okengine 0.17.2 → 0.18.3

package/src/drivers/postgres.ts

@@ -122,8 +122,25 @@ export function toPostgresParams(sql: string, values: readonly unknown[] = []):
 export async function connectPostgres(options: SqlConnectOptions = {}): Promise<SqlConnection> {
   const role = options.role ?? "primary";
   const injected = options.client as PostgresClientLike | undefined;
-  const client = injected ?? sharedPostgresClient(options.url);
-  return wrapPostgresClient(client, role, { shared: injected === undefined });
+  // Dedicated single-connection client (pool.max === 1): workloads that hold
+  // manual transaction state across many statements (e.g. vault rotateMaster)
+  // must not share a pooled client — Bun raises ERR_POSTGRES_UNSAFE_TRANSACTION
+  // when raw statements interleave with open transaction state on the shared
+  // pool. Opt in explicitly; default behavior is unchanged.
+  const dedicated = !injected && options.pool?.max === 1;
+  const client =
+    injected ??
+    (dedicated
+      ? dedicatedPostgresClient(resolvePostgresUrl(options.url))
+      : sharedPostgresClient(options.url));
+  return wrapPostgresClient(client, role, {
+    shared: injected === undefined && !dedicated,
+  });
+}
+
+/** Standalone one-connection Bun.SQL client — closed with its SqlConnection. */
+function dedicatedPostgresClient(url: string): PostgresClientLike {
+  return new Bun.SQL(url, { max: 1 }) as unknown as PostgresClientLike;
 }
 
 /**
@@ -266,6 +283,32 @@ export function createPostgresFakeClient(): PostgresClientLike & {
         return [{ [retCol]: next }];
       }
 
+      // CTE-shaped atomic increment with jsonb image capture:
+      // WITH __oke_old AS (SELECT "pk" FROM t WHERE "pk" = ? FOR UPDATE)
+      //   UPDATE t SET "col" = "col" + ? FROM __oke_old
+      //   WHERE t."pk" = __oke_old."pk"
+      //   RETURNING row_to_json(t) AS __oke_after_data, "col"
+      const cteIncrement =
+        /^WITH\s+__oke_old\s+AS\s+\(SELECT\s+("?[\w]+"?)\s+FROM\s+("?[\w]+"?)\s+WHERE\s+"?[\w]+"?\s*=\s*\?\s+FOR\s+UPDATE\)\s+UPDATE\s+("?[\w]+"?)\s+SET\s+("?[\w]+"?)\s*=\s*("?[\w]+"?)\s*\+\s*\?\s+FROM\s+__oke_old\s+WHERE\s+("?[\w]+")\."?[\w]+"?\s*=\s*__oke_old\."?[\w]+"?\s+RETURNING\s+row_to_json\(("?[\w]+")\)\s+AS\s+__oke_after_data,\s*("?[\w]+"?)\s*$/i.exec(
+          normalised,
+        );
+      if (cteIncrement) {
+        const whereTable = parseIdent(cteIncrement[2]!);
+        const updateTable = parseIdent(cteIncrement[3]!);
+        const setCol = parseIdent(cteIncrement[4]!);
+        const addCol = parseIdent(cteIncrement[5]!);
+        const retCol = parseIdent(cteIncrement[8]!);
+        if (whereTable !== updateTable || setCol !== addCol || setCol !== retCol) {
+          throw new Error(`postgres fake: unsupported SQL: ${sql}`);
+        }
+        const list = tables.get(updateTable) ?? [];
+        const row = list.find((r) => r[parseIdent(cteIncrement[1]!)] === values[0]);
+        if (!row) return [];
+        const next = Number(row[setCol] ?? 0) + Number(values[1]);
+        row[setCol] = next;
+        return [{ __oke_after_data: { ...row }, [retCol]: next }];
+      }
+
       const insertReturning =
         /^INSERT\s+INTO\s+("?[a-zA-Z_][a-zA-Z0-9_]*"?)\s*\(([^)]+)\)\s*VALUES\s*\(([^)]+)\)\s*RETURNING\s+\*\s*$/i.exec(
           normalised,

