okengine 0.21.1 → 0.23.0

package/src/elements/store/resource.test.ts

@@ -156,7 +156,7 @@ describe("resource HTTP — exact keys + PII with differing TS/SQL names", () =>
 
   test("app.fetch list/get/create/update: only createdAt + masked email, never raw SQL keys", async () => {
     const app = buildApp();
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
 
     // create → 201
     const created = await app.fetch(
@@ -234,7 +234,7 @@ describe("resource HTTP — exact keys + PII with differing TS/SQL names", () =>
 
   test("list cursor meta walks next and previous", async () => {
     const app = buildApp();
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     for (const email of ["a@example.com", "b@example.com", "c@example.com"]) {
       const created = await app.fetch(
         new Request("http://localhost/contacts", {
@@ -317,7 +317,7 @@ describe("resource HTTP — exact keys + PII with differing TS/SQL names", () =>
       config: { drivers: { store: { sql: { test: "pglite" } } } },
     });
 
-    const t = await createTestApp(app);
+    const t = await createTestApp(app, { capability: "open" });
     const created = await app.fetch(
       new Request("http://localhost/people", {
         method: "POST",

package/src/elements/store/schema-decl.test.ts

@@ -289,6 +289,7 @@ describe("store.schema RLS extras", () => {
       "scope_booking_create_insert",
     ]);
     const src = emitDrizzleSource([bookings], "postgres");
+    expect(src).toContain("pgTable.withRLS");
     expect(src).toContain("pgPolicy");
     expect(src).toContain("oke.gate() = ");
     expect(src).toContain("oke.user()");

package/src/elements/store/sql-condition.ts

@@ -215,6 +215,8 @@ function compileSqlNode(node: unknown): CompiledNode {
 
   // Group level: only structural parens and ` and ` / ` or ` separators may
   // appear next to nested conditions — anything else is a loud failure.
+  // `1.0.0-rc.5-5935859` glues the parens onto the separator (`"(("`,
+  // `") and ("`, `"))`).
   let joiner: "AND" | "OR" | undefined;
   for (const chunk of chunks) {
     if (isDrizzleSql(chunk)) continue;
@@ -222,14 +224,13 @@ function compileSqlNode(node: unknown): CompiledNode {
     if (text === undefined) {
       throw new TypeError("sql where: unsupported mixed condition");
     }
-    const token = text.trim().toLowerCase();
-    if (token === "" || token === "(" || token === ")") continue;
-    if (token === "and" || token === "or") {
-      const next = token.toUpperCase() as "AND" | "OR";
-      if (joiner !== undefined && joiner !== next) {
+    const sep = groupSeparator(text);
+    if (sep === "skip") continue;
+    if (sep === "AND" || sep === "OR") {
+      if (joiner !== undefined && joiner !== sep) {
         throw new TypeError("sql where: mixed AND/OR at one level — parenthesize explicitly");
       }
-      joiner = next;
+      joiner = sep;
       continue;
     }
     throw new TypeError(`sql where: unsupported fragment ${JSON.stringify(text)}`);
@@ -329,6 +330,22 @@ function compileLeaf(chunks: readonly unknown[]): CompiledNode {
   };
 }
 
+/**
+ * Classify a group-level string chunk.
+ *
+ * Empty or parenthesis-only text is structural. `and` / `or` may sit inside
+ * the parentheses (`") and ("`). Anything else is not a separator.
+ *
+ * @param text - Raw `StringChunk` text
+ */
+function groupSeparator(text: string): "skip" | "AND" | "OR" | undefined {
+  const token = text.trim().toLowerCase().replace(/[()]/g, "").trim();
+  if (token === "") return "skip";
+  if (token === "and") return "AND";
+  if (token === "or") return "OR";
+  return undefined;
+}
+
 function chunksOf(node: unknown): readonly unknown[] {
   return (node as { queryChunks: unknown[] }).queryChunks;
 }
@@ -353,7 +370,7 @@ function isStringChunk(chunk: object): boolean {
 /**
  * Joined text of a Drizzle `StringChunk`.
  *
- * drizzle-orm `1.0.0-rc.5-169397b` stores `value` as a `string`. Earlier
+ * drizzle-orm `1.0.0-rc.5-5935859` stores `value` as a `string`. Earlier
  * snapshots (and the synthetic chunks in `resource.ts`) store `string[]`.
  */
 function chunkText(chunk: unknown): string | undefined {

package/src/elements/store/sql-session.test.ts

@@ -156,6 +156,57 @@ describe("SqlStoreHandle — upsert", () => {
     expect(row).toEqual({ id: "welcome", title: "Hello", createdAt: 1 });
   });
 
