okengine 0.2.6 → 0.2.8

package/src/runtime/index.ts

@@ -2,12 +2,7 @@
  * Runtime adapters: Bun (primary) · Web Standards (Node / Deno / edge).
  */
 
-export {
-  createBunRuntime,
-  buildBunRoutes,
-  isBunNativePath,
-  type BunRuntime,
-} from "./bun.ts";
+export { createBunRuntime, buildBunRoutes, isBunNativePath, type BunRuntime } from "./bun.ts";
 
 export {
   createEnv,

package/src/runtime/primitives.ts

@@ -44,8 +44,8 @@ export function createTimers(): RuntimeTimers {
 export function createEnv(): RuntimeEnv {
   return {
     get(key) {
-      const bunEnv = (globalThis as { Bun?: { env?: Record<string, string | undefined> } })
-        .Bun?.env;
+      const bunEnv = (globalThis as { Bun?: { env?: Record<string, string | undefined> } }).Bun
+        ?.env;
       if (bunEnv && key in bunEnv) return bunEnv[key];
       const proc = (globalThis as { process?: { env?: Record<string, string | undefined> } })
         .process?.env;
@@ -70,8 +70,9 @@ export function createEnv(): RuntimeEnv {
 export function createFiles(): RuntimeFiles {
   return {
     async read(path) {
-      const bun = (globalThis as { Bun?: { file?(p: string): { arrayBuffer(): Promise<ArrayBuffer> } } })
-        .Bun;
+      const bun = (
+        globalThis as { Bun?: { file?(p: string): { arrayBuffer(): Promise<ArrayBuffer> } } }
+      ).Bun;
       if (bun?.file) {
         return new Uint8Array(await bun.file(path).arrayBuffer());
       }

package/src/runtime/security.ts

@@ -10,12 +10,7 @@
 import type { ServeOptions } from "./types.ts";
 
 /** Loopback names always accepted alongside the listen hostname. */
-const LOOPBACK_HOSTS: readonly string[] = [
-  "localhost",
-  "127.0.0.1",
-  "::1",
-  "[::1]",
-];
+const LOOPBACK_HOSTS: readonly string[] = ["localhost", "127.0.0.1", "::1", "[::1]"];
 
 /**
  * Build the effective allow-list: loopback + listen hostname + user extras.
@@ -76,10 +71,7 @@ export function normalizeHost(raw: string): string {
  * @param host - Normalized host
  * @param allowed - Allow-list
  */
-export function isHostAllowed(
-  host: string,
-  allowed: ReadonlySet<string>,
-): boolean {
+export function isHostAllowed(host: string, allowed: ReadonlySet<string>): boolean {
   if (host.length === 0) return false;
   if (allowed.has(host)) return true;
   // Bracketed IPv6 sibling
@@ -138,9 +130,7 @@ export function checkRequestSecurity(
 /** 403 body for a failed Host / Origin check. */
 export function forbiddenResponse(reason: "host" | "origin"): Response {
   const message =
-    reason === "host"
-      ? "Forbidden: unexpected Host header"
-      : "Forbidden: unexpected Origin header";
+    reason === "host" ? "Forbidden: unexpected Host header" : "Forbidden: unexpected Origin header";
   return new Response(message, {
     status: 403,
     headers: { "content-type": "text/plain; charset=utf-8" },

package/src/runtime/serve.test.ts

@@ -107,13 +107,10 @@ describe("Bun.serve — real HTTP", () => {
     expect(await direct.text()).toContain("Host");
 
     // On the wire — the DNS-rebinding shape (CVE-2025-66414 class).
-    const wire = await rawHttp(handle.port, [
-      "GET /ping HTTP/1.1",
-      "Host: attacker.com",
-      "Connection: close",
-      "",
-      "",
-    ].join("\r\n"));
+    const wire = await rawHttp(
+      handle.port,
+      ["GET /ping HTTP/1.1", "Host: attacker.com", "Connection: close", "", ""].join("\r\n"),
+    );
     expect(wire).toContain("403");
     expect(wire).toContain("Host");
   });

package/src/runtime/types.ts

@@ -151,10 +151,7 @@ export interface RuntimeCrypto {
    * @param password - Plaintext
    * @param algorithm - Hash algorithm (Bun default `argon2id`)
    */
-  hashPassword(
-    password: string,
-    algorithm?: PasswordAlgorithm,
-  ): Promise<string>;
+  hashPassword(password: string, algorithm?: PasswordAlgorithm): Promise<string>;
   /**
    * Verify a password against a hash from {@link RuntimeCrypto.hashPassword}.
    *

package/src/runtime/web-standard.ts

@@ -13,12 +13,7 @@
  * Host / Origin validation is identical to the Bun adapter (console §10.1).
  */
 