package/src/drivers/signal-postgres.ts

@@ -7,6 +7,7 @@
 
 import type { SignalDecl } from "../elements/signal/declare.ts";
 import type { SignalDelivery } from "../manifest/types.ts";
+import { okid } from "../okid.ts";
 import { DryRunWriteIsolationError, setDryRunMessageId, withDryRun } from "../kernel/dry-run.ts";
 import { OkeError, OKE_ERRORS } from "../kernel/errors.ts";
 import { LIVE_RESUME_GAP } from "../kernel/errors-live-resume.ts";
@@ -607,7 +608,7 @@ export async function openPostgresSignal(options: SignalOpenOptions): Promise<Si
     await tx.exec(
       `INSERT INTO oke_signal_messages (id, signal, payload, ordering_key, delivery, attempts, failures, created_at, available_at, status, locked_by, lease_expires_at, delivered_to, parent_run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
-        crypto.randomUUID(),
+        okid(),
         signal,
         JSON.stringify(payload ?? null),
         orderingKey,

package/src/elements/channel/runtime.ts

@@ -175,7 +175,32 @@ export function createChannelRuntime(options: CreateChannelRuntimeOptions = {}):
   const catalog = options.catalog ?? {};
   const defaultLocale = options.defaultLocale ?? "en";
   const now = options.now ?? (() => Date.now());
-  const drivers = [...(options.drivers ?? [])];
+
+  /**
+   * One wire conversation per transport instance — sently transports are not
+   * safe for concurrent `send()` on the shared socket (interleaved SMTP DATA
+   * → "Unexpected SMTP response for DATA end"). Every driver handed to this
+   * runtime gets a serializing wrapper so concurrent flows queue instead of
+   * corrupting the connection.
+   */
+  function serializeTransport(t: ChannelDriver["transport"] & object): Transport {
+    let tail: Promise<unknown> = Promise.resolve();
+    return {
+      ...(t.provider !== undefined ? { provider: t.provider } : {}),
+      send(mail: Parameters<Transport["send"]>[0]): ReturnType<Transport["send"]> {
+        const run = tail.then(
+          () => t.send(mail),
+          () => t.send(mail),
+        );
+        tail = run.catch(() => undefined);
+        return run as ReturnType<Transport["send"]>;
+      },
+    } as Transport;
+  }
+
+  const drivers = [...(options.drivers ?? [])].map((d) =>
+    d.transport ? { ...d, transport: serializeTransport(d.transport) } : d,
+  );
 
   function resolveBody(
     template: string,
@@ -543,7 +568,9 @@ export function createChannelRuntime(options: CreateChannelRuntimeOptions = {}):
     let attempts: ChannelAttempt[];
 
     if (medium === "email" || (medium === "any" && chain.some((d) => d.transport))) {
-      const from = decl.from ?? "oke@localhost";
+      // Default sender must pass RFC/sently validation — `oke@localhost`
+      // (dotless) was rejected by every real SMTP transport after retries.
+      const from = decl.from ?? "oke@localhost.test";
       const sendResult = await sendViaEmailChain(chain, {
         from,
         to: opts.to,

package/src/elements/channel.test.ts

@@ -70,6 +70,58 @@ describe("channel declaration", () => {
 });
 
 describe("fallback chain records both attempts", () => {
+  test("default sender passes SMTP address validation (G13d fix)", async () => {
+    const seen: Array<string | undefined> = [];
+    const capturing = okTransport("smtp");
+    const base = capturing.send.bind(capturing);
+    const runtime = createChannelRuntime({
+      templates: [channel.email().template("no-from-declared")],
+      drivers: [
+        driverFromTransport("smtp", {
+          provider: "smtp",
+          async send(options: MailOptions) {
+            seen.push(addressToString(options.from));
+            return base(options);
+          },
+        }),
+      ],
+      catalog: { "no-from-declared": { en: { subject: "s", text: "t" } } },
+    });
+
+    const result = await runtime.send("no-from-declared", { to: "user@example.com" });
+    expect(result.ok).toBe(true);
+    // Dotless `oke@localhost` was rejected by sently address validation.
+    expect(seen[0]).toBe("oke@localhost.test");
+  });
+
+  test("concurrent sends serialize per transport — no wire interleave (G13d fix)", async () => {
+    let inside = 0;
+    let overlapped = false;
+    const serialTransport: Transport = {
+      provider: "smtp",
+      async send(options: MailOptions): Promise<SendResult> {
+        if (inside > 0) overlapped = true;
+        inside += 1;
+        await new Promise((r) => setTimeout(r, 5));
+        inside -= 1;
+        return okTransport("smtp").send(options);
+      },
+    };
+    const runtime = createChannelRuntime({
+      templates: [channel.email().template("bulk")],
+      drivers: [driverFromTransport("smtp", serialTransport)],
+      catalog: { bulk: { en: { subject: "s", text: "t" } } },
+    });
+
+    const results = await Promise.all(
+      Array.from({ length: 8 }, (_, i) =>
+        runtime.send("bulk", { to: `user${i}@example.com` }).then((r) => r.ok),
+      ),
+    );
+    expect(results.every(Boolean)).toBe(true);
+    expect(overlapped).toBe(false);
+  });
+
   test("failed then succeeded — both attempts on the receipt", async () => {
     const inbox = createChannelInbox();
     const runtime = createChannelRuntime({