+  test("primary-key insert and update each hit the connection once", async () => {
+    let queries = 0;
+    const counting = {
+      driverId: sharedConn.driverId,
+      role: sharedConn.role,
+      query(sql: string, params?: readonly unknown[]) {
+        queries += 1;
+        return sharedConn.query(sql, params);
+      },
+      exec: (sql: string, params?: readonly unknown[]) => sharedConn.exec(sql, params),
+      close: () => sharedConn.close(),
+    } satisfies SqlConnection;
+    const handle = createSqlStoreHandle("sql:app", {
+      connection: counting,
+      classifications: new Map(),
+      routedRole: "primary",
+      domainDdl: "off",
+    });
+
+    queries = 0;
+    const inserted = await handle.upsert(
+      posts,
+      { id: "once" },
+      { id: "once", title: "a", createdAt: 1 },
+    );
+    expect(inserted.status).toBe("upserted");
+    expect(queries).toBe(1);
+
+    queries = 0;
+    const updated = await handle.upsert(
+      posts,
+      { id: "once" },
+      { id: "once", title: "b", createdAt: 2 },
+      { onExisting: "update" },
+    );
+    expect(updated.status).toBe("changed");
+    expect(queries).toBe(1);
+
+    const row = await sharedHandle.findById(posts, "once");
+    expect(row).toEqual({ id: "once", title: "b", createdAt: 2 });
+
+    queries = 0;
+    const other = await handle.upsert(
+      posts,
+      { title: "missing" },
+      { id: "other", title: "missing", createdAt: 3 },
+    );
+    expect(other.status).toBe("upserted");
+    expect(queries).toBe(2);
+  });
+
   test("onExisting update changes matched columns", async () => {
     await sharedHandle.upsert(posts, { id: "n1" }, { id: "n1", title: "one", createdAt: 10 });
     const updated = await sharedHandle.upsert(

package/src/elements/store/sql-session.ts

@@ -424,7 +424,9 @@ export interface SqlStoreHandle {
   exists(table: TableHandle | unknown, idOrWhere: string | WhereMap): Promise<boolean>;
   /**
    * Insert when no row matches `matchOn`; never touches an existing match
-   * unless `options.onExisting` is `"update"`.
+   * unless `options.onExisting` is `"update"`. A match that is only the
+   * primary key is one `INSERT … ON CONFLICT` round trip on postgres and
+   * pglite. Memory SQL, and any other predicate, stays a read then a write.
    *
    * @param table - Table
    * @param matchOn - Equality map or Drizzle condition identifying the row
@@ -685,6 +687,101 @@ export function createSqlStoreHandle(
     return coerceCompiledWhere(table, compileWhere(where));
   }
 
