okengine 0.2.6 → 0.2.8

package/src/config/index.ts

@@ -8,12 +8,15 @@
 /**
  * Environment role keys used in driver maps.
  *
- * - `dev` — local laptop (`oke dev`)
- * - `stack` — local server (`oke dev -s` / compose infra + host Bun)
+ * - `local` — laptop defaults (`oke dev` / `oke dev -l`)
+ * - `docker` — compose infra + host Bun (`oke dev -d`)
  * - `test` — automated tests
  * - `prod` — production deploy
  */
-export type ConfigEnv = "dev" | "stack" | "test" | "prod";
+export type ConfigEnv = "local" | "docker" | "test" | "prod";
+
+/** Legacy driver-map keys accepted during soft-compat migration. */
+type LegacyConfigEnv = "dev" | "stack";
 
 /** Pool options for SQL drivers. */
 export interface DriverPoolOptions {
@@ -38,6 +41,12 @@ export type DriverRef =
 /** Map of env → driver ref. */
 export type EnvDriverMap = Partial<Record<ConfigEnv, DriverRef>>;
 
+/**
+ * Raw map that may still use deprecated `dev` / `stack` keys.
+ * Normalized by {@link normalizeEnvDriverMap}.
+ */
+export type RawEnvDriverMap = Partial<Record<ConfigEnv | LegacyConfigEnv, DriverRef>>;
+
 /** Store facet driver maps. */
 export interface StoreDriversConfig {
   readonly sql?: EnvDriverMap;
@@ -92,9 +101,7 @@ export interface TenancyResolveContext {
 export interface TenancyConfig {
   readonly isolation?: "row" | "schema" | "database";
   /** Tenant resolver — opaque string id or function (Skyport). */
-  readonly resolve?:
-    | string
-    | ((ctx: TenancyResolveContext) => string | null | undefined);
+  readonly resolve?: string | ((ctx: TenancyResolveContext) => string | null | undefined);
 }
 
 /** Port overrides (defaults: app 6530 · console 6533 · mcp 6535). */
@@ -126,6 +133,42 @@ export interface RunsConfig {
  */
 export type PrivacyConfig = Readonly<Record<string, unknown>>;
 
+/**
+ * Domain schema sync via drizzle-kit (`oke db push|generate|migrate`).
+ *
+ * Distinct from `oke schema generate` (core/plugin stub tables).
+ */
+export interface DbConfig {
+  /**
+   * Auto-run `oke db push` when domain schema files change under `oke dev`
+   * (local mode only). Default `true`. Set `false` to opt out explicitly.
+   * Forced off for `docker` / `prod`.
+   */
+  readonly autoPush?: boolean;
+  /**
+   * Path to `drizzle.config.ts` (relative to project root).
+   * Default `"drizzle.config.ts"`.
+   */
+  readonly config?: string;
+  /**
+   * Abstract schema declare module (`store.schema.table` exports).
+   * When present, `oke db` emits Drizzle into {@link generated} before sync.
+   * Default `"src/schema.decl.ts"` (emit skipped if the file is absent).
+   */
+  readonly declare?: string;
+  /**
+   * Generated Drizzle schema path written from abstract decls.
+   * Default `"src/schema.generated.ts"`. Point `drizzle.config.ts` `schema`
+   * at this file when using the abstract path.
+   */
+  readonly generated?: string;
+  /**
+   * App entry used to collect live `.plug()` table contributions for emit.
+   * Default: `package.json` `okengine.entry` / `src/app.ts` (same as `oke start`).
+   */
+  readonly entry?: string;
+}
+
 /**
  * Application config returned by {@link defineConfig}.
  */
@@ -144,108 +187,209 @@ export interface OkeConfig {
    * Not the same key as `drivers.runs`.
    */
   readonly runs?: RunsConfig;
+  /**
+   * Domain Drizzle schema sync (`oke db …`). Not related to `oke schema`.
+   */
+  readonly db?: DbConfig;
   readonly topology?: "monolith" | "services";
   readonly ports?: PortsConfig;
   readonly console?: ConsoleConfig;
 }
 
