okengine 0.2.6 → 0.3.2

package/src/console/server/store.test.ts

@@ -5,10 +5,7 @@
 import { describe, expect, test } from "bun:test";
 import { defineTable } from "../../elements/store.ts";
 import { classify } from "../../elements/store/classify.ts";
-import {
-  DryRunWriteIsolationError,
-  withDryRun,
-} from "../../kernel/dry-run.ts";
+import { DryRunWriteIsolationError, withDryRun } from "../../kernel/dry-run.ts";
 import type { Manifest } from "../../manifest/types.ts";
 import {
   createManifestStoreRuntime,
@@ -79,21 +76,24 @@ describe("tenancyDeclared", () => {
 describe("projectStoresList", () => {
   test("groups facets and surfaces will-not-fire from effects", async () => {
     const runtime = await createManifestStoreRuntime(MANIFEST);
-    const { stores, tenancyDeclared: tenancy, tenants } =
-      await projectStoresList({
-        manifest: MANIFEST,
-        runtime,
-        declaredFingerprint: "decl",
-        appliedFingerprint: "decl",
-        runs: [
-          {
-            flow: "bookings.mine",
-            replicaLagMs: 120,
-            tenant: "t1",
-            effects: [{ kind: "read", resource: "sql:bookings" } as never],
-          },
-        ],
-      });
+    const {
+      stores,
+      tenancyDeclared: tenancy,
+      tenants,
+    } = await projectStoresList({
+      manifest: MANIFEST,
+      runtime,
+      declaredFingerprint: "decl",
+      appliedFingerprint: "decl",
+      runs: [
+        {
+          flow: "bookings.mine",
+          replicaLagMs: 120,
+          tenant: "t1",
+          effects: [{ kind: "read", resource: "sql:bookings" } as never],
+        },
+      ],
+    });
 
     expect(tenancy).toBe(true);
     expect(tenants).toContain("t1");
@@ -226,8 +226,6 @@ describe("preview dual test (withDryRun)", () => {
       const { recordWouldHaveFired } = await import("../../kernel/dry-run.ts");
       recordWouldHaveFired("send", "booking-confirmed");
     });
-    expect(wouldHaveFired).toEqual([
-      { kind: "send", resource: "booking-confirmed" },
-    ]);
+    expect(wouldHaveFired).toEqual([{ kind: "send", resource: "booking-confirmed" }]);
   });
 });

package/src/console/server/store.ts

@@ -4,10 +4,7 @@
  * The UI must not reimplement cache invalidation, PII masking, or effects graph.
  */
 
-import {
-  readSchemaFingerprint,
-  schemaFingerprint,
-} from "../../cli/schema.ts";
+import { readSchemaFingerprint, schemaFingerprint } from "../../cli/schema.ts";
 import {
   memoryFilesDriver,
   memoryIndexDriver,
@@ -29,16 +26,8 @@ import {
   type SqlStoreHandle,
   type StoreRuntime,
 } from "../../elements/store.ts";
-import {
-  DryRunWriteIsolationError,
-  withDryRun,
-} from "../../kernel/dry-run.ts";
-import type {
-  Effects,
-  Manifest,
-  ResourceRef,
-  StoreFacet,
-} from "../../manifest/types.ts";
+import { DryRunWriteIsolationError, withDryRun } from "../../kernel/dry-run.ts";
+import type { Effects, Manifest, ResourceRef, StoreFacet } from "../../manifest/types.ts";
 import type { WideEvent } from "../../runs/types.ts";
 
 /** Whether multi-tenancy is declared on the Manifest (off by default). */
@@ -114,9 +103,7 @@ export interface ProjectStoresOptions {
  *
  * @param options - Manifest, runtime, runs
  */
-export async function projectStoresList(
-  options: ProjectStoresOptions,
-): Promise<{
+export async function projectStoresList(options: ProjectStoresOptions): Promise<{
   readonly stores: readonly ConsoleStoreRow[];
   readonly tenancyDeclared: boolean;
   readonly tenants: readonly string[];
@@ -146,8 +133,7 @@ export async function projectStoresList(
     const facet = store.facet;
     const ref = `${facet}:${name}` as ResourceRef;
     const children = childrenOf(manifest!, name, facet, store);
-    const replicaLagMs =
-      facet === "sql" ? latestReplicaLag(options.runs ?? [], children) : null;
+    const replicaLagMs = facet === "sql" ? latestReplicaLag(options.runs ?? [], children) : null;
 