+  /**
+   * Primary-key equality only. Any other predicate cannot use `ON CONFLICT`.
+   *
+   * @param compiled - Match clause
+   * @param pkCol - Primary key SQL name
+   */
+  function primaryKeyEquality(
+    compiled: ReturnType<typeof compileWhere>,
+    pkCol: string,
+  ): { readonly value: unknown } | undefined {
+    if (compiled.predicates.length !== 1) return undefined;
+    const pred = compiled.predicates[0];
+    if (!pred || pred.op !== "=" || pred.column !== pkCol) return undefined;
+    return { value: pred.value };
+  }
+
+  /**
+   * One round trip: `INSERT … ON CONFLICT (pk)`.
+   *
+   * `DO NOTHING` when the existing row must stay. `DO UPDATE` captures the
+   * pre-image in a CTE so CDC still sees before and after.
+   *
+   * @param table - Table
+   * @param name - SQL table name
+   * @param pkCol - Primary key SQL name
+   * @param pkValue - Bound primary key
+   * @param values - Insert / update payload
+   * @param onExisting - `"update"` rewrites the existing row
+   */
+  async function upsertOnPrimaryKey(
+    table: TableHandle | unknown,
+    name: string,
+    pkCol: string,
+    pkValue: unknown,
+    values: SqlRow,
+    onExisting: "update" | undefined,
+  ): Promise<UpsertResult> {
+    const prepared = prepareInsertRow(table, values);
+    if (!(pkCol in prepared)) prepared[pkCol] = pkValue;
+    const cols = Object.keys(prepared);
+    const colList = cols.map(quoteIdent).join(", ");
+    const placeholders = cols.map(() => "?").join(", ");
+    const params = cols.map((col) => prepared[col]);
+    const quotedPk = quoteIdent(pkCol);
+    const quotedName = quoteIdent(name);
+    const setEntries =
+      onExisting === "update"
+        ? Object.entries(prepareUpdateRow(table, values)).filter(([col]) => col !== pkCol)
+        : [];
+    if (onExisting !== "update" || setEntries.length === 0) {
+      const rows = await query(
+        `INSERT INTO ${quotedName} (${colList}) VALUES (${placeholders})` +
+          ` ON CONFLICT (${quotedPk}) DO NOTHING RETURNING *`,
+        params,
+      );
+      if (rows.length === 0) {
+        return { status: onExisting === "update" ? "changed" : "already-existed" };
+      }
+      notifySqlCdc({
+        tableName: name,
+        op: "insert",
+        before: null,
+        after: toJs(table, rows)[0] ?? null,
+      });
+      return { status: "upserted" };
+    }
+    const setSql = setEntries
+      .map(([col]) => `${quoteIdent(col)} = EXCLUDED.${quoteIdent(col)}`)
+      .join(", ");
+    // The old row is a CTE, then read from an outer SELECT. INSERT …
+    // RETURNING cannot see that CTE on PGlite, so the before image would
+    // be null and an update would look like an insert.
+    const result = await query(
+      `WITH __oke_old AS (` +
+        `SELECT * FROM ${quotedName} WHERE ${quotedPk} = ? FOR UPDATE` +
+        `), __oke_new AS (` +
+        `INSERT INTO ${quotedName} (${colList}) VALUES (${placeholders})` +
+        ` ON CONFLICT (${quotedPk}) DO UPDATE SET ${setSql}` +
+        ` RETURNING *` +
+        `) SELECT (SELECT row_to_json(__oke_old) FROM __oke_old) AS __oke_before_data,` +
+        ` (SELECT row_to_json(__oke_new) FROM __oke_new) AS __oke_after_data`,
+      [pkValue, ...params],
+    );
+    const raw = result[0];
+    const before = raw ? jsonImageToJs(table, raw.__oke_before_data) : null;
+    const after = raw ? jsonImageToJs(table, raw.__oke_after_data) : null;
+    notifySqlCdc({
+      tableName: name,
+      op: before ? "update" : "insert",
+      before,
+      after,
+    });
+    return { status: before ? "changed" : "upserted" };
+  }
+
   /**
    * Postgres `row_to_json` images come back as JSON strings on pglite and
    * objects on Bun.SQL — normalize to the JS row mapping (snake→camel).
@@ -1026,6 +1123,19 @@ export function createSqlStoreHandle(
       if (!compiled.clause) {
         throw new Error("upsert() requires at least one matchOn predicate");
       }
+      const pkCol = resolvePkColumn(table);
+      const pkMatch = primaryKeyEquality(compiled, pkCol);
+      // Memory SQL has no ON CONFLICT. Postgres and PGlite do.
+      if (pkMatch && connection.driverId !== "memory") {
+        return upsertOnPrimaryKey(
+          table,
+          name,
+          pkCol,
+          pkMatch.value,
+          values,
+          upsertOptions?.onExisting,
+        );
+      }
       const found = await query(
         `SELECT 1 AS "ok" FROM ${quoteIdent(name)} WHERE ${compiled.clause} LIMIT 1`,
         compiled.params,

package/src/elements/store/upsert-app.test.ts

@@ -65,7 +65,7 @@ describe("fx.store(db).upsert via app.fetch (real boot)", () => {
       gate: { policies: [gate.public] },
     }).adopt({ seed });
     Object.assign(app.$options, { env: "test", stores: [db], unguardedHttp: "allow" });
-    await createTestApp(app);
+    await createTestApp(app, { capability: "open" });
 
