okengine 0.21.1 → 0.22.0

package/src/drivers/journal-postgres.ts

@@ -7,6 +7,19 @@
  * completed journal steps replay instead of re-running).
  */
 
+import {
+  createPostgresIdempotencyStore,
+  IDEM_ATTACH_SQL,
+  IDEM_COMPLETE_SQL,
+  IDEM_DELETE_EXPIRED_ONE_SQL,
+  IDEM_FORFEIT_SQL,
+  IDEM_INSERT_SQL,
+  IDEM_PURGE_SQL,
+  IDEM_RECLAIM_SQL,
+  IDEM_REMOVE_SQL,
+  IDEM_RENEW_SQL,
+  IDEM_SELECT_SQL,
+} from "../kernel/idempotency-store.ts";
 import {
   JOURNAL_DEFAULT_LEASE_MS,
   type JournalEntry,
@@ -199,6 +212,26 @@ async function ensureSchema(sql: PostgresJournalSql): Promise<void> {
   await sql.exec(
     `CREATE INDEX IF NOT EXISTS oke_journal_runs_lease ON oke_journal_runs (status, lease_expires_at)`,
   );
+  await sql.exec(`CREATE TABLE IF NOT EXISTS oke_idempotency (
+    tenant TEXT NOT NULL DEFAULT '',
+    principal TEXT NOT NULL,
+    flow TEXT NOT NULL,
+    key TEXT NOT NULL,
+    fingerprint TEXT NOT NULL,
+    status TEXT NOT NULL,
+    claim_token TEXT NOT NULL,
+    lease_expires_at BIGINT NOT NULL,
+    run_id TEXT,
+    response_status INTEGER,
+    response_headers TEXT,
+    response_body TEXT,
+    created_at BIGINT NOT NULL,
+    expires_at BIGINT NOT NULL,
+    PRIMARY KEY (tenant, principal, flow, key)
+  )`);
+  await sql.exec(
+    `CREATE INDEX IF NOT EXISTS oke_idempotency_expires ON oke_idempotency (expires_at)`,
+  );
 }
 
 /**
@@ -208,9 +241,25 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
   /** Force-kill mid-transaction (drops uncommitted state). */
   killActiveTransaction(): void;
 } {
-  type State = { rows: JournalDbRow[] };
+  type IdemDbRow = {
+    tenant: string;
+    principal: string;
+    flow: string;
+    key: string;
+    fingerprint: string;
+    status: string;
+    claim_token: string;
+    lease_expires_at: number;
+    run_id: string | null;
+    response_status: number | null;
+    response_headers: string | null;
+    response_body: string | null;
+    created_at: number;
+    expires_at: number;
+  };
+  type State = { rows: JournalDbRow[]; idem: IdemDbRow[] };
 
-  let committed: State = { rows: [] };
+  let committed: State = { rows: [], idem: [] };
   let active: { state: State; locked: Set<string>; done: boolean } | null = null;
   /** Run ids held by other active transactions (SKIP LOCKED). */
   const heldByTxn = new Set<string>();
@@ -222,7 +271,19 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
   }
 
   function cloneState(s: State): State {
-    return { rows: s.rows.map((r) => ({ ...r })) };
+    return {
+      rows: s.rows.map((r) => ({ ...r })),
+      idem: s.idem.map((r) => ({ ...r })),
+    };
+  }
+
+  function idemPk(row: IdemDbRow, params: readonly unknown[], offset = 0): boolean {
+    return (
+      row.tenant === String(params[offset]) &&
+      row.principal === String(params[offset + 1]) &&
+      row.flow === String(params[offset + 2]) &&
+      row.key === String(params[offset + 3])
+    );
   }
 
   function claimable(r: JournalDbRow, holder: string, cutoff: number): boolean {
@@ -309,6 +370,12 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
         return state.rows.map((r) => ({ ...r }));
       }
 
+      if (text === IDEM_SELECT_SQL) {
+        return state.idem
+          .filter((row) => idemPk(row, params))
+          .map((row) => ({ ...row }) as Record<string, unknown>);
+      }
+
       throw new Error(`postgres journal fake: unsupported query: ${sql}`);
     },
     async exec(sql, params = []) {
@@ -388,6 +455,103 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
         return { changes: 0 };
       }
 
