create-oke 0.10.2 → 0.11.0

package/src/scaffold.ts

@@ -13,17 +13,17 @@ import {
   writeFileSync,
 } from "node:fs";
 import { basename, join, relative, resolve } from "node:path";
-import {
-  resolveLocalOkengineRoot,
-  resolveTemplateDir,
-  TEMPLATE_DEFAULT_MODE,
-  type TemplateId,
-} from "./templates.ts";
+import { pathToFileURL } from "node:url";
+import { resolveLocalOkengineRoot, resolveTemplateDir, type TemplateId } from "./templates.ts";
 import { agentsMdContent } from "./agents-md.ts";
 import type { CreateDefaults } from "./create-defaults.ts";
+import { DEFAULT_IMAGES, TEMPLATE_DEV } from "./drivers-catalog.ts";
+import { applyLocalesToProject } from "./locales.ts";
 import {
   DEFAULT_SQL_DRIVER,
   applyCreateAnswers,
+  applyPgDogToConfig,
+  extractImages,
   sanitizeProjectName,
   shouldSkipTemplatePath,
   transformConfigForSqlDriver,
@@ -47,13 +47,23 @@ export type ScaffoldOptions = {
   /** Write root `AGENTS.md` (default true). */
   readonly writeAgentsMd?: boolean;
   /**
-   * Store SQL driver — pins `oke.config.ts` `store.sql` local/docker/prod
-   * when `postgres`. Default `sqlite` keeps the dual-mode config.
+   * Store SQL driver — pins `oke.config.ts` `store.sql` `dev`/`prod`
+   * when set. Default `postgres` matches the Docker-first templates.
    * Ignored when {@link createDefaults} is set.
    */
   readonly sqlDriver?: SqlDriverId;
   /** Full customize / reuse answers — applied after copy. */
   readonly createDefaults?: CreateDefaults;
+  /**
+   * Extra locales beyond English. When omitted, uses
+   * {@link CreateDefaults.locales} or English-only.
+   */
+  readonly locales?: readonly string[];
+  /**
+   * Pin PgDog in front of Postgres. When omitted, uses
+   * {@link CreateDefaults.pgdog} or `false`.
+   */
+  readonly pgdog?: boolean;
 };
 
 /** Result of a successful scaffold. */
@@ -68,6 +78,10 @@ export type ScaffoldResult = {
   readonly sqlDriver: SqlDriverId;
   /** Customize answers applied, if any. */
   readonly createDefaults?: CreateDefaults;
+  /** Extra locales applied beyond English. */
+  readonly locales: readonly string[];
+  /** Whether `images.pgdog` was pinned. */
+  readonly pgdog: boolean;
   /** Relative paths written (POSIX), sorted. */
   readonly files: readonly string[];
 };
@@ -101,14 +115,14 @@ export function targetDirectoryBlockReason(targetDir: string): string | null {
  *
  * @param options - Name, source, destination
  */
-export function scaffold(options: ScaffoldOptions): ScaffoldResult {
+export async function scaffold(options: ScaffoldOptions): Promise<ScaffoldResult> {
   const name = sanitizeProjectName(options.name);
   const targetDir = resolve(options.targetDir);
   const sourceDir = resolveTemplateDir(options.source.id);
   const label = options.source.id;
   const createDefaults = options.createDefaults;
   const sqlDriver =
-    createDefaults?.drivers.store.sql.local === "postgres" || options.sqlDriver === "postgres"
+    createDefaults?.drivers.store.sql.dev === "postgres" || options.sqlDriver === "postgres"
       ? "postgres"
       : (options.sqlDriver ?? DEFAULT_SQL_DRIVER);
 
@@ -144,6 +158,8 @@ export function scaffold(options: ScaffoldOptions): ScaffoldResult {
       if (!written.includes("AGENTS.md")) written.push("AGENTS.md");
     }
 
