okengine 0.6.0 → 0.6.1

package/README.md

@@ -1,21 +1,90 @@
 <p align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="site/public/logo/OKE-W.svg" />
-    <img alt="OKE" src="site/public/logo/OKE-B.svg" width="220" />
+    <source
+      media="(prefers-color-scheme: dark)"
+      srcset="https://shieldcn.dev/header/grid.svg?title=okengine&subtitle=One+law.+Eight+elements.+Ten+exports.&logo=https://raw.githubusercontent.com/omqkhafi/okengine/main/site/public/logo/OKE-W.svg&theme=zinc&size=banner&mode=dark&font=geist&align=left"
+    />
+    <img
+      alt="okengine — One law. Eight elements. Ten exports."
+      src="https://shieldcn.dev/header/grid.svg?title=okengine&subtitle=One+law.+Eight+elements.+Ten+exports.&logo=https://raw.githubusercontent.com/omqkhafi/okengine/main/site/public/logo/OKE-B.svg&theme=zinc&size=banner&mode=light&font=geist&align=left"
+      width="750"
+    />
   </picture>
 </p>
 
-# okengine
-
-_"Stop gluing APIs, jobs, and queues into one backend. One law collapses them — client, Console, and infra come free. Yours to host."_
+<p align="center">
+  <a href="https://www.npmjs.com/package/okengine">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/npm/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="npm" src="https://shieldcn.dev/npm/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://jsr.io/@omqkhafi/okengine">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/jsr/@omqkhafi/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="JSR" src="https://shieldcn.dev/jsr/@omqkhafi/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://www.npmjs.com/package/create-oke">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/npm/create-oke.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="create-oke" src="https://shieldcn.dev/npm/create-oke.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://www.npmjs.com/package/okengine">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/npm/types/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="types" src="https://shieldcn.dev/npm/types/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://opensource.org/licenses/MIT">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/license/omqkhafi/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="MIT" src="https://shieldcn.dev/github/license/omqkhafi/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://bun.sh">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/badge/Bun-%3E%3D1.3.svg?logo=bun&variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="Bun >=1.3" src="https://shieldcn.dev/badge/Bun-%3E%3D1.3.svg?logo=bun&variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://github.com/omqkhafi/okengine/releases">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/release/omqkhafi/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="release" src="https://shieldcn.dev/github/release/omqkhafi/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://github.com/omqkhafi/okengine/stargazers">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/stars/omqkhafi/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="stars" src="https://shieldcn.dev/github/stars/omqkhafi/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://github.com/omqkhafi/okengine/actions">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/ci/omqkhafi/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="CI" src="https://shieldcn.dev/github/ci/omqkhafi/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+  <a href="https://github.com/omqkhafi/okengine/commits">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/last-commit/omqkhafi/okengine.svg?variant=outline&mode=dark&size=sm&theme=zinc&font=geist" />
+      <img alt="last commit" src="https://shieldcn.dev/github/last-commit/omqkhafi/okengine.svg?variant=outline&mode=light&size=sm&theme=zinc&font=geist" />
+    </picture>
+  </a>
+</p>
 
-[![npm](https://img.shields.io/npm/v/okengine.svg)](https://www.npmjs.com/package/okengine)
-[![JSR](https://jsr.io/badges/@omqkhafi/okengine)](https://jsr.io/@omqkhafi/okengine)
-[![npm](https://img.shields.io/npm/v/create-oke.svg)](https://www.npmjs.com/package/create-oke)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![Bun >=1.3](https://img.shields.io/badge/Bun-%3E%3D1.3-black.svg)](https://bun.sh)
+<p align="center">
+  <em>Stop gluing APIs, jobs, and queues into one backend. One law collapses them — client, Console, and infra come free. Yours to host.</em>
+</p>
 
