okengine 0.2.6 → 0.3.2

package/src/elements/store.test.ts

@@ -7,11 +7,7 @@
  */
 
 import { describe, expect, test } from "bun:test";
-import {
-  createPostgresFakeClient,
-  postgresDriver,
-  sqliteDriver,
-} from "../drivers/index.ts";
+import { createPostgresFakeClient, postgresDriver, sqliteDriver } from "../drivers/index.ts";
 import type { Effects } from "../manifest/types.ts";
 import {
   classify,
@@ -72,9 +68,7 @@ describe("store facets", () => {
   });
 
   test("id and now helpers", () => {
-    expect(id()).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
-    );
+    expect(id()).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
     expect(now()).toBeGreaterThan(0);
   });
 });
@@ -119,13 +113,11 @@ describe("same flow against sqlite and postgres", () => {
 describe("replica routing from effects", () => {
   test("read-only flows are detected from the effect set", () => {
     expect(isReadOnlyStoreFlow({ reads: ["sql:notes"] })).toBe(true);
-    expect(
-      isReadOnlyStoreFlow({ reads: ["sql:notes"], writes: ["sql:notes"] }),
-    ).toBe(false);
+    expect(isReadOnlyStoreFlow({ reads: ["sql:notes"], writes: ["sql:notes"] })).toBe(false);
     expect(sqlRoleForEffects({ reads: ["sql:notes"] }, true)).toBe("replica");
-    expect(
-      sqlRoleForEffects({ reads: ["sql:notes"], writes: ["sql:notes"] }, true),
-    ).toBe("primary");
+    expect(sqlRoleForEffects({ reads: ["sql:notes"], writes: ["sql:notes"] }, true)).toBe(
+      "primary",
+    );
   });
 
   test("read-only flow provably hits a replica", async () => {
@@ -135,10 +127,11 @@ describe("replica routing from effects", () => {
     await replicaClient.unsafe(
       `CREATE TABLE IF NOT EXISTS "notes" ("id" TEXT PRIMARY KEY, "title" TEXT, "email" TEXT)`,
     );
-    await replicaClient.unsafe(
-      `INSERT INTO "notes" ("id", "title", "email") VALUES ($1, $2, $3)`,
-      ["n1", "from-replica", "x@y.z"],
-    );
+    await replicaClient.unsafe(`INSERT INTO "notes" ("id", "title", "email") VALUES ($1, $2, $3)`, [
+      "n1",
+      "from-replica",
+      "x@y.z",
+    ]);
 
     const decl = store.sql("notes", {
       classify: { notes: { email: classify({ pii: true }) } },
@@ -213,12 +206,8 @@ describe("tier-1 cache invalidation from effects", () => {
       expiresAt: null,
     });
 
-    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:notes"] })).toBe(
-      true,
-    );
-    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:orders"] })).toBe(
-      false,
-    );
+    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:notes"] })).toBe(true);
+    expect(isInvalidatedByWrite(keys[0]!, { writes: ["sql:orders"] })).toBe(false);
 
     const event = cache.invalidateFromEffects({ writes: ["sql:notes"] });
     expect(event.keys).toEqual([computedCacheKey("sql:notes")]);
@@ -268,10 +257,7 @@ describe("exists and increment helpers", () => {
         }),
       );
       await handle.ensureTable(counters);
-      await handle
-        .insert(counters)
-        .values({ id: "c1", clicks: 0 })
-        .execute();
+      await handle.insert(counters).values({ id: "c1", clicks: 0 }).execute();
 
       expect(await handle.exists(counters, { id: "c1" }), label).toBe(true);
       expect(await handle.exists(counters, { id: "gone" }), label).toBe(false);
@@ -301,16 +287,11 @@ describe("exists and increment helpers", () => {
         }),
       );
       await handle.ensureTable(counters);
-      await handle
-        .insert(counters)
-        .values({ id: "c1", clicks: 0 })
-        .execute();
+      await handle.insert(counters).values({ id: "c1", clicks: 0 }).execute();
 
       const n = 100;
       const results = await Promise.all(
-        Array.from({ length: n }, () =>
-          handle.increment(counters, "c1", "clicks"),
-        ),
+        Array.from({ length: n }, () => handle.increment(counters, "c1", "clicks")),
       );
       expect(new Set(results).size, label).toBe(n);
       expect(Math.max(...results), label).toBe(n);
@@ -337,10 +318,7 @@ describe("PII masking at the driver boundary", () => {
       }),
     );
     await handle.ensureTable(notes);
-    await handle
-      .insert(notes)
-      .values({ id: "1", title: "t", email: "pii@x.com" })
-      .execute();
+    await handle.insert(notes).values({ id: "1", title: "t", email: "pii@x.com" }).execute();
 
     const rows = await handle.raw(`SELECT * FROM notes`);
     expect(rows[0]?.title).toBe("t");

package/src/elements/store.ts

@@ -21,6 +21,37 @@ export type {
   IndexStoreOptions,
 } from "./store/declare.ts";
 
