okengine 0.10.1 → 0.10.3

package/src/kernel/app.ts

@@ -83,6 +83,12 @@ import {
 import { releaseInstanceLeases } from "./graceful-shutdown.ts";
 import type { JournalRuntime } from "./boot-bind/journal.ts";
 import { listBindings, resetBindings, type Binding } from "./on.ts";
+import {
+  channelTemplateRegistry,
+  secretRegistry,
+  signalRegistry,
+  storeRegistry,
+} from "./element-registries.ts";
 import {
   applyPrincipal,
   createElementPipelineHooks,
@@ -442,6 +448,21 @@ export interface OkeApp<D extends Record<string, unknown> = {}, R extends AppRou
   readonly $options: OkeOptions;
 }
 
+/**
+ * Concat two decl lists, skipping registry entries already present by
+ * reference (the same call-site object explicitly re-passed).
+ *
+ * @param explicit - Hand-passed decls (kept in order, always wins position)
+ * @param fromRegistry - Auto-drained decls to append
+ */
+function mergeUnique<T>(explicit: readonly T[] | undefined, fromRegistry: readonly T[]): T[] {
+  const out: T[] = [...(explicit ?? [])];
+  for (const item of fromRegistry) {
+    if (!out.includes(item)) out.push(item);
+  }
+  return out;
+}
+
 /**
  * Create an application. Adopts bindings registered via {@link on}.
  *
@@ -456,6 +477,42 @@ export function oke(options: OkeOptions): OkeApp {
       : [...listBindings(), ...(options.bindings ?? [])];
   if (registry === "consume") resetBindings();
 
+  // Same registry mode drains store.sql/store.files, vault.secret, signal(),
+  // and channel.<medium>().template() — module-evaluation registries that
+  // mirror `on`'s trigger drain (`listBindings`/`resetBindings` above).
+  // Explicit `options.stores` / `secrets` / `signals` / `channel.templates`
+  // are additive, never silently ignored — deduped by reference so an
+  // explicitly-passed decl that is also in the registry is not doubled.
+  const registrySnapshot =
+    registry === "ignore"
+      ? { stores: [], secrets: [], signals: [], channelTemplates: [] }
+      : {
+          stores: storeRegistry.slice(),
+          secrets: secretRegistry.slice(),
+          signals: signalRegistry.slice(),
+          channelTemplates: channelTemplateRegistry.slice(),
+        };
+  if (registry === "consume") {
+    storeRegistry.length = 0;
+    secretRegistry.length = 0;
+    signalRegistry.length = 0;
+    channelTemplateRegistry.length = 0;
+  }
+  const effectiveStores = mergeUnique(options.stores, registrySnapshot.stores);
+  const effectiveSecrets = mergeUnique(options.secrets, registrySnapshot.secrets);
+  const effectiveSignals = mergeUnique(options.signals, registrySnapshot.signals);
+  // Stay `undefined` (never a defined-but-empty object) when neither an
+  // explicit `options.channel` nor a registered template exists — a defined
+  // object here would flip `resolveElementNeeds`'s `channel` need to `true`
+  // for every app, whether or not it uses channel at all.
+  const effectiveChannel: BootOptions["channel"] =
+    options.channel === undefined && registrySnapshot.channelTemplates.length === 0
+      ? undefined
+      : {
+          ...(options.channel ?? {}),
+          templates: mergeUnique(options.channel?.templates, registrySnapshot.channelTemplates),
+        };
+
   // Resolve Gate bag early so auth HTTP Bindings join `adopted` + the router
   // before posture audit (same ensureBoot → doBoot path — never a side channel).
   const gateConfig: ResolvedGateConfig = resolveGateConfig({
@@ -772,13 +829,13 @@ export function oke(options: OkeOptions): OkeApp {
       docker: overrides?.docker ?? options.docker,
       config: overrides?.config ?? options.config,
       elements: overrides?.elements ?? options.elements,
-      secrets: overrides?.secrets ?? options.secrets,
+      secrets: overrides?.secrets ?? effectiveSecrets,
       vault: overrides?.vault ?? options.vault,
       gates: [...baseGates, ...authGates],
-      signals: overrides?.signals ?? options.signals,
+      signals: overrides?.signals ?? effectiveSignals,
       clocks: overrides?.clocks ?? options.clocks,
-      stores: overrides?.stores ?? options.stores,
-      channel: overrides?.channel ?? options.channel,
+      stores: overrides?.stores ?? effectiveStores,
+      channel: overrides?.channel ?? effectiveChannel,
       ai: overrides?.ai ?? options.ai,
       runs: overrides?.runs ?? options.runs,
       bindings: adopted,
@@ -790,7 +847,7 @@ export function oke(options: OkeOptions): OkeApp {
         if (d.startsWith("driver:")) driverIds.push(d.slice("driver:".length));
       }
     }
-    const stores = overrides?.stores ?? options.stores ?? [];
+    const stores = overrides?.stores ?? effectiveStores;
     const available = buildAvailableNeedTokens({
       elements: {
         storeSql:
@@ -829,10 +886,10 @@ export function oke(options: OkeOptions): OkeApp {
     if (gateConfig.auth) available.add("auth");
     assertPluginNeeds(caps, { pluginNames, available });
 