-**Docs:** [oke.omqkhafi.dev](https://oke.omqkhafi.dev) · **Handbook:** [/docs](https://oke.omqkhafi.dev/docs) · **CLI:** `oke` · **Scaffold:** [`create-oke`](https://www.npmjs.com/package/create-oke)
+<p align="center">
+  <a href="https://oke.omqkhafi.dev"><strong>Docs</strong></a> ·
+  <a href="https://oke.omqkhafi.dev/docs"><strong>Handbook</strong></a> ·
+  <code>oke</code> CLI ·
+  <a href="https://www.npmjs.com/package/create-oke"><code>create-oke</code></a>
+</p>
 
 > [!WARNING]
 > **Early development (`v0.x`) — not production-ready.**
@@ -27,13 +96,13 @@ _"Stop gluing APIs, jobs, and queues into one backend. One law collapses them
 ```bash
 bun add okengine                                   # framework + `oke` CLI
 bunx jsr add @omqkhafi/okengine                    # JSR — library API only
-bunx create-oke@latest my-app --template hello     # scaffold
+bunx create-oke@latest my-app                      # scaffold
 ```
 
 ## Quick start
 
 ```bash
-bunx create-oke@latest my-app --template hello
+bunx create-oke@latest my-app
 cd my-app
 oke dev
 # or: oke mode docker && oke dev   # compose infra · app on host Bun
@@ -102,6 +171,72 @@ export const remove = mounted.remove;
 
 Full walkthrough: [Basic usage](https://oke.omqkhafi.dev/docs/get-started/basic-usage).
 
+## Charts
+
+<p align="center">
+  <a href="https://github.com/omqkhafi/okengine/issues">
+    <picture>
+      <source
+        media="(prefers-color-scheme: dark)"
+        srcset="https://shieldcn.dev/chart/github/issues/omqkhafi/okengine.svg?theme=zinc&font=geist&mode=dark"
+      />
+      <img
+        alt="GitHub issues over time"
+        src="https://shieldcn.dev/chart/github/issues/omqkhafi/okengine.svg?theme=zinc&font=geist&mode=light"
+        width="750"
+      />
+    </picture>
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/omqkhafi">
+    <picture>
+      <source
+        media="(prefers-color-scheme: dark)"
+        srcset="https://shieldcn.dev/chart/github/commits/omqkhafi.svg?theme=zinc&font=geist&mode=dark"
+      />
+      <img
+        alt="Lifetime commit history"
+        src="https://shieldcn.dev/chart/github/commits/omqkhafi.svg?theme=zinc&font=geist&mode=light"
+        width="750"
+      />
+    </picture>
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/okengine">
+    <picture>
+      <source
+        media="(prefers-color-scheme: dark)"
+        srcset="https://shieldcn.dev/chart/npm/okengine.svg?theme=zinc&font=geist&mode=dark"
+      />
+      <img
+        alt="okengine npm downloads"
+        src="https://shieldcn.dev/chart/npm/okengine.svg?theme=zinc&font=geist&mode=light"
+        width="750"
+      />
+    </picture>
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/create-oke">
+    <picture>
+      <source
+        media="(prefers-color-scheme: dark)"
+        srcset="https://shieldcn.dev/chart/npm/create-oke.svg?theme=zinc&font=geist&mode=dark"
+      />
+      <img
+        alt="create-oke npm downloads"
+        src="https://shieldcn.dev/chart/npm/create-oke.svg?theme=zinc&font=geist&mode=light"
+        width="750"
+      />
+    </picture>
+  </a>
+</p>
+
 ## Documentation
 
 Everything beyond this page lives in the site handbook:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okengine",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "One law. Eight elements. Ten exports. One package. One manifest. Every backend need is derived, never added.",
   "license": "MIT",
   "repository": {
@@ -58,7 +58,7 @@
     "prepack": "bun run build",
     "bench": "bun test ./src/runtime/cold-start.bench.ts src/client/budget.test.ts src/console/budget.test.ts src/kernel/budget.test.ts src/kernel/routing-budget.test.ts src/runs/bench.test.ts",
     "budgets": "bun src/release/publish.ts",
-    "gate": "bun test src/cli/doc-staleness.test.ts src/cli/competitor-mention-removal.test.ts src/drivers/vault-driver-removal.test.ts src/kernel/errors.registry.test.ts src/upgrade/codemods.test.ts",