+export {
+  field,
+  schema,
+  schemaTable,
+  schemaRelations,
+  isSchemaTableDecl,
+  isSchemaColumnDecl,
+  isSchemaRelationsDecl,
+  isFieldBuilder,
+  finalizeColumnMap,
+  tablesFromExports,
+  relationsFromExports,
+} from "./store/schema-decl.ts";
+export type {
+  FieldBuilder,
+  FieldSqlType,
+  DefaultFnKind,
+  SchemaColumnDecl,
+  SchemaColumnInput,
+  SchemaTableDecl,
+  SchemaTableWithColumns,
+  SchemaRelationsDecl,
+  SchemaRelationEntry,
+  SchemaRelationOne,
+  SchemaRelationMany,
+  RelationColumnRef,
+  ReferenceAction,
+  ReferenceActions,
+  ColumnReference,
+} from "./store/schema-decl.ts";
+
 export {
   classify,
   buildClassificationMap,
@@ -39,47 +70,42 @@ export {
   isInvalidatedByWrite,
   parseTtlMs,
 } from "./store/cache.ts";
-export type {
-  CacheTier,
-  CacheEntry,
-  InvalidationEvent,
-  StoreCache,
-} from "./store/cache.ts";
+export type { CacheTier, CacheEntry, InvalidationEvent, StoreCache } from "./store/cache.ts";
 
-export {
-  isReadOnlyStoreFlow,
-  sqlRoleForEffects,
-  resolveSqlTarget,
-} from "./store/replica.ts";
+export { isReadOnlyStoreFlow, sqlRoleForEffects, resolveSqlTarget } from "./store/replica.ts";
 export type { SqlBindingConfig } from "./store/replica.ts";
 
-export {
-  defineTable,
-  resolveTableName,
-  classificationsFromTable,
-  id,
-  now,
-} from "./store/table.ts";
+export { defineTable, resolveTableName, classificationsFromTable, id, now } from "./store/table.ts";
 export type { ColumnDef, TableHandle } from "./store/table.ts";
 
-export {
-  createSqlStoreHandle,
-  resolvePkColumn,
-} from "./store/sql-session.ts";
+export { resource } from "./store/resource.ts";
+export type {
+  ColumnScope,
+  ListCountMode,
+  ListPageMode,
+  ResourceColumns,
+  ResourceDef,
+  ResourceFlowDefs,
+  ResourceListOptions,
+  ResourceOptions,
+  ResolvedListConfig,
+} from "./store/resource.ts";
+
+export { createSqlStoreHandle, resolvePkColumn } from "./store/sql-session.ts";
 export type {
   SqlStoreHandle,
   SelectBuilder,
   SelectFromBuilder,
+  SelectWhereBuilder,
+  SelectOrderBuilder,
   InsertBuilder,
   InsertValuesBuilder,
   SqlSessionOptions,
+  SqlPageOptions,
   WhereMap,
 } from "./store/sql-session.ts";
 
-export {
-  createStoreRuntime,
-  putTier2,
-} from "./store/runtime.ts";
+export { createStoreRuntime, putTier2 } from "./store/runtime.ts";
 export type {
   StoreRuntime,
   StoreDriverBundle,
@@ -92,9 +118,5 @@ export type {
   IndexStoreFxHandle,
 } from "./store/runtime.ts";
 
-export {
-  fileKeyWarnings,
-  contentAddressedKey,
-  projectFileKeys,
-} from "./store/files-policy.ts";
+export { fileKeyWarnings, contentAddressedKey, projectFileKeys } from "./store/files-policy.ts";
 export type { FileKeyWarning } from "./store/files-policy.ts";