     let warnings: ConsoleStoreRow["warnings"] = [];
     if (facet === "files" && options.runtime) {
@@ -194,10 +180,7 @@ function childrenOf(
     names.push(...Object.keys(store.tables ?? {}));
     // Also surface table suffixes from effects when Manifest tables are sparse.
     for (const flow of Object.values(manifest.flows ?? {})) {
-      for (const ref of [
-        ...(flow.effects?.reads ?? []),
-        ...(flow.effects?.writes ?? []),
-      ]) {
+      for (const ref of [...(flow.effects?.reads ?? []), ...(flow.effects?.writes ?? [])]) {
         if (ref.startsWith("sql:")) {
           const table = ref.slice(4);
           if (!names.includes(table)) names.push(table);
@@ -240,11 +223,7 @@ function childrenOf(
   });
 }
 
-function flowsTouching(
-  manifest: Manifest,
-  ref: ResourceRef,
-  kind: "reads" | "writes",
-): string[] {
+function flowsTouching(manifest: Manifest, ref: ResourceRef, kind: "reads" | "writes"): string[] {
   const out: string[] = [];
   for (const [flowId, flow] of Object.entries(manifest.flows ?? {})) {
     if ((flow.effects?.[kind] ?? []).includes(ref)) out.push(flowId);
@@ -277,10 +256,7 @@ export function willNotFireFor(
   };
 }
 
-function piiColumnsFor(
-  store: NonNullable<Manifest["stores"]>[string],
-  table: string,
-): string[] {
+function piiColumnsFor(store: NonNullable<Manifest["stores"]>[string], table: string): string[] {
   const cols: string[] = [];
   const tableMeta = store.tables?.[table];
   for (const [col, tags] of Object.entries(tableMeta?.columns ?? {})) {
@@ -309,18 +285,14 @@ function latestReplicaLag(
   let lag: number | null = null;
   for (const run of runs) {
     if (run.replicaLagMs == null) continue;
-    const touches = (run.effects ?? []).some(
-      (e) => refs.has(e.resource as ResourceRef),
-    );
+    const touches = (run.effects ?? []).some((e) => refs.has(e.resource as ResourceRef));
     if (!touches) continue;
     if (lag === null || run.replicaLagMs > lag) lag = run.replicaLagMs;
   }
   return lag;
 }
 
-function collectTenants(
-  runs: ReadonlyArray<{ readonly tenant?: string | null }>,
-): string[] {
+function collectTenants(runs: ReadonlyArray<{ readonly tenant?: string | null }>): string[] {
   const set = new Set<string>();
   for (const r of runs) {
     if (r.tenant) set.add(r.tenant);
@@ -497,13 +469,9 @@ export async function editStore(
   },
 ): Promise<StoreEditResult> {
   const effectRef = (
-    input.child && input.ref.startsWith("sql:")
-      ? `sql:${input.child}`
-      : input.ref
+    input.child && input.ref.startsWith("sql:") ? `sql:${input.child}` : input.ref
   ) as ResourceRef;
-  const writers = manifest
-    ? flowsTouching(manifest, effectRef, "writes")
-    : [];
+  const writers = manifest ? flowsTouching(manifest, effectRef, "writes") : [];
   const willNotFire = willNotFireFor(manifest ?? { oke: "1.0", app: "" }, writers);
 
   if (options.dryRun) {
@@ -547,7 +515,12 @@ export async function editStore(
 
 /** Snapshot of a direct-edit target for dry-run rollback. */
 type EditSnapshot =
-  | { readonly kind: "kv"; readonly ref: ResourceRef; readonly key: string; readonly value: unknown }
+  | {
+      readonly kind: "kv";
+      readonly ref: ResourceRef;
+      readonly key: string;
+      readonly value: unknown;
+    }
   | {
       readonly kind: "sql";
       readonly ref: ResourceRef;
@@ -578,10 +551,9 @@ async function snapshotEditTarget(
       effects: { reads: [input.ref] },
     })) as SqlStoreHandle;
     try {
-      const rows = await sql.raw(
-        `SELECT * FROM "${input.child}" WHERE "id" = ? LIMIT 1`,
-        [input.id],
-      );
+      const rows = await sql.raw(`SELECT * FROM "${input.child}" WHERE "id" = ? LIMIT 1`, [
+        input.id,
+      ]);
       return {
         kind: "sql",
         ref: input.ref,
@@ -602,10 +574,7 @@ async function snapshotEditTarget(
   return { kind: "none" };
 }
 