+    "gate": "PUBLISH_GATE=1 bun test src/cli/doc-staleness.test.ts src/cli/competitor-mention-removal.test.ts src/drivers/vault-driver-removal.test.ts src/kernel/errors.registry.test.ts src/upgrade/codemods.test.ts scripts/publish.gate.test.ts",
     "dev": "bun run --cwd site dev",
     "site:build": "bun run --cwd site build",
     "ci": "bun scripts/ci.ts",
@@ -73,7 +73,7 @@
     "ajv-formats": "^3.0.1",
     "intl-messageformat": "^11.2.13",
     "oxc-parser": "^0.142.0",
-    "sently": "^0.8.0"
+    "sently": "1.0.0"
   },
   "devDependencies": {
     "@base-ui/react": "^1.6.0",

package/site/content/docs/elements/channel.mdx

@@ -109,23 +109,52 @@ Each send records its attempts — driver, ok/error, timestamp, message id — s
 
 ## Per-environment drivers
 
+Boot opens the email driver from `drivers.channel.email`, and appends an SMS
+driver when `drivers.channel.sms` is set (other than `console`). WhatsApp and
+push drivers are passed via `BootOptions.channel.drivers` when you need them.
+
 ```typescript title="oke.config.ts"
 drivers: {
   channel: {
     email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
+    // optional — omit until you need SMS at boot
+    sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
   },
 },
 images: {
-  "channel.email": "axllent/mailpit:v1.22.3", // SMTP catcher for the docker stack
+  "channel.email": "axllent/mailpit:v1.22.3",
 },
 ```
 
-| Driver     | Medium | Behavior                                             |
-| ---------- | ------ | ---------------------------------------------------- |
-| `console`  | any    | Captures into a readable inbox — local + tests       |
-| `smtp`     | email  | Real SMTP — Mailpit in docker, your provider in prod |
-| `resend`   | email  | Resend API                                           |
-| `unifonic` | sms    | Unifonic SMS API                                     |
+| Driver     | Medium   | Behavior                                                            |
+| ---------- | -------- | ------------------------------------------------------------------- |
+| `console`  | any      | Captures into a readable inbox — local + tests                      |
+| `smtp`     | email    | Real SMTP — Mailpit in docker, your provider in prod                |
+| `resend`   | email    | Resend HTTP API (`RESEND_API_KEY`)                                  |
+| `sndr`     | email    | SNDR HTTP API (`SNDR_API_KEY`)                                      |
+| `taqnyat`  | sms      | Taqnyat SMS (`TAQNYAT_BEARER_TOKEN` + `TAQNYAT_SENDER`)             |
+| `msegat`   | sms      | Msegat SMS (`MSEGAT_USERNAME` + `MSEGAT_API_KEY` + `MSEGAT_SENDER`) |
+| `unifonic` | sms      | Unifonic el.cloud SMS (`UNIFONIC_APPSID`)                           |
+| `wa-cloud` | whatsapp | Meta WhatsApp Cloud API                                             |
+| `webpush`  | push     | Web Push + VAPID (`createPushSender` → `WebPushTransport`)          |
+| `fcm`      | push     | Firebase Cloud Messaging HTTP v1                                    |
+
+Email fallback uses ordered email transports; SMS with multiple SMS drivers uses
+the same failover path. Credentials for boot-opened drivers are listed under
+[Environment Variables](/docs/reference/environment-variables).
+
+`webpush` needs VAPID keys — open it yourself and include it in
+`BootOptions.channel.drivers` (boot does not open push from env):
+
+```typescript
+import { openWebPushChannel } from "okengine/drivers/channel-webpush";
+
+openWebPushChannel({
+  vapidPublicKey: process.env.VAPID_PUBLIC_KEY!,
+  vapidPrivateKey: process.env.VAPID_PRIVATE_KEY!,
+  vapidSubject: process.env.VAPID_SUBJECT,
+});
+```
 
 ## Troubleshooting
 
@@ -144,11 +173,44 @@ Check consent first: if they opted out, sends to them are suppressed by design.
 
 Locale resolution falls back through the chain to your default locale when a translation is missing — the send still succeeds with the fallback body. Check that the template declares `locales: ["en", "ar"]` and that the Arabic body exists in the catalog.
 
