** Durable local project state (gitignored under `.oke/`). */
+export type ProjectState = {
+  /** ISO timestamp when prompted `oke db seed` last succeeded. */
+  readonly seededAt?: string;
+  /**
+   * Seed identity (`defineSeed({ name })` or project folder).
+   * A different name re-prompts — not a global "already seeded" flag.
+   */
+  readonly seed?: string;
+};
+
+/**
+ * Absolute path to `.oke/state.json`.
+ *
+ * @param cwd - Project root
+ */
+export function projectStatePath(cwd: string): string {
+  return resolve(cwd, PROJECT_STATE_REL);
+}
+
+/**
+ * Parse and validate a state object from JSON.
+ *
+ * @param raw - Unknown JSON value
+ */
+export function parseProjectState(raw: unknown): ProjectState {
+  if (raw === null || typeof raw !== "object") return {};
+  const o = raw as Record<string, unknown>;
+  const seededAt = o["seededAt"];
+  const seed = o["seed"];
+  return {
+    ...(typeof seededAt === "string" && seededAt.trim().length > 0
+      ? { seededAt: seededAt.trim() }
+      : {}),
+    ...(typeof seed === "string" && seed.trim().length > 0 ? { seed: seed.trim() } : {}),
+  };
+}
+
+/**
+ * Read project state, migrating a legacy `.oke/seeded` marker when present.
+ *
+ * @param cwd - Project root
+ */
+export async function readProjectState(cwd: string): Promise<ProjectState> {
+  const path = projectStatePath(cwd);
+  let state: ProjectState = {};
+  if (await Bun.file(path).exists()) {
+    try {
+      state = parseProjectState(await Bun.file(path).json());
+    } catch {
+      state = {};
+    }
+  }
+
+  if (state.seededAt) return state;
+
+  const legacy = resolve(cwd, LEGACY_SEEDED_MARKER);
+  if (!(await Bun.file(legacy).exists())) return state;
+
+  let seededAt = new Date().toISOString();
+  try {
+    const text = (await Bun.file(legacy).text()).trim();
+    if (text.length > 0) seededAt = text.split(/\r?\n/, 1)[0]!.trim() || seededAt;
+  } catch {
+    // keep generated timestamp
+  }
+  const migrated: ProjectState = { ...state, seededAt };
+  await writeProjectState(cwd, migrated);
+  try {
+    await unlink(legacy);
+  } catch {
+    // best-effort
+  }
+  return migrated;
+}
+
+/**
+ * Write project state (creates `.oke/` as needed).
+ *
+ * @param cwd - Project root
+ * @param state - Full state payload
+ */
+export async function writeProjectState(cwd: string, state: ProjectState): Promise<void> {
+  const path = projectStatePath(cwd);
+  await mkdir(dirname(path), { recursive: true });
+  const body: Record<string, string> = {};
+  if (state.seededAt) body.seededAt = state.seededAt;
+  if (state.seed) body.seed = state.seed;
+  await Bun.write(path, `${JSON.stringify(body, null, 2)}\n`);
+}
+
+/**
+ * Whether prompted seed already completed for this seed identity.
+ *
+ * @param cwd - Project root
+ * @param seed - Current {@link SeedDef.name} / folder id; a mismatch re-asks
+ */
+export async function isProjectSeeded(cwd: string, seed?: string): Promise<boolean> {
+  const state = await readProjectState(cwd);
+  if (typeof state.seededAt !== "string" || state.seededAt.length === 0) return false;
+  if (seed === undefined) return true;
+  return state.seed === seed;
+}
+
+/**
+ * Record a successful prompted seed (ISO timestamp + identity).
+ *
+ * @param cwd - Project root
+ * @param options - Seed id and optional timestamp
+ */
+export async function markProjectSeeded(
+  cwd: string,
+  options: { readonly seed?: string; readonly at?: string } = {},
+): Promise<void> {
+  const prev = await readProjectState(cwd);
+  await writeProjectState(cwd, {
+    ...prev,
+    seededAt: options.at ?? new Date().toISOString(),
+    ...(options.seed !== undefined ? { seed: options.seed } : {}),
+  });
+}

package/src/cli/registry.ts

@@ -655,6 +655,17 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
       HELP,
     ],
   },
+  {
+    name: "console",
+    summary: "Console helpers — claim-code",
+    subcommands: [
+      {
+        name: "claim-code",
+        summary: "Print the local setup claim code from .oke/claim-code",
+        flags: [JSON_FLAG, HELP],
+      },
+    ],
+  },
   {
     name: "gates",
     summary: "gate catalogue from Manifest",

