okengine 0.2.6 → 0.3.2

package/src/drivers/signal-redis.ts

@@ -27,15 +27,10 @@ import type {
  *
  * @param url - Optional Redis URL
  */
-export function createBunSignalRedisClient(
-  url?: string,
-): SignalRedisClientLike {
-  const redis =
-    url !== undefined ? new Bun.RedisClient(url) : Bun.redis;
+export function createBunSignalRedisClient(url?: string): SignalRedisClientLike {
+  const redis = url !== undefined ? new Bun.RedisClient(url) : Bun.redis;
   /** Subscribe blocks a connection — keep a dedicated client. */
-  let sub:
-    | InstanceType<typeof Bun.RedisClient>
-    | undefined;
+  let sub: InstanceType<typeof Bun.RedisClient> | undefined;
 
   function subClient(): InstanceType<typeof Bun.RedisClient> {
     if (!sub) {
@@ -127,16 +122,10 @@ export function parseXreadgroupReply(
  * In-memory redis-protocol fake for signal streams + pub/sub.
  */
 export function createSignalRedisFake(): SignalRedisClientLike & {
-  readonly streams: Map<
-    string,
-    Array<{ id: string; fields: Record<string, string> }>
-  >;
+  readonly streams: Map<string, Array<{ id: string; fields: Record<string, string> }>>;
   readonly published: Array<{ channel: string; message: string }>;
 } {
-  const streams = new Map<
-    string,
-    Array<{ id: string; fields: Record<string, string> }>
-  >();
+  const streams = new Map<string, Array<{ id: string; fields: Record<string, string> }>>();
   const groups = new Map<string, Set<string>>();
   const claimed = new Map<string, Set<string>>();
   const subs = new Map<string, Set<(message: string) => void>>();
@@ -210,9 +199,7 @@ export function createSignalRedisFake(): SignalRedisClientLike & {
  *
  * @param options - Declarations / redis client / durable outbox path
  */
-export async function openRedisSignal(
-  options: SignalOpenOptions,
-): Promise<SignalBus> {
+export async function openRedisSignal(options: SignalOpenOptions): Promise<SignalBus> {
   // Same DI shape as postgres/redis/s3: inject a client in tests; production
   // binds Bun.redis (Streams via send until Bun ships typed xadd).
   const redis = options.redis ?? createBunSignalRedisClient();
@@ -255,8 +242,7 @@ export async function openRedisSignal(
         rollback: () => tx.rollback(),
       };
     },
-    subscribe: (signal, subscriberId, handler) =>
-      outbox.subscribe(signal, subscriberId, handler),
+    subscribe: (signal, subscriberId, handler) => outbox.subscribe(signal, subscriberId, handler),
     live: (signal, handler) => outbox.live(signal, handler),
     drain: () => outbox.drain(),
     deadLetters: (s) => outbox.deadLetters(s),

package/src/drivers/signal-types.ts

@@ -229,10 +229,7 @@ export interface SignalRedisClientLike {
   ): Promise<Array<{ id: string; fields: Record<string, string> }>>;
   xack(key: string, group: string, id: string): Promise<number>;
   publish(channel: string, message: string): Promise<number>;
-  subscribe(
-    channel: string,
-    listener: (message: string) => void,
-  ): Promise<() => void>;
+  subscribe(channel: string, listener: (message: string) => void): Promise<() => void>;
 }
 
 /** Minimal NATS / JetStream surface. */

package/src/drivers/sqlite.ts

@@ -3,26 +3,17 @@
  */
 
 import { Database, type SQLQueryBindings } from "bun:sqlite";
-import type {
-  SqlConnectOptions,
-  SqlConnection,
-  SqlDriver,
-  SqlRow,
-} from "./types.ts";
+import type { SqlConnectOptions, SqlConnection, SqlDriver, SqlRow } from "./types.ts";
 