+      if (text === IDEM_PURGE_SQL) {
+        const now = Number(params[0]);
+        const before = state.idem.length;
+        state.idem = state.idem.filter((row) => row.expires_at > now);
+        return { changes: before - state.idem.length };
+      }
+      if (text === IDEM_DELETE_EXPIRED_ONE_SQL) {
+        const now = Number(params[4]);
+        const idx = state.idem.findIndex((row) => idemPk(row, params) && row.expires_at <= now);
+        if (idx < 0) return { changes: 0 };
+        state.idem.splice(idx, 1);
+        return { changes: 1 };
+      }
+      if (text === IDEM_INSERT_SQL) {
+        if (state.idem.some((row) => idemPk(row, params))) return { changes: 0 };
+        state.idem.push({
+          tenant: String(params[0]),
+          principal: String(params[1]),
+          flow: String(params[2]),
+          key: String(params[3]),
+          fingerprint: String(params[4]),
+          status: "in_progress",
+          claim_token: String(params[5]),
+          lease_expires_at: Number(params[6]),
+          run_id: null,
+          response_status: null,
+          response_headers: null,
+          response_body: null,
+          created_at: Number(params[7]),
+          expires_at: Number(params[8]),
+        });
+        return { changes: 1 };
+      }
+      if (text === IDEM_RECLAIM_SQL) {
+        const row = state.idem.find(
+          (candidate) =>
+            idemPk(candidate, params, 2) && candidate.claim_token === String(params[6]),
+        );
+        if (row === undefined || row.status !== "in_progress") return { changes: 0 };
+        row.claim_token = String(params[0]);
+        row.lease_expires_at = Number(params[1]);
+        return { changes: 1 };
+      }
+      if (text === IDEM_COMPLETE_SQL) {
+        const row = state.idem.find(
+          (candidate) =>
+            idemPk(candidate, params, 4) && candidate.claim_token === String(params[8]),
+        );
+        if (row === undefined) return { changes: 0 };
+        row.status = "completed";
+        row.response_status = Number(params[0]);
+        row.response_headers = params[1] === null ? null : String(params[1]);
+        row.response_body = params[2] === null ? null : String(params[2]);
+        if (params[3] !== null && params[3] !== undefined) row.run_id = String(params[3]);
+        return { changes: 1 };
+      }
+      if (text === IDEM_REMOVE_SQL) {
+        const idx = state.idem.findIndex(
+          (candidate) => idemPk(candidate, params) && candidate.claim_token === String(params[4]),
+        );
+        if (idx < 0) return { changes: 0 };
+        state.idem.splice(idx, 1);
+        return { changes: 1 };
+      }
+      if (text === IDEM_RENEW_SQL) {
+        const row = state.idem.find(
+          (candidate) =>
+            idemPk(candidate, params, 1) &&
+            candidate.claim_token === String(params[5]) &&
+            candidate.status === "in_progress",
+        );
+        if (row === undefined) return { changes: 0 };
+        row.lease_expires_at = Number(params[0]);
+        return { changes: 1 };
+      }
+      if (text === IDEM_ATTACH_SQL) {
+        const row = state.idem.find(
+          (candidate) =>
+            idemPk(candidate, params, 1) && candidate.claim_token === String(params[5]),
+        );
+        if (row === undefined) return { changes: 0 };
+        row.run_id = String(params[0]);
+        return { changes: 1 };
+      }
+      if (text === IDEM_FORFEIT_SQL) {
+        const row = state.idem.find(
+          (candidate) =>
+            idemPk(candidate, params, 1) &&
+            candidate.claim_token === String(params[5]) &&
+            candidate.status === "in_progress",
+        );
+        if (row === undefined) return { changes: 0 };
+        row.claim_token = String(params[0]);
+        row.lease_expires_at = 0;
+        return { changes: 1 };
+      }
+
       throw new Error(`postgres journal fake: unsupported exec: ${sql}`);
     },
     async begin(fn) {
@@ -460,6 +624,7 @@ export async function createPostgresJournalStore(
 
   const store: PostgresJournalStore = {
     sql,
+    idempotency: createPostgresIdempotencyStore(sql),
     async get(runId) {
       const rows = await sql.query(`SELECT * FROM oke_journal_runs WHERE id = ?`, [runId]);
       if (!rows[0]) return undefined;

package/src/drivers/meilisearch.ts

@@ -22,6 +22,7 @@ import type {
   TextIndexStore,
 } from "./types.ts";
 import { hostFromUrl } from "./external.ts";
+import { requestSignal } from "../kernel/abort-scope.ts";
 
