okengine 0.10.2 → 0.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okengine",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "One law. Eight elements. Ten exports. One package. One manifest. Every backend need is derived, never added.",
   "license": "MIT",
   "repository": {

package/site/content/docs/ai/mcp.mdx

@@ -98,7 +98,6 @@ The docs content ships inside the `okengine` package, so the index your agent se
 
 ## Learn more
 
-- [Console · Access](/docs/console/access) — how operator tokens and grants work
 - [Agent contracts](/docs/ai/skills) — what agents are taught about the system they operate
 - [Flow](/docs/elements/flow) — the effects the MCP reads back
 

package/site/content/docs/elements/ai.mdx

@@ -289,7 +289,6 @@ Bound it at declaration: `maxSteps` caps iterations, `budget.maxCostPerRun` caps
 
 - [Flow](/docs/elements/flow) — `fx.ask` and `fx.search` inside `do`
 - [Store](/docs/elements/store) — `store.index`, the home of embeddings
-- [Console · AI](/docs/console/ai) — prompts, versions, cost per run
 
 ## Next
 
@@ -304,9 +303,4 @@ Bound it at declaration: `maxSteps` caps iterations, `budget.maxCostPerRun` caps
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/channel.mdx

@@ -326,7 +326,6 @@ Confirm a visible OS notification titled `okengine webpush interop`.
 ## Learn more
 
 - [Flow](/docs/elements/flow) — `fx.send` inside `do`
-- [Console · Channels](/docs/console/channels) — receipts, attempts, suppression
 - [Environment Variables](/docs/reference/environment-variables) — Channel boot credentials
 - [Configuration](/docs/reference/configuration) — `drivers.channel.*` maps
 - [i18n](/docs/reference/i18n) — ICU / `fx.t` vs Channel `{{field}}` catalogs
@@ -341,9 +340,4 @@ Confirm a visible OS notification titled `okengine webpush interop`.
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/clock.mdx

@@ -195,7 +195,6 @@ They are not sharing one CronStore. In-memory leases are per process. Point ever
 
 - [Flow](/docs/elements/flow) — `on(trigger, flow)` and the `fx` surface
 - [fx · Runs](/docs/reference/fx#runs-observability-read) — native SLO checkers via `on(every(…))` + `fx.runs`
-- [Console · Clock](/docs/console/clock) — health numbers, pause / edit / wake early
 - [Signal](/docs/elements/signal) — reacting to events instead of time
 
 ## Next
@@ -207,9 +206,4 @@ They are not sharing one CronStore. In-memory leases are per process. Point ever
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/flow.mdx

@@ -320,8 +320,6 @@ Only that run fails — the schedule keeps firing and the process does not exit.
 - [fx](/docs/reference/fx) — full `fx` surface, including ICU `fx.t` / `fx.locale`
 - [Signal](/docs/elements/signal) — delivery physics (`once` · `broadcast` · `live`)
 - [Clock](/docs/elements/clock) — schedules and durable sleep
-- [Console · Flows](/docs/console/flows) — the Manifest-derived panel
-- [Runs](/docs/console/runs) — how a flow execution is observed
 
 ## Next
 
@@ -332,9 +330,4 @@ Only that run fails — the schedule keeps firing and the process does not exit.
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/gate.mdx

@@ -308,7 +308,6 @@ Keying an authenticated endpoint by IP punishes shared NAT.
 - [fx](/docs/reference/fx) — `fx.auth`, `fx.operator`, `fx.principal`
 - [Client](/docs/reference/client) — Bearer `createClient` + `okengine/client/auth`
 - [Plugins](/docs/plugins) — username, magic link, OTP, TOTP, passkeys
-- [Console · Gates](/docs/console/gates) — decision audit and posture
 - [Vault](/docs/elements/vault) — credentials your policies protect
 
 ## Next
@@ -316,9 +315,4 @@ Keying an authenticated endpoint by IP punishes shared NAT.
 <Cards>
   <Card title="Vault" description="Continue to Vault." href="/docs/elements/vault" />
   <Card title="Plugins" description="Sign-in method plugins under /auth." href="/docs/plugins" />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/signal.mdx

@@ -291,7 +291,6 @@ At-least-once: crash-after-claim reclaims when the lease expires, and a handler
 ## Learn more
 
 - [Flow](/docs/elements/flow) — `on(trigger, flow)` and `fx.emit`
-- [Console · Signals](/docs/console/signals) — topology, delivery stats, DLQ replay
 - [Clock](/docs/elements/clock) — scheduled and delayed work
 
 ## Next
@@ -303,9 +302,4 @@ At-least-once: crash-after-claim reclaims when the lease expires, and a handler
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/store.mdx