package/src/cli/replay.ts

@@ -6,7 +6,12 @@ import { resolve } from "node:path";
 import { withDryRun } from "../kernel/dry-run.ts";
 import type { AnyFlowDef } from "../kernel/flow.ts";
 import type { InternalTrigger } from "../kernel/triggers.ts";
-import { createRunsRuntime, type RunsRuntime, type WideEvent } from "../runs/index.ts";
+import {
+  createRunsRuntime,
+  DEFAULT_RUNS_LOCAL_ROOT,
+  type RunsRuntime,
+  type WideEvent,
+} from "../runs/index.ts";
 import { resolveStartEntry } from "./start.ts";
 import { flagValue, hasFlag } from "./args.ts";
 import { EXIT_OK, EXIT_USAGE } from "./exit.ts";
@@ -134,7 +139,7 @@ export async function runReplay(options: ReplayOptions): Promise<number> {
       options.runs ??
       createRunsRuntime({
         driver: "files",
-        localRoot: resolve(cwd, ".oke/runs"),
+        localRoot: resolve(cwd, DEFAULT_RUNS_LOCAL_ROOT),
       });
     if (!runs.store) await runs.open();
 

package/src/cli/vault-cmd.test.ts

@@ -2,12 +2,13 @@
  * `oke vault` builtin loop — init · status · seal/unseal · rotate · audit ·
  * backup/restore.
  *
- * Every case runs against a real PGlite instance shared across the
- * subcommands of one scenario, which is what a live vault looks like: each
- * `oke vault …` is a fresh process that must re-supply the master key.
+ * Logic-only cases (init / status seal-state) use the in-memory Vault SQL
+ * fake so they do not pay PGlite WASM cold-start. Dialect-heavy cases
+ * (rotate, backup, audit purge, …) share one warmed file-scoped PGlite
+ * (cold WASM once; {@link resetVaultTables} between tests).
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -18,8 +19,20 @@ import {
   sqlConnectionAsExec,
   type BuiltinVaultAdapter,
 } from "../elements/vault/builtin-adapter.ts";
+import { createMemoryVaultSql, resetVaultTables } from "../elements/vault/test-helpers.ts";
 import { vaultCli } from "./vault-cmd.ts";
 
+/** File-scoped warmed PGlite for dialect-heavy CLI cases. */
+let sharedPglite: SqlConnection;
+
+beforeAll(async () => {
+  sharedPglite = await connectPglite({ url: "memory://vault-cli-shared" });
+}, 15_000);
+
+afterAll(async () => {
+  await sharedPglite.close();
+});
+
 /** A CLI bound to one in-memory vault, plus its captured stdout. */
 interface Harness {
   readonly sql: SqlConnection;
@@ -31,13 +44,28 @@ interface Harness {
   close(): Promise<void>;
 }
 
+/** Options for {@link harness}. */
+interface HarnessOptions {
+  /** Project root for relative file arguments. */
+  readonly cwd?: string;
+  /**
+   * Pre-opened SQL. Defaults to the file-scoped warmed PGlite. Pass
+   * {@link createMemoryVaultSql} for logic-only cases that must not pay
+   * WASM cold-start.
+   */
+  readonly sql?: SqlConnection;
+}
+
 /**
- * Open a CLI harness over a fresh PGlite instance.
+ * Open a CLI harness over an injected or shared PGlite connection.
  *
- * @param cwd - Project root for relative file arguments
+ * @param options - Cwd / SQL backend
  */
-async function harness(cwd?: string): Promise<Harness> {
-  const sql = await connectPglite({ url: "memory://vault-cli-test" });
+async function harness(options: HarnessOptions = {}): Promise<Harness> {
+  const injected = options.sql !== undefined;
+  if (!injected) await resetVaultTables(sharedPglite);
+  const sql = options.sql ?? sharedPglite;
+  const cwd = options.cwd;
   let captured = "";
   return {
     sql,
@@ -46,6 +74,8 @@ async function harness(cwd?: string): Promise<Harness> {
         sql,
         // Never inherit a real OKE_VAULT_MASTER_KEY from the developer's shell.
         env: {},
+        // `bun test` from a TTY must not block on the hidden master-key prompt.
+        stdinIsTTY: false,
         ...(cwd === undefined ? {} : { cwd }),
         write: (text) => {
           captured += text;
@@ -55,7 +85,7 @@ async function harness(cwd?: string): Promise<Harness> {
     reset: () => {
       captured = "";
     },
-    close: () => sql.close(),
+    close: () => (injected ? sql.close() : Promise.resolve()),
   };
 }
 