     async function post(body: unknown) {
       const res = await app.fetch(

package/src/elements/vault/audit.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Audit sinks — secret-free stdout/webhook payloads, and chain commands
+ * that exist only for the `db` sink.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { createAuditSink, type AuditEntry } from "./audit.ts";
+import { buildVaultBootChain } from "./boot-chain.ts";
+import { createBuiltinVaultAdapter, sqlConnectionAsExec } from "./builtin-adapter.ts";
+import { isVaultError } from "./errors.ts";
+import { createMemoryVaultSql } from "./test-helpers.ts";
+
+const ENTRY: AuditEntry = {
+  action: "set",
+  path: "prod/api",
+  actorType: "flow",
+  actorId: "orders.place",
+  success: true,
+  requestId: "req-1",
+  at: new Date("2026-01-02T03:04:05.000Z"),
+};
+
+const SECRET = "sk_live_do_not_log_me";
+
+describe("webhook audit sink", () => {
+  test("missing or non-http webhookUrl fails at construction", () => {
+    expect(() => createAuditSink("webhook")).toThrow(/webhookUrl/);
+    expect(
+      isVaultError(
+        catchError(() => createAuditSink("webhook")),
+        "MISSING_PEER",
+      ),
+    ).toBe(true);
+    expect(
+      isVaultError(
+        catchError(() => createAuditSink("webhook", { webhookUrl: "/relative" })),
+        "MISSING_PEER",
+      ),
+    ).toBe(true);
+    expect(
+      isVaultError(
+        catchError(() => createAuditSink("webhook", { webhookUrl: "ftp://audit.example/hook" })),
+        "MISSING_PEER",
+      ),
+    ).toBe(true);
+  });
+
+  test("POSTs the stdout-shaped JSON, refuses redirects, and omits secret values", async () => {
+    const bodies: string[] = [];
+    const inits: RequestInit[] = [];
+    const sink = createAuditSink("webhook", {
+      webhookUrl: "https://audit.example/hook",
+      fetch: (async (_url, init) => {
+        inits.push(init ?? {});
+        bodies.push(String(init?.body ?? ""));
+        return new Response(null, { status: 204 });
+      }) as typeof fetch,
+    });
+
+    await sink.append(ENTRY);
+
+    expect(inits[0]?.method).toBe("POST");
+    expect(inits[0]?.redirect).toBe("error");
+    expect(inits[0]?.signal).toBeInstanceOf(AbortSignal);
+    const parsed = JSON.parse(bodies[0] ?? "{}") as Record<string, unknown>;
+    expect(parsed).toEqual({
+      sink: "oke.vault.audit",
+      action: "set",
+      path: "prod/api",
+      actorType: "flow",
+      actorId: "orders.place",
+      success: true,
+      errorCode: null,
+      errorMessage: null,
+      requestId: "req-1",
+      createdAt: "2026-01-02T03:04:05.000Z",
+    });
+    expect(bodies[0]).not.toContain(SECRET);
+    expect(parsed).not.toHaveProperty("value");
+  });
+
+  test("a non-2xx response rejects without echoing the body", async () => {
+    const sink = createAuditSink("webhook", {
+      webhookUrl: "https://audit.example/hook",
+      fetch: (async () => new Response(SECRET, { status: 502 })) as unknown as typeof fetch,
+    });
+    const failure = await sink.append(ENTRY).catch((err: unknown) => err);
+    expect(isVaultError(failure, "BACKEND_ERROR")).toBe(true);
+    expect((failure as Error).message).not.toContain(SECRET);
+    expect((failure as Error).message).toContain("502");
+  });
+});
+
+describe("vault boot chain", () => {
+  test("forwards vault.audit only onto the builtin driver layer", () => {
+    const audit = { sink: "webhook" as const, webhookUrl: "https://audit.example/hook" };
+    const chain = buildVaultBootChain({ driverId: "vault", audit });
+    expect(chain[0]?.driver.id).toBe("vault");
+    expect(chain[0]?.options?.audit).toEqual(audit);
+    expect(chain.slice(1).every((layer) => layer.options?.audit === undefined)).toBe(true);
+  });
+});
+
+describe("non-db audit commands", () => {
+  test("verify refuses a webhook sink before touching the chain", async () => {
+    const sql = createMemoryVaultSql();
+    try {
+      const adapter = createBuiltinVaultAdapter({
+        db: sqlConnectionAsExec(sql),
+        audit: { sink: "webhook", webhookUrl: "https://audit.example/hook" },
+        fetch: (async () => new Response(null, { status: 500 })) as unknown as typeof fetch,
+      });
+      const failure = await adapter.verifyAudit().catch((err: unknown) => err);
+      expect(isVaultError(failure, "UNSUPPORTED")).toBe(true);
+      expect((failure as Error).message).toContain('audit.sink "db"');
+
+      const init = await adapter.initialize();
+      expect(init.masterKey.length).toBeGreaterThan(0);
+    } finally {
+      await sql.close();
+    }
+  });
+});
+
+/**
+ * Capture a thrown construction error.
+ *
+ * @param fn - Throwing call
+ */
+function catchError(fn: () => unknown): unknown {
+  try {
+    fn();
+    return undefined;
+  } catch (err) {
+    return err;
+  }
+}