-async function restoreEditTarget(
-  runtime: StoreRuntime,
-  snapshot: EditSnapshot,
-): Promise<void> {
+async function restoreEditTarget(runtime: StoreRuntime, snapshot: EditSnapshot): Promise<void> {
   if (snapshot.kind === "kv") {
     const kv = (await runtime.openRef(snapshot.ref, {
       effects: { writes: [snapshot.ref] },
@@ -623,10 +592,7 @@ async function restoreEditTarget(
     })) as SqlStoreHandle;
     if (snapshot.row === null) {
       try {
-        await sql.raw(
-          `DELETE FROM "${snapshot.child}" WHERE "id" = ?`,
-          [snapshot.id],
-        );
+        await sql.raw(`DELETE FROM "${snapshot.child}" WHERE "id" = ?`, [snapshot.id]);
       } catch {
         /* table may not exist */
       }
@@ -635,10 +601,10 @@ async function restoreEditTarget(
     const cols = Object.keys(snapshot.row);
     const assignments = cols.map((c) => `"${c}" = ?`).join(", ");
     try {
-      await sql.raw(
-        `UPDATE "${snapshot.child}" SET ${assignments} WHERE "id" = ?`,
-        [...cols.map((c) => snapshot.row![c]), snapshot.id],
-      );
+      await sql.raw(`UPDATE "${snapshot.child}" SET ${assignments} WHERE "id" = ?`, [
+        ...cols.map((c) => snapshot.row![c]),
+        snapshot.id,
+      ]);
     } catch {
       /* best-effort restore */
     }
@@ -673,10 +639,7 @@ async function applyEdit(
     if (sets.length === 0) return;
     const assignments = sets.map((c) => `"${c}" = ?`).join(", ");
     const params = [...sets.map((c) => input.patch[c]), id];
-    await sql.raw(
-      `UPDATE "${table}" SET ${assignments} WHERE "id" = ?`,
-      params,
-    );
+    await sql.raw(`UPDATE "${table}" SET ${assignments} WHERE "id" = ?`, params);
     return;
   }
 
@@ -786,14 +749,9 @@ export async function runStoreSql(
   readonly routedRole: "primary" | "replica";
 }> {
   const trimmed = sqlText.trim();
-  const isWrite =
-    /^(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|REPLACE)\b/i.test(
-      trimmed,
-    );
+  const isWrite = /^(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|REPLACE)\b/i.test(trimmed);
   if (isWrite && !options.allowWrite) {
-    throw new Error(
-      "SQL console is read-only by default — write requires console:store.sql:write",
-    );
+    throw new Error("SQL console is read-only by default — write requires console:store.sql:write");
   }
   const handle = (await runtime.openRef(ref, {
     effects: isWrite ? { writes: [ref] } : { reads: [ref] },
@@ -814,10 +772,7 @@ export async function runStoreSql(
  * @param key - Cache key
  * @param writeRef - Written resource
  */
-export function cacheKeyInvalidatedBy(
-  key: string,
-  writeRef: ResourceRef,
-): boolean {
+export function cacheKeyInvalidatedBy(key: string, writeRef: ResourceRef): boolean {
   return isInvalidatedByWrite(key, { writes: [writeRef] });
 }
 