+    ensureVaultEnvNotes(targetDir, createDefaults?.drivers.vault.dev ?? TEMPLATE_DEV.vault);
+
     const envExample = join(targetDir, ".env.example");
     const envLocal = join(targetDir, ".env.local");
     if (existsSync(envExample) && !existsSync(envLocal)) {
@@ -151,9 +167,31 @@ export function scaffold(options: ScaffoldOptions): ScaffoldResult {
       if (!written.includes(".env.local")) written.push(".env.local");
     }
 
-    // Seed `.oke/mode` so `oke dev` does not re-ask local vs docker.
-    writeProjectDevMode(targetDir, resolveInitialDevMode(createDefaults, options.source.id));
-    if (!written.includes(".oke/mode")) written.push(".oke/mode");
+    const locales = options.locales ?? createDefaults?.locales ?? [];
+    for (const rel of applyLocalesToProject(targetDir, locales)) {
+      if (!written.includes(rel) && existsSync(join(targetDir, rel))) written.push(rel);
+      // Drop removed locale files from the written list when English-only.
+      if (!existsSync(join(targetDir, rel))) {
+        const i = written.indexOf(rel);
+        if (i >= 0) written.splice(i, 1);
+      }
+    }
+
+    const pgdog = options.pgdog ?? createDefaults?.pgdog ?? false;
+    const configPath = join(targetDir, "oke.config.ts");
+    if (existsSync(configPath)) {
+      const prev = readFileSync(configPath, "utf8");
+      const next = applyPgDogToConfig(prev, pgdog);
+      if (next !== prev) writeFileSync(configPath, next, "utf8");
+    }
+
+    const composeFiles = await writeScaffoldCompose(targetDir);
+    for (const rel of composeFiles) {
+      if (!written.includes(rel)) written.push(rel);
+    }
+
+    const systemSchema = await writeSystemSchema(targetDir);
+    if (systemSchema && !written.includes(systemSchema)) written.push(systemSchema);
 
     written.sort();
     return {
@@ -164,6 +202,8 @@ export function scaffold(options: ScaffoldOptions): ScaffoldResult {
       okengineDependency,
       sqlDriver,
       ...(createDefaults !== undefined ? { createDefaults } : {}),
+      locales,
+      pgdog,
       files: written,
     };
   } catch (e) {
@@ -173,12 +213,10 @@ export function scaffold(options: ScaffoldOptions): ScaffoldResult {
 }
 
 /**
- * For postgres, pin `store.sql` local/docker/prod in `oke.config.ts`.
+ * For postgres, pin `store.sql` `dev`/`prod` in `oke.config.ts`.
  *
- * The default template ships abstract `src/db/schema.decl.ts` — dialect is
- * emitted from the active `store.sql` driver, so there is no hand-written
- * `sqliteTable`/`pgTable` source to rewrite. `sqlite` keeps the template
- * dual-mode config (`local: sqlite` · `docker`/`prod: postgres`) untouched.
+ * The default template already ships postgres for `dev`/`prod` — this is a
+ * no-op unless customize changed the SQL driver and `--sql postgres` restores it.
  *
  * @param targetDir - Scaffolded project root
  * @param sqlDriver - Chosen store.sql driver
@@ -193,6 +231,38 @@ function applySqlDriverTransforms(targetDir: string, sqlDriver: SqlDriverId): vo
   }
 }
 