+</Accordion>
+<Accordion title="How do I ingest SNDR / Unifonic delivery webhooks?">
+
+```typescript
+import {
+  parseSndrWebhook,
+  verifySndrSignature,
+  parseUnifonicWebhook,
+  toDeliveryEvent,
+} from "okengine/channel";
+```
+
+Verify the signature when the provider sends one, parse the body, then call
+`ingestOutcome` on your channel runtime with the bounce/complaint fields.
+Console reads the receipt ledger — never raw webhook JSON.
+
 </Accordion>
 <Accordion title="How do I know which medium finally delivered?">
 
 The receipt keeps every attempt in order with its outcome. A send that succeeded on a later medium reports status `fallback` — you can see the full chain in Console → Channels.
 
+</Accordion>
+<Accordion title="How do I verify Web Push against a real browser?">
+
+Subscribe in a real browser with sently’s `examples/webpush-interop` page
+(paste the same `VAPID_PUBLIC_KEY`), copy the `PushSubscription` JSON, then:
+
+```sh
+export VAPID_PUBLIC_KEY='…'
+export VAPID_PRIVATE_KEY='…'
+bun scripts/webpush-interop.ts /tmp/push-sub.json
+```
+
+That path is Channel → `webpush` → sently `createPushSender` →
+`WebPushTransport`, and it prints the push-service HTTP response.
+
+Confirm a visible OS notification titled `okengine webpush interop`.
+
 </Accordion>
 </Accordions>
 
@@ -156,6 +218,8 @@ The receipt keeps every attempt in order with its outcome. A send that succeeded
 
 - [Flow](/docs/elements/flow) — `fx.send` inside `do`
 - [Console · Channels](/docs/console/channels) — receipts, attempts, suppression
+- [Environment Variables](/docs/reference/environment-variables) — Channel boot credentials
+- [Configuration](/docs/reference/configuration) — `drivers.channel.*` maps
 - [Signal](/docs/elements/signal) — machine-to-machine messaging, the other side of the line
 
 ## Next

package/site/content/docs/reference/configuration.mdx

@@ -30,6 +30,7 @@ drivers: {
   vault: { local: "dotenv", docker: "openbao", test: "memory", prod: "openbao" },
   channel: {
     email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
+    sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
   },
 },
 ```
@@ -43,10 +44,10 @@ drivers: {
 | `signal`           | env driver map | `memory` · `postgres` · `redis` · `nats`                                     |
 | `clock`            | env driver map | `memory` · `postgres` · `frozen`                                             |
 | `vault`            | env driver map | `dotenv` · `openbao` · `memory`                                              |
-| `channel.email`    | env driver map | `console` · `smtp` · `resend`                                                |
-| `channel.sms`      | env driver map | `console` · `unifonic`                                                       |
-| `channel.whatsapp` | env driver map | medium declared; drivers added per provider                                  |
-| `channel.push`     | env driver map | medium declared; drivers added per provider                                  |
+| `channel.email`    | env driver map | `console` · `smtp` · `resend` · `sndr`                                       |
+| `channel.sms`      | env driver map | `console` · `taqnyat` · `msegat` · `unifonic`                                |
+| `channel.whatsapp` | env driver map | `console` · `wa-cloud`                                                       |
+| `channel.push`     | env driver map | `console` · `webpush` · `fcm`                                                |
 | `ai`               | env driver map | `mock` · `anthropic` · `openai-compatible` · `bedrock` · `vertex` · `ollama` |
 | `runs`             | env driver map | runs-store driver (distinct from top-level `runs`)                           |
 | `prod`             | `string[]`     | flat protocol list for the Manifest — nested maps are preferred              |