package/src/console/server/vault.test.ts

@@ -4,15 +4,8 @@
 
 import { describe, expect, test } from "bun:test";
 import { memoryVaultDriver } from "../../drivers/index.ts";
-import {
-  createVaultRuntime,
-  fingerprintSecretSync,
-  vault,
-} from "../../elements/vault.ts";
-import {
-  createMemoryJournalStore,
-  type JournalRun,
-} from "../../kernel/journal.ts";
+import { createVaultRuntime, fingerprintSecretSync, vault } from "../../elements/vault.ts";
+import { createMemoryJournalStore, type JournalRun } from "../../kernel/journal.ts";
 import type { Manifest } from "../../manifest/types.ts";
 import {
   assertNoSecretLeak,
@@ -82,13 +75,13 @@ describe("projectVaultList", () => {
     const { secrets, env } = await projectVaultList({
       manifest: manifest(),
       runtime: rt,
-      env: "dev",
+      env: "local",
       peerFingerprints: {
         STRIPE_KEY: { staging: fingerprintSecretSync(SECRET) },
       },
     });
 
-    expect(env).toBe("dev");
+    expect(env).toBe("local");
     const stripe = secrets.find((s) => s.name === "STRIPE_KEY");
     const pub = secrets.find((s) => s.name === "PUBLIC_APP_URL");
     expect(stripe?.sensitive).toBe(true);
@@ -131,16 +124,12 @@ describe("projectVaultList", () => {
     const { secrets } = await projectVaultList({
       manifest: null,
       runtime: rt,
-      env: "dev",
+      env: "local",
     });
     const row = secrets.find((s) => s.name === "KEY");
     expect(row?.winner).toBe(".env.local");
-    expect(row?.resolution.find((s) => s.source === ".env.local")?.won).toBe(
-      true,
-    );
-    expect(row?.resolution.find((s) => s.source === "driver")?.present).toBe(
-      true,
-    );
+    expect(row?.resolution.find((s) => s.source === ".env.local")?.won).toBe(true);
+    expect(row?.resolution.find((s) => s.source === "driver")?.present).toBe(true);
     expect(row?.resolution.find((s) => s.source === "driver")?.won).toBe(false);
   });
 
@@ -152,11 +141,9 @@ describe("projectVaultList", () => {
     const { secrets } = await projectVaultList({
       manifest: manifest(),
       runtime: rt,
-      env: "dev",
+      env: "local",
     });
-    expect(secrets.find((s) => s.name === "STRIPE_KEY")?.lastReadAt).toBe(
-      1_700_000_000_000,
-    );
+    expect(secrets.find((s) => s.name === "STRIPE_KEY")?.lastReadAt).toBe(1_700_000_000_000);
   });
 
   test("blast radius queries journal — count + longest wake", async () => {
@@ -215,12 +202,10 @@ describe("projectVaultList", () => {
       manifest: manifest(),
       runtime: rt,
       journal,
-      env: "dev",
+      env: "local",
       now: () => now,
     });
-    expect(secrets.find((s) => s.name === "STRIPE_KEY")?.blastRadius.count).toBe(
-      2,
-    );
+    expect(secrets.find((s) => s.name === "STRIPE_KEY")?.blastRadius.count).toBe(2);
   });
 });
 
@@ -234,9 +219,7 @@ describe("set / rotate", () => {
     });
     expect(result.name).toBe("STRIPE_KEY");
     expect(result.fingerprint).not.toBe(before);
-    expect(result.fingerprint).toBe(
-      fingerprintSecretSync("sk_rotated_value_xyz"),
-    );
+    expect(result.fingerprint).toBe(fingerprintSecretSync("sk_rotated_value_xyz"));
     expect(JSON.stringify(result)).not.toContain("sk_rotated_value_xyz");
   });
 

package/src/console/server/vault.ts

@@ -6,17 +6,21 @@
  * rotation blast radius are derived — never reimplemented in the UI.
  */
 
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import type { ConfigEnv } from "../../config/index.ts";
-import { envVaultDriver, memoryVaultDriver } from "../../drivers/index.ts";
+import { envVaultDriver, memoryVaultDriver, openbaoVaultDriver } from "../../drivers/index.ts";
+import { parseDotenv } from "../../drivers/vault-dotenv-parse.ts";
 import {
   createVaultRuntime,
   vault as declareVault,
+  type VaultChainLayer,
   type VaultResolutionSource,
   type VaultResolutionStep,
   type VaultRuntime,
   type VaultSecretDecl,
 } from "../../elements/vault.ts";
+import { resolveComposeEnvPath } from "../../elements/vault/chain.ts";
 import type { JournalRun, JournalStore } from "../../kernel/journal.ts";
 import type { Manifest } from "../../manifest/types.ts";
 