-import {
-  createEnv,
-  createFiles,
-  createTimers,
-  createWebCrypto,
-} from "./primitives.ts";
+import { createEnv, createFiles, createTimers, createWebCrypto } from "./primitives.ts";
 import { secureFetch } from "./security.ts";
 import {
   APP_PORT,
@@ -50,17 +45,10 @@ export function createWebStandardRuntime(): Runtime {
  * @param app - Application
  * @param options - Port/hostname metadata + `allowedHosts`
  */
-function createFetchHandle(
-  app: FetchApp,
-  options?: ServeOptions,
-): ServerHandle {
+function createFetchHandle(app: FetchApp, options?: ServeOptions): ServerHandle {
   const port = options?.port ?? APP_PORT;
   const hostname = options?.hostname ?? "127.0.0.1";
-  const fetchHandler = secureFetch(
-    (req) => app.fetch(req),
-    options,
-    hostname,
-  );
+  const fetchHandler = secureFetch((req) => app.fetch(req), options, hostname);
   const url = new URL(
     `http://${hostname.includes(":") && !hostname.startsWith("[") ? `[${hostname}]` : hostname}:${port}/`,
   );

package/src/term.test.ts

@@ -34,7 +34,7 @@ describe("term", () => {
     const out = formatDevBanner({
       color: false,
       version: "0.2.4",
-      profile: "local-server",
+      profile: "docker",
       runtimeEnv: "local",
       system: "darwin 25.4.0 · bun 1.3.14",
       elements: [
@@ -45,7 +45,7 @@ describe("term", () => {
     });
     expect(out).toContain("oke dev  v0.2.4");
     expect(out).toContain("profile");
-    expect(out).toContain("local-server");
+    expect(out).toContain("docker");
     expect(out).toContain("env");
     expect(out).toContain("local");
     expect(out).toContain("system");
@@ -62,9 +62,7 @@ describe("term", () => {
     expect(formatServiceLine("Console", "http://127.0.0.1:6533", false)).toContain(
       "http://127.0.0.1:6533",
     );
-    expect(formatAppReadyLine("http://127.0.0.1:6530", false)).toContain(
-      "http://127.0.0.1:6530",
-    );
+    expect(formatAppReadyLine("http://127.0.0.1:6530", false)).toContain("http://127.0.0.1:6530");
   });
 
   test("formatDevHero keeps App Console MCP URLs", () => {
@@ -137,7 +135,7 @@ describe("term", () => {
       appDrivers: ["postgres", "redis"],
       color: false,
     });
-    expect(out).toContain("Stack");
+    expect(out).toContain("Docker");
     expect(out).toContain(":15975");
     expect(out).not.toMatch(/\u001b\[/);
   });

package/src/term.ts

@@ -6,9 +6,7 @@
  */
 
 /** Whether ANSI color should be applied. */
-export function termColorEnabled(
-  stream: { readonly isTTY?: boolean } = process.stdout,
-): boolean {
+export function termColorEnabled(stream: { readonly isTTY?: boolean } = process.stdout): boolean {
   if (process.env["NO_COLOR"] !== undefined) return false;
   if (process.env["FORCE_COLOR"] === "0") return false;
   if (process.env["FORCE_COLOR"]) return true;
@@ -70,7 +68,7 @@ export type DevHeroElement = {
 