 /** Error thrown when the remote Meilisearch is unreachable / unhealthy / errors. */
 export class MeilisearchUnavailableError extends Error {
@@ -134,6 +135,7 @@ export async function openMeilisearchIndex(
       res = await fetchFn(`${url}${path}`, {
         ...init,
         headers: { ...headers, ...(init?.headers ?? {}) },
+        signal: requestSignal(init?.signal ?? null),
       });
     } catch (err) {
       throw new MeilisearchUnavailableError(

package/src/drivers/vault-builtin.test.ts

@@ -115,4 +115,14 @@ describe("builtin vault driver", () => {
       await rm(dir, { recursive: true, force: true });
     }
   }, 15_000);
+
+  test("webhook audit without a URL fails open instead of degrading", async () => {
+    await expect(
+      builtinVaultDriver.open({
+        connection: sharedConn,
+        env: {},
+        audit: { sink: "webhook" },
+      }),
+    ).rejects.toThrow(/webhookUrl/);
+  });
 });

package/src/drivers/vault-builtin.ts

@@ -18,6 +18,7 @@ import {
   sqlConnectionAsExec,
   type BuiltinVaultAdapter,
 } from "../elements/vault/builtin-adapter.ts";
+import { isVaultError } from "../elements/vault/errors.ts";
 import type { SqlConnection } from "./types.ts";
 import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
 
@@ -39,6 +40,10 @@ export interface OpenBuiltinVaultOptions {
   readonly env?: Readonly<Record<string, string | undefined>>;
   /** DEKs re-wrapped per master-rotation batch. */
   readonly kekRewrapBatchSize?: number;
+  /** `vault.audit` from config. Omitted means the SQL hash chain. */
+  readonly audit?: import("../elements/vault/types.ts").VaultAuditConfig;
+  /** Fetch override for the webhook audit sink (tests). */
+  readonly fetch?: typeof globalThis.fetch;
 }
 
 /** An adapter plus the connection this module opened for it, if any. */
@@ -76,6 +81,8 @@ export async function openBuiltinVaultAdapter(
     ...(options.kekRewrapBatchSize === undefined
       ? {}
       : { kekRewrapBatchSize: options.kekRewrapBatchSize }),
+    ...(options.audit === undefined ? {} : { audit: options.audit }),
+    ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
   });
 
   const masterKey = options.masterKey ?? env[VAULT_MASTER_KEY_ENV];
@@ -114,6 +121,8 @@ export const builtinVaultDriver: VaultDriver = {
         opened = await openBuiltinVaultAdapter({
           env,
           ...(options.connection !== undefined ? { connection: options.connection } : { url }),
+          ...(options.audit === undefined ? {} : { audit: options.audit }),
+          ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
         });
         if (opened.adapter.getUnsealer() !== null) {
           for (const entry of await opened.adapter.list()) {
@@ -121,7 +130,10 @@ export const builtinVaultDriver: VaultDriver = {
             if (secret) map.set(entry.path, secret.value);
           }
         }
-      } catch {
+      } catch (err) {
+        // A bad audit sink is a config error — do not hide it behind the
+        // uninitialized-backend fallback.
+        if (isVaultError(err, "MISSING_PEER")) throw err;
         // Uninitialized / sealed / unreachable: fall back to the seed bag so
         // boot reports missing contracts instead of a driver stack trace.
         await opened?.close().catch(() => undefined);

package/src/drivers/vault-remote-bag.ts

@@ -8,6 +8,7 @@
  */
 
 import { VaultError } from "../elements/vault/errors.ts";
+import { requestSignal } from "../kernel/abort-scope.ts";
 import type { VaultBag } from "./vault-types.ts";
 
 /**
@@ -183,7 +184,10 @@ export async function vaultHttpJson(
 ): Promise<VaultHttpJsonResult> {
   let response: Response;
   try {
-    response = await fetchFn(url, init);
+    response = await fetchFn(url, {
+      ...init,
+      signal: requestSignal(init.signal),
+    });
   } catch (error) {
     throw asRemoteVaultError(error, message);
   }

package/src/drivers/vault-types.ts

@@ -46,8 +46,13 @@ export interface VaultOpenOptions {
   readonly region?: string;
   /** Seed map for `memory` / `managed` drivers. */
   readonly secrets?: Readonly<Record<string, string>>;
-  /** HTTP fetch override for remote drivers (tests). */
+  /** HTTP fetch override for remote drivers and the webhook audit sink (tests). */
   readonly fetch?: typeof globalThis.fetch;
+  /**
+   * Built-in vault audit block (`vault.audit`). Honored by the `vault` driver.
+   * Omitted means the SQL hash chain.
+   */
+  readonly audit?: import("../elements/vault/types.ts").VaultAuditConfig;
 }
 