 /**
- * Fill missing `stack` pins from `prod` (local server ≈ production protocols).
+ * Whether domain auto-DDL (`ensureFromMeta`) should run for this env.
+ *
+ * - `ensure` — `CREATE TABLE IF NOT EXISTS` on first touch (test / local opt-out)
+ * - `off` — migrations / `oke db push` own DDL (docker, prod, local+autoPush)
+ */
+export type DomainDdlMode = "ensure" | "off";
+
+/**
+ * Resolve domain DDL policy from env + `db.autoPush`.
+ *
+ * @param env - Active config env
+ * @param autoPush - Effective auto-push flag (default true)
+ */
+export function resolveDomainDdlMode(env: ConfigEnv, autoPush = true): DomainDdlMode {
+  if (env === "test") return "ensure";
+  if (env === "docker" || env === "prod") return "off";
+  return autoPush ? "off" : "ensure";
+}
+
+/** Whether a legacy-key deprecation warning was already emitted this process. */
+let legacyKeyWarned = false;
+
+/**
+ * Normalize deprecated `dev`/`stack` driver-map keys to `local`/`docker`.
+ *
+ * Emits a one-time stderr warning when legacy keys are present.
+ *
+ * @param raw - Env → driver map (possibly legacy keys)
+ */
+export function normalizeEnvDriverMap(
+  raw: RawEnvDriverMap | EnvDriverMap | undefined,
+): EnvDriverMap | undefined {
+  if (!raw) return undefined;
+  const hasLegacy =
+    (raw as RawEnvDriverMap).dev !== undefined || (raw as RawEnvDriverMap).stack !== undefined;
+  if (hasLegacy && !legacyKeyWarned) {
+    legacyKeyWarned = true;
+    console.warn(
+      "oke: driver map keys `dev`/`stack` are deprecated — use `local`/`docker` (run `oke upgrade`)",
+    );
+  }
+  const out: EnvDriverMap = { ...(raw as EnvDriverMap) };
+  const legacy = raw as RawEnvDriverMap;
+  if (legacy.local === undefined && legacy.dev !== undefined) {
+    out.local = legacy.dev;
+  }
+  if (legacy.docker === undefined && legacy.stack !== undefined) {
+    out.docker = legacy.stack;
+  }
+  delete (out as RawEnvDriverMap).dev;
+  delete (out as RawEnvDriverMap).stack;
+  return out;
+}
+
+/**
+ * Normalize every env map under a drivers block.
  *
- * Vault is the exception: `prod: "sops"` becomes `stack: "dotenv"` so
- * `oke dev -s` can read `.env.stack` without age keys.
+ * @param drivers - Drivers block
+ */
+export function normalizeDriversConfig(
+  drivers: DriversConfig | undefined,
+): DriversConfig | undefined {
+  if (!drivers) return undefined;
+  const store = drivers.store
+    ? {
+        ...drivers.store,
+        sql: normalizeEnvDriverMap(drivers.store.sql as RawEnvDriverMap),
+        kv: normalizeEnvDriverMap(drivers.store.kv as RawEnvDriverMap),
+        files: normalizeEnvDriverMap(drivers.store.files as RawEnvDriverMap),
+        index: normalizeEnvDriverMap(drivers.store.index as RawEnvDriverMap),
+      }
+    : undefined;
+  const channel = drivers.channel
+    ? {
+        ...drivers.channel,
+        email: normalizeEnvDriverMap(drivers.channel.email as RawEnvDriverMap),
+        sms: normalizeEnvDriverMap(drivers.channel.sms as RawEnvDriverMap),
+        whatsapp: normalizeEnvDriverMap(drivers.channel.whatsapp as RawEnvDriverMap),
+        push: normalizeEnvDriverMap(drivers.channel.push as RawEnvDriverMap),
+      }
+    : undefined;
+  return {
+    ...drivers,
+    ...(store !== undefined ? { store } : {}),
+    signal: normalizeEnvDriverMap(drivers.signal as RawEnvDriverMap),
+    clock: normalizeEnvDriverMap(drivers.clock as RawEnvDriverMap),
+    vault: normalizeEnvDriverMap(drivers.vault as RawEnvDriverMap),
+    ...(channel !== undefined ? { channel } : {}),
+    ai: normalizeEnvDriverMap(drivers.ai as RawEnvDriverMap),
+    runs: normalizeEnvDriverMap(drivers.runs as RawEnvDriverMap),
+  };
+}
+
+/**
+ * Fill missing `docker` pins from `prod` (compose infra ≈ production protocols).
+ *
+ * Vault is the exception: `prod: "sops"` becomes `docker: "dotenv"` so
+ * `oke dev -d` can read `docker/.env.docker` without age keys.
  *
  * @param map - Env → driver map
  * @param options - Element-specific defaults
  */
-export function fillStackFromProd(
+export function fillDockerFromProd(
   map: EnvDriverMap | undefined,
   options: { readonly vault?: boolean } = {},
 ): EnvDriverMap | undefined {
   if (!map) return undefined;
-  if (map.stack !== undefined || map.prod === undefined) return map;
+  if (map.docker !== undefined || map.prod === undefined) return map;
   if (options.vault) {
     const prodId = typeof map.prod === "string" ? map.prod : map.prod.driver;
     if (prodId === "sops") {
-      return { ...map, stack: "dotenv" };
+      return { ...map, docker: "dotenv" };
     }
   }
-  return { ...map, stack: map.prod };
+  return { ...map, docker: map.prod };
 }
 