@@ -84,7 +114,8 @@ async function attach(sql: SqlConnection, masterKey: string): Promise<BuiltinVau
 
 describe("oke vault — builtin lifecycle", () => {
   test("init prints the master key once and status reflects seal state", async () => {
-    const h = await harness();
+    // Logic-only: seal-state + init CLI copy — no Postgres dialect under test.
+    const h = await harness({ sql: createMemoryVaultSql() });
     try {
       // A never-initialized vault reports rather than crashes.
       expect(await h.run(["status"])).toBe(0);
@@ -121,7 +152,7 @@ describe("oke vault — builtin lifecycle", () => {
   });
 
   test("unseal requires a key and seal records the transition", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());
@@ -149,7 +180,7 @@ describe("oke vault — builtin lifecycle", () => {
 
 describe("oke vault rotate", () => {
   test("rotate re-encrypts the current value under a new version", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());
@@ -179,7 +210,7 @@ describe("oke vault rotate", () => {
   });
 
   test("rotate-master issues a new key and retires the old one", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const first = masterKeyFrom(h.output());
@@ -211,7 +242,7 @@ describe("oke vault rotate", () => {
 
 describe("oke vault audit", () => {
   test("lists rows, verifies the chain, and purges by date", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());
@@ -256,7 +287,7 @@ describe("oke vault audit", () => {
 describe("oke vault backup / restore", () => {
   test("round-trips every live secret through an encrypted bundle", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-vault-cli-"));
-    const h = await harness(dir);
+    const h = await harness({ cwd: dir });
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());
@@ -319,7 +350,7 @@ describe("oke vault help", () => {
 
 describe("oke vault secure master-key input", () => {
   test("unseal accepts --key - via injected stdin", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());
@@ -340,7 +371,7 @@ describe("oke vault secure master-key input", () => {
   });
 
   test("unseal accepts an injected interactive prompt", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());
@@ -367,7 +398,7 @@ describe("oke vault secure master-key input", () => {
 
 describe("oke vault purge-expired", () => {
   test("dry-run counts without deleting; live purge removes expired rows", async () => {
-    const h = await harness();
+    const h = await harness({});
     try {
       await h.run(["init"]);
       const masterKey = masterKeyFrom(h.output());

package/src/cli/vault-cmd.ts

@@ -59,6 +59,11 @@ export interface VaultCmdOptions {
    * `process.env`.
    */
   readonly env?: Readonly<Record<string, string | undefined>>;
+  /**
+   * Override stdin TTY detection (tests). Default: `process.stdin.isTTY`.
+   * Non-interactive runs must not block on a hidden master-key prompt.
+   */
+  readonly stdinIsTTY?: boolean;
   /**
    * Pre-opened SQL connection for the builtin loop. Injected by tests so a
    * sequence of subcommands shares one in-memory database; the CLI never
@@ -368,7 +373,7 @@ async function resolveMasterKey(
     return prompted.length > 0 ? prompted : null;
   }
   // Never block a non-interactive pipe waiting for a hidden prompt.
-  if (!process.stdin.isTTY) return null;
+  if (!(options.stdinIsTTY ?? Boolean(process.stdin.isTTY))) return null;
   const prompted = (
     await promptHidden("Enter current master key: ", { write: options.write })
   ).trim();
@@ -405,7 +410,7 @@ async function resolveNewMasterKey(
     const prompted = (await options.readSecret("Enter new master key: ")).trim();
     return prompted.length > 0 ? prompted : undefined;
   }
-  if (!process.stdin.isTTY) return undefined;
+  if (!(options.stdinIsTTY ?? Boolean(process.stdin.isTTY))) return undefined;
   const prompted = (await promptHidden("Enter new master key: ", { write: options.write })).trim();
   return prompted.length > 0 ? prompted : undefined;
 }
@@ -755,7 +760,8 @@ async function runVaultBackup(
     return 1;
   }
   const blob = await withVault(options, flags, key, (a) => a.exportBackup());
-  await Bun.write(resolve(cwd, file), blob);
+  const { writeBackupFileAtomic } = await import("../elements/vault/builtin-adapter.ts");
+  await writeBackupFileAtomic(resolve(cwd, file), blob);
   write(`oke vault: wrote ${blob.byteLength} encrypted byte(s) to ${file}\n`);
   return 0;
 }