 /**
  * Open a bun:sqlite connection implementing {@link SqlConnection}.
  *
  * @param options - URL (`:memory:` / path) or injected Database
  */
-export async function connectSqlite(
-  options: SqlConnectOptions = {},
-): Promise<SqlConnection> {
+export async function connectSqlite(options: SqlConnectOptions = {}): Promise<SqlConnection> {
   const role = options.role ?? "primary";
   const db =
-    options.client instanceof Database
-      ? options.client
-      : new Database(options.url ?? ":memory:");
+    options.client instanceof Database ? options.client : new Database(options.url ?? ":memory:");
 
   function asBindings(params: readonly unknown[]): SQLQueryBindings[] {
     return params as SQLQueryBindings[];

package/src/drivers/types.ts

@@ -8,14 +8,7 @@
 import type { ColumnClassification, StoreFacet } from "../manifest/types.ts";
 
 /** Protocol ids for store drivers in scope. */
-export type StoreDriverId =
-  | "sqlite"
-  | "postgres"
-  | "memory"
-  | "redis"
-  | "fs"
-  | "s3"
-  | "pgvector";
+export type StoreDriverId = "sqlite" | "postgres" | "memory" | "redis" | "fs" | "s3" | "pgvector";
 
 /** Facets a driver may serve. */
 export type DriverFacet = StoreFacet;
@@ -112,11 +105,7 @@ export interface KvNamespace {
    * @param keys - KEYS table entries (unprefixed)
    * @param args - ARGV table entries
    */
-  eval<T = unknown>(
-    script: string,
-    keys: readonly string[],
-    args?: readonly string[],
-  ): Promise<T>;
+  eval<T = unknown>(script: string, keys: readonly string[], args?: readonly string[]): Promise<T>;
   /**
    * List keys in this namespace, optionally by prefix (Console Store browser).
    *
@@ -151,11 +140,7 @@ export interface KvClientLike {
    * @param numkeys - KEYS count
    * @param keysAndArgs - KEYS then ARGV
    */
-  eval?(
-    script: string,
-    numkeys: number,
-    ...keysAndArgs: string[]
-  ): Promise<unknown>;
+  eval?(script: string, numkeys: number, ...keysAndArgs: string[]): Promise<unknown>;
   /**
    * Raw command send (Bun.RedisClient). Used when `eval` is absent.
    *
@@ -271,11 +256,7 @@ export interface IndexStore {
    * @param vector - Embedding
    * @param meta - Optional metadata
    */
-  upsert(
-    id: string,
-    vector: readonly number[],
-    meta?: Record<string, unknown>,
-  ): Promise<void>;
+  upsert(id: string, vector: readonly number[], meta?: Record<string, unknown>): Promise<void>;
   /**
    * Similarity search (cosine).
    *

package/src/drivers/vault-driver-removal.test.ts

@@ -0,0 +1,55 @@
+/**
+ * Gate: the removed vault driver id stays gone from the tracked tree.
+ *
+ * Mirrors {@link ../cli/doc-staleness.test.ts} — `git grep` must find zero
+ * hits (this file splits the token so it never matches itself).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dir, "../..");
+
+/** Forbidden driver id, split so this file does not match itself. */
+const FORBIDDEN_DRIVER = ["so", "ps"].join("");
+/** Forbidden optional peer, split so this file does not match itself. */
+const FORBIDDEN_AGE = ["age", "-", "encryption"].join("");
+
+/** Lockfiles regenerated by `bun install` — not source residue. */
+const LOCKFILE_PREFIXES = ["bun.lock:", "packages/create-oke/template/bun.lock:"];
+
+/**
+ * Run `git grep -F` and assert zero matches outside allow-listed prefixes.
+ *
+ * @param pattern - Fixed-string pattern
+ * @param ignorePrefixes - `path:line:` prefixes to ignore
+ */
+function assertZeroGitGrep(pattern: string, ignorePrefixes: readonly string[] = []): void {
+  const proc = Bun.spawnSync(["git", "grep", "-F", "-i", "-n", "-e", pattern, "--"], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  // git grep exits 1 when there are no matches.
+  if (proc.exitCode === 1) {
+    expect(proc.stdout.toString()).toBe("");
+    return;
+  }
+  const hits = proc.stdout
+    .toString()
+    .trim()
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .filter((line) => !ignorePrefixes.some((prefix) => line.startsWith(prefix)));
+  expect(hits.join("\n")).toBe("");
+}
+
+describe("removed vault driver gate", () => {
+  test("tracked tree has zero matches for the removed driver id", () => {
+    assertZeroGitGrep(FORBIDDEN_DRIVER);
+  });
+
+  test("tracked tree has zero matches for the removed age peer outside lockfiles", () => {
+    assertZeroGitGrep(FORBIDDEN_AGE, LOCKFILE_PREFIXES);
+  });
+});