 /**
- * Copy production driver pins onto `stack` wherever `stack` is omitted.
+ * Copy production driver pins onto `docker` wherever `docker` is omitted.
  *
  * @param drivers - Drivers block
  */
-export function fillDriversStackFromProd(
+export function fillDriversDockerFromProd(
   drivers: DriversConfig | undefined,
 ): DriversConfig | undefined {
   if (!drivers) return undefined;
   const store = drivers.store
     ? {
         ...drivers.store,
-        sql: fillStackFromProd(drivers.store.sql),
-        kv: fillStackFromProd(drivers.store.kv),
-        files: fillStackFromProd(drivers.store.files),
-        index: fillStackFromProd(drivers.store.index),
+        sql: fillDockerFromProd(drivers.store.sql),
+        kv: fillDockerFromProd(drivers.store.kv),
+        files: fillDockerFromProd(drivers.store.files),
+        index: fillDockerFromProd(drivers.store.index),
       }
     : undefined;
   const channel = drivers.channel
     ? {
         ...drivers.channel,
-        email: fillStackFromProd(drivers.channel.email),
-        sms: fillStackFromProd(drivers.channel.sms),
-        whatsapp: fillStackFromProd(drivers.channel.whatsapp),
-        push: fillStackFromProd(drivers.channel.push),
+        email: fillDockerFromProd(drivers.channel.email),
+        sms: fillDockerFromProd(drivers.channel.sms),
+        whatsapp: fillDockerFromProd(drivers.channel.whatsapp),
+        push: fillDockerFromProd(drivers.channel.push),
       }
     : undefined;
   return {
     ...drivers,
     ...(store !== undefined ? { store } : {}),
-    signal: fillStackFromProd(drivers.signal),
-    clock: fillStackFromProd(drivers.clock),
-    vault: fillStackFromProd(drivers.vault, { vault: true }),
+    signal: fillDockerFromProd(drivers.signal),
+    clock: fillDockerFromProd(drivers.clock),
+    vault: fillDockerFromProd(drivers.vault, { vault: true }),
     ...(channel !== undefined ? { channel } : {}),
-    ai: fillStackFromProd(drivers.ai),
-    runs: fillStackFromProd(drivers.runs),
+    ai: fillDockerFromProd(drivers.ai),
+    runs: fillDockerFromProd(drivers.runs),
   };
 }
 