package/src/elements/vault/chain.ts

@@ -0,0 +1,34 @@
+/**
+ * Canonical vault compose-env path resolution — shared by app boot and Console.
+ *
+ * Compose credentials live at `docker/.env.docker`. Legacy project-root
+ * `.env.docker` is consulted when absent (soft-compat).
+ */
+
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import type { VaultResolutionSource } from "./runtime.ts";
+
+/** Canonical relative path for compose stack credentials. */
+export const COMPOSE_ENV_REL = "docker/.env.docker";
+
+/**
+ * Resolve the compose-env path: prefer `docker/.env.docker`, then legacy
+ * project-root `.env.docker`.
+ *
+ * @param root - Project root
+ */
+export function resolveComposeEnvPath(root: string): {
+  readonly path: string;
+  readonly source: Extract<VaultResolutionSource, ".env.docker">;
+} {
+  const dockerPath = resolve(root, COMPOSE_ENV_REL);
+  if (existsSync(dockerPath)) {
+    return { path: dockerPath, source: ".env.docker" };
+  }
+  const legacyDocker = resolve(root, ".env.docker");
+  if (existsSync(legacyDocker)) {
+    return { path: legacyDocker, source: ".env.docker" };
+  }
+  return { path: dockerPath, source: ".env.docker" };
+}

package/src/elements/vault/declare.ts

@@ -41,10 +41,7 @@ export interface VaultSecretDecl {
  * @param name - Secret name
  * @param options - Description / rotate / schema / dev fallback
  */
-function declareSecret(
-  name: string,
-  options: VaultSecretOptions = {},
-): VaultSecretDecl {
+function declareSecret(name: string, options: VaultSecretOptions = {}): VaultSecretDecl {
   if (!name) {
     throw new TypeError("vault.secret: name is required");
   }
@@ -52,9 +49,7 @@ function declareSecret(
     kind: "secret",
     name,
     sensitive: options.sensitive ?? true,
-    ...(options.description !== undefined
-      ? { description: options.description }
-      : {}),
+    ...(options.description !== undefined ? { description: options.description } : {}),
     ...(options.rotate !== undefined ? { rotate: options.rotate } : {}),
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
@@ -67,10 +62,7 @@ function declareSecret(
  * @param name - Config name
  * @param options - Description / schema / dev fallback
  */
-function declareConfig(
-  name: string,
-  options: VaultSecretOptions = {},
-): VaultSecretDecl {
+function declareConfig(name: string, options: VaultSecretOptions = {}): VaultSecretDecl {
   if (!name) {
     throw new TypeError("vault.config: name is required");
   }
@@ -78,9 +70,7 @@ function declareConfig(
     kind: "config",
     name,
     sensitive: options.sensitive ?? false,
-    ...(options.description !== undefined
-      ? { description: options.description }
-      : {}),
+    ...(options.description !== undefined ? { description: options.description } : {}),
     ...(options.rotate !== undefined ? { rotate: options.rotate } : {}),
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
@@ -88,41 +78,41 @@ function declareConfig(
 }
 
 /**
- * Marker prefix for {@link vault.fromStack} dev fallbacks.
- * Resolved from `.env.stack` by `oke dev --stack` / vault boot.
+ * Marker prefix for {@link vault.fromDocker} local fallbacks.
+ * Resolved from `docker/.env.docker` by `oke dev --docker` / vault boot.
  */
-export const FROM_STACK_PREFIX = "__oke_from_stack__:";
+export const FROM_DOCKER_PREFIX = "__oke_from_docker__:";
 
 /**
- * Dev fallback that reads the URL built by the image recipe for `role`.
+ * Local fallback that reads the URL built by the image recipe for `role`.
  * The kernel never sees the underlying env-var names — only the URL.
  *
  * @param role - Image role (`store.sql`, …)
  */
-export function fromStack(role: string): string {
-  if (!role) throw new TypeError("vault.fromStack: role is required");
-  return `${FROM_STACK_PREFIX}${role}`;
+export function fromDocker(role: string): string {
+  if (!role) throw new TypeError("vault.fromDocker: role is required");
+  return `${FROM_DOCKER_PREFIX}${role}`;
 }
 
 /**
- * Whether a dev fallback is a {@link fromStack} marker.
+ * Whether a local fallback is a {@link fromDocker} marker.
  *
  * @param value - Candidate
  */
-export function isFromStack(value: string): boolean {
-  return value.startsWith(FROM_STACK_PREFIX);
+export function isFromDocker(value: string): boolean {
+  return value.startsWith(FROM_DOCKER_PREFIX);
 }
 