package/src/drivers/vault-env.ts

@@ -1,6 +1,6 @@
 /**
  * `env` vault driver — resolves secrets from the process environment
- * and/or a dotenv file path (`.env.local`, `.env.stack`, …).
+ * and/or a dotenv file path (`.env.local`, `.env.docker`, …).
  *
  * Resolution order is owned by {@link createVaultRuntime}; this driver only
  * exposes one layer of the chain. Layer identity (`process.env` vs file)
@@ -8,11 +8,7 @@
  */
 
 import { parseDotenv, formatDotenv } from "./vault-dotenv-parse.ts";
-import type {
-  VaultBag,
-  VaultDriver,
-  VaultOpenOptions,
-} from "./vault-types.ts";
+import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
 
 /**
  * Create an env vault driver.

package/src/drivers/vault-infisical.ts

@@ -2,11 +2,7 @@
  * `infisical` vault driver — Infisical REST secrets API (protocol-shaped).
  */
 
-import type {
-  VaultBag,
-  VaultDriver,
-  VaultOpenOptions,
-} from "./vault-types.ts";
+import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
 
 /**
  * Infisical secrets driver.

package/src/drivers/vault-managed.ts

@@ -4,11 +4,7 @@
  * Values arrive as an injected map (or env); OKE never invents a vendor client.
  */
 
-import type {
-  VaultBag,
-  VaultDriver,
-  VaultOpenOptions,
-} from "./vault-types.ts";
+import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
 
 /**
  * Managed / platform vault driver.

package/src/drivers/vault-memory.ts

@@ -2,11 +2,7 @@
  * In-memory vault driver — tests and deterministic harnesses.
  */
 
-import type {
-  VaultBag,
-  VaultDriver,
-  VaultOpenOptions,
-} from "./vault-types.ts";
+import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
 
 /**
  * Create a memory vault driver seeded from `options.secrets`.

package/src/drivers/vault-openbao.test.ts

@@ -0,0 +1,97 @@
+/**
+ * OpenBao vault driver — KV v2 read + write/delete + fail-loud semantics.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { OpenBaoUnavailableError, openbaoVaultDriver } from "./vault-openbao.ts";
+
+/** Scripted fetch: LIST + per-key GET, then capture writes/deletes. */
+function fakeKv(
+  seed: Record<string, string>,
+  calls: { method: string; path: string; body?: string }[],
+) {
+  return (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = new URL(String(input));
+    const method = init?.method ?? "GET";
+    calls.push({
+      method,
+      path: url.pathname + url.search,
+      body: typeof init?.body === "string" ? init.body : undefined,
+    });
+    const mount = "/v1/secret";
+    if (method === "GET" && url.pathname === `${mount}/metadata`) {
+      return Response.json({ data: { keys: Object.keys(seed) } });
+    }
+    if (method === "GET" && url.pathname.startsWith(`${mount}/data/`)) {
+      const name = decodeURIComponent(url.pathname.slice(`${mount}/data/`.length));
+      if (!(name in seed)) return new Response("{}", { status: 404 });
+      return Response.json({ data: { data: { value: seed[name] } } });
+    }
+    if (method === "POST" && url.pathname.startsWith(`${mount}/data/`)) {
+      return new Response(null, { status: 204 });
+    }
+    if (method === "DELETE" && url.pathname.startsWith(`${mount}/data/`)) {
+      return new Response(null, { status: 204 });
+    }
+    return new Response("{}", { status: 404 });
+  }) as typeof globalThis.fetch;
+}
+
+describe("openbao vault driver", () => {
+  test("LIST + GET loads all keys", async () => {
+    const calls: { method: string; path: string; body?: string }[] = [];
+    const bag = await openbaoVaultDriver.open({
+      url: "http://127.0.0.1:8200",
+      token: "app-tok",
+      fetch: fakeKv({ STRIPE_KEY: "sk_live", DATABASE_URL: "postgres://x" }, calls),
+    });
+    expect(bag.get("STRIPE_KEY")).toBe("sk_live");
+    expect([...bag.names()].sort()).toEqual(["DATABASE_URL", "STRIPE_KEY"]);
+  });
+
+  test("set POSTs KV v2 data payload", async () => {
+    const calls: { method: string; path: string; body?: string }[] = [];
+    const bag = await openbaoVaultDriver.open({
+      url: "http://127.0.0.1:8200",
+      token: "app-tok",
+      fetch: fakeKv({ STRIPE_KEY: "sk_live" }, calls),
+    });
+    bag.set?.("STRIPE_KEY", "sk_rotated");
+    await Bun.sleep(0);
+    const writeCall = calls.find((c) => c.method === "POST");
+    expect(writeCall?.path).toBe("/v1/secret/data/STRIPE_KEY");
+    expect(writeCall?.body).toBe(JSON.stringify({ data: { value: "sk_rotated" } }));
+    expect(bag.get("STRIPE_KEY")).toBe("sk_rotated");
+  });
+
+  test("unreachable remote fails loud (no soft-empty bag)", async () => {
+    let failed: unknown;
+    try {
+      await openbaoVaultDriver.open({
+        url: "http://127.0.0.1:9",
+        token: "app-tok",
+        fetch: (async () => {
+          throw new Error("connect ECONNREFUSED");
+        }) as unknown as typeof globalThis.fetch,
+      });
+    } catch (err) {
+      failed = err;
+    }
+    expect(failed).toBeInstanceOf(OpenBaoUnavailableError);
+  });
+
+  test("sealed / 5xx on GET fails loud", async () => {
+    const fetchFn = (async (input: string | URL | Request) => {
+      const url = String(input);
+      if (url.includes("metadata")) return Response.json({ data: { keys: ["STRIPE_KEY"] } });
+      return new Response("sealed", { status: 503 });
+    }) as typeof globalThis.fetch;
+    let failed: unknown;
+    try {
+      await openbaoVaultDriver.open({ url: "http://127.0.0.1:8200", token: "t", fetch: fetchFn });
+    } catch (err) {
+      failed = err;
+    }
+    expect(failed).toBeInstanceOf(OpenBaoUnavailableError);
+  });
+});