 /**
  * Define an `oke.config.ts` document.
  *
- * Missing `stack` driver pins are filled from `prod` so `oke dev -s` uses the
- * same server protocols as production (vault → dotenv for `.env.stack`).
+ * Missing `docker` driver pins are filled from `prod` so `oke dev -d` uses the
+ * same server protocols as production (vault → dotenv for `docker/.env.docker`).
+ * Legacy `dev`/`stack` keys are normalized to `local`/`docker`.
  *
  * @param config - Driver / tenancy / i18n / topology
  */
 export function defineConfig(config: OkeConfig): OkeConfig {
   if (!config.drivers) return config;
+  const normalized = normalizeDriversConfig(config.drivers);
   return {
     ...config,
-    drivers: fillDriversStackFromProd(config.drivers),
+    drivers: fillDriversDockerFromProd(normalized),
   };
 }
 
 /**
  * Resolve a driver id for an env from an {@link EnvDriverMap}.
  *
- * `stack` falls back to `prod` then `dev` so existing configs keep working
- * until an explicit `stack:` pin is added.
+ * `docker` falls back to `prod` then `local` so existing configs keep working
+ * until an explicit `docker:` pin is added. Legacy keys are normalized first.
  *
  * @param map - Env → driver map
  * @param env - Active environment
  */
 export function resolveDriverId(
-  map: EnvDriverMap | undefined,
+  map: EnvDriverMap | RawEnvDriverMap | undefined,
   env: ConfigEnv,
 ): string | undefined {
   if (!map) return undefined;
+  const normalized = normalizeEnvDriverMap(map as RawEnvDriverMap) ?? map;
   const ref =
-    env === "stack"
-      ? (map.stack ?? map.prod ?? map.dev ?? map.test)
-      : (map[env] ?? map.dev ?? map.test);
+    env === "docker"
+      ? (normalized.docker ?? normalized.prod ?? normalized.local ?? normalized.test)
+      : (normalized[env] ?? normalized.local ?? normalized.test);
   if (ref === undefined) return undefined;
   return typeof ref === "string" ? ref : ref.driver;
 }

package/src/config/resolve-driver.test.ts

@@ -1,30 +1,41 @@
 /**
- * Driver map resolution — including `stack` → prod fallback.
+ * Driver map resolution — including `docker` → prod fallback.
  */
 
 import { describe, expect, test } from "bun:test";
-import { resolveDriverId } from "./index.ts";
+import { resolveDomainDdlMode, resolveDriverId } from "./index.ts";
+
+describe("resolveDomainDdlMode", () => {
+  test("test keeps ensure; docker/prod always off", () => {
+    expect(resolveDomainDdlMode("test", true)).toBe("ensure");
+    expect(resolveDomainDdlMode("docker", true)).toBe("off");
+    expect(resolveDomainDdlMode("prod", true)).toBe("off");
+  });
+
+  test("local follows autoPush", () => {
+    expect(resolveDomainDdlMode("local", true)).toBe("off");
+    expect(resolveDomainDdlMode("local", false)).toBe("ensure");
+  });
+});
 
 describe("resolveDriverId", () => {
   test("reads the named env key", () => {
-    expect(
-      resolveDriverId({ dev: "sqlite", prod: "postgres" }, "dev"),
-    ).toBe("sqlite");
-    expect(
-      resolveDriverId({ dev: "sqlite", prod: "postgres" }, "prod"),
-    ).toBe("postgres");
+    expect(resolveDriverId({ local: "sqlite", prod: "postgres" }, "local")).toBe("sqlite");
+    expect(resolveDriverId({ local: "sqlite", prod: "postgres" }, "prod")).toBe("postgres");
   });
 
-  test("stack prefers stack, then prod, then dev", () => {
-    expect(
-      resolveDriverId(
-        { dev: "sqlite", stack: "postgres", prod: "postgres" },
-        "stack",
-      ),
-    ).toBe("postgres");
+  test("docker prefers docker, then prod, then local", () => {
     expect(
-      resolveDriverId({ dev: "sqlite", prod: "postgres" }, "stack"),
+      resolveDriverId({ local: "sqlite", docker: "postgres", prod: "postgres" }, "docker"),
     ).toBe("postgres");
-    expect(resolveDriverId({ dev: "sqlite" }, "stack")).toBe("sqlite");
+    expect(resolveDriverId({ local: "sqlite", prod: "postgres" }, "docker")).toBe("postgres");
+    expect(resolveDriverId({ local: "sqlite" }, "docker")).toBe("sqlite");
+  });
+
+  test("legacy keys resolve after normalize", () => {
+    expect(resolveDriverId({ dev: "sqlite", stack: "postgres" } as never, "local")).toBe("sqlite");
+    expect(resolveDriverId({ dev: "sqlite", stack: "postgres" } as never, "docker")).toBe(
+      "postgres",
+    );
   });
 });