 /**
- * Role encoded in a {@link fromStack} marker.
+ * Role encoded in a {@link fromDocker} marker.
  *
- * @param value - Marker from {@link fromStack}
+ * @param value - Marker from {@link fromDocker}
  */
-export function fromStackRole(value: string): string {
-  if (!isFromStack(value)) {
-    throw new TypeError(`vault: not a fromStack marker: ${value}`);
+export function fromDockerRole(value: string): string {
+  if (!isFromDocker(value)) {
+    throw new TypeError(`vault: not a fromDocker marker: ${value}`);
   }
-  return value.slice(FROM_STACK_PREFIX.length);
+  return value.slice(FROM_DOCKER_PREFIX.length);
 }
 
 /**
@@ -135,9 +125,9 @@ export const vault: {
   (name: string, options?: VaultSecretOptions): VaultSecretDecl;
   secret(name: string, options?: VaultSecretOptions): VaultSecretDecl;
   config(name: string, options?: VaultSecretOptions): VaultSecretDecl;
-  fromStack(role: string): string;
+  fromDocker(role: string): string;
 } = Object.assign(declareSecret, {
   secret: declareSecret,
   config: declareConfig,
-  fromStack,
+  fromDocker,
 });

package/src/elements/vault/fingerprint.ts

@@ -8,13 +8,8 @@
  * @param value - Cleartext secret
  */
 export async function fingerprintSecret(value: string): Promise<string> {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(value),
-  );
-  const hex = [...new Uint8Array(digest)]
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
   return `sha256:${hex.slice(0, 16)}`;
 }
 

package/src/elements/vault/redact.ts

@@ -11,17 +11,13 @@ export const SECRET_MASK = "[redacted:secret]";
  *
  * @param secrets - Cleartext values currently loaded
  */
-export function createSecretRedactor(
-  secrets: Iterable<string>,
-): {
+export function createSecretRedactor(secrets: Iterable<string>): {
   /** Redact a free-form string. */
   redactString(input: string): string;
   /** Deep-redact a JSON-like value. */
   redact(value: unknown): unknown;
 } {
-  const values = [...secrets]
-    .filter((v) => v.length > 0)
-    .sort((a, b) => b.length - a.length);
+  const values = [...secrets].filter((v) => v.length > 0).sort((a, b) => b.length - a.length);
 
   function redactString(input: string): string {
     let out = input;

package/src/elements/vault/runtime.ts

@@ -3,7 +3,7 @@
  */
 
 import type { VaultBag, VaultDriver } from "../../drivers/vault-types.ts";
-import { fromStackRole, isFromStack } from "./declare.ts";
+import { fromDockerRole, isFromDocker } from "./declare.ts";
 import type { VaultSecretDecl } from "./declare.ts";
 import { fingerprintSecretSync } from "./fingerprint.ts";
 import { createSecretRedactor, SECRET_MASK } from "./redact.ts";
@@ -25,13 +25,8 @@ export class VaultBootError extends Error {
    * @param gaps - Missing secrets
    */
   constructor(gaps: readonly VaultGap[]) {
-    const lines = gaps.map(
-      (g) =>
-        `  - ${g.name}${g.description ? `: ${g.description}` : ""}`,
-    );
-    super(
-      `vault boot failed — ${gaps.length} missing secret(s):\n${lines.join("\n")}`,
-    );
+    const lines = gaps.map((g) => `  - ${g.name}${g.description ? `: ${g.description}` : ""}`);
+    super(`vault boot failed — ${gaps.length} missing secret(s):\n${lines.join("\n")}`);
     this.name = "VaultBootError";
     this.gaps = gaps;
   }
@@ -39,12 +34,12 @@ export class VaultBootError extends Error {
 
 /**
  * Named layer in the resolution chain (console §9.8).
- * Spec order: process.env → .env.local → .env.stack → driver → dev-fallback.
+ * Spec order: process.env → .env.local → .env.docker → driver → dev-fallback.
  */
 export type VaultResolutionSource =
   | "process.env"
   | ".env.local"
-  | ".env.stack"
+  | ".env.docker"
   | "driver"
   | "dev-fallback";
 