@@ -24,9 +28,7 @@ import type { Manifest } from "../../manifest/types.ts";
 export type VaultEnvLabel = ConfigEnv | "staging" | (string & {});
 
 /** Fingerprints keyed by environment — never values. */
-export type VaultFingerprintsByEnv = Readonly<
-  Partial<Record<VaultEnvLabel, string>>
->;
+export type VaultFingerprintsByEnv = Readonly<Partial<Record<VaultEnvLabel, string>>>;
 
 /** Rotation blast radius from the durable journal (queried, not estimated). */
 export interface ConsoleVaultBlastRadius {
@@ -84,9 +86,7 @@ export interface ProjectVaultOptions {
    * Optional peer-environment fingerprints (e.g. staging from a remote
    * probe). Never values — fingerprints only.
    */
-  readonly peerFingerprints?: Readonly<
-    Record<string, VaultFingerprintsByEnv>
-  >;
+  readonly peerFingerprints?: Readonly<Record<string, VaultFingerprintsByEnv>>;
   /** Durable journal — blast radius is queried, not estimated. */
   readonly journal?: JournalStore | null;
   readonly now?: () => number;
@@ -97,13 +97,11 @@ export interface ProjectVaultOptions {
  *
  * @param options - Manifest, runtime, journal
  */
-export async function projectVaultList(
-  options: ProjectVaultOptions,
-): Promise<{
+export async function projectVaultList(options: ProjectVaultOptions): Promise<{
   readonly secrets: readonly ConsoleVaultRow[];
   readonly env: VaultEnvLabel;
 }> {
-  const env = options.env ?? "dev";
+  const env = options.env ?? "local";
   const now = options.now ?? (() => Date.now());
   const names = collectNames(options.manifest, options.runtime);
   const journalRuns = options.journal
@@ -115,11 +113,7 @@ export async function projectVaultList(
     const contract = contractOf(name, options.manifest, options.runtime);
     const sensitive = contract.sensitive;
     const readers = readersOf(options.manifest, name);
-    const blastRadius = blastRadiusOf(
-      journalRuns,
-      readers,
-      now(),
-    );
+    const blastRadius = blastRadiusOf(journalRuns, readers, now());
     const winner = options.runtime?.resolution(name) ?? null;
     const resolution = options.runtime?.resolutionChain(name) ?? [];
     const lastReadAt = options.runtime?.lastReadAt(name) ?? null;
@@ -141,17 +135,13 @@ export async function projectVaultList(
       cleartext = options.runtime?.cleartext(name) ?? null;
     }
 
-    const sharedFingerprintEnvs = sensitive
-      ? sharedEnvs(fingerprints, env, fingerprint)
-      : [];
+    const sharedFingerprintEnvs = sensitive ? sharedEnvs(fingerprints, env, fingerprint) : [];
 
     secrets.push({
       name,
       kind: contract.kind,
       sensitive,
-      ...(contract.description !== undefined
-        ? { description: contract.description }
-        : {}),
+      ...(contract.description !== undefined ? { description: contract.description } : {}),
       ...(contract.rotate !== undefined ? { rotate: contract.rotate } : {}),
       fingerprints,
       fingerprint,
@@ -187,9 +177,7 @@ export function setVaultValue(
   runtime.put(input.name, input.value);
   return {
     name: input.name,
-    fingerprint: runtime.isSensitive(input.name)
-      ? (runtime.fingerprint(input.name) ?? null)
-      : null,
+    fingerprint: runtime.isSensitive(input.name) ? (runtime.fingerprint(input.name) ?? null) : null,
   };
 }
 