package/src/drivers/vault-openbao.ts

@@ -1,25 +1,30 @@
 /**
- * `openbao` vault driver — HashiCorp Vault / OpenBao KV v2 HTTP API.
+ * `openbao` vault driver — OpenBao (Vault-compatible) KV v2 HTTP API.
  *
  * Protocol-named; image/vendor choice lives in `images`.
  */
 
-import type {
-  VaultBag,
-  VaultDriver,
-  VaultOpenOptions,
-} from "./vault-types.ts";
+import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
+
+/** Error thrown when the remote OpenBao is unreachable / sealed / errors. */
+export class OpenBaoUnavailableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "OpenBaoUnavailableError";
+  }
+}
 
 /**
- * OpenBao / Vault KV driver.
+ * OpenBao KV-v2 bag. Reads are loaded at open when `url` + `token` resolve;
+ * writes (`set` / `delete`) hit the HTTP API directly.
  *
- * Expects `url` + `token` + optional `mount` (default `secret`).
- * Fetches `GET {url}/v1/{mount}/data/{name}` for each requested secret
- * lazily via a cached bag loaded at open when `secrets` seed keys are listed,
- * or returns empty until {@link VaultBag.get} is called against a remote.
+ * When `url` and `token` are provided, an unreachable, sealed, or erroring
+ * OpenBao is **fatal** (fail-loud) — the bag never silently degrades to an
+ * empty / seed-only view.
  *
  * For boot validation the runtime passes declared names; this driver loads
- * all keys under `mount` when the LIST API is available, else uses seed names.
+ * all keys under `mount` when the LIST API is available, else falls back to
+ * GETs for the seed names.
  */
 export const openbaoVaultDriver: VaultDriver = {
   id: "openbao",
@@ -34,36 +39,60 @@ export const openbaoVaultDriver: VaultDriver = {
       ),
     );
 