-    const baseSecrets = overrides?.secrets ?? options.secrets ?? [];
-    const baseSignals = overrides?.signals ?? options.signals ?? [];
+    const baseSecrets = overrides?.secrets ?? effectiveSecrets;
+    const baseSignals = overrides?.signals ?? effectiveSignals;
     const baseClocks = overrides?.clocks ?? options.clocks ?? [];
-    const baseChannel = overrides?.channel ?? options.channel;
+    const baseChannel = overrides?.channel ?? effectiveChannel;
     const mergedCatalog = mergeTemplateCatalogs(baseChannel?.catalog, ...pluginChannelCatalogs);
 
     const merged: BootOptions = {
@@ -848,7 +905,7 @@ export function oke(options: OkeOptions): OkeApp {
       unguardedHttp,
       signals: [...baseSignals, ...pluginSignals],
       clocks: [...baseClocks, ...pluginClocks],
-      stores: overrides?.stores ?? options.stores,
+      stores: overrides?.stores ?? effectiveStores,
       channel: {
         ...(baseChannel ?? {}),
         templates: [...(baseChannel?.templates ?? []), ...pluginChannelTemplates],

package/src/kernel/auto-registry.test.ts

@@ -0,0 +1,198 @@
+/**
+ * `oke({...})` auto-populates `stores` / `secrets` / `signals` /
+ * `channel.templates` from the same kind of module-evaluation registry
+ * already proven for `on()`'s trigger drain (`registry-isolation.test.ts`).
+ *
+ * `store.sql` / `store.files`, `vault.secret`, `signal()`, and medium-binder
+ * `.template()` push into a shared registry (`src/kernel/element-registries.ts`)
+ * at call time — zero change to how developers call them. `oke()` drains it
+ * at construction under the same `registry: "consume" | "keep" | "ignore"`
+ * switch that already governs bindings.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { channel } from "../elements/channel/declare.ts";
+import { signal } from "../elements/signal/declare.ts";
+import { store } from "../elements/store/declare.ts";
+import { vault } from "../elements/vault/declare.ts";
+import { oke } from "./app.ts";
+import { flow } from "./flow.ts";
+import { on, resetBindings } from "./on.ts";
+import { http } from "./triggers.ts";
+
+describe("oke() auto-registry — stores/secrets/signals/channel.templates", () => {
+  test("before/after: zero explicit arrays boots identically to the explicit-array form", async () => {
+    resetBindings();
+
+    // "before" — today's explicit-array form (registry: "ignore" so this
+    // app cannot see anything auto-drained; proves the old path is unchanged).
+    const dbBefore = store.sql("before-app", { schema: {} });
+    const filesBefore = store.files("before-uploads");
+    const secretBefore = vault.secret("BEFORE_WEBHOOK_SECRET", { dev: "dev-secret-before" });
+    const signalBefore = signal("before-note-created", { delivery: "once", optional: true });
+    const mailBefore = channel.email({ from: "Before <before@localhost>" });
+    const templateBefore = mailBefore.template("before-note-created");
+
+    const beforeFlow = flow("before.onCreated", {
+      effects: {
+        secrets: ["BEFORE_WEBHOOK_SECRET"],
+        emits: ["before-note-created"],
+        sends: ["before-note-created"],
+      },
+      do: async (_input, fx) => {
+        const secret = fx.vault(secretBefore);
+        await fx.emit(signalBefore, {});
+        await fx.send(templateBefore, { to: "you@localhost", data: {} });
+        return { secret };
+      },
+    });
+    on(http.post("/before"), beforeFlow);