@@ -76,7 +71,7 @@ export interface CreateVaultRuntimeOptions {
   readonly secrets?: readonly VaultSecretDecl[];
   /**
    * Resolution chain — first hit wins.
-   * Default for prod: `[sops]`; for tests callers pass memory/env layers.
+   * Callers pass the env-appropriate layers (env / openbao / memory / …).
    */
   readonly chain?: readonly VaultChainLayer[];
   /**
@@ -173,9 +168,7 @@ export interface VaultRuntime {
  *
  * @param options - Contracts + resolution chain
  */
-export function createVaultRuntime(
-  options: CreateVaultRuntimeOptions = {},
-): VaultRuntime {
+export function createVaultRuntime(options: CreateVaultRuntimeOptions = {}): VaultRuntime {
   const contracts = new Map<string, VaultSecretDecl>();
   for (const s of options.secrets ?? []) {
     contracts.set(s.name, s);
@@ -236,9 +229,7 @@ export function createVaultRuntime(
       if (value === undefined || value.length === 0) {
         gaps.push({
           name: c.name,
-          ...(c.description !== undefined
-            ? { description: c.description }
-            : {}),
+          ...(c.description !== undefined ? { description: c.description } : {}),
         });
       }
     }
@@ -384,17 +375,15 @@ export function createVaultRuntime(
  *
  * @param layer - Chain layer
  */
-export function resolveLayerSource(
-  layer: VaultChainLayer,
-): VaultResolutionSource {
+export function resolveLayerSource(layer: VaultChainLayer): VaultResolutionSource {
   if (layer.source) return layer.source;
   const path = layer.options?.path;
   if (typeof path === "string") {
     if (path.endsWith(".env.local") || path.includes("/.env.local")) {
       return ".env.local";
     }
-    if (path.endsWith(".env.stack") || path.includes("/.env.stack")) {
-      return ".env.stack";
+    if (path.endsWith(".env.docker") || path.includes("/.env.docker")) {
+      return ".env.docker";
     }
   }
   if (layer.driver.id === "env" && path === undefined) {
@@ -404,25 +393,25 @@ export function resolveLayerSource(
 }
 
 /**
- * Resolve a `dev` fallback, expanding {@link import("./declare.ts").fromStack}
- * markers via stack env (`OKE_<ROLE>_URL`) without teaching the kernel
+ * Resolve a `dev` fallback, expanding {@link import("./declare.ts").fromDocker}
+ * markers via docker env (`OKE_<ROLE>_URL`) without teaching the kernel
  * image-specific env-var names.
  *
  * @param dev - Declared fallback
  */
 function resolveDevFallback(dev: string): string | undefined {
-  if (!isFromStack(dev)) return dev;
-  const role = fromStackRole(dev);
+  if (!isFromDocker(dev)) return dev;
+  const role = fromDockerRole(dev);
   const key = `OKE_${role.replaceAll(".", "_").toUpperCase()}_URL`;
   const fromEnv =
     (typeof Bun !== "undefined" ? Bun.env[key] : undefined) ??
     process.env[key] ??
     (role === "store.sql"
-      ? (typeof Bun !== "undefined" ? Bun.env.DATABASE_URL : undefined) ??
-        process.env.DATABASE_URL
+      ? ((typeof Bun !== "undefined" ? Bun.env.DATABASE_URL : undefined) ??
+        process.env.DATABASE_URL)
       : undefined);
   if (fromEnv && fromEnv.length > 0) return fromEnv;
-  // Dev/test without `oke dev --stack`: still satisfy url-shaped contracts.
+  // Local/test without `oke dev --docker`: still satisfy url-shaped contracts.
   if (role === "store.sql") return "postgres://localhost/oke";
   return undefined;
 }
@@ -431,10 +420,7 @@ function resolveDevFallback(dev: string): string | undefined {
  * @param contracts - Declared contracts
  * @param name - Contract name
  */
-function isSensitiveName(
-  contracts: ReadonlyMap<string, VaultSecretDecl>,
-  name: string,
-): boolean {
+function isSensitiveName(contracts: ReadonlyMap<string, VaultSecretDecl>, name: string): boolean {
   const c = contracts.get(name);
   if (!c) return true;
   return c.sensitive;

package/src/elements/vault.test.ts

@@ -4,17 +4,10 @@
  * - a secret value never appears in a log or trace even when passed to fx.log
  * - fingerprints instead of values
  * - resolution chain (first hit wins)
- * - sops/age via Typage (in-process, no Go binary)
  */
 
 import { describe, expect, test } from "bun:test";
-import * as age from "age-encryption";
-import {
-  buildSopsFixture,
-  envVaultDriver,
-  memoryVaultDriver,
-  sopsVaultDriver,
-} from "../drivers/index.ts";
+import { envVaultDriver, memoryVaultDriver } from "../drivers/index.ts";
 import { createFx } from "../kernel/fx.ts";
 import {
   createVaultRuntime,
@@ -43,27 +36,23 @@ describe("vault declaration", () => {
     expect(cfg.kind).toBe("config");
     expect(cfg.sensitive).toBe(false);
 