package/src/elements/gate/boot.ts

@@ -28,7 +28,7 @@ export class GateBootError extends Error {
   constructor(gaps: readonly GatePostureGap[]) {
     const lines = gaps.map((g) => `  - ${g.flowId} ${g.method} ${g.path}`);
     super(
-      `gate boot failed — ${gaps.length} HTTP trigger(s) missing auth posture (attach a gate or .public()):\n${lines.join("\n")}`,
+      `gate boot failed — ${gaps.length} trigger(s) missing auth posture (attach a gate or .public()):\n${lines.join("\n")}`,
     );
     this.name = "GateBootError";
     this.gaps = gaps;
@@ -43,6 +43,13 @@ export interface HttpTriggerPosture {
   readonly gates: readonly (string | { readonly name: string })[];
 }
 
+/** Minimal MCP tool trigger shape for posture audit. */
+export interface McpTriggerPosture {
+  readonly kind: "mcp";
+  readonly name: string;
+  readonly gates: readonly (string | { readonly name: string })[];
+}
+
 /** Binding shape consumed by the audit. */
 export interface BindingPosture {
   readonly trigger: { readonly kind: string } & Omit<Partial<HttpTriggerPosture>, "kind">;
@@ -103,6 +110,26 @@ export function collectUnguardedHttpGaps(bindings: readonly BindingPosture[]): G
   return gaps;
 }
 
+/**
+ * Collect MCP tool triggers with neither a gate nor `.public()`.
+ *
+ * @param bindings - Adopted / registered bindings
+ */
+export function collectUnguardedMcpGaps(bindings: readonly BindingPosture[]): GatePostureGap[] {
+  const gaps: GatePostureGap[] = [];
+  for (const b of bindings) {
+    if (b.trigger.kind !== "mcp") continue;
+    const t = b.trigger as McpTriggerPosture;
+    if (hasHttpGatePosture(t.gates)) continue;
+    gaps.push({
+      flowId: b.flow.name,
+      method: "mcp",
+      path: t.name,
+    });
+  }
+  return gaps;
+}
+
 /**
  * Whether `unguardedHttp: "allow"` may skip the audit for this boot.
  * Hard-coded: only `env === "test"`.
@@ -131,6 +158,6 @@ export function assertHttpGatePosture(
   const opts: AssertHttpGatePostureOptions =
     typeof options === "string" ? { unguardedHttp: options } : options;
   if (unguardedHttpAllowActive(opts.unguardedHttp, opts.env)) return;
-  const gaps = collectUnguardedHttpGaps(bindings);
+  const gaps = [...collectUnguardedHttpGaps(bindings), ...collectUnguardedMcpGaps(bindings)];
   if (gaps.length > 0) throw new GateBootError(gaps);
 }