package/site/content/docs/reference/environment-variables.mdx

@@ -61,14 +61,38 @@ Written by the first-boot bootstrap; you normally only set these when pointing a
 | `OKE_VAULT_TOKEN` | App token (least-privilege) | —                  |
 | `OKE_VAULT_MOUNT` | KV v2 mount path            | `"secret"`         |
 
-## Channel (email)
-
-| Variable                | Used for                                  |
-| ----------------------- | ----------------------------------------- |
-| `SMTP_URL`              | Full SMTP connection string (`smtp://…`)  |
-| `SMTP_USER`             | Overrides the user embedded in `SMTP_URL` |
-| `SMTP_PASSWORD`         | Overrides the password in `SMTP_URL`      |
-| `OKE_CHANNEL_EMAIL_URL` | OKE-specific alternative to `SMTP_URL`    |
+## Channel (email) — boot binder
+
+Read when `drivers.channel.email` resolves to that driver id.
+
+| Variable                | Used for                                         |
+| ----------------------- | ------------------------------------------------ |
+| `SMTP_URL`              | `smtp` — full SMTP URL (`smtp://…`)              |
+| `SMTP_USER`             | Overrides the user embedded in `SMTP_URL`        |
+| `SMTP_PASSWORD`         | Overrides the password in `SMTP_URL`             |
+| `OKE_CHANNEL_EMAIL_URL` | Alternative to `SMTP_URL`                        |
+| `RESEND_API_KEY`        | `resend` API key                                 |
+| `SNDR_API_KEY`          | `sndr` API key                                   |
+| `SNDR_BASE_URL`         | Optional SNDR API origin (default `api.sndr.sh`) |
+
+## Channel (SMS) — boot binder
+
+Read when `drivers.channel.sms` resolves to that driver id (`console` opens nothing).
+
+| Variable               | Used for                         |
+| ---------------------- | -------------------------------- |
+| `TAQNYAT_BEARER_TOKEN` | `taqnyat` bearer token           |
+| `TAQNYAT_TOKEN`        | Alias for `TAQNYAT_BEARER_TOKEN` |
+| `TAQNYAT_SENDER`       | Taqnyat pre-approved sender id   |
+| `MSEGAT_USERNAME`      | `msegat` account username        |
+| `MSEGAT_API_KEY`       | `msegat` API key                 |
+| `MSEGAT_SENDER`        | Msegat pre-approved sender id    |
+| `UNIFONIC_APPSID`      | `unifonic` AppSid                |
+| `UNIFONIC_APP_SID`     | Alias for `UNIFONIC_APPSID`      |
+| `UNIFONIC_SENDER`      | Unifonic SenderID (optional)     |
+
+WhatsApp (`wa-cloud`) and push (`webpush` / `fcm`) are not opened from env at
+boot — pass them on `BootOptions.channel.drivers` with their open options.
 
 ## AI providers
 

package/src/cli/openbao-restart.integration.test.ts

@@ -3,7 +3,7 @@
  *
  * Proves the acceptance criterion — set a secret, kill/restart the container
  * on the same Raft volume, re-run the bootstrap unseal, and read the secret
- * back. Skips when no Docker daemon is available.
+ * back. Opt-in via `OKE_TEST_DOCKER=1` plus a live Docker daemon.
  */
 
 import { describe, expect, test } from "bun:test";
@@ -13,10 +13,9 @@ import { join } from "node:path";
 import { deriveInfrastructure, writeDerivedFiles } from "../docker/index.ts";
 import { ensureOpenBao } from "./openbao-bootstrap.ts";
 