 /** Shared options for the `oke dev` hero / banner. */
 export type DevHeroMeta = {
-  /** `local` · `local-server` · `test` · `production` */
+  /** `local` · `docker` · `test` · `production` */
   readonly profile?: string;
   /** Data plane: `local` · `production` */
   readonly runtimeEnv?: string;
@@ -88,20 +86,20 @@ export type DevHeroMeta = {
  *
  * @param color - Color on/off
  */
-export function formatOkeWordmark(
-  color: boolean = termColorEnabled(),
-): string {
+export function formatOkeWordmark(color: boolean = termColorEnabled()): string {
   const s = termStyle(color);
   const ink = `${s.green}${s.bold}`;
   const r = s.reset;
-  return [
-    `${ink}   ██████╗ ██╗  ██╗███████╗${r}`,
-    `${ink}  ██╔═══██╗██║ ██╔╝██╔════╝${r}`,
-    `${ink}  ██║   ██║█████╔╝ █████╗  ${r}`,
-    `${ink}  ██║   ██║██╔═██╗ ██╔══╝  ${r}`,
-    `${ink}  ╚██████╔╝██║  ██╗███████╗${r}`,
-    `${ink}   ╚═════╝ ╚═╝  ╚═╝╚══════╝${r}`,
-  ].join("\n") + "\n";
+  return (
+    [
+      `${ink}   ██████╗ ██╗  ██╗███████╗${r}`,
+      `${ink}  ██╔═══██╗██║ ██╔╝██╔════╝${r}`,
+      `${ink}  ██║   ██║█████╔╝ █████╗  ${r}`,
+      `${ink}  ██║   ██║██╔═██╗ ██╔══╝  ${r}`,
+      `${ink}  ╚██████╔╝██║  ██╗███████╗${r}`,
+      `${ink}   ╚═════╝ ╚═╝  ╚═╝╚══════╝${r}`,
+    ].join("\n") + "\n"
+  );
 }
 