+/** Marker that the built-in vault key note is already present. */
+const VAULT_MASTER_KEY_MARKER = "OKE_VAULT_MASTER_KEY";
+
+/**
+ * Make sure `.env.example` explains the built-in vault's master key.
+ *
+ * Only the built-in `vault` backend has a key to hold: `env` reads the dotenv
+ * layers directly, and `managed` gets credentials from the provider secret
+ * store. The bundled templates already carry the note, so this only fires
+ * for a template that dropped it.
+ *
+ * @param targetDir - Scaffolded project root
+ * @param vaultDriver - Chosen `drivers.vault` dev pin
+ */
+function ensureVaultEnvNotes(targetDir: string, vaultDriver: string): void {
+  if (vaultDriver !== "vault") return;
+  const envExample = join(targetDir, ".env.example");
+  if (!existsSync(envExample)) return;
+  const source = readFileSync(envExample, "utf8");
+  if (source.includes(VAULT_MASTER_KEY_MARKER)) return;
+  writeFileSync(
+    envExample,
+    `${source.trimEnd()}\n
+# ── vault — built-in encrypted-at-rest store ────────────────
+# \`oke vault init\` prints the master key once; every later boot unseals with it.
+# In production read it from your KMS instead of committing it here.
+# OKE_VAULT_MASTER_KEY=
+`,
+    "utf8",
+  );
+}
+
 /**
  * Apply full customize / reuse defaults to `oke.config.ts`.
  *
@@ -209,29 +279,203 @@ function applyCreateDefaultsTransforms(targetDir: string, defaults: CreateDefaul
 }
 
 /**
- * Map create-oke profile / template → persisted `oke dev` mode.
+ * Emit `.oke/schema/oke.ts` (system / auth / plugin stubs) when the local
+ * okengine source tree is available. Published create-oke regenerates after
+ * `bun install` via `oke schema generate`.
  *
- * @param defaults - Customize / reuse answers, or undefined for recommended
- * @param template - Starter id (recommended path uses template default mode)
+ * @param targetDir - Scaffolded project root
+ * @returns Relative path written, or `undefined` when skipped
  */
-export function resolveInitialDevMode(
-  defaults: CreateDefaults | undefined,
-  template: TemplateId = "standard",
-): "local" | "docker" {
-  if (defaults?.profile === "docker-ready") return "docker";
-  if (defaults?.profile === "local-only") return "local";
-  return TEMPLATE_DEFAULT_MODE[template];
+async function writeSystemSchema(targetDir: string): Promise<string | undefined> {
+  const okengineRoot = resolveLocalOkengineRoot();
+  if (!okengineRoot) return undefined;
+  try {
+    const schemaUrl = pathToFileURL(join(okengineRoot, "src/cli/schema.ts")).href;
+    const mod = (await import(schemaUrl)) as {
+      runSchemaGenerate: (opts: {
+        cwd?: string;
+        write?: (text: string) => void;
+      }) => Promise<number>;
+      SCHEMA_OUT: string;
+    };
+    const code = await mod.runSchemaGenerate({ cwd: targetDir, write: () => {} });
+    if (code !== 0) return undefined;
+    return mod.SCHEMA_OUT;
+  } catch {
+    return undefined;
+  }
 }
 