@@ -209,7 +197,7 @@ export function rotateVaultValue(
 /**
  * Build a VaultRuntime from Manifest contracts when no host runtime is attached.
  *
- * Uses the standard resolution chain: process.env → .env.local → .env.stack
+ * Uses the standard resolution chain: process.env → .env.local → .env.docker
  * → memory driver → (optional) dev fallback. Does not parse dotenv in the UI.
  *
  * @param manifest - Manifest snapshot
@@ -248,10 +236,26 @@ export async function createManifestVaultRuntime(
   });
 
   const seed = options.seed ?? {};
+  const composeEnv = resolveComposeEnvPath(cwd);
+  const envMap = parseDotenv(readFileSync(composeEnv.path, "utf8").toString());
+  const openbaoUrl = process.env.OKE_VAULT_URL ?? envMap.get("OKE_VAULT_URL");
+  const openbaoToken = process.env.OKE_VAULT_TOKEN ?? envMap.get("OKE_VAULT_TOKEN");
+  const openbaoMount = process.env.OKE_VAULT_MOUNT ?? envMap.get("OKE_VAULT_MOUNT") ?? "secret";
+  const driverLayer: VaultChainLayer =
+    openbaoUrl && openbaoToken
+      ? {
+          driver: openbaoVaultDriver,
+          source: "driver",
+          options: { url: openbaoUrl, token: openbaoToken, mount: openbaoMount },
+        }
+      : {
+          driver: memoryVaultDriver,
+          source: "driver",
+          options: { secrets: seed },
+        };
   const runtime = createVaultRuntime({
     secrets,
-    allowDevFallbacks:
-      options.allowDevFallbacks ?? (options.env ?? "dev") !== "prod",
+    allowDevFallbacks: options.allowDevFallbacks ?? (options.env ?? "local") !== "prod",
     now: options.now,
     chain: [
       { driver: envVaultDriver, source: "process.env" },
@@ -262,14 +266,10 @@ export async function createManifestVaultRuntime(
       },
       {
         driver: envVaultDriver,
-        source: ".env.stack",
-        options: { path: resolve(cwd, ".env.stack") },
-      },
-      {
-        driver: memoryVaultDriver,
-        source: "driver",
-        options: { secrets: seed },
+        source: composeEnv.source,
+        options: { path: composeEnv.path },
       },
+      driverLayer,
     ],
   });
   await runtime.boot();
@@ -290,10 +290,7 @@ export function blastRadiusOf(
 ): ConsoleVaultBlastRadius {
   const readers = new Set(readerFlowIds);
   const affected = runs.filter(
-    (r) =>
-      r.status === "sleeping" &&
-      r.wakeAt != null &&
-      readers.has(r.flow),
+    (r) => r.status === "sleeping" && r.wakeAt != null && readers.has(r.flow),
   );
   if (affected.length === 0) {
     return {
@@ -323,10 +320,7 @@ export function blastRadiusOf(
  * @param manifest - Manifest
  * @param name - Secret name
  */
-export function readersOf(
-  manifest: Manifest | null,
-  name: string,
-): readonly string[] {
+export function readersOf(manifest: Manifest | null, name: string): readonly string[] {
   if (!manifest?.flows) return [];
   const out: string[] = [];
   for (const [flowId, flow] of Object.entries(manifest.flows)) {
@@ -339,10 +333,7 @@ export function readersOf(
  * @param manifest - Manifest
  * @param runtime - Runtime
  */
-function collectNames(
-  manifest: Manifest | null,
-  runtime: VaultRuntime | null,
-): readonly string[] {
+function collectNames(manifest: Manifest | null, runtime: VaultRuntime | null): readonly string[] {
   const set = new Set<string>();
   for (const name of Object.keys(manifest?.vault ?? {})) set.add(name);
   if (runtime) {
@@ -372,12 +363,8 @@ function contractOf(
     return {
       kind: fromRuntime.kind,
       sensitive: fromRuntime.sensitive,
-      ...(fromRuntime.description !== undefined
-        ? { description: fromRuntime.description }
-        : {}),
-      ...(fromRuntime.rotate !== undefined
-        ? { rotate: fromRuntime.rotate }
-        : {}),
+      ...(fromRuntime.description !== undefined ? { description: fromRuntime.description } : {}),
+      ...(fromRuntime.rotate !== undefined ? { rotate: fromRuntime.rotate } : {}),
     };
   }
   const fromManifest = manifest?.vault?.[name];
@@ -385,12 +372,8 @@ function contractOf(
   return {
     kind: sensitive ? "secret" : "config",
     sensitive,
-    ...(fromManifest?.description !== undefined
-      ? { description: fromManifest.description }
-      : {}),
-    ...(fromManifest?.rotate !== undefined
-      ? { rotate: fromManifest.rotate }
-      : {}),
+    ...(fromManifest?.description !== undefined ? { description: fromManifest.description } : {}),
+    ...(fromManifest?.rotate !== undefined ? { rotate: fromManifest.rotate } : {}),
   };
 }
 