package/src/console/budget.test.ts

@@ -32,10 +32,7 @@ describe("console bundle budget", () => {
       console.log(
         "other (not initial, not panel-*):\n" +
           breakdown.other
-            .map(
-              (a) =>
-                `  ${a.name}: ${a.gzip} (${(a.gzip / 1024).toFixed(2)} kB)`,
-            )
+            .map((a) => `  ${a.name}: ${a.gzip} (${(a.gzip / 1024).toFixed(2)} kB)`)
             .join("\n"),
       );
     }

package/src/console/index.ts

@@ -37,7 +37,4 @@ export {
   type ConsoleServerHandle,
   type ServeConsoleOptions,
 } from "./server/serve.ts";
-export {
-  createConsoleState,
-  type ConsoleState,
-} from "./server/state.ts";
+export { createConsoleState, type ConsoleState } from "./server/state.ts";

package/src/console/server/access.test.ts

@@ -126,26 +126,14 @@ describe("projectAccessPanel", () => {
     expect(projection.userPlane.operators).toBeUndefined();
 
     // Cross-plane scopes absent from grantable lists.
-    expect(
-      projection.operatorPlane.grantableScopes.every((s) =>
-        s.startsWith("console:"),
-      ),
-    ).toBe(true);
-    expect(
-      projection.userPlane.grantableScopes.every(
-        (s) => !s.startsWith("console:"),
-      ),
-    ).toBe(true);
-
-    expect(projection.hygiene.unusedKeys.some((k) => k.id === "key_stale")).toBe(
+    expect(projection.operatorPlane.grantableScopes.every((s) => s.startsWith("console:"))).toBe(
       true,
     );
-    expect(
-      projection.hygiene.neverSignedInOperators.some((o) => o.id === "op_never"),
-    ).toBe(true);
-    expect(
-      projection.hygiene.expiredInvitations.some((i) => i.id === "inv1"),
-    ).toBe(true);
+    expect(projection.userPlane.grantableScopes.every((s) => !s.startsWith("console:"))).toBe(true);
+
+    expect(projection.hygiene.unusedKeys.some((k) => k.id === "key_stale")).toBe(true);
+    expect(projection.hygiene.neverSignedInOperators.some((o) => o.id === "op_never")).toBe(true);
+    expect(projection.hygiene.expiredInvitations.some((i) => i.id === "inv1")).toBe(true);
   });
 
   test("scope not held is not grantable (absence, not refusal)", () => {
@@ -163,12 +151,8 @@ describe("projectAccessPanel", () => {
       now: () => 0,
     });
     expect(projection.userPlane.grantableScopes).not.toContain("booking:create");
-    expect(projection.operatorPlane.grantableScopes).toContain(
-      "console:store.sql:read",
-    );
-    expect(projection.operatorPlane.grantableScopes).not.toContain(
-      "console:store.sql:write",
-    );
+    expect(projection.operatorPlane.grantableScopes).toContain("console:store.sql:read");
+    expect(projection.operatorPlane.grantableScopes).not.toContain("console:store.sql:write");
   });
 });
 
@@ -266,9 +250,7 @@ describe("keyBlastRadius", () => {
     expect(blast.lastUsedAt).toBe(200);
     expect(blast.sourceAddresses).toEqual(["198.51.100.7", "203.0.113.10"]);
     expect(blast.accessTtlMs).toBe(ttl);
-    expect(blast.residualAccessNote).toBe(
-      residualAccessNote(ttl),
-    );
+    expect(blast.residualAccessNote).toBe(residualAccessNote(ttl));
     expect(blast.residualAccessNote).toContain("7 minute");
   });
 });
@@ -331,22 +313,16 @@ describe("accessCreateKey / revoke", () => {
 