 /**
- * Write project-local `.oke/mode` (same shape as `oke mode` / `oke dev`).
+ * Derive `docker/docker-compose.yml` via okengine's {@link deriveInfrastructure}
+ * when the monorepo root is available; otherwise write a minimal postgres+redis stub.
  *
  * @param targetDir - Scaffolded project root
- * @param mode - Mode to save
+ * @returns Relative docker paths written
  */
-function writeProjectDevMode(targetDir: string, mode: "local" | "docker"): void {
-  mkdirSync(join(targetDir, ".oke"), { recursive: true });
-  writeFileSync(join(targetDir, ".oke", "mode"), `${mode}\n`, "utf8");
+async function writeScaffoldCompose(targetDir: string): Promise<string[]> {
+  const configPath = join(targetDir, "oke.config.ts");
+  const images = existsSync(configPath)
+    ? extractImages(readFileSync(configPath, "utf8"))
+    : { ...DEFAULT_IMAGES };
+  if (Object.keys(images).length === 0) {
+    Object.assign(images, DEFAULT_IMAGES);
+  }
+
+  const okengineRoot = resolveLocalOkengineRoot();
+  if (okengineRoot) {
+    try {
+      const deriveUrl = pathToFileURL(join(okengineRoot, "src/docker/derive.ts")).href;
+      const mod = (await import(deriveUrl)) as {
+        deriveInfrastructure: (opts: {
+          images: Readonly<Record<string, string>>;
+          app?: string;
+          composeDir?: string;
+          includeApp?: boolean;
+          prod?: boolean;
+          layout?: "single" | "split" | "stack";
+        }) => {
+          files: readonly { path: string; content: string }[];
+        };
+        writeDerivedFiles: (
+          result: { files: readonly { path: string; content: string }[] },
+          outDir: string,
+          options?: { writeStackEnv?: boolean },
+        ) => Promise<readonly string[]>;
+      };
+      const result = mod.deriveInfrastructure({
+        images,
+        app: "app",
+        composeDir: "docker",
+        includeApp: true,
+        prod: true,
+        layout: "single",
+      });
+      const dockerDir = join(targetDir, "docker");
+      await mod.writeDerivedFiles(result, dockerDir, { writeStackEnv: false });
+      return result.files
+        .filter(
+          (f) => f.path.endsWith(".yml") || f.path === "Dockerfile" || f.path.endsWith(".toml"),
+        )
+        .map((f) => `docker/${f.path}`);
+    } catch {
+      // Fall through to stub when derive fails (published create-oke, etc.).
+    }
+  }
+
+  return writeMinimalComposeStub(targetDir);
+}
+
+/**
+ * Minimal committed-style single-file compose with postgres + redis healthchecks.
+ *
+ * @param targetDir - Project root
+ */
+function writeMinimalComposeStub(targetDir: string): string[] {
+  const dockerDir = join(targetDir, "docker");
+  mkdirSync(dockerDir, { recursive: true });
+  const compose = `# Generated by create-oke (minimal stub when okengine derive is unavailable).
+# Local overrides: docker-compose.override.yml (do not commit secrets).
+
+name: oke-app
+
+networks:
+  oke:
+    driver: bridge
+
+services:
+  # App — okengine runtime
+  app:
+    image: oke-app:latest
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    ports:
+      - "6530:6530"
+    env_file:
+      - .env.docker
+    depends_on:
+      store-sql:
+        condition: service_healthy
+      store-kv:
+        condition: service_healthy
+    networks:
+      - oke
+    healthcheck:
+      test:
+        - CMD
+        - bun
+        - -e
+        - fetch("http://127.0.0.1:6530/_/ready").then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 60s
+    stop_grace_period: 30s
+    deploy:
+      replicas: 1
+      resources:
+        limits:
+          cpus: "0.72"
+          memory: 1475M
+
+  # store.sql — Postgres
+  store-sql:
+    image: postgres:18-alpine
+    ports:
+      - "127.0.0.1:5432:5432"
+    networks:
+      - oke
+    env_file:
+      - .env.docker
+    environment:
+      POSTGRES_USER: \${OKE_STORE_SQL_USER}
+      POSTGRES_PASSWORD: \${OKE_STORE_SQL_PASSWORD}
+      POSTGRES_DB: \${OKE_STORE_SQL_DB}
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - pg_isready -U $$POSTGRES_USER
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    deploy:
+      resources:
+        limits:
+          cpus: "1.08"
+          memory: 2212M
+
+  # store.kv — Redis
+  store-kv:
+    image: redis:8-alpine
+    ports:
+      - "127.0.0.1:6379:6379"
+    networks:
+      - oke
+    env_file:
+      - .env.docker
+    command:
+      - sh
+      - -c
+      - exec redis-server --requirepass "$$OKE_STORE_KV_PASSWORD"
+    healthcheck:
+      test:
+        - CMD
+        - redis-cli
+        - -a
+        - \${OKE_STORE_KV_PASSWORD}
+        - ping
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    deploy:
+      resources:
+        limits:
+          cpus: "0.54"
+          memory: 1106M
+`;
+  writeFileSync(join(dockerDir, "docker-compose.yml"), compose, "utf8");
+  return ["docker/docker-compose.yml"];
 }
 