@@ -414,17 +397,12 @@ function sharedEnvs(
 }
 
 /** Assert a Console row never embeds a secret value (tests / export safety). */
-export function assertNoSecretLeak(
-  row: ConsoleVaultRow,
-  knownSecrets: readonly string[],
-): void {
+export function assertNoSecretLeak(row: ConsoleVaultRow, knownSecrets: readonly string[]): void {
   const blob = JSON.stringify(row);
   for (const secret of knownSecrets) {
     if (secret.length === 0) continue;
     if (blob.includes(secret)) {
-      throw new Error(
-        `vault console leak: secret value appears in row for ${row.name}`,
-      );
+      throw new Error(`vault console leak: secret value appears in row for ${row.name}`);
     }
   }
 }

package/src/console/ui/access/AccessA11yView.tsx

@@ -3,16 +3,9 @@
  * (console §9.14).
  */
 
-import {
-  ONCE_SECRET_ACK_LABEL,
-  ONCE_SECRET_WARNING,
-} from "./acknowledgement.ts";
+import { ONCE_SECRET_ACK_LABEL, ONCE_SECRET_WARNING } from "./acknowledgement.ts";
 import { formatAccessBlastRadius } from "./blast-radius.ts";
-import {
-  ACCESS_BLAST_FIXTURE,
-  ACCESS_EFFECTIVE_FIXTURE,
-  ACCESS_LIST_FIXTURE,
-} from "./fixture.ts";
+import { ACCESS_BLAST_FIXTURE, ACCESS_EFFECTIVE_FIXTURE, ACCESS_LIST_FIXTURE } from "./fixture.ts";
 import { hygieneLines } from "./hygiene.ts";
 import { formatProvenance } from "./provenance.ts";
 
@@ -34,9 +27,7 @@ export interface AccessA11yViewProps {
 export function AccessA11yView(props: AccessA11yViewProps) {
   const plane = props.plane ?? "user";
   const section =
-    plane === "operator"
-      ? ACCESS_LIST_FIXTURE.operatorPlane
-      : ACCESS_LIST_FIXTURE.userPlane;
+    plane === "operator" ? ACCESS_LIST_FIXTURE.operatorPlane : ACCESS_LIST_FIXTURE.userPlane;
   const openKeyId = props.openKeyId ?? "key_demo";
   const openKey = section.keys.find((k) => k.id === openKeyId);
   const blast = formatAccessBlastRadius(ACCESS_BLAST_FIXTURE);
@@ -86,9 +77,7 @@ export function AccessA11yView(props: AccessA11yViewProps) {
                   <li key={op.id}>
                     <button type="button" style={{ minHeight: 32, width: "100%" }}>
                       {op.name} ({op.email})
-                      {op.neverSignedIn ? (
-                        <span role="status"> never signed in</span>
-                      ) : null}
+                      {op.neverSignedIn ? <span role="status"> never signed in</span> : null}
                     </button>
                   </li>
                 ))}
@@ -135,9 +124,7 @@ export function AccessA11yView(props: AccessA11yViewProps) {
                     style={{ minHeight: 32, width: "100%" }}
                   >
                     {k.name}
-                    {k.unused90d ? (
-                      <span role="status"> unused 90d+</span>
-                    ) : null}
+                    {k.unused90d ? <span role="status"> unused 90d+</span> : null}
                   </button>
                 </li>
               ))}
@@ -146,9 +133,7 @@ export function AccessA11yView(props: AccessA11yViewProps) {
 
           <section aria-label="Grantable scopes">
             <h3>Grantable scopes</h3>
-            <p>
-              Only scopes you hold appear — impossibility taught by absence
-            </p>
+            <p>Only scopes you hold appear — impossibility taught by absence</p>
             <ul>
               {section.grantableScopes.map((s) => (
                 <li key={s}>