 describe("helpers", () => {
   test("expandAccessCeiling adds application scopes for console:*", () => {
-    const held = expandAccessCeiling(["console:*"], [
-      "console:store.sql:read",
-      "booking:create",
-    ]);
+    const held = expandAccessCeiling(["console:*"], ["console:store.sql:read", "booking:create"]);
     expect(held.has("console:store.sql:read")).toBe(true);
     expect(held.has("booking:create")).toBe(true);
   });
 
   test("isKeyUnused90d", () => {
     const now = () => 1_000_000 + KEY_UNUSED_MS;
-    expect(
-      isKeyUnused90d(
-        { createdAt: 1_000_000, lastUsedAt: null, revokedAt: null },
-        now,
-      ),
-    ).toBe(true);
+    expect(isKeyUnused90d({ createdAt: 1_000_000, lastUsedAt: null, revokedAt: null }, now)).toBe(
+      true,
+    );
     expect(
       isKeyUnused90d(
         {
@@ -360,11 +336,7 @@ describe("helpers", () => {
   });
 
   test("residualAccessNote uses config TTL, not a hardcoded 14", () => {
-    expect(residualAccessNote(60_000)).toBe(
-      "Existing access may continue up to 1 minute",
-    );
-    expect(residualAccessNote(90_000)).toBe(
-      "Existing access may continue up to 2 minutes",
-    );
+    expect(residualAccessNote(60_000)).toBe("Existing access may continue up to 1 minute");
+    expect(residualAccessNote(90_000)).toBe("Existing access may continue up to 2 minutes");
   });
 });

package/src/console/server/access.ts

@@ -180,9 +180,7 @@ export interface ProjectAccessOptions {
  *
  * @param options - Auth stores + actor ceiling
  */
-export function projectAccessPanel(
-  options: ProjectAccessOptions,
-): AccessPanelProjection {
+export function projectAccessPanel(options: ProjectAccessOptions): AccessPanelProjection {
   const now = options.now ?? (() => Date.now());
   const accessTtlMs = options.accessTtlMs ?? ACCESS_TTL_MS;
   const catalog = options.manifest
@@ -269,9 +267,7 @@ export function effectivePermissions(options: {
         .sort((a, b) => a.localeCompare(b))
         .map((scope) => ({
           scope,
-          sources: [
-            { kind: "direct" as const, id: key.id, name: key.name },
-          ],
+          sources: [{ kind: "direct" as const, id: key.id, name: key.name }],
         })),
     };
   }
@@ -288,9 +284,7 @@ export function effectivePermissions(options: {
       plane: role.plane,
       scopes: scopes.map((scope) => ({
         scope,
-        sources: [
-          { kind: "role" as const, id: role.id, name: role.name },
-        ],
+        sources: [{ kind: "role" as const, id: role.id, name: role.name }],
       })),
     };
   }
@@ -318,9 +312,7 @@ export function effectivePermissions(options: {
     if (covered.has(scope)) continue;
     scopes.push({
       scope,
-      sources: [
-        { kind: "direct" as const, id: identity.id, name: identity.name },
-      ],
+      sources: [{ kind: "direct" as const, id: identity.id, name: identity.name }],
     });
   }
   scopes.sort((a, b) => a.scope.localeCompare(b.scope));
@@ -412,9 +404,7 @@ export async function accessCreateKey(
   for (const scope of input.scopes) {
     if (!allowed.has(scope)) {
       assertAttenuated(held, [scope], "api key");
-      throw new AccessGrantError(
-        `scope ${scope} is not grantable on the ${input.plane} plane`,
-      );
+      throw new AccessGrantError(`scope ${scope} is not grantable on the ${input.plane} plane`);
     }
   }
   const created = await createApiKey(store, {
@@ -461,9 +451,7 @@ export function accessSetRoleGrants(options: {
   );
   for (const scope of options.scopes) {
     if (!allowed.has(scope)) {
-      throw new AccessGrantError(
-        `scope ${scope} is not grantable on the ${role.plane} plane`,
-      );
+      throw new AccessGrantError(`scope ${scope} is not grantable on the ${role.plane} plane`);
     }
   }
   setRoleGrants(options.roles, options.roleId, options.scopes);
@@ -565,15 +553,13 @@ export function expandAccessCeiling(
   return out;
 }
 