 /**

package/src/templates.ts

@@ -17,14 +17,8 @@ export const DEFAULT_TEMPLATE: TemplateId = "standard";
 
 /** One-line purpose for the starter (interactive select + help). */
 export const TEMPLATE_PURPOSES: Readonly<Record<TemplateId, string>> = {
-  standard: "Notes app — local-first (sqlite · memory · console email)",
-  advanced: "Notes app — docker-ready (postgres · redis · s3 · openbao)",
-};
-
-/** Recommended `.oke/mode` when using recommended defaults (no customize). */
-export const TEMPLATE_DEFAULT_MODE: Readonly<Record<TemplateId, "local" | "docker">> = {
-  standard: "local",
-  advanced: "docker",
+  standard: "Notes app — Docker-first (postgres · redis · s3 · smtp)",
+  advanced: "Notes app — Docker-first + store.index (meilisearch)",
 };
 
 /**

package/src/transform.test.ts

@@ -6,9 +6,9 @@ import { describe, expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { toCreateDefaults } from "./create-defaults.ts";
-import { pinsDockerReady, pinsLocalOnly } from "./drivers-catalog.ts";
+import { pinsDockerReady, recommendedDefaults, VAULT_CHOICES } from "./drivers-catalog.ts";
 import { resolveTemplateDir } from "./templates.ts";
-import { applyCreateAnswers, upsertAiDrivers } from "./transform.ts";
+import { applyCreateAnswers, extractImages, upsertAiDrivers } from "./transform.ts";
 import type { EnvDriverPins } from "./create-defaults.ts";
 
 function templateConfig(id: "standard" | "advanced" = "advanced"): string {
@@ -21,7 +21,11 @@ function evalConfig(source: string): {
     ai?: unknown;
     channel?: { ai?: unknown; email?: unknown };
   };
-  images?: Record<string, string>;
+  images?: {
+    store?: Record<string, string>;
+    channel?: Record<string, string>;
+    ai?: string;
+  };
 } {
   const body = source
     .replace(/^import\s+[\s\S]*?from\s+["'][^"']+["'];?\s*/m, "")
@@ -30,67 +34,126 @@ function evalConfig(source: string): {
   return new Function("defineConfig", body)(defineConfig) as ReturnType<typeof evalConfig>;
 }
 
-function defaultsWithIndex(indexLocal: string, indexDocker: string) {
+function defaultsWithIndex(indexDev: string) {
   return toCreateDefaults({
     template: "advanced",
     profile: "docker-ready",
     drivers: {
       store: {
-        sql: pinsDockerReady("libsql", "postgres", "memory"),
-        kv: pinsLocalOnly("memory", "redis", "memory"),
-        files: pinsLocalOnly("fs", "s3", "memory"),
-        index: pinsDockerReady(indexLocal, indexDocker, "memory"),
+        sql: pinsDockerReady("postgres", "pglite"),
+        kv: pinsDockerReady("redis", "memory"),
+        files: pinsDockerReady("s3", "memory"),
+        index: pinsDockerReady(indexDev, "memory"),
       },
-      signal: pinsLocalOnly("memory", "redis", "memory"),
-      clock: pinsLocalOnly("memory", "file", "frozen"),
-      vault: pinsLocalOnly("env", "openbao", "memory"),
-      channel: { email: pinsLocalOnly("console", "smtp", "console") },
+      signal: pinsDockerReady("redis", "memory"),
+      clock: pinsDockerReady("postgres", "frozen"),
+      vault: pinsDockerReady("vault", "memory"),
+      channel: { email: pinsDockerReady("smtp", "console") },
       ai: null,
     },
     ai: { enabled: false, provider: null, driver: null },
+    locales: [],
+    pgdog: false,
   });
 }
 