+
+    const appBefore = oke({
+      name: "before-app",
+      registry: "ignore",
+      bindings: [{ trigger: http.post("/before"), flow: beforeFlow }],
+      gate: { unguardedHttp: "allow" },
+      vault: { allowDevFallbacks: true },
+      stores: [dbBefore, filesBefore],
+      secrets: [secretBefore],
+      signals: [signalBefore],
+      channel: { templates: [templateBefore] },
+      startScheduler: false,
+    });
+
+    // "after" — same shape, zero explicit arrays; registry auto-populates.
+    // Declared (and registered) for their side effect only — never passed
+    // to `oke()` directly, proving the registry alone carries them.
+    store.sql("after-app", { schema: {} });
+    store.files("after-uploads");
+    const secretAfter = vault.secret("AFTER_WEBHOOK_SECRET", { dev: "dev-secret-after" });
+    const signalAfter = signal("after-note-created", { delivery: "once", optional: true });
+    const mailAfter = channel.email({ from: "After <after@localhost>" });
+    const templateAfter = mailAfter.template("after-note-created");
+
+    const afterFlow = flow("after.onCreated", {
+      effects: {
+        secrets: ["AFTER_WEBHOOK_SECRET"],
+        emits: ["after-note-created"],
+        sends: ["after-note-created"],
+      },
+      do: async (_input, fx) => {
+        const secret = fx.vault(secretAfter);
+        await fx.emit(signalAfter, {});
+        await fx.send(templateAfter, { to: "you@localhost", data: {} });
+        return { secret };
+      },
+    });
+    resetBindings();
+    on(http.post("/after"), afterFlow);
+
+    const appAfter = oke({
+      name: "after-app",
+      gate: { unguardedHttp: "allow" },
+      vault: { allowDevFallbacks: true },
+      startScheduler: false,
+      // No stores / secrets / signals / channel — registry supplies them.
+    });
+
+    await appBefore.boot({ env: "test", unguardedHttp: "allow" });
+    await appAfter.boot({ env: "test", unguardedHttp: "allow" });
+
+    // Both boots resolved the same shape from stores → secrets → signals → channel.
+    expect(appBefore.bootResult?.store?.declarations.has("sql:before-app")).toBe(true);
+    expect(appBefore.bootResult?.store?.declarations.has("files:before-uploads")).toBe(true);
+    expect(appAfter.bootResult?.store?.declarations.has("sql:after-app")).toBe(true);
+    expect(appAfter.bootResult?.store?.declarations.has("files:after-uploads")).toBe(true);
+
+    expect(appBefore.bootResult?.vault?.contracts.has("BEFORE_WEBHOOK_SECRET")).toBe(true);
+    expect(appAfter.bootResult?.vault?.contracts.has("AFTER_WEBHOOK_SECRET")).toBe(true);
+    expect(appBefore.bootResult?.vault?.read("BEFORE_WEBHOOK_SECRET")).toBe("dev-secret-before");
+    expect(appAfter.bootResult?.vault?.read("AFTER_WEBHOOK_SECRET")).toBe("dev-secret-after");
+
+    expect(appBefore.bootResult?.signal?.declarations.has("before-note-created")).toBe(true);
+    expect(appAfter.bootResult?.signal?.declarations.has("after-note-created")).toBe(true);
+
+    expect(appBefore.bootResult?.channel?.templates.has("before-note-created")).toBe(true);
+    expect(appAfter.bootResult?.channel?.templates.has("after-note-created")).toBe(true);
+
+    // Same flow execution shape through the real HTTP path either way —
+    // both resolve, emit, and send successfully; the secret value itself
+    // comes back redacted (fx output redaction), same on both sides.