 /**
@@ -109,39 +107,27 @@ export function formatOkeWordmark(
  *
  * @param options - Snapshot fields from {@link import("./cli/hero-meta.ts").buildDevHeroSnapshot}
  */
-export function formatDevHeroDetails(
-  options: DevHeroMeta = {},
-): string {
+export function formatDevHeroDetails(options: DevHeroMeta = {}): string {
   const s = termStyle(options.color ?? termColorEnabled());
   const bar = `${s.dim}│${s.reset}`;
   const label = (name: string) => `${s.dim}${name.padEnd(9)}${s.reset}`;
   const lines: string[] = [];
   if (options.profile) {
-    lines.push(
-      `${bar}  ${label("profile")} ${s.cyan}${options.profile}${s.reset}`,
-    );
+    lines.push(`${bar}  ${label("profile")} ${s.cyan}${options.profile}${s.reset}`);
   }
   if (options.runtimeEnv) {
-    lines.push(
-      `${bar}  ${label("env")} ${s.cyan}${options.runtimeEnv}${s.reset}`,
-    );
+    lines.push(`${bar}  ${label("env")} ${s.cyan}${options.runtimeEnv}${s.reset}`);
   }
   if (options.system) {
-    lines.push(
-      `${bar}  ${label("system")} ${s.dim}${options.system}${s.reset}`,
-    );
+    lines.push(`${bar}  ${label("system")} ${s.dim}${options.system}${s.reset}`);
   }
   const elements = options.elements ?? [];
   if (elements.length > 0) {
     lines.push(`${bar}  ${s.dim}elements${s.reset}`);
     for (const row of elements) {
       const idle = row.detail === "—";
-      const detail = idle
-        ? `${s.dim}—${s.reset}`
-        : `${s.cyan}${row.detail}${s.reset}`;
-      lines.push(
-        `${bar}  ${s.dim}${row.element.padEnd(9)}${s.reset} ${detail}`,
-      );
+      const detail = idle ? `${s.dim}—${s.reset}` : `${s.cyan}${row.detail}${s.reset}`;
+      lines.push(`${bar}  ${s.dim}${row.element.padEnd(9)}${s.reset} ${detail}`);
     }
   }
   return lines.length > 0 ? `${lines.join("\n")}\n` : "";
@@ -164,9 +150,7 @@ export function formatDevBanner(options: DevHeroMeta = {}): string {
     `${s.green}◇${s.reset}  Starting`,
   ];
   if (options.watching !== false) {
-    lines.push(
-      `${bar}  ${s.dim}watching — client types regenerate on save${s.reset}`,
-    );
+    lines.push(`${bar}  ${s.dim}watching — client types regenerate on save${s.reset}`);
   }
   lines.push(formatDevHeroDetails(options).trimEnd());
   lines.push(bar);
@@ -196,10 +180,7 @@ export function formatServiceLine(
  * @param url - App base URL
  * @param color - Color on/off
  */
-export function formatAppReadyLine(
-  url: string,
-  color: boolean = termColorEnabled(),
-): string {
+export function formatAppReadyLine(url: string, color: boolean = termColorEnabled()): string {
   const s = termStyle(color);
   return `${s.green}●${s.reset}  ${s.dim}App${s.reset}      ${s.cyan}${url}${s.reset}\n`;
 }
@@ -245,9 +226,7 @@ export function formatDevHero(
  *
  * @param color - Color on/off
  */
-export function formatDevLogSeparator(
-  color: boolean = termColorEnabled(),
-): string {
+export function formatDevLogSeparator(color: boolean = termColorEnabled()): string {
   const s = termStyle(color);
   return (
     `${s.dim}│${s.reset}\n` +
@@ -263,10 +242,7 @@ export function formatDevLogSeparator(
  * @param message - Status text
  * @param color - Color on/off
  */
-export function formatStatusLine(
-  message: string,
-  color: boolean = termColorEnabled(),
-): string {
+export function formatStatusLine(message: string, color: boolean = termColorEnabled()): string {
   const s = termStyle(color);
   return `${s.dim}│${s.reset}  ${s.dim}${message}${s.reset}\n`;
 }
@@ -314,35 +290,24 @@ export function formatDevLogTime(at: Date = new Date()): string {
  *
  * @param options - Surface, method, path, flow, timing, status
  */
-export function formatRequestLine(
-  options: {
-    readonly surface: DevLogSurface;
-    readonly method: string;
-    readonly path: string;
-    readonly flow?: string;
-    readonly status: number;
-    readonly ms: number;
-    /** Instant for date/time columns (default now). */
-    readonly at?: Date;
-    readonly color?: boolean;
-  },
-): string {
+export function formatRequestLine(options: {
+  readonly surface: DevLogSurface;
+  readonly method: string;
+  readonly path: string;
+  readonly flow?: string;
+  readonly status: number;
+  readonly ms: number;
+  /** Instant for date/time columns (default now). */
+  readonly at?: Date;
+  readonly color?: boolean;
+}): string {
   const s = termStyle(options.color ?? termColorEnabled());
   const at = options.at ?? new Date();
   const date = formatDevLogDate(at);
   const time = formatDevLogTime(at);
   const surfaceColor =
-    options.surface === "App"
-      ? s.green
-      : options.surface === "Console"
-        ? s.magenta
-        : s.cyan;
-  const statusColor =
-    options.status >= 500
-      ? s.red
-      : options.status >= 400
-        ? s.yellow
-        : s.green;
+    options.surface === "App" ? s.green : options.surface === "Console" ? s.magenta : s.cyan;
+  const statusColor = options.status >= 500 ? s.red : options.status >= 400 ? s.yellow : s.green;
   const methodRaw = options.method.toUpperCase();
   const methodColor =
     methodRaw === "GET"
@@ -355,9 +320,7 @@ export function formatRequestLine(
             ? s.red
             : s.cyan;
   const method = methodRaw.padEnd(4);
-  const path = options.path.length > 28
-    ? `${options.path.slice(0, 27)}…`
-    : options.path.padEnd(28);
+  const path = options.path.length > 28 ? `${options.path.slice(0, 27)}…` : options.path.padEnd(28);
   const flow = (options.flow ?? "—").padEnd(22);
   const ms = `${options.ms}ms`.padStart(6);
   return (
@@ -378,34 +341,25 @@ export function formatRequestLine(
  *
  * @param options - Project name, services, driver labels
  */
-export function formatStackSummary(
-  options: {
-    readonly project: string;
-    readonly services: readonly StackSummaryService[];
-    /** Drivers the host app will use (e.g. `postgres`, `redis`). */
-    readonly appDrivers?: readonly string[];
-    readonly color?: boolean;
-  },
-): string {
+export function formatStackSummary(options: {
+  readonly project: string;
+  readonly services: readonly StackSummaryService[];
+  /** Drivers the host app will use (e.g. `postgres`, `redis`). */
+  readonly appDrivers?: readonly string[];
+  readonly color?: boolean;
+}): string {
   const s = termStyle(options.color ?? termColorEnabled());
   const bar = `${s.dim}│${s.reset}`;
   const pad = (label: string) => label.padEnd(8);
   const lines: string[] = [
-    `${s.green}◇${s.reset}  ${s.bold}Stack${s.reset}     ${s.cyan}${options.project}${s.reset}`,
+    `${s.green}◇${s.reset}  ${s.bold}Docker${s.reset}     ${s.cyan}${options.project}${s.reset}`,
   ];
   for (const svc of options.services) {
-    lines.push(
-      `${bar}  ${s.dim}${pad(svc.label)}${s.reset}  ${s.cyan}:${svc.hostPort}${s.reset}`,
-    );
+    lines.push(`${bar}  ${s.dim}${pad(svc.label)}${s.reset}  ${s.cyan}:${svc.hostPort}${s.reset}`);
   }
   const drivers = options.appDrivers ?? [];
-  const appDetail =
-    drivers.length > 0
-      ? `host Bun · ${drivers.join(" + ")}`
-      : "host Bun";
-  lines.push(
-    `${bar}  ${s.dim}${pad("app")}${s.reset}  ${s.dim}${appDetail}${s.reset}`,
-  );
+  const appDetail = drivers.length > 0 ? `host Bun · ${drivers.join(" + ")}` : "host Bun";
+  lines.push(`${bar}  ${s.dim}${pad("app")}${s.reset}  ${s.dim}${appDetail}${s.reset}`);
   lines.push(bar);
   return `${lines.join("\n")}\n`;
 }
@@ -416,10 +370,7 @@ export function formatStackSummary(
  * @param code - Hex claim code
  * @param color - Color on/off
  */
-export function formatClaimNote(
-  code: string,
-  color: boolean = termColorEnabled(),
-): string {
+export function formatClaimNote(code: string, color: boolean = termColorEnabled()): string {
   const s = termStyle(color);
   const bar = `${s.dim}│${s.reset}`;
   const title = "Claim code";