-async function dockerAvailable(): Promise<boolean> {
+function dockerAvailable(): boolean {
   try {
-    const proc = Bun.spawn(["docker", "info"], { stdout: "pipe", stderr: "pipe" });
-    return (await proc.exited) === 0;
+    return Bun.spawnSync(["docker", "info"], { stdout: "pipe", stderr: "pipe" }).exitCode === 0;
   } catch {
     return false;
   }
@@ -31,106 +30,116 @@ async function compose(project: string, dir: string, args: readonly string[]): P
   return proc.exited;
 }
 
-describe("openbao restart persistence (real container)", () => {
-  test("secret set before restart is readable after restart + unseal", async () => {
-    if (!(await dockerAvailable())) {
-      console.warn("skipping: docker daemon not available");
-      return;
-    }
-
-    const dir = await mkdtemp(join(tmpdir(), "oke-openbao-it-"));
-    const dockerDir = join(dir, "docker");
-    const project = `oke-bao-${Date.now()}`;
-    const composeFiles = ["compose.yml", "compose.vault.yml"];
-    try {
-      const derived = deriveInfrastructure({
-        images: { vault: "openbao/openbao:2.6.1" },
-        app: "baotest",
-        includeApp: false,
-        composeDir: "docker",
-      });
-      await writeDerivedFiles(derived, dockerDir, { writeStackEnv: true });
-      const spec = derived.specs.find((s) => s.role === "vault")!;
-      const url = `http://127.0.0.1:${spec.hostPort}`;
-
-      const up = await compose(project, dockerDir, [
-        ...composeFiles.flatMap((f) => ["-f", f]),
-        "up",
-        "-d",
-      ]);
-      expect(up).toBe(0);
+const WANT = process.env.OKE_TEST_DOCKER === "1";
+const DOCKER = WANT && dockerAvailable();
+if (!DOCKER) {
+  console.log(
+    WANT
+      ? "skip: openbao restart e2e (docker daemon not available)"
+      : "skip: openbao restart e2e (OKE_TEST_DOCKER≠1)",
+  );
+}
+const live = DOCKER ? test : test.skip;
 
-      const names = ["STRIPE_KEY"];
-      let first;
+describe("openbao restart persistence (real container)", () => {
+  live(
+    "secret set before restart is readable after restart + unseal",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "oke-openbao-it-"));
+      const dockerDir = join(dir, "docker");
+      const project = `oke-bao-${Date.now()}`;
+      const composeFiles = ["compose.yml", "compose.vault.yml"];
       try {
-        first = await ensureOpenBao({ cwd: dir, url, names });
-      } catch (err) {
-        const logs = Bun.spawn(
-          [
-            "docker",
-            "compose",
-            "-p",
-            project,
-            ...composeFiles.flatMap((f) => ["-f", f]),
-            "logs",
-            "vault",
-          ],
-          { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
-        );
-        console.error(await new Response(logs.stdout).text());
-        console.error(await new Response(logs.stderr).text());
-        await logs.exited;
-        throw err;
-      }
-      expect(first.appToken.length).toBeGreaterThan(0);
+        const derived = deriveInfrastructure({
+          images: { vault: "openbao/openbao:2.6.1" },
+          app: "baotest",
+          includeApp: false,
+          composeDir: "docker",
+        });
+        await writeDerivedFiles(derived, dockerDir, { writeStackEnv: true });
+        const spec = derived.specs.find((s) => s.role === "vault")!;
+        const url = `http://127.0.0.1:${spec.hostPort}`;
 
-      const write = await fetch(`${url}/v1/secret/data/STRIPE_KEY`, {
-        method: "POST",
-        headers: { "X-Vault-Token": first.appToken, "content-type": "application/json" },
-        body: JSON.stringify({ data: { value: "sk_restart_persistent" } }),
-      });
-      if (!write.ok) console.error("write failed", write.status, await write.text());
-      expect(write.ok).toBe(true);
+        const up = await compose(project, dockerDir, [
+          ...composeFiles.flatMap((f) => ["-f", f]),
+          "up",
+          "-d",
+        ]);
+        expect(up).toBe(0);
 