@@ -490,9 +490,8 @@ await fx.store(sessions).set(`sess:${token}`, { userId }, "7d");
 const keys = await fx.store(sessions).list("sess:");
 ```
 
-**Consequence:** `list` is how the [Console · Store](/docs/console/store) browser enumerates a
-namespace. Prefer stable key prefixes (`user:`, `sess:`) so both your Flows and the Console stay
-readable.
+**Consequence:** `list` enumerates a namespace. Prefer stable key prefixes (`user:`, `sess:`) so
+your Flows and operator tools stay readable.
 
 ### Per-environment KV drivers
 
@@ -637,9 +636,9 @@ images: {
 
 **Known limit:** `fs` is single-host. Under horizontal scale each replica sees its own filesystem (silently inconsistent object views). Boot prints a one-shot warning when `drivers.store.files` is `fs`. Use `s3` for docker/prod (create-oke templates already do).
 
-<Callout title="Console can browse, not edit bytes">
-  The [Console · Store](/docs/console/store) lists keys and can delete them. Direct edit is **KV +
-  SQL only** — blob bodies are not patched from the Console.
+<Callout title="Operator tools can browse, not edit bytes">
+  Operator tools can list keys and delete them. Direct edit is **KV + SQL only** — blob bodies are
+  not patched.
 </Callout>
 
 ### Images — `image` / `putImage`
@@ -861,9 +860,9 @@ Container images come from the `images` map — change the vendor by changing th
 
 Columns tagged `.pii()` or `.sensitive()` are masked at the store boundary — flows, logs, and the Console see a mask, not the value. Revealing cleartext PII requires an explicit `pii:reveal` gate on the flow, so access is a permission, not a convention.
 
-Optional `description` on a store (and `.describe("…")` on fields) becomes the human title in the
-[Console · Store](/docs/console/store) browser. Single-table `reads` / `writes` in the Manifest
-power cache invalidation and that same PII masking — see the Callout under [Querying by hand](#querying-by-hand).
+Optional `description` on a store (and `.describe("…")` on fields) becomes its human title in
+operator tools. Single-table `reads` / `writes` in the Manifest power cache invalidation and that
+same PII masking — see the Callout under [Querying by hand](#querying-by-hand).
 
 ## Troubleshooting
 
@@ -915,7 +914,6 @@ Unlike KV/Files, unset `drivers.store.index` does **not** promote to `pgvector`
 - [Flow](/docs/elements/flow) — the `fx.store` session inside `do`
 - [AI](/docs/elements/ai) — `ai.embed` into a vector `store.index`, searched via `fx.search`
 - [Gate](/docs/elements/gate) — `pii:reveal` and other permissions on flows
-- [Console · Store](/docs/console/store) — browse data, cache keys, PII masking
 - [CLI Reference](/docs/reference/cli) — `oke db push` · `generate` · `migrate`
 - [Configuration](/docs/reference/configuration) — `drivers.store` maps and `images` pins
 - [Environment variables](/docs/reference/environment-variables) — Redis · S3 · meilisearch URLs
@@ -929,9 +927,4 @@ Unlike KV/Files, unset `drivers.store.index` does **not** promote to `pgvector`
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/vault.mdx

@@ -251,7 +251,6 @@ Set the new value (`oke vault set` or the Console). The Console's rotation view
 
 ## Learn more
 
-- [Console · Vault](/docs/console/vault) — fingerprints, resolution chain, rotation blast radius
 - [Flow](/docs/elements/flow) — how `fx.vault` reads secrets inside `do`
 - [CLI Reference](/docs/reference/cli) — `oke vault set` · `list` · `import`
 
@@ -264,9 +263,4 @@ Set the new value (`oke vault set` or the Console). The Console's rotation view
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/get-started/basic-usage.mdx

@@ -146,7 +146,6 @@ bun test
 - [Flow](/docs/elements/flow) — triggers, contracts, effects, and composition
 - [Store](/docs/elements/store) — SQL, KV, files, index
 - [fx](/docs/reference/fx) — the full effect surface
-- [Console · Overview](/docs/console/overview) — Manifest-derived panels
 
 ## Next
 
@@ -161,9 +160,4 @@ bun test
     description="SQL, KV, files, index, and declarative resources."
     href="/docs/elements/store"
   />
-  <Card
-    title="Console"
-    description="Manifest-derived flows, effects, traces, and architecture."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/get-started/why.mdx

@@ -49,7 +49,7 @@ shared lifecycle, optional live DB config, nothing to re-copy.
 Your observability stack learned your routes from sampled traffic. The Flow
 you deployed an hour ago is invisible until someone wires it by hand.
 
-**OKE derives:** the [Console](/docs/console/overview) reads the Manifest —
+**OKE derives:** its operator interface reads the Manifest —
 flows, effects, traces, architecture — current on every save, in dev and prod
 (`:6533`).
 
@@ -118,7 +118,6 @@ ninth element — the set of eight is closed.
 - [Flow](/docs/elements/flow) — how effects are recorded and inferred