package/src/elements/store/emit-drizzle.ts

@@ -17,6 +17,7 @@ import {
   schemaTable,
   schemaTableSqlName,
   tablesFromExports,
+  type FieldTypeOptions,
   type RelationColumnRef,
   type SchemaColumnDecl,
   type SchemaColumnInput,
@@ -68,17 +69,21 @@ export function dialectFromDriverId(driverId: string | undefined): SqlDialect {
 /**
  * Serialize one column to a Drizzle builder chain.
  *
+ * Emits drizzle-exact calls for every {@link FieldSqlType}, carrying options
+ * (`length`, `precision`, `scale`, `withTimezone`, `mode`, `fields`,
+ * `enumValues`). Temporal modes are always pinned explicitly — rc.5 library
+ * defaults differ from OKE's (bare `date()` = string, bare `timestamp()` =
+ * Date).
+ *
+ * Postgres INTEGER is 32-bit; abstract `integer` (often ms clocks) → bigint.
+ * drizzle-orm's `bigint()` requires `{ mode }` — omitting it throws on
+ * `config.mode` when the generated schema is loaded by drizzle-kit push.
+ *
  * @param col - Column decl
  * @param dialect - Target dialect (affects import names only at file level)
  */
 export function emitColumnSource(col: SchemaColumnDecl, _dialect: SqlDialect = "postgres"): string {
-  // Postgres INTEGER is 32-bit; abstract `integer` (often ms clocks) → bigint.
-  // drizzle-orm's `bigint()` requires `{ mode }` — omitting it throws on
-  // `config.mode` when the generated schema is loaded by drizzle-kit push.
-  let expr =
-    col.sqlType === "integer"
-      ? `bigint(${JSON.stringify(col.sqlName)}, { mode: "number" })`
-      : `text(${JSON.stringify(col.sqlName)})`;
+  let expr = `${columnFactoryCall(col)}`;
   if (col.primaryKey) expr += ".primaryKey()";
   else if (col.notNull) expr += ".notNull()";
   if (col.unique) expr += ".unique()";
@@ -87,6 +92,8 @@ export function emitColumnSource(col: SchemaColumnDecl, _dialect: SqlDialect = "
   }
   if (col.defaultFnKind === "id") expr += ".$defaultFn(id)";
   else if (col.defaultFnKind === "now") expr += ".$defaultFn(now)";
+  else if (col.defaultFnKind === "nowIso") expr += ".$defaultFn(nowIso)";
+  else if (col.defaultFnKind === "nowDate") expr += ".$defaultFn(nowDate)";
   if (col.references) {
     const target = col.references.ref();
     const targetTable = exportNameForTable(target.tableName ?? "unknown");
@@ -104,8 +111,119 @@ export function emitColumnSource(col: SchemaColumnDecl, _dialect: SqlDialect = "
   return expr;
 }
 