-    const fromStack = vault.fromStack("store.sql");
-    expect(fromStack).toStartWith("__oke_from_stack__:");
-    const c = vault.secret("DATABASE_URL", { dev: fromStack });
-    expect(c.dev).toBe(fromStack);
+    const fromDocker = vault.fromDocker("store.sql");
+    expect(fromDocker).toStartWith("__oke_from_docker__:");
+    const c = vault.secret("DATABASE_URL", { dev: fromDocker });
+    expect(c.dev).toBe(fromDocker);
   });
 
-  test("fromStack resolves via OKE_<ROLE>_URL without env-var names in the kernel", async () => {
+  test("fromDocker resolves via OKE_<ROLE>_URL without env-var names in the kernel", async () => {
     const prev = process.env.OKE_STORE_SQL_URL;
     process.env.OKE_STORE_SQL_URL = "postgres://oke:x@127.0.0.1:5432/oke";
     try {
       const runtime = createVaultRuntime({
-        secrets: [
-          vault.secret("DATABASE_URL", { dev: vault.fromStack("store.sql") }),
-        ],
+        secrets: [vault.secret("DATABASE_URL", { dev: vault.fromDocker("store.sql") })],
         chain: [],
         allowDevFallbacks: true,
       });
       await runtime.boot();
-      expect(runtime.read("DATABASE_URL")).toBe(
-        "postgres://oke:x@127.0.0.1:5432/oke",
-      );
+      expect(runtime.read("DATABASE_URL")).toBe("postgres://oke:x@127.0.0.1:5432/oke");
     } finally {
       if (prev === undefined) delete process.env.OKE_STORE_SQL_URL;
       else process.env.OKE_STORE_SQL_URL = prev;
@@ -94,10 +83,7 @@ describe("boot lists every missing secret", () => {
       expect(err).toBeInstanceOf(VaultBootError);
       const boot = err as VaultBootError;
       expect(boot.gaps).toHaveLength(2);
-      expect(boot.gaps.map((g) => g.name).sort()).toEqual([
-        "DATABASE_URL",
-        "STRIPE_KEY",
-      ]);
+      expect(boot.gaps.map((g) => g.name).sort()).toEqual(["DATABASE_URL", "STRIPE_KEY"]);
       expect(boot.message).toContain("STRIPE_KEY");
       expect(boot.message).toContain("Payments gateway key");
       expect(boot.message).toContain("DATABASE_URL");
@@ -181,10 +167,7 @@ describe("resolution chain", () => {
 
   test("config cleartext is exposed; secrets are not", async () => {
     const runtime = createVaultRuntime({
-      secrets: [
-        vault.secret("STRIPE_KEY"),
-        vault.config("PUBLIC_URL"),
-      ],
+      secrets: [vault.secret("STRIPE_KEY"), vault.config("PUBLIC_URL")],
       chain: [
         {
           driver: memoryVaultDriver,
@@ -210,14 +193,11 @@ describe("redaction + fingerprints", () => {
     const secret = "sk_live_super_secret_value_do_not_leak";
     const runtime = createVaultRuntime({
       secrets: [vault("STRIPE_KEY")],
-      chain: [
-        { driver: memoryVaultDriver, options: { secrets: { STRIPE_KEY: secret } } },
-      ],
+      chain: [{ driver: memoryVaultDriver, options: { secrets: { STRIPE_KEY: secret } } }],
     });
     await runtime.boot();
 
-    const lines: Array<{ message: string; data?: Record<string, unknown> }> =
-      [];
+    const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
     const { fx } = createFxContextWithVault(runtime, lines);
 
     const value = fx.vault("STRIPE_KEY");
@@ -252,29 +232,6 @@ describe("redaction + fingerprints", () => {
   });
 });
 
-describe("sops / age (Typage)", () => {
-  test("decrypts SOPS JSON in-process with age-encryption", async () => {
-    const identity = await age.generateIdentity();
-    const recipient = await age.identityToRecipient(identity);
-    const { json } = await buildSopsFixture(
-      { STRIPE_KEY: "sk_sops_decrypted" },
-      recipient,
-    );
-
-    const runtime = createVaultRuntime({
-      secrets: [vault("STRIPE_KEY")],
-      chain: [
-        {
-          driver: sopsVaultDriver,
-          options: { ciphertext: json, ageIdentity: identity },
-        },
-      ],
-    });
-    await runtime.boot();
-    expect(runtime.read("STRIPE_KEY")).toBe("sk_sops_decrypted");
-  });
-});
-
 /**
  * Helper — createFx with vault runtime + log sink.
  */