 /** Resolved secret bag — names → cleartext values. Never logged. */

package/src/elements/store/emit-drizzle.ts

@@ -519,12 +519,12 @@ function emitTableBlock(table: SchemaTableDecl, dialect: SqlDialect): string {
   const exportName = exportNameForTable(sqlName);
   const cols = `{\n${lines.join("\n")}\n}`;
   const policies = table.policies ?? [];
+  const ctor = table.rls === true ? "pgTable.withRLS" : "pgTable";
   if (policies.length === 0) {
-    const ctor = table.rls === true ? "pgTable.withRLS" : "pgTable";
     return `export const ${exportName} = ${ctor}(${JSON.stringify(sqlName)}, ${cols});`;
   }
   const extras = policies.map((policy) => `  ${emitPolicyExtra(policy, sqlName)},`).join("\n");
-  return `export const ${exportName} = pgTable(${JSON.stringify(sqlName)}, ${cols}, (_t) => [\n${extras}\n]);`;
+  return `export const ${exportName} = ${ctor}(${JSON.stringify(sqlName)}, ${cols}, (_t) => [\n${extras}\n]);`;
 }
 
 function emitPolicyExtra(policy: SchemaPolicyDecl, table: string): string {

package/src/elements/store/live-default.test.ts

@@ -88,6 +88,7 @@ describe("project-wide store.live default — real boot", () => {
     });
     try {
       await createTestApp(app, {
+        capability: "open",
         boot: {
           stores: [db],
           config: { drivers: { store: { sql: { test: "pglite" } } } },
@@ -127,6 +128,7 @@ describe("project-wide store.live default — real boot", () => {
     });
     try {
       await createTestApp(app, {
+        capability: "open",
         boot: {
           stores: [db],
           config: { drivers: { store: { sql: { test: "pglite" } } } },

package/src/elements/store/live-http.test.ts

@@ -124,6 +124,7 @@ describe("manual live flow (.live(table) + liveQuery) — real boot", () => {
     // SQL unless boot.config.drivers.store.sql is set explicitly.
     try {
       await createTestApp(app, {
+        capability: "open",
         boot: {
           stores: [db],
           config: { drivers: { store: { sql: { test: "pglite" } } } },

package/src/elements/store/resource-list-docs.test.ts

@@ -40,7 +40,7 @@ describe("resource-list-docs fixtures — documented behaviors stay real", () =>
       // (and cleared by the global afterEach registry reset).
       Object.assign(app.$options, { env: "test", stores: [docsListItemsStore] });
 
-      const t = await createTestApp(app);
+      const t = await createTestApp(app, { capability: "open" });
 
       const bad = await app.fetch(new Request("http://localhost/docs-restricted?secret=eq.x"));
       expect(bad.status).toBe(422);
@@ -70,7 +70,7 @@ describe("resource-list-docs fixtures — documented behaviors stay real", () =>
       const app = oke({ name: "docs-admin-test" }).adopt({ docs: exactMounted });
       Object.assign(app.$options, { env: "test", stores: [docsListItemsStore] });
 
-      const t = await createTestApp(app);
+      const t = await createTestApp(app, { capability: "open" });
       const created = await app.fetch(
         new Request("http://localhost/docs-admin", {
           method: "POST",

package/src/elements/store/resource.test.ts

@@ -156,7 +156,7 @@ describe("resource HTTP — exact keys + PII with differing TS/SQL names", () =>
 
   test("app.fetch list/get/create/update: only createdAt + masked email, never raw SQL keys", async () => {
     const app = buildApp();
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
 
     // create → 201
     const created = await app.fetch(
@@ -234,7 +234,7 @@ describe("resource HTTP — exact keys + PII with differing TS/SQL names", () =>
 
   test("list cursor meta walks next and previous", async () => {
     const app = buildApp();
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     for (const email of ["a@example.com", "b@example.com", "c@example.com"]) {
       const created = await app.fetch(
         new Request("http://localhost/contacts", {
@@ -317,7 +317,7 @@ describe("resource HTTP — exact keys + PII with differing TS/SQL names", () =>
       config: { drivers: { store: { sql: { test: "pglite" } } } },
     });
 