-function literalSource(value: string | number | boolean | null): string {
+/** Factory call for a column type with its options, e.g. `varchar("x", { length: 256 })`. */
+function columnFactoryCall(col: SchemaColumnDecl): string {
+  const name = JSON.stringify(col.sqlName);
+  const o = col.typeOptions ?? {};
+  switch (col.sqlType) {
+    case "text":
+      return enumConfig(o) !== undefined
+        ? `text(${name}, { enum: ${JSON.stringify(o.enumValues)} })`
+        : `text(${name})`;
+    case "varchar":
+    case "char": {
+      const factory = col.sqlType;
+      const configParts: string[] = [];
+      if (o.length !== undefined) configParts.push(`length: ${o.length}`);
+      const enumValues = enumConfig(o);
+      if (enumValues !== undefined) configParts.push(`enum: ${enumValues}`);
+      return configParts.length > 0
+        ? `${factory}(${name}, { ${configParts.join(", ")} })`
+        : `${factory}(${name})`;
+    }
+    case "boolean":
+      return `boolean(${name})`;
+    case "smallint":
+      return `smallint(${name})`;
+    case "integer":
+      // Postgres INTEGER is 32-bit — abstract integer (ms clocks) widens.
+      return `bigint(${name}, { mode: "number" })`;
+    case "bigint":
+      return `bigint(${name}, { mode: ${JSON.stringify(o.mode ?? "number")} })`;
+    case "serial":
+      return `serial(${name})`;
+    case "smallserial":
+      return `smallserial(${name})`;
+    case "bigserial":
+      return `bigserial(${name}, { mode: ${JSON.stringify(o.mode ?? "number")} })`;
+    case "numeric": {
+      const configParts: string[] = [];
+      if (o.precision !== undefined) configParts.push(`precision: ${o.precision}`);
+      if (o.scale !== undefined) configParts.push(`scale: ${o.scale}`);
+      if (o.mode !== undefined && o.mode !== "string") {
+        configParts.push(`mode: ${JSON.stringify(o.mode)}`);
+      }
+      // rc.5 factory shape: numeric(name, config?) where the config is a
+      // discriminated union requiring at least one of precision/scale/mode.
+      return configParts.length > 0
+        ? `numeric(${name}, { ${configParts.join(", ")} })`
+        : `numeric(${name})`;
+    }
+    case "real":
+      return `real(${name})`;
+    case "doublePrecision":
+      return `doublePrecision(${name})`;
+    case "json":
+      return `json(${name})`;
+    case "jsonb":
+      return `jsonb(${name})`;
+    case "uuid":
+      return `uuid(${name})`;
+    case "time": {
+      const configParts: string[] = [];
+      if (o.withTimezone !== undefined) configParts.push(`withTimezone: ${o.withTimezone}`);
+      if (o.precision !== undefined) configParts.push(`precision: ${o.precision}`);
+      return configParts.length > 0
+        ? `time(${name}, { ${configParts.join(", ")} })`
+        : `time(${name})`;
+    }
+    case "timestamp": {
+      const configParts: string[] = [`mode: ${JSON.stringify(o.mode ?? "date")}`];
+      if (o.precision !== undefined) configParts.push(`precision: ${o.precision}`);
+      if (o.withTimezone !== undefined) configParts.push(`withTimezone: ${o.withTimezone}`);
+      return `timestamp(${name}, { ${configParts.join(", ")} })`;
+    }
+    case "date":
+      return `date(${name}, { mode: ${JSON.stringify(o.mode ?? "date")} })`;
+    case "interval": {
+      const configParts: string[] = [];
+      if (o.fields !== undefined) configParts.push(`fields: ${JSON.stringify(o.fields)}`);
+      if (o.precision !== undefined) configParts.push(`precision: ${o.precision}`);
+      return configParts.length > 0
+        ? `interval(${name}, { ${configParts.join(", ")} })`
+        : `interval(${name})`;
+    }
+    case "point":
+      return o.mode !== undefined && o.mode !== "tuple"
+        ? `point(${name}, { mode: ${JSON.stringify(o.mode)} })`
+        : `point(${name})`;
+    case "line":
+      return o.mode !== undefined && o.mode !== "tuple"
+        ? `line(${name}, { mode: ${JSON.stringify(o.mode)} })`
+        : `line(${name})`;
+    case "bytea":
+      return `bytea(${name})`;
+    case "inet":
+      return `inet(${name})`;
+    case "cidr":
+      return `cidr(${name})`;
+    case "macaddr":
+      return `macaddr(${name})`;
+    case "macaddr8":
+      return `macaddr8(${name})`;
+  }
+}
+
+function enumConfig(o: FieldTypeOptions): string | undefined {
+  if (!o.enumValues || o.enumValues.length === 0) return undefined;
+  return JSON.stringify(o.enumValues);
+}
+
+function literalSource(value: string | number | boolean | Date | Buffer | null): string {
   if (value === null) return "null";
+  if (value instanceof Date) return `new Date(${JSON.stringify(value.toISOString())})`;
+  if (Buffer.isBuffer(value))
+    return `Buffer.from(${JSON.stringify(value.toString("base64"))}, "base64")`;
   if (typeof value === "string") return JSON.stringify(value);
   if (typeof value === "boolean") return value ? "true" : "false";
   return String(value);
@@ -184,12 +302,18 @@ export function emitDrizzleSource(
   options: EmitDrizzleSourceOptions = {},
 ): string {
   void dialect;
-  const needsInteger = tables.some((t) =>
-    Object.values(t.columns).some((c) => c.sqlType === "integer"),
+  const usedFactories = new Set<string>();
+  for (const table of tables) {
+    for (const col of Object.values(table.columns)) {
+      // Abstract `integer` emits as drizzle `bigint` (32-bit widening).
+      usedFactories.add(col.sqlType === "integer" ? "bigint" : col.sqlType);
+    }
+  }
+  const pgIntImport = [...usedFactories].filter(
+    (name) => name !== "pgTable" && name !== "pgPolicy",
   );
-  const pgIntImport = needsInteger ? "bigint" : null;
   const needsPolicy = tables.some((t) => (t.policies?.length ?? 0) > 0);
-  const coreNames = ["pgTable", "text", pgIntImport, needsPolicy ? "pgPolicy" : null].filter(
+  const coreNames = ["pgTable", ...pgIntImport, needsPolicy ? "pgPolicy" : null].filter(
     (name): name is string => name !== null,
   );
   const coreImport = `import { ${coreNames.join(", ")} } from "drizzle-orm/pg-core";`;
@@ -201,9 +325,18 @@ export function emitDrizzleSource(
   const needsNow = tables.some((t) =>
     Object.values(t.columns).some((c) => c.defaultFnKind === "now"),
   );
-  const helperNames = [needsId ? "id" : null, needsNow ? "now" : null].filter(
-    (x): x is string => x !== null,
+  const needsNowIso = tables.some((t) =>
+    Object.values(t.columns).some((c) => c.defaultFnKind === "nowIso"),
+  );
+  const needsNowDate = tables.some((t) =>
+    Object.values(t.columns).some((c) => c.defaultFnKind === "nowDate"),
   );
+  const helperNames = [
+    needsId ? "id" : null,
+    needsNow ? "now" : null,
+    needsNowIso ? "nowIso" : null,
+    needsNowDate ? "nowDate" : null,
+  ].filter((x): x is string => x !== null);
   const helperImport =
     helperNames.length > 0 ? `import { ${helperNames.join(", ")} } from "okengine/store";\n` : "";
 