-      // Kill + start the same volume (a real restart, not a fresh stack).
-      const restart = await compose(project, dockerDir, [
-        ...composeFiles.flatMap((f) => ["-f", f]),
-        "restart",
-      ]);
-      expect(restart).toBe(0);
-      // Poll the API until the server is back (sealed or unsealed).
-      let apiUp = false;
-      for (let i = 0; i < 60; i++) {
+        const names = ["STRIPE_KEY"];
+        let first;
         try {
-          const probe = await fetch(`${url}/v1/sys/seal-status`);
-          if (probe.ok) {
-            apiUp = true;
-            break;
+          first = await ensureOpenBao({ cwd: dir, url, names });
+        } catch (err) {
+          const logs = Bun.spawn(
+            [
+              "docker",
+              "compose",
+              "-p",
+              project,
+              ...composeFiles.flatMap((f) => ["-f", f]),
+              "logs",
+              "vault",
+            ],
+            { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+          );
+          console.error(await new Response(logs.stdout).text());
+          console.error(await new Response(logs.stderr).text());
+          await logs.exited;
+          throw err;
+        }
+        expect(first.appToken.length).toBeGreaterThan(0);
+
+        const write = await fetch(`${url}/v1/secret/data/STRIPE_KEY`, {
+          method: "POST",
+          headers: { "X-Vault-Token": first.appToken, "content-type": "application/json" },
+          body: JSON.stringify({ data: { value: "sk_restart_persistent" } }),
+        });
+        if (!write.ok) console.error("write failed", write.status, await write.text());
+        expect(write.ok).toBe(true);
+
+        // Kill + start the same volume (a real restart, not a fresh stack).
+        const restart = await compose(project, dockerDir, [
+          ...composeFiles.flatMap((f) => ["-f", f]),
+          "restart",
+        ]);
+        expect(restart).toBe(0);
+        // Poll the API until the server is back (sealed or unsealed).
+        let apiUp = false;
+        for (let i = 0; i < 60; i++) {
+          try {
+            const probe = await fetch(`${url}/v1/sys/seal-status`);
+            if (probe.ok) {
+              apiUp = true;
+              break;
+            }
+          } catch {
+            // not up yet
           }
-        } catch {
-          // not up yet
+          await Bun.sleep(500);
         }
-        await Bun.sleep(500);
-      }
-      expect(apiUp).toBe(true);
+        expect(apiUp).toBe(true);
 
-      const second = await ensureOpenBao({ cwd: dir, url, names });
-      expect(second.initializedNow).toBe(false);
-      expect(second.appToken).toBe(first.appToken);
+        const second = await ensureOpenBao({ cwd: dir, url, names });
+        expect(second.initializedNow).toBe(false);
+        expect(second.appToken).toBe(first.appToken);
 
-      const read = await fetch(`${url}/v1/secret/data/STRIPE_KEY`, {
-        headers: { "X-Vault-Token": second.appToken },
-      });
-      expect(read.ok).toBe(true);
-      const body = (await read.json()) as { data?: { data?: { value?: string } } };
-      expect(body.data?.data?.value).toBe("sk_restart_persistent");
-    } finally {
-      await compose(project, dockerDir, [
-        ...composeFiles.flatMap((f) => ["-f", f]),
-        "down",
-        "-v",
-      ]).catch(() => 0);
-      await rm(dir, { recursive: true, force: true }).catch(() => {});
-    }
-  }, 180_000);
+        const read = await fetch(`${url}/v1/secret/data/STRIPE_KEY`, {
+          headers: { "X-Vault-Token": second.appToken },
+        });
+        expect(read.ok).toBe(true);
+        const body = (await read.json()) as { data?: { data?: { value?: string } } };
+        expect(body.data?.data?.value).toBe("sk_restart_persistent");
+      } finally {
+        await compose(project, dockerDir, [
+          ...composeFiles.flatMap((f) => ["-f", f]),
+          "down",
+          "-v",
+        ]).catch(() => 0);
+        await rm(dir, { recursive: true, force: true }).catch(() => {});
+      }
+    },
+    180_000,
+  );
 });