+    const resBefore = await appBefore.fetch(
+      new Request("http://localhost/before", { method: "POST" }),
+    );
+    const resAfter = await appAfter.fetch(
+      new Request("http://localhost/after", { method: "POST" }),
+    );
+    expect(resBefore.status).toBe(200);
+    expect(resAfter.status).toBe(200);
+    const bodyBefore = (await resBefore.json()) as { data: { secret: string } };
+    const bodyAfter = (await resAfter.json()) as { data: { secret: string } };
+    expect(bodyBefore.data.secret).toBe(bodyAfter.data.secret);
+  });
+
+  test("explicit passing is additive, never silently ignored — same object via both paths is deduped, not doubled", async () => {
+    const db = store.sql("dedup-app", { schema: {} });
+
+    // `db` is already sitting in the registry from the call above *and*
+    // passed explicitly — must not double-register / conflict.
+    const app = oke({
+      name: "dedup-app",
+      autoBoot: false,
+      stores: [db],
+      startScheduler: false,
+    });
+
+    await app.boot({ env: "test", unguardedHttp: "allow" });
+    expect(app.bootResult?.store?.declarations.has("sql:dedup-app")).toBe(true);
+  });
+
+  test('registry: "ignore" does not auto-populate', async () => {
+    vault.secret("IGNORED_SECRET", { description: "never passed, never auto-read" });
+
+    const app = oke({
+      name: "ignore-mode-app",
+      registry: "ignore",
+      startScheduler: false,
+    });
+    // Nothing requires the secret, so boot succeeds — but it must not have
+    // silently picked up IGNORED_SECRET from the registry either way.
+    await app.boot({ env: "test", unguardedHttp: "allow" });
+    expect(app.bootResult?.vault?.contracts.has("IGNORED_SECRET")).toBeFalsy();
+  });
+
+  test('registry: "consume" (default) drains stores/secrets/signals/channel.templates — a later app does not inherit them', async () => {
+    store.sql("leak-app", { schema: {} });
+    vault.secret("LEAK_SECRET", { dev: "dev-leak" });
+    signal("leak-signal", { delivery: "once" });
+    channel.email().template("leak-template");
+
+    const appA = oke({
+      name: "leak-app-a",
+      autoBoot: false,
+      vault: { allowDevFallbacks: true },
+      startScheduler: false,
+    });
+    await appA.boot({ env: "test", unguardedHttp: "allow" });
+    expect(appA.bootResult?.store?.declarations.has("sql:leak-app")).toBe(true);
+    expect(appA.bootResult?.vault?.contracts.has("LEAK_SECRET")).toBe(true);
+
+    // Second app, constructed after the first drained the registry.
+    const appB = oke({
+      name: "leak-app-b",
+      autoBoot: false,
+      startScheduler: false,
+    });
+    await appB.boot({ env: "test", unguardedHttp: "allow" });
+    // Nothing was passed and nothing was left in the registry (App A drained
+    // it) — App B needed store/vault/signal not at all, so no runtime was
+    // built for them. Channel boots unconditionally regardless of registry
+    // content (pre-existing, unrelated to this feature — `resolveElementNeeds`
+    // gates channel on object *presence*, not template count) — assert its
+    // template map, not runtime absence.
+    expect(appB.bootResult?.store).toBeUndefined();
+    expect(appB.bootResult?.vault).toBeUndefined();
+    expect(appB.bootResult?.signal).toBeUndefined();
+    expect(appB.bootResult?.channel?.templates.has("leak-template") ?? false).toBe(false);
+  });
+});