-    if (url && token) {
-      // Best-effort LIST; ignore failures (permission / disabled).
+    const remote = url !== undefined && token !== undefined;
+    let mutableRemote = false;
+
+    if (remote && url !== undefined && token !== undefined) {
+      const headers = { "X-Vault-Token": token };
+      const base = `${url}/v1/${mount}`;
+
+      async function listNames(): Promise<string[]> {
+        const res = await fetchFn(`${base}/metadata?list=true`, { headers });
+        if (!res.ok) return [];
+        const body = (await res.json()) as { data?: { keys?: string[] } };
+        return (body.data?.keys ?? []).map((k) => k.replace(/\/$/, ""));
+      }
+
+      async function readName(name: string): Promise<boolean> {
+        const res = await fetchFn(`${base}/data/${encodeURIComponent(name)}`, { headers });
+        if (res.status === 404) return false;
+        if (!res.ok) {
+          throw new OpenBaoUnavailableError(
+            `openbao vault: GET ${name} failed (${res.status}) — sealed or unauthorized?`,
+          );
+        }
+        const body = (await res.json()) as { data?: { data?: Record<string, unknown> } };
+        const data = body.data?.data ?? {};
+        const value =
+          typeof data.value === "string"
+            ? data.value
+            : typeof data[name] === "string"
+              ? (data[name] as string)
+              : JSON.stringify(data);
+        map.set(name, value);
+        return true;
+      }
+
+      // LIST when the token has metadata list; otherwise only fetch the
+      // seed/declared names so a least-privilege token still works. A
+      // connection-level failure here must never degrade to an empty bag.
+      let names: string[] = [];
       try {
-        const listRes = await fetchFn(`${url}/v1/${mount}/metadata?list=true`, {
-          headers: { "X-Vault-Token": token },
-        });
-        if (listRes.ok) {
-          const body = (await listRes.json()) as {
-            data?: { keys?: string[] };
-          };
-          for (const key of body.data?.keys ?? []) {
-            const getRes = await fetchFn(`${url}/v1/${mount}/data/${key}`, {
-              headers: { "X-Vault-Token": token },
-            });
-            if (!getRes.ok) continue;
-            const got = (await getRes.json()) as {
-              data?: { data?: Record<string, unknown> };
-            };
-            const data = got.data?.data ?? {};
-            const value =
-              typeof data.value === "string"
-                ? data.value
-                : typeof data[key] === "string"
-                  ? (data[key] as string)
-                  : JSON.stringify(data);
-            map.set(key.replace(/\/$/, ""), value);
-          }
+        names = await listNames();
+      } catch (err) {
+        if (map.size === 0) {
+          throw new OpenBaoUnavailableError(
+            `openbao vault: unreachable at ${url} — ${err instanceof Error ? err.message : String(err)}`,
+          );
         }
-      } catch {
-        // Remote unavailable — bag stays at seed / empty; boot validation reports gaps.
+        // Fall through: LIST denied but we still have declared names to GET.
+      }
+      if (names.length > 0) {
+        for (const key of names) await readName(key);
+        mutableRemote = true;
+      } else if (map.size > 0) {
+        for (const name of map.keys()) await readName(name);
+        mutableRemote = true;
       }
     }
 
@@ -75,6 +104,40 @@ export const openbaoVaultDriver: VaultDriver = {
       names() {
         return [...map.keys()];
       },
+      ...(mutableRemote && url !== undefined && token !== undefined
+        ? {
+            set(name: string, value: string) {
+              void (async () => {
+                const res = await fetchFn(`${url}/v1/${mount}/data/${encodeURIComponent(name)}`, {
+                  method: "POST",
+                  headers: { "X-Vault-Token": token, "content-type": "application/json" },
+                  body: JSON.stringify({ data: { value } }),
+                });
+                if (!res.ok) {
+                  throw new OpenBaoUnavailableError(
+                    `openbao vault: write ${name} failed (${res.status})`,
+                  );
+                }
+                map.set(name, value);
+              })();
+            },
+            delete(name: string) {
+              const had = map.delete(name);
+              void (async () => {
+                const res = await fetchFn(`${url}/v1/${mount}/data/${encodeURIComponent(name)}`, {
+                  method: "DELETE",
+                  headers: { "X-Vault-Token": token },
+                });
+                if (!res.ok && res.status !== 404) {
+                  throw new OpenBaoUnavailableError(
+                    `openbao vault: delete ${name} failed (${res.status})`,
+                  );
+                }
+              })();
+              return had;
+            },
+          }
+        : {}),
     };
   },
 };

package/src/drivers/vault-types.ts

@@ -1,30 +1,17 @@
 /**
  * Protocol-named vault driver contracts.
  *
- * Driver ids: `sops` · `env` · `openbao` · `infisical` · `managed` · `memory`.
+ * Driver ids: `env` · `openbao` · `infisical` · `managed` · `memory`.
  * Never vendor names (`neon`, `infisical-cloud`, …) — vendor choice lives in `images`.
  */
 