 - [Vault](/docs/elements/vault) — fail-loud secret contracts
 - [Plugins](/docs/reference/plugins) — the official HTTP glue set
-- [Console · Overview](/docs/console/overview) — the Manifest-derived operator UI
 
 ## Next
 

package/site/content/docs/index.mdx

@@ -31,7 +31,6 @@ on(orderPlaced, sendReceipt);
     description="Official extensions — security, ops, performance."
     href="/docs/plugins"
   />
-  <Card title="Console" description="Manifest-derived operator panels." href="/docs/console" />
   <Card
     title="Deployment"
     description="Compose, Swarm, Kubernetes, reverse proxy."

package/site/content/docs/meta.json

@@ -6,7 +6,6 @@
     "get-started",
     "elements",
     "plugins",
-    "console",
     "deployment",
     "recipes",
     "providers",

package/site/content/docs/reference/fx.mdx

@@ -259,9 +259,9 @@ must log who started the call chain.
 ## Not on `fx`
 
 <Callout title="No fx.metric">
-  Investigated and declined. [Runs](/docs/console/runs) already own per-invocation observability as
-  wide events. Native alerting is `fx.runs` + Clock + Channel — not a second counter/gauge API.
-  Optional OTLP export for existing Grafana/Datadog stacks is additive and never required.
+  Investigated and declined. `fx.runs` already provides per-invocation observability as wide events.
+  Native alerting is `fx.runs` + Clock + Channel — not a second counter/gauge API. Optional OTLP
+  export for existing Grafana/Datadog stacks is additive and never required.
 </Callout>
 
 ## Learn more

package/src/cli/ai-setup/ai-setup.test.ts

@@ -117,7 +117,9 @@ export default defineConfig({
     },
   },
   images: {
-    "store.sql": "postgres:18-alpine",
+    store: {
+      sql: "postgres:18-alpine",
+    },
   },
 });
 `,

package/src/cli/build.ts

@@ -2,9 +2,6 @@
  * `oke build --target edge` — tree-shaken kernel profile.
  */
 
-import { writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
 /** Options for {@link runBuild}. */
 export interface BuildOptions {
   readonly target?: "bun" | "node" | "edge";
@@ -21,8 +18,9 @@ export interface BuildOptions {
   }) => Promise<{ success: boolean; logs: string }>;
   /**
    * Inject `.adopt()` barrel regeneration (tests). Default: real
-   * `generateAdoptBarrel` + write to `<rootDir>/src/flows/generated.ts`.
-   * Returns the unit names written, for the status line.
+   * `generateAdoptBarrel` + atomic write to `<rootDir>/src/flows/generated.ts`
+   * (`generated.ts.tmp` → rename). Returns the unit names written, for the
+   * status line.
    */
   readonly syncAdoptBarrel?: (rootDir: string) => Promise<readonly string[]>;
 }
@@ -33,14 +31,15 @@ export interface BuildOptions {
  * pre-step). A real file on disk, not a virtual module: identical resolution
  * under `oke dev`'s runtime `import()` and `oke build`'s `Bun.build()`
  * (investigated — a virtual-module Bun plugin does not resolve consistently
- * across those two paths).
+ * across those two paths). Written atomically so a concurrent reader never
+ * sees a torn file.
  *
  * @param rootDir - Project root
  */
 async function defaultSyncAdoptBarrel(rootDir: string): Promise<readonly string[]> {
-  const { generateAdoptBarrel } = await import("../compiler/generate-adopt.ts");
+  const { generateAdoptBarrel, writeAdoptBarrel } = await import("../compiler/generate-adopt.ts");
   const { source, units } = await generateAdoptBarrel({ rootDir });
-  await writeFile(join(rootDir, "src/flows/generated.ts"), source);
+  await writeAdoptBarrel(rootDir, source);
   return units;
 }
 

package/src/cli/dev.test.ts

@@ -7,9 +7,14 @@
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtemp } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import {
+  ADOPT_BARREL_FILE,
+  generateAdoptBarrel,
+  writeAdoptBarrel,
+} from "../compiler/generate-adopt.ts";
 import type { Manifest } from "../manifest/types.ts";
 import type { WideEvent } from "../runs/types.ts";
 import { isDataEnvelope, MCP_DATA_KIND } from "../mcp/data.ts";
@@ -544,6 +549,88 @@ describe("oke dev hot reload", () => {
   }, 60_000);
 });
 
+describe("oke dev syncAdoptBarrel atomic write", () => {
+  test("default path regenerates generated.ts and leaves no .tmp behind", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "oke-dev-adopt-atomic-"));
+    await mkdir(join(dir, "src/flows/notes"), { recursive: true });
+    await Bun.write(join(dir, "src/flows/notes/index.ts"), "export {};\n");
+    await Bun.write(join(dir, "src/app.ts"), "export {};\n");
+    await Bun.write(join(dir, "src/flows", ADOPT_BARREL_FILE), "// stale stub\n");
+
+    const { code } = await runDev({
+      cwd: dir,
+      dryRun: true,
+      stdinIsTTY: false,
+      write: () => {},
+    });
+    expect(code).toBe(0);
+
+    const barrelPath = join(dir, "src/flows", ADOPT_BARREL_FILE);
+    const text