package/src/elements/vault/audit.ts

@@ -9,8 +9,10 @@
 
 import { VaultError } from "./errors.ts";
 import type { VaultErrorCode } from "./errors.ts";
-import type { VaultActorType } from "./types.ts";
-import type { VaultAuditSinkKind } from "./types.ts";
+import type { VaultActorType, VaultAuditConfig, VaultAuditSinkKind } from "./types.ts";
+
+/** Bound on a webhook audit POST so a dead receiver cannot stall a write. */
+const AUDIT_WEBHOOK_TIMEOUT_MS = 5_000;
 
 /** Operations recorded in the audit chain. */
 export type AuditAction =
@@ -110,8 +112,10 @@ export interface AuditWriter {
 export interface CreateAuditSinkOptions {
   /** Required for the `db` sink. */
   readonly writer?: AuditWriter;
-  /** Required for the `webhook` sink (not yet implemented). */
+  /** Required for the `webhook` sink. Absolute `http:` or `https:` URL. */
   readonly webhookUrl?: string;
+  /** Fetch implementation for the `webhook` sink (tests). */
+  readonly fetch?: typeof globalThis.fetch;
   /** Line writer for the `stdout` sink (tests). */
   readonly write?: (line: string) => void;
   /** Clock for `stdout` timestamps (tests). */
@@ -169,23 +173,98 @@ export async function computeAuditRowHash(
   return Buffer.from(new Uint8Array(digest)).toString("hex");
 }
 
+/**
+ * Reject a webhook URL that is missing or not an absolute http(s) URL.
+ *
+ * @param webhookUrl - Configured destination
+ * @returns Absolute URL string
+ * @throws VaultError `MISSING_PEER` when the URL is absent or not http(s)
+ */
+function requireWebhookUrl(webhookUrl: string | undefined): string {
+  const raw = webhookUrl?.trim() ?? "";
+  if (raw.length === 0) {
+    throw new VaultError("MISSING_PEER", "vault: webhook audit sink requires webhookUrl");
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new VaultError(
+      "MISSING_PEER",
+      "vault: webhook audit sink requires an absolute http(s) webhookUrl",
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new VaultError(
+      "MISSING_PEER",
+      "vault: webhook audit sink requires an absolute http(s) webhookUrl",
+    );
+  }
+  return parsed.href;
+}
+
+/**
+ * JSON body shared by the `stdout` and `webhook` sinks.
+ *
+ * Only normalized metadata is serialized — an entry never holds a value.
+ *
+ * @param entry - Operation to record
+ * @param now - Clock when the entry has no `at`
+ */
+function auditEventJson(entry: AuditEntry, now: () => Date): string {
+  return JSON.stringify({
+    sink: "oke.vault.audit",
+    ...toAuditHashPayload(entry, entry.at ?? now()),
+  });
+}
+
 /**
  * Build an audit sink.
  *
  * - `db` delegates to an {@link AuditWriter} supplied by storage.
  * - `stdout` writes one secret-free JSON line per operation.
- * - `webhook` is not implemented yet and throws `UNSUPPORTED`.
+ * - `webhook` POSTs that same JSON. Delivery failure throws; callers that
+ *   record after a successful operation swallow it.
+ *
+ * Hash-chain verify and purge apply only to the `db` sink.
  *
  * @param kind - Sink kind from `audit.sink`
  * @param opts - Writer / webhook URL / test seams
- * @throws VaultError `UNSUPPORTED` for `webhook`, or `MISSING_PEER` when `db` has no writer
+ * @throws VaultError `MISSING_PEER` when `db` has no writer or `webhook` has no absolute URL
  */
 export function createAuditSink(
   kind: VaultAuditSinkKind,
   opts: CreateAuditSinkOptions = {},
 ): AuditSink {
   if (kind === "webhook") {
-    throw new VaultError("UNSUPPORTED", "vault: webhook audit sink is not implemented");
+    const url = requireWebhookUrl(opts.webhookUrl);
+    const fetchFn = opts.fetch ?? globalThis.fetch;
+    const now = opts.now ?? (() => new Date());
+    return {
+      kind: "webhook",
+      async append(entry) {
+        const body = auditEventJson(entry, now);
+        let response: Response;
+        try {
+          response = await fetchFn(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body,
+            redirect: "error",
+            signal: AbortSignal.timeout(AUDIT_WEBHOOK_TIMEOUT_MS),
+          });
+        } catch (err) {
+          if (err instanceof VaultError) throw err;
+          throw new VaultError("BACKEND_ERROR", "vault: webhook audit sink request failed");
+        }
+        if (!response.ok) {
+          throw new VaultError(
+            "BACKEND_ERROR",
+            `vault: webhook audit sink failed (${response.status})`,
+          );
+        }
+      },
+    };
   }
 