 /** Protocol ids for vault drivers. */
-export type VaultDriverId =
-  | "sops"
-  | "env"
-  | "openbao"
-  | "infisical"
-  | "managed"
-  | "memory";
+export type VaultDriverId = "env" | "openbao" | "infisical" | "managed" | "memory";
 
 /** Options when opening a vault backend. */
 export interface VaultOpenOptions {
-  /**
-   * Path to a SOPS-encrypted file (`sops` driver) or a dotenv file (`env` driver).
-   * Prefer JSON / ENV formats produced by `sops -e` for SOPS.
-   */
+  /** Path to a dotenv file (`env` driver). */
   readonly path?: string;
-  /** Inline SOPS ciphertext (tests). */
-  readonly ciphertext?: string | Uint8Array;
-  /** Age identity (`AGE-SECRET-KEY-…`) for Typage decryption. */
-  readonly ageIdentity?: string;
   /** Env prefix filter for the `env` driver (default: none — whole `process.env`). */
   readonly envPrefix?: string;
   /** Injected env map for tests (defaults to `process.env`). */

package/src/elements/ai/declare.ts

@@ -145,13 +145,9 @@ export const ai: AiNamespace = {
           kind: "prompt",
           name: promptName,
           model: name,
-          ...(promptOpts.version !== undefined
-            ? { version: promptOpts.version }
-            : {}),
+          ...(promptOpts.version !== undefined ? { version: promptOpts.version } : {}),
           ...(promptOpts.evals !== undefined ? { evals: promptOpts.evals } : {}),
-          ...(promptOpts.budget !== undefined
-            ? { budget: promptOpts.budget }
-            : {}),
+          ...(promptOpts.budget !== undefined ? { budget: promptOpts.budget } : {}),
           ...(promptOpts.in !== undefined ? { in: promptOpts.in } : {}),
           ...(promptOpts.out !== undefined ? { out: promptOpts.out } : {}),
         };
@@ -167,14 +163,8 @@ export const ai: AiNamespace = {
    * @param options - Model + destination index
    */
   embed(name: string, options: AiEmbedOptions = {}): AiEmbedDecl {
-    const model =
-      typeof options.model === "string"
-        ? options.model
-        : options.model?.name;
-    const into =
-      typeof options.into === "string"
-        ? options.into
-        : options.into?.name;
+    const model = typeof options.model === "string" ? options.model : options.model?.name;
+    const into = typeof options.into === "string" ? options.into : options.into?.name;
     return {
       kind: "embed",
       name,

package/src/elements/ai/eval.ts

@@ -52,12 +52,8 @@ export interface RunPromptEvalsOptions {
  *
  * @param options - Cases + ask fn
  */
-export async function runPromptEvals(
-  options: RunPromptEvalsOptions,
-): Promise<EvalSuiteResult> {
-  const equals =
-    options.equals ??
-    ((a, b) => JSON.stringify(a) === JSON.stringify(b));
+export async function runPromptEvals(options: RunPromptEvalsOptions): Promise<EvalSuiteResult> {
+  const equals = options.equals ?? ((a, b) => JSON.stringify(a) === JSON.stringify(b));
   const results: EvalCaseResult[] = [];
 
   for (let i = 0; i < options.cases.length; i++) {

package/src/elements/ai/pii.ts

@@ -55,9 +55,7 @@ export class AiPiiBuildError extends Error {
  *
  * @param tags - Classification value
  */
-function isPiiTags(
-  tags: ColumnClassification | string | readonly string[] | undefined,
-): boolean {
+function isPiiTags(tags: ColumnClassification | string | readonly string[] | undefined): boolean {
   if (!tags) return false;
   if (typeof tags === "string") return tags === "pii";
   if (Array.isArray(tags)) return tags.includes("pii");