package/src/kernel/boot-bind/channel.ts

@@ -3,6 +3,11 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import {
+  CHANNEL_EMAIL_DEFAULTS,
+  CHANNEL_SMS_DEFAULTS,
+  dockerFlagDefaults,
+} from "../../config/driver-defaults.ts";
 import { openConsoleChannel } from "../../drivers/channel-console.ts";
 import { openMsegatChannel } from "../../drivers/channel-msegat.ts";
 import { openResendChannel } from "../../drivers/channel-resend.ts";
@@ -81,9 +86,12 @@ export function resolveEmailDriverId(
   env: ConfigEnv,
   docker: boolean,
 ): string {
-  return (
-    resolveDriverId(options.config?.drivers?.channel?.email, env) ?? (docker ? "smtp" : "console")
-  );
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.channel?.email,
+    env,
+    dockerFlagDefaults(CHANNEL_EMAIL_DEFAULTS, docker),
+  )!;
 }
 
 /**
@@ -93,7 +101,7 @@ export function resolveEmailDriverId(
  * @param env - Active environment
  */
 export function resolveSmsDriverId(options: BootOptions, env: ConfigEnv): string | undefined {
-  return resolveDriverId(options.config?.drivers?.channel?.sms, env);
+  return resolveDriverId(options.config?.drivers?.channel?.sms, env, CHANNEL_SMS_DEFAULTS);
 }
 
 /**

package/src/kernel/boot-bind/clock.ts

@@ -15,6 +15,7 @@ import {
 } from "../../elements/clock.ts";
 import { createPostgresCronStore } from "../../drivers/clock-postgres.ts";
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { CLOCK_DEFAULTS } from "../../config/driver-defaults.ts";
 import type { BootOptions } from "../boot.ts";
 
 /** Result of binding a clock runtime. */
@@ -33,9 +34,8 @@ export const DEFAULT_FILE_CRON_PATH = ".oke/crons.json";
  * @param env - Active environment
  */
 export function resolveClockDriverId(options: BootOptions, env: ConfigEnv): string {
-  const resolved = resolveDriverId(options.config?.drivers?.clock, env);
-  if (resolved) return resolved;
-  return env === "test" ? "frozen" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.clock, env, CLOCK_DEFAULTS)!;
 }
 
 /**

package/src/kernel/boot-bind/gate.ts

@@ -3,6 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { dockerFlagDefaults, STORE_KV_DEFAULTS } from "../../config/driver-defaults.ts";
 import { memoryDrivers } from "../../drivers/memory.ts";
 import { redisDriver } from "../../drivers/redis.ts";
 import type { KvClientLike } from "../../drivers/types.ts";
@@ -27,10 +28,12 @@ export function resolveGateKvDriverId(
   const fromEnv = process.env.OKE_KV_DRIVER?.trim();
   if (docker && fromEnv === "redis") return "redis";
   if (docker && fromEnv === "memory") return "memory";
-  const resolved = resolveDriverId(options.config?.drivers?.store?.kv, env);
-  if (resolved === "redis") return "redis";
-  if (resolved === "memory") return "memory";
-  return docker ? "redis" : "memory";
+  const resolved = resolveDriverId(
+    options.config?.drivers?.store?.kv,
+    env,
+    dockerFlagDefaults(STORE_KV_DEFAULTS, docker),
+  );
+  return resolved === "redis" ? "redis" : "memory";
 }
 