package/src/elements/store/field-ddl.test.ts

@@ -0,0 +1,118 @@
+/**
+ * Runtime auto-DDL across the widened field surface — `ensureFromMeta`
+ * creates tables with the new column types on memory + pglite drivers.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { memorySqlDriver } from "../../drivers/memory.ts";
+import { createSqlStoreHandle } from "./sql-session.ts";
+import { defineTable } from "./table.ts";
+import { resolveColumns } from "./table.ts";
+
+/** TableHandle carrying sqlType metadata for DDL (declare-site shape). */
+function typedTable(
+  name: string,
+  cols: Readonly<Record<string, string>>,
+): ReturnType<typeof defineTable> {
+  const base = defineTable(name, Object.fromEntries(Object.keys(cols).map((k) => [k, true])));
+  return {
+    ...base,
+    columns: Object.fromEntries(
+      Object.entries(base.columns).map(([k, v]) => [k, { ...v, sqlType: cols[k] }]),
+    ),
+  } as ReturnType<typeof defineTable>;
+}
+
+describe("ensureFromMeta — widened types", () => {
+  test("memory driver CREATEs boolean/jsonb/uuid/timestamp columns", async () => {
+    const conn = await memorySqlDriver.connect({ role: "primary" });
+    const handle = createSqlStoreHandle("sql:app", {
+      connection: conn,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "ensure",
+    });
+    const events = typedTable("events_wide", {
+      id: "uuid",
+      active: "boolean",
+      doc: "jsonb",
+      at: "timestamp",
+      day: "date",
+      amount: "numeric",
+      ratio: "doublePrecision",
+      big: "bigserial",
+      ip: "inet",
+      bin: "bytea",
+      loc: "point",
+    });
+
+    const cols = resolveColumns(events);
+    expect(cols.find((c) => c.sqlName === "active")!.sqlType).toBe("BOOLEAN");
+    expect(cols.find((c) => c.sqlName === "doc")!.sqlType).toBe("JSONB");
+
+    await handle.insert(events).values({
+      id: "e1",
+      active: true,
+      doc: JSON.stringify({ ok: 1 }),
+      at: "2026-01-01T00:00:00Z",
+      day: "2026-01-01",
+      amount: "10.50",
+      ratio: 0.25,
+      big: 7,
+      ip: "10.0.0.1",
+      bin: Buffer.from("x"),
+      loc: "[1,2]",
+    });
+
+    const rows = await handle.select().from(events);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({ id: "e1", active: true });
+    await conn.close();
+  });
+
+  test("pglite driver accepts unparameterized BIGINT / BOOLEAN / JSONB DDL", async () => {
+    let pglite: typeof import("../../drivers/pglite.ts");
+    try {
+      pglite = await import("../../drivers/pglite.ts");
+    } catch {
+      return; // driver optional in some environments
+    }
+    const conn = await pglite.pgliteDriver.connect({ role: "primary" }).catch(() => null);
+    if (!conn) return;
+    const handle = createSqlStoreHandle("sql:app", {
+      connection: conn,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "ensure",
+    });
+    const wide = typedTable("wide_pglite", {
+      id: "text",
+      n: "integer",
+      flag: "boolean",
+      payload: "jsonb",
+    });
+    // pglite data persists in-repo across runs — start from a clean table.
+    await conn.exec(`DROP TABLE IF EXISTS "wide_pglite"`);
+    await handle.insert(wide).values({ id: "r1", n: 5, flag: false, payload: '{"a":2}' });
+    const rows = await handle.select().from(wide);
+    expect(rows).toHaveLength(1);
+    await conn.close();
+  });
+
+  test("memory parser survives comma-free numeric DDL", async () => {
+    const conn = await memorySqlDriver.connect({ role: "primary" });
+    const handle = createSqlStoreHandle("sql:app", {
+      connection: conn,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "ensure",
+    });
+    // ddlTypeOf emits NUMERIC without parens — the memory CREATE TABLE parser
+    // comma-splits column defs, so numeric(p,s) would break it.
+    const rates = typedTable("rates_ddl", { id: "text", rate: "numeric" });
+    await handle.insert(rates).values({ id: "1", rate: "3.14" });
+    const rows = await handle.select().from(rates);
+    expect(rows[0]).toMatchObject({ id: "1", rate: "3.14" });
+    await conn.close();
+  });
+});