package/src/test/create-test-app.test.ts

@@ -96,19 +96,14 @@ describe("createTestApp — four-applications surface", () => {
     const u = await t.auth.loginAs({ scopes: ["order:create"] });
     expect(u.verified).toBe(true);
 
-    const { data, error } = await t.api.orders!.create!(
-      { sku: "COFFEE", qty: 2 },
-      { as: u },
-    );
+    const { data, error } = await t.api.orders!.create!({ sku: "COFFEE", qty: 2 }, { as: u });
     expect(error).toBeNull();
     expect(data).toMatchObject({ id: expect.any(String) });
 
     await t.signals.drain();
     const sent = t.channels.sent();
     expect(sent.length).toBeGreaterThanOrEqual(1);
-    expect(
-      sent.some((s) => "template" in s && s.template === "order-confirmed"),
-    ).toBe(true);
+    expect(sent.some((s) => "template" in s && s.template === "order-confirmed")).toBe(true);
 
     await t.clock.advance("2m");
     expect(await t.cron.run("expire-stale")).toBe(true);
@@ -116,9 +111,7 @@ describe("createTestApp — four-applications surface", () => {
     const events = await t.runs();
     expect(events.some((e) => e.flow === "orders.create")).toBe(true);
     const createRun = events.find((e) => e.flow === "orders.create")!;
-    expect(t.effects.of(createRun.id).some((e) => e.kind === "emit")).toBe(
-      true,
-    );
+    expect(t.effects.of(createRun.id).some((e) => e.kind === "emit")).toBe(true);
 
     await t.close();
   });
@@ -142,10 +135,7 @@ describe("createTestApp — vault gaps still fail boot", () => {
 
     try {
       await createTestApp(app, {
-        secrets: [
-          vault("A", { description: "alpha" }),
-          vault("B", { description: "beta" }),
-        ],
+        secrets: [vault("A", { description: "alpha" }), vault("B", { description: "beta" })],
         boot: {
           env: "prod",
           vault: { allowDevFallbacks: false, chain: [] },