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const created = await app.fetch(
       new Request("http://localhost/people", {
         method: "POST",

package/src/elements/store/schema-decl.test.ts

@@ -289,6 +289,7 @@ describe("store.schema RLS extras", () => {
       "scope_booking_create_insert",
     ]);
     const src = emitDrizzleSource([bookings], "postgres");
+    expect(src).toContain("pgTable.withRLS");
     expect(src).toContain("pgPolicy");
     expect(src).toContain("oke.gate() = ");
     expect(src).toContain("oke.user()");

package/src/elements/store/sql-condition.ts

@@ -215,6 +215,8 @@ function compileSqlNode(node: unknown): CompiledNode {
 
   // Group level: only structural parens and ` and ` / ` or ` separators may
   // appear next to nested conditions — anything else is a loud failure.
+  // `1.0.0-rc.5-5935859` glues the parens onto the separator (`"(("`,
+  // `") and ("`, `"))`).
   let joiner: "AND" | "OR" | undefined;
   for (const chunk of chunks) {
     if (isDrizzleSql(chunk)) continue;
@@ -222,14 +224,13 @@ function compileSqlNode(node: unknown): CompiledNode {
     if (text === undefined) {
       throw new TypeError("sql where: unsupported mixed condition");
     }
-    const token = text.trim().toLowerCase();
-    if (token === "" || token === "(" || token === ")") continue;
-    if (token === "and" || token === "or") {
-      const next = token.toUpperCase() as "AND" | "OR";
-      if (joiner !== undefined && joiner !== next) {
+    const sep = groupSeparator(text);
+    if (sep === "skip") continue;
+    if (sep === "AND" || sep === "OR") {
+      if (joiner !== undefined && joiner !== sep) {
         throw new TypeError("sql where: mixed AND/OR at one level — parenthesize explicitly");
       }
-      joiner = next;
+      joiner = sep;
       continue;
     }
     throw new TypeError(`sql where: unsupported fragment ${JSON.stringify(text)}`);
@@ -329,6 +330,22 @@ function compileLeaf(chunks: readonly unknown[]): CompiledNode {
   };
 }
 
+/**
+ * Classify a group-level string chunk.
+ *
+ * Empty or parenthesis-only text is structural. `and` / `or` may sit inside
+ * the parentheses (`") and ("`). Anything else is not a separator.
+ *
+ * @param text - Raw `StringChunk` text
+ */
+function groupSeparator(text: string): "skip" | "AND" | "OR" | undefined {
+  const token = text.trim().toLowerCase().replace(/[()]/g, "").trim();
+  if (token === "") return "skip";
+  if (token === "and") return "AND";
+  if (token === "or") return "OR";
+  return undefined;
+}
+
 function chunksOf(node: unknown): readonly unknown[] {
   return (node as { queryChunks: unknown[] }).queryChunks;
 }
@@ -353,7 +370,7 @@ function isStringChunk(chunk: object): boolean {
 /**
  * Joined text of a Drizzle `StringChunk`.
  *
- * drizzle-orm `1.0.0-rc.5-169397b` stores `value` as a `string`. Earlier
+ * drizzle-orm `1.0.0-rc.5-5935859` stores `value` as a `string`. Earlier
  * snapshots (and the synthetic chunks in `resource.ts`) store `string[]`.
  */
 function chunkText(chunk: unknown): string | undefined {

package/src/elements/store/upsert-app.test.ts

@@ -65,7 +65,7 @@ describe("fx.store(db).upsert via app.fetch (real boot)", () => {
       gate: { policies: [gate.public] },
     }).adopt({ seed });
     Object.assign(app.$options, { env: "test", stores: [db], unguardedHttp: "allow" });
-    await createTestApp(app);
+    await createTestApp(app, { capability: "open" });
 