-function projectOperators(
-  options: ProjectAccessOptions,
-): AccessOperatorRow[] {
+function projectOperators(options: ProjectAccessOptions): AccessOperatorRow[] {
   const rows: AccessOperatorRow[] = [];
   for (const op of options.operators.operators.values()) {
     const roleIds = options.operators.roles.get(op.id) ?? [];
-    const scopes = [
-      ...scopesForRoles(options.roles, roleIds, "operator"),
-    ].sort((a, b) => a.localeCompare(b));
+    const scopes = [...scopesForRoles(options.roles, roleIds, "operator")].sort((a, b) =>
+      a.localeCompare(b),
+    );
     rows.push({
       id: op.id,
       email: op.email,
@@ -592,12 +578,10 @@ function projectUsers(options: ProjectAccessOptions): AccessUserRow[] {
   return options.identities
     .map((identity) => {
       const roleIds = roleIdsForMember(options.roleMembers, identity.id);
-      const fromRoles = [
-        ...scopesForRoles(options.roles, roleIds, "user"),
-      ];
-      const scopes = [
-        ...new Set([...fromRoles, ...identity.scopes]),
-      ].sort((a, b) => a.localeCompare(b));
+      const fromRoles = [...scopesForRoles(options.roles, roleIds, "user")];
+      const scopes = [...new Set([...fromRoles, ...identity.scopes])].sort((a, b) =>
+        a.localeCompare(b),
+      );
       return {
         id: identity.id,
         email: identity.email,
@@ -618,19 +602,14 @@ function projectRoles(options: ProjectAccessOptions): AccessRoleRow[] {
       name: role.name,
       plane: role.plane,
       description: role.description,
-      scopes: [...(options.roles.grants.get(role.id) ?? [])].sort((a, b) =>
-        a.localeCompare(b),
-      ),
+      scopes: [...(options.roles.grants.get(role.id) ?? [])].sort((a, b) => a.localeCompare(b)),
       memberCount: options.roleMembers.get(role.id)?.length ?? 0,
     });
   }
   return rows.sort((a, b) => a.name.localeCompare(b.name));
 }
 
-function projectKeys(
-  options: ProjectAccessOptions,
-  now: () => number,
-): AccessKeyRow[] {
+function projectKeys(options: ProjectAccessOptions, now: () => number): AccessKeyRow[] {
   const rows: AccessKeyRow[] = [];
   for (const key of options.apiKeys.keys.values()) {
     rows.push(toKeyRow(key, now));
@@ -638,10 +617,7 @@ function projectKeys(
   return rows.sort((a, b) => a.name.localeCompare(b.name));
 }
 
-function projectInvites(
-  options: ProjectAccessOptions,
-  now: () => number,
-): AccessInviteRow[] {
+function projectInvites(options: ProjectAccessOptions, now: () => number): AccessInviteRow[] {
   const rows: AccessInviteRow[] = [];
   for (const invite of options.invites.invites.values()) {
     rows.push({
@@ -714,10 +690,7 @@ function provenanceForRoles(
   roleIds: readonly string[],
   plane: "user" | "operator",
 ): AccessScopeProvenance[] {
-  const byScope = new Map<
-    string,
-    { kind: "role"; id: string; name: string }[]
-  >();
+  const byScope = new Map<string, { kind: "role"; id: string; name: string }[]>();
   for (const roleId of roleIds) {
     const role = roles.roles.get(roleId);
     if (!role || role.plane !== plane) continue;
@@ -762,10 +735,7 @@ function sourceAddressOf(run: WideEvent): string | null {
   return null;
 }
 
-function collectCatalogFromStores(
-  roles: RoleStore,
-  apiKeys: ApiKeyStore,
-): string[] {
+function collectCatalogFromStores(roles: RoleStore, apiKeys: ApiKeyStore): string[] {
   const set = new Set<string>();
   for (const grants of roles.grants.values()) {
     for (const g of grants) set.add(g);