 describe("applyCreateAnswers images", () => {
-  test("index: libsql does not poison images with driver pins", () => {
-    const next = applyCreateAnswers(templateConfig(), defaultsWithIndex("libsql", "libsql"));
-    expect(next).toContain('local: "libsql"');
-    expect(next).toMatch(/index:\s*\{\s*local: "libsql"/);
+  test("index: pgvector does not poison images with driver pins", () => {
+    const next = applyCreateAnswers(templateConfig(), defaultsWithIndex("pgvector"));
+    expect(next).toContain('dev: "pgvector"');
+    expect(next).toMatch(/index:\s*\{\s*dev: "pgvector"/);
     // Role pins only — never env-column keys or bare driver ids as images.
-    expect(next).not.toMatch(/images:\s*\{[^}]*\blocal:\s*"/s);
-    expect(next).not.toMatch(/images:\s*\{[^}]*\bdocker:\s*"/s);
-    expect(next).not.toMatch(/images:\s*\{[^}]*:\s*"libsql"/s);
-    expect(next).toContain('"store.sql": "postgres:18-alpine"');
+    expect(next).not.toMatch(/images:\s*\{[^}]*\bdev:\s*"/s);
+    expect(next).not.toMatch(/images:\s*\{[^}]*\btest:\s*"memory"/s);
+    expect(next).not.toMatch(/images:\s*\{[^}]*:\s*"pgvector"/s);
+    expect(next).toMatch(/images:\s*\{\s*store:\s*\{[^}]*\bsql: "postgres:18-alpine"/s);
   });
 
   test("index meilisearch pins store.index image without comment leakage", () => {
+    const next = applyCreateAnswers(templateConfig(), defaultsWithIndex("meilisearch"));
+    expect(next).toMatch(/images:\s*\{\s*store:\s*\{[^}]*\bindex: "getmeili\/meilisearch:v1.37"/s);
+    expect(next).not.toMatch(/images:\s*\{[^}]*\btest:\s*"memory"/s);
+  });
+});
+
+describe("vault backend defaults", () => {
+  test("recommended defaults pick the built-in encrypted store", () => {
+    const defaults = recommendedDefaults("docker-ready", "standard");
+    expect(defaults.drivers.vault).toEqual({ dev: "vault", test: "memory", prod: "vault" });
+  });
+
+  test("the wizard offers env, vault, managed, and memory", () => {
+    const values = VAULT_CHOICES.map((c) => c.value);
+    expect(values).toEqual(["env", "vault", "managed", "memory"]);
+    expect(VAULT_CHOICES.find((c) => c.value === "vault")?.label).toContain("recommended");
+  });
+
+  test("both templates pin only vault.dev (built-in) — other drivers use defaults", () => {
+    for (const id of ["standard", "advanced"] as const) {
+      const source = templateConfig(id);
+      expect(source, id).toMatch(/vault:\s*\{\s*dev: "vault",?\s*\}/);
+      expect(source, id).not.toMatch(/^\s*sql:\s*\{/m);
+      expect(source, id).not.toMatch(/^\s*signal:\s*\{/m);
+      expect(extractImages(source).vault, id).toBeUndefined();
+    }
+  });
+
+  test("both templates document the master key in .env.example", () => {
+    for (const id of ["standard", "advanced"] as const) {
+      const env = readFileSync(join(resolveTemplateDir(id), ".env.example"), "utf8");
+      expect(env, id).toContain("OKE_VAULT_MASTER_KEY");
+      expect(env, id).toContain("oke vault init");
+    }
+  });
+
+  test("managed vault does not pin a compose image", () => {
     const next = applyCreateAnswers(
-      templateConfig(),
-      defaultsWithIndex("meilisearch", "meilisearch"),
+      templateConfig("standard"),
+      toCreateDefaults({
+        template: "standard",
+        profile: "docker-ready",
+        drivers: {
+          store: {
+            sql: pinsDockerReady("postgres", "pglite"),
+            kv: pinsDockerReady("redis", "memory"),
+            files: pinsDockerReady("s3", "memory"),
+            index: null,
+          },
+          signal: pinsDockerReady("redis", "memory"),
+          clock: pinsDockerReady("postgres", "frozen"),
+          vault: pinsDockerReady("managed", "memory"),
+          channel: { email: pinsDockerReady("smtp", "console") },
+          ai: null,
+        },
+        ai: { enabled: false, provider: null, driver: null },
+        locales: [],
+        pgdog: false,
+      }),
     );
-    expect(next).toContain('"store.index": "getmeili/meilisearch:v1.37"');
-    expect(next).not.toMatch(/images:\s*\{[^}]*\btest:\s*"memory"/s);
+    expect(next).toMatch(/vault:\s*\{\s*dev: "managed"/);
+    expect(extractImages(next).vault).toBeUndefined();
   });
 });
 