package/src/test/create-test-app.ts

@@ -22,15 +22,8 @@ import {
   type ChannelInbox,
   type ChannelInboxEntry,
 } from "../drivers/index.ts";
-import {
-  createAiRuntime,
-  type AiPromptDecl,
-  type AiRuntime,
-} from "../elements/ai.ts";
-import {
-  createChannelRuntime,
-  type DeliveryReceipt,
-} from "../elements/channel.ts";
+import { createAiRuntime, type AiPromptDecl, type AiRuntime } from "../elements/ai.ts";
+import { createChannelRuntime, type DeliveryReceipt } from "../elements/channel.ts";
 import { createTestClockRuntime } from "../elements/clock.ts";
 import type { GateDecl } from "../elements/gate.ts";
 import type { SignalDecl } from "../elements/signal.ts";
@@ -199,16 +192,13 @@ export async function createTestApp<App extends OkeApp>(
     defaultLocale: "ar",
     ...(appOpts.channel ?? {}),
     ...(options.boot?.channel ?? {}),
-    drivers: options.boot?.channel?.drivers ?? [
-      openConsoleChannel({ inbox }),
-    ],
+    drivers: options.boot?.channel?.drivers ?? [openConsoleChannel({ inbox })],
     now: () => clock.now(),
   });
   const ai = createAiRuntime({
     ...(appOpts.ai ?? {}),
     ...(options.boot?.ai ?? {}),
-    defaultDriver:
-      options.boot?.ai?.defaultDriver ?? createMockAiDriver(mockResponses),
+    defaultDriver: options.boot?.ai?.defaultDriver ?? createMockAiDriver(mockResponses),
     now: () => clock.now(),
   });
 
@@ -353,9 +343,7 @@ function createTestApi(app: OkeApp, now: () => number): TestApi {
     opts?: TestCallOptions,
   ): Promise<{ data: unknown; error: FlowFailure["error"] | null }> => {
     const flowDef =
-      app.flow(`${unit}.${flowName}`) ??
-      app.flow(flowName) ??
-      findFlowByUnit(app, unit, flowName);
+      app.flow(`${unit}.${flowName}`) ?? app.flow(flowName) ?? findFlowByUnit(app, unit, flowName);
     if (!flowDef) {
       return {
         data: null,
@@ -369,9 +357,7 @@ function createTestApi(app: OkeApp, now: () => number): TestApi {
     const principal = toPrincipal(opts?.as);
     const httpTrigger = flowDef.triggers.find((t) => t.kind === "http");
     const trigger: Trigger =
-      httpTrigger ??
-      flowDef.triggers[0] ??
-      ({ kind: "internal" } satisfies InternalTrigger);
+      httpTrigger ?? flowDef.triggers[0] ?? ({ kind: "internal" } satisfies InternalTrigger);
 
     const result = await app.execute(flowDef, input, trigger, {
       principal,
@@ -400,8 +386,7 @@ function createTestApi(app: OkeApp, now: () => number): TestApi {
             if (typeof flowName !== "string" || flowName === "then") {
               return undefined;
             }
-            return (input?: unknown, opts?: TestCallOptions) =>
-              call(unit, flowName, input, opts);
+            return (input?: unknown, opts?: TestCallOptions) => call(unit, flowName, input, opts);
           },
         },
       );
@@ -409,11 +394,7 @@ function createTestApi(app: OkeApp, now: () => number): TestApi {
   });
 }
 
-function findFlowByUnit(
-  app: OkeApp,
-  unit: string,
-  flowName: string,
-): ReturnType<OkeApp["flow"]> {
+function findFlowByUnit(app: OkeApp, unit: string, flowName: string): ReturnType<OkeApp["flow"]> {
   // Prefer $routes unit.flow → full flow name from bindings.
   const routes = app.$routes as Record<
     string,
@@ -439,7 +420,10 @@ function findFlowByUnit(
     }
   }
   for (const b of app.bindings) {
-    if (b.flow.unit === unit && (b.flow.name === flowName || b.flow.name.endsWith(`.${flowName}`))) {
+    if (
+      b.flow.unit === unit &&
+      (b.flow.name === flowName || b.flow.name.endsWith(`.${flowName}`))
+    ) {
       return b.flow;
     }
     // Auto-named flows: match export-style via name suffix after adopt.
@@ -515,9 +499,7 @@ function matchRestHeuristic(
   return undefined;
 }
 