 function kvUrlFor(docker: boolean): string {

package/src/kernel/boot-bind/honor-config.test.ts

@@ -157,7 +157,7 @@ describe("boot binders honour drivers.* config", () => {
     const result = await bootApplication({
       env: "local",
       startScheduler: false,
-      flows: [flow({ name: "charge", durable: true, do: () => ({ ok: true }) })],
+      flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
     });
     try {
       expect(result.journal?.driverId).toBe("memory");
@@ -172,7 +172,7 @@ describe("boot binders honour drivers.* config", () => {
     const result = await bootApplication({
       env: "local",
       startScheduler: false,
-      flows: [flow({ name: "plain", do: () => ({ ok: true }) })],
+      flows: [flow("plain", { do: () => ({ ok: true }) })],
     });
     try {
       expect(result.journal).toBeUndefined();
@@ -187,7 +187,7 @@ describe("boot binders honour drivers.* config", () => {
     const result = await bootApplication({
       env: "local",
       startScheduler: false,
-      flows: [flow({ name: "charge", durable: true, do: () => ({ ok: true }) })],
+      flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
       config: {
         drivers: {
           journal: { local: "file", docker: "postgres", test: "memory", prod: "postgres" },
@@ -211,7 +211,7 @@ describe("boot binders honour drivers.* config", () => {
         bootApplication({
           env: "local",
           startScheduler: false,
-          flows: [flow({ name: "charge", durable: true, do: () => ({ ok: true }) })],
+          flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
           config: {
             drivers: {
               journal: { local: "postgres" },
@@ -232,7 +232,7 @@ describe("boot binders honour drivers.* config", () => {
       bootApplication({
         env: "local",
         startScheduler: false,
-        flows: [flow({ name: "charge", durable: true, do: () => ({ ok: true }) })],
+        flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
         config: {
           drivers: {
             journal: { local: "neon" },

package/src/kernel/boot-bind/journal.ts

@@ -12,6 +12,7 @@ import {
 } from "../journal.ts";
 import { createPostgresJournalStore } from "../../drivers/journal-postgres.ts";
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { JOURNAL_DEFAULTS } from "../../config/driver-defaults.ts";
 import type { BootOptions } from "../boot.ts";
 
 /** Bound journal runtime — store + this instance's lease identity. */
@@ -37,9 +38,8 @@ export const DEFAULT_FILE_JOURNAL_PATH = ".oke/journal.json";
  * @param env - Active environment
  */
 export function resolveJournalDriverId(options: BootOptions, env: ConfigEnv): string {
-  const resolved = resolveDriverId(options.config?.drivers?.journal, env);
-  if (resolved) return resolved;
-  return "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.journal, env, JOURNAL_DEFAULTS)!;
 }
 
 /**

package/src/kernel/boot-bind/signal.ts

@@ -3,6 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { SIGNAL_DEFAULTS } from "../../config/driver-defaults.ts";
 import { memorySignalDriver } from "../../drivers/signal-memory.ts";
 import { createBunSignalRedisClient, redisSignalDriver } from "../../drivers/signal-redis.ts";
 import type { SignalRedisClientLike } from "../../drivers/signal-types.ts";
@@ -17,7 +18,8 @@ import type { BootOptions } from "../boot.ts";
  * @param env - Active environment
  */
 export function resolveSignalDriverId(options: BootOptions, env: ConfigEnv): string {
-  return resolveDriverId(options.config?.drivers?.signal, env) ?? "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.signal, env, SIGNAL_DEFAULTS)!;
 }
 