 describe("upsertAiDrivers", () => {
   const ollamaPins: EnvDriverPins = {
-    local: "ollama",
-    docker: "ollama",
+    dev: "ollama",
     test: "mock",
     prod: "ollama",
   };
 
-  test("inserts drivers.ai as sibling of channel (not inside email)", () => {
+  test("inserts drivers.ai inside drivers (not images / channel)", () => {
     const next = upsertAiDrivers(templateConfig("advanced"), ollamaPins);
     const config = evalConfig(next);
     expect(config.drivers?.ai).toEqual(ollamaPins);
     expect(config.drivers?.channel?.ai).toBeUndefined();
-    expect(config.drivers?.channel?.email).toBeDefined();
+    // Sparse templates omit drivers.channel — images.channel stays a string pin.
+    expect(config.images?.channel?.email).toBe("axllent/mailpit:v1.22.3");
+    expect(config.images?.ai).toBeUndefined();
   });
 
   test("applyCreateAnswers with ai pins keeps top-level drivers.ai", () => {
-    const llamaPins = pinsDockerReady("openai-compatible", "openai-compatible", "mock");
+    const llamaPins = pinsDockerReady("openai-compatible", "mock");
     for (const id of ["standard", "advanced"] as const) {
       const next = applyCreateAnswers(
         templateConfig(id),
@@ -99,24 +162,25 @@ describe("upsertAiDrivers", () => {
           profile: "docker-ready",
           drivers: {
             store: {
-              sql: pinsDockerReady("libsql", "postgres", "memory"),
-              kv: pinsLocalOnly("memory", "redis", "memory"),
-              files: pinsLocalOnly("fs", "s3", "memory"),
+              sql: pinsDockerReady("postgres", "pglite"),
+              kv: pinsDockerReady("redis", "memory"),
+              files: pinsDockerReady("s3", "memory"),
               index: null,
             },
-            signal: pinsLocalOnly("memory", "redis", "memory"),
-            clock: pinsLocalOnly("memory", "file", "frozen"),
-            vault: pinsLocalOnly("env", "openbao", "memory"),
-            channel: { email: pinsLocalOnly("console", "smtp", "console") },
+            signal: pinsDockerReady("redis", "memory"),
+            clock: pinsDockerReady("postgres", "frozen"),
+            vault: pinsDockerReady("vault", "memory"),
+            channel: { email: pinsDockerReady("smtp", "console") },
             ai: llamaPins,
           },
           ai: { enabled: true, provider: "llama-cpp", driver: "openai-compatible" },
+          locales: [],
+          pgdog: false,
         }),
       );
       const config = evalConfig(next);
       expect(config.drivers?.ai, id).toEqual({
-        local: "openai-compatible",
-        docker: "openai-compatible",
+        dev: "openai-compatible",
         test: "mock",
         prod: "openai-compatible",
       });