     async function post(body: unknown) {
       const res = await app.fetch(

package/src/elements/vault/audit.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Audit sinks — secret-free stdout/webhook payloads, and chain commands
+ * that exist only for the `db` sink.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { createAuditSink, type AuditEntry } from "./audit.ts";
+import { buildVaultBootChain } from "./boot-chain.ts";
+import { createBuiltinVaultAdapter, sqlConnectionAsExec } from "./builtin-adapter.ts";
+import { isVaultError } from "./errors.ts";
+import { createMemoryVaultSql } from "./test-helpers.ts";
+
+const ENTRY: AuditEntry = {
+  action: "set",
+  path: "prod/api",
+  actorType: "flow",
+  actorId: "orders.place",
+  success: true,
+  requestId: "req-1",
+  at: new Date("2026-01-02T03:04:05.000Z"),
+};
+
+const SECRET = "sk_live_do_not_log_me";
+
+describe("webhook audit sink", () => {
+  test("missing or non-http webhookUrl fails at construction", () => {
+    expect(() => createAuditSink("webhook")).toThrow(/webhookUrl/);
+    expect(
+      isVaultError(
+        catchError(() => createAuditSink("webhook")),
+        "MISSING_PEER",
+      ),
+    ).toBe(true);
+    expect(
+      isVaultError(
+        catchError(() => createAuditSink("webhook", { webhookUrl: "/relative" })),
+        "MISSING_PEER",
+      ),
+    ).toBe(true);
+    expect(
+      isVaultError(
+        catchError(() => createAuditSink("webhook", { webhookUrl: "ftp://audit.example/hook" })),
+        "MISSING_PEER",
+      ),
+    ).toBe(true);
+  });
+
+  test("POSTs the stdout-shaped JSON, refuses redirects, and omits secret values", async () => {
+    const bodies: string[] = [];
+    const inits: RequestInit[] = [];
+    const sink = createAuditSink("webhook", {
+      webhookUrl: "https://audit.example/hook",
+      fetch: (async (_url, init) => {
+        inits.push(init ?? {});
+        bodies.push(String(init?.body ?? ""));
+        return new Response(null, { status: 204 });
+      }) as typeof fetch,
+    });
+
+    await sink.append(ENTRY);
+
+    expect(inits[0]?.method).toBe("POST");
+    expect(inits[0]?.redirect).toBe("error");
+    expect(inits[0]?.signal).toBeInstanceOf(AbortSignal);
+    const parsed = JSON.parse(bodies[0] ?? "{}") as Record<string, unknown>;
+    expect(parsed).toEqual({
+      sink: "oke.vault.audit",
+      action: "set",
+      path: "prod/api",
+      actorType: "flow",
+      actorId: "orders.place",
+      success: true,
+      errorCode: null,
+      errorMessage: null,
+      requestId: "req-1",
+      createdAt: "2026-01-02T03:04:05.000Z",
+    });
+    expect(bodies[0]).not.toContain(SECRET);
+    expect(parsed).not.toHaveProperty("value");
+  });
+
+  test("a non-2xx response rejects without echoing the body", async () => {
+    const sink = createAuditSink("webhook", {
+      webhookUrl: "https://audit.example/hook",
+      fetch: (async () => new Response(SECRET, { status: 502 })) as unknown as typeof fetch,
+    });
+    const failure = await sink.append(ENTRY).catch((err: unknown) => err);
+    expect(isVaultError(failure, "BACKEND_ERROR")).toBe(true);
+    expect((failure as Error).message).not.toContain(SECRET);
+    expect((failure as Error).message).toContain("502");
+  });
+});
+
+describe("vault boot chain", () => {
+  test("forwards vault.audit only onto the builtin driver layer", () => {
+    const audit = { sink: "webhook" as const, webhookUrl: "https://audit.example/hook" };
+    const chain = buildVaultBootChain({ driverId: "vault", audit });
+    expect(chain[0]?.driver.id).toBe("vault");
+    expect(chain[0]?.options?.audit).toEqual(audit);
+    expect(chain.slice(1).every((layer) => layer.options?.audit === undefined)).toBe(true);
+  });
+});
+
+describe("non-db audit commands", () => {
+  test("verify refuses a webhook sink before touching the chain", async () => {
+    const sql = createMemoryVaultSql();
+    try {
+      const adapter = createBuiltinVaultAdapter({
+        db: sqlConnectionAsExec(sql),
+        audit: { sink: "webhook", webhookUrl: "https://audit.example/hook" },
+        fetch: (async () => new Response(null, { status: 500 })) as unknown as typeof fetch,
+      });
+      const failure = await adapter.verifyAudit().catch((err: unknown) => err);
+      expect(isVaultError(failure, "UNSUPPORTED")).toBe(true);
+      expect((failure as Error).message).toContain('audit.sink "db"');
+
+      const init = await adapter.initialize();
+      expect(init.masterKey.length).toBeGreaterThan(0);
+    } finally {
+      await sql.close();
+    }
+  });
+});
+
+/**
+ * Capture a thrown construction error.
+ *
+ * @param fn - Throwing call
+ */
+function catchError(fn: () => unknown): unknown {
+  try {
+    fn();
+    return undefined;
+  } catch (err) {
+    return err;
+  }
+}