 function redisUrlFor(docker: boolean): string | undefined {

package/src/kernel/boot-bind/store.test.ts

@@ -78,6 +78,25 @@ describe("bindStore driver resolution", () => {
     expect(resolveKvDriverId({}, "docker", true)).toBe("redis");
     expect(resolveFilesDriverId({}, "docker", true)).toBe("s3");
   });
+
+  test("pinning only `local` never leaks into docker/test/prod — each keeps its real default", () => {
+    const options = {
+      config: {
+        drivers: {
+          store: {
+            sql: { local: "pglite" },
+          },
+        },
+      },
+    };
+    expect(resolveSqlDriverId(options, "local", false)).toBe("pglite");
+    expect(resolveSqlDriverId(options, "docker", true)).toBe("postgres");
+    expect(resolveSqlDriverId(options, "test", false)).toBe("memory");
+    expect(resolveSqlDriverId(options, "prod", true)).toBe("postgres");
+    // kv / files are untouched by the sql-only override.
+    expect(resolveKvDriverId(options, "local", false)).toBe("memory");
+    expect(resolveKvDriverId(options, "docker", true)).toBe("redis");
+  });
 });
 
 describe("bindStore files fs multi-instance warn", () => {

package/src/kernel/boot-bind/store.ts

@@ -3,6 +3,12 @@
  */
 
 import { resolveDomainDdlMode, resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import {
+  dockerFlagDefaults,
+  STORE_FILES_DEFAULTS,
+  STORE_KV_DEFAULTS,
+  STORE_SQL_DEFAULTS,
+} from "../../config/driver-defaults.ts";
 import { fsDriver } from "../../drivers/fs.ts";
 import { libsqlDriver, libsqlIndexDriver } from "../../drivers/libsql.ts";
 import { meilisearchDriver } from "../../drivers/meilisearch.ts";
@@ -138,9 +144,12 @@ function resolveAutoPush(options: BootOptions): boolean {
 export function resolveSqlDriverId(options: BootOptions, env: ConfigEnv, docker: boolean): string {
   const fromEnv = process.env.OKE_SQL_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
-  const resolved = resolveDriverId(options.config?.drivers?.store?.sql, env);
-  if (resolved) return resolved;
-  return docker ? "postgres" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.store?.sql,
+    env,
+    dockerFlagDefaults(STORE_SQL_DEFAULTS, docker),
+  )!;
 }
 
 /**
@@ -151,9 +160,12 @@ export function resolveSqlDriverId(options: BootOptions, env: ConfigEnv, docker:
 export function resolveKvDriverId(options: BootOptions, env: ConfigEnv, docker: boolean): string {
   const fromEnv = process.env.OKE_KV_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
-  const resolved = resolveDriverId(options.config?.drivers?.store?.kv, env);
-  if (resolved) return resolved;
-  return docker ? "redis" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.store?.kv,
+    env,
+    dockerFlagDefaults(STORE_KV_DEFAULTS, docker),
+  )!;
 }
 
 /**
@@ -168,9 +180,12 @@ export function resolveFilesDriverId(
 ): string {
   const fromEnv = process.env.OKE_FILES_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
-  const resolved = resolveDriverId(options.config?.drivers?.store?.files, env);
-  if (resolved) return resolved;
-  return docker ? "s3" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.store?.files,
+    env,
+    dockerFlagDefaults(STORE_FILES_DEFAULTS, docker),
+  )!;
 }
 
 /**

package/src/kernel/boot-bind/vault.ts

@@ -3,6 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { VAULT_DEFAULTS } from "../../config/driver-defaults.ts";
 import { createVaultRuntime, type VaultRuntime } from "../../elements/vault.ts";
 import { buildVaultBootChain, normalizeVaultDriverId } from "../../elements/vault/boot-chain.ts";
 import type { BootOptions } from "../boot.ts";
@@ -14,9 +15,8 @@ import type { BootOptions } from "../boot.ts";
  * @param env - Active environment
  */
 export function resolveVaultDriverId(options: BootOptions, env: ConfigEnv): string {
-  const resolved = resolveDriverId(options.config?.drivers?.vault, env);
-  if (resolved) return resolved;
-  return env === "test" ? "memory" : "env";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.vault, env, VAULT_DEFAULTS)!;
 }
 
 /**