   if (kind === "db") {
@@ -206,17 +285,31 @@ export function createAuditSink(
   return {
     kind: "stdout",
     async append(entry) {
-      // Only normalized metadata is serialized — an entry never holds a value.
-      write(
-        JSON.stringify({
-          sink: "oke.vault.audit",
-          ...toAuditHashPayload(entry, entry.at ?? now()),
-        }),
-      );
+      write(auditEventJson(entry, now));
     },
   };
 }
 
+/**
+ * Pick the sink for a built-in adapter from `vault.audit`.
+ *
+ * `enabled: false` drops every row. Omitted config is the `db` chain.
+ *
+ * @param config - `vault.audit` block, when present
+ * @param opts - SQL writer and optional fetch
+ */
+export function auditSinkForConfig(
+  config: VaultAuditConfig | undefined,
+  opts: { readonly writer: AuditWriter; readonly fetch?: typeof globalThis.fetch },
+): AuditSink {
+  if (config?.enabled === false) return createNullAuditSink();
+  return createAuditSink(config?.sink ?? "db", {
+    writer: opts.writer,
+    ...(config?.webhookUrl === undefined ? {} : { webhookUrl: config.webhookUrl }),
+    ...(opts.fetch === undefined ? {} : { fetch: opts.fetch }),
+  });
+}
+
 /**
  * Sink that drops every entry (`audit.enabled: false`).
  *

package/src/elements/vault/boot-chain.ts

@@ -22,6 +22,7 @@ import {
 import { parseDotenv } from "../../drivers/vault-dotenv-parse.ts";
 import type { VaultDriverId } from "../../drivers/vault-types.ts";
 import { resolveComposeEnvPath } from "./chain.ts";
+import type { VaultAuditConfig } from "./types.ts";
 import type { VaultChainLayer } from "./runtime.ts";
 
 /** Options for {@link buildVaultBootChain}. */
@@ -34,6 +35,10 @@ export interface BuildVaultBootChainOptions {
   readonly env?: ConfigEnv;
   /** Seed secrets for the terminal memory / managed layer. */
   readonly seed?: Readonly<Record<string, string>>;
+  /**
+   * Built-in store audit block. Forwarded only to the `vault` driver layer.
+   */
+  readonly audit?: VaultAuditConfig;
 }
 
 /**
@@ -142,7 +147,10 @@ export function buildVaultBootChain(options: BuildVaultBootChainOptions): VaultC
         {
           driver: builtinVaultDriver,
           source: "driver",
-          options: { secrets: seed },
+          options: {
+            secrets: seed,
+            ...(options.audit === undefined ? {} : { audit: options.audit }),
+          },
         },
         ...envLayers,
       ];