-function toPrincipal(
-  as: TestUser | ResolvedPrincipal | undefined,
-): ResolvedPrincipal | undefined {
+function toPrincipal(as: TestUser | ResolvedPrincipal | undefined): ResolvedPrincipal | undefined {
   if (!as) return undefined;
   if ("scopes" in as && as.scopes instanceof Set && "id" in as) {
     const u = as as TestUser;

package/src/test/provisions.integration.test.ts

@@ -22,9 +22,7 @@ describe("Provisions integration", () => {
     resetFlowSeq();
 
     const member = gate.policy("member", ({ auth }) => !!auth.verified);
-    const canOrder = gate.policy("order:create", ({ auth }) =>
-      auth.scopes.has("order:create"),
-    );
+    const canOrder = gate.policy("order:create", ({ auth }) => auth.scopes.has("order:create"));
     const stripeKey = vault("STRIPE_KEY", {
       description: "Payments gateway key",
       dev: "sk_test_local",
@@ -133,10 +131,7 @@ describe("Provisions integration", () => {
     expect(denied.error?.code).toBe("Unauthorized");
 
     const u = await t.auth.loginAs({ scopes: ["order:create"] });
-    const { data, error } = await t.api.orders!.create!(
-      { sku: "COFFEE", qty: 2 },
-      { as: u },
-    );
+    const { data, error } = await t.api.orders!.create!({ sku: "COFFEE", qty: 2 }, { as: u });
     expect(error).toBeNull();
     expect(data).toMatchObject({ id: expect.any(String) });
 
@@ -159,10 +154,7 @@ describe("Provisions integration", () => {
     // First orders.create is the anonymous deny (stops at member); the
     // authenticated success evaluates the full chain.
     const createRun = events.find(
-      (e) =>
-        e.flow === "orders.create" &&
-        e.gates.includes("order:create") &&
-        e.error == null,
+      (e) => e.flow === "orders.create" && e.gates.includes("order:create") && e.error == null,
     );
     expect(createRun).toBeDefined();
     expect(createRun!.gates).toEqual(["member", "order:create"]);

package/src/upgrade/codemods.test.ts

@@ -5,6 +5,8 @@
 import { describe, expect, test } from "bun:test";
 import {
   CODEMODS,
+  rewriteConfigEnvKeys,
+  rewriteFromStackMarkers,
   runCodemods,
   validateCodemodRegistry,
   type Codemod,
@@ -45,14 +47,31 @@ describe("codemod registry", () => {
         from: "0.0.0",
         to: "0.0.1",
         description: "rename demo",
-        apply: async () => [
-          { path: "src/x.ts", before: "old", after: "new" },
-        ],
+        apply: async () => [{ path: "src/x.ts", before: "old", after: "new" }],
       },
     ];
     const changes = await runCodemods("/tmp", registry);
-    expect(changes).toEqual([
-      { path: "src/x.ts", before: "old", after: "new" },
-    ]);
+    expect(changes).toEqual([{ path: "src/x.ts", before: "old", after: "new" }]);
+  });
+
+  test("rewriteConfigEnvKeys renames driver-map keys", () => {
+    const after = rewriteConfigEnvKeys(`sql: {
+  dev: "sqlite",
+  stack: "postgres",
+  prod: "postgres",
+}`);
+    expect(after).toContain('local: "sqlite"');
+    expect(after).toContain('docker: "postgres"');
+    expect(after).not.toMatch(/(^|[^\w.])dev\s*:/);
+    expect(after).not.toMatch(/(^|[^\w.])stack\s*:/);
+  });
+
+  test("rewriteFromStackMarkers renames vault helpers", () => {
+    const after = rewriteFromStackMarkers(
+      `dev: vault.fromStack("store.sql") // __oke_from_stack__`,
+    );
+    expect(after).toContain("fromDocker");
+    expect(after).toContain("__oke_from_docker__");
+    expect(after).not.toContain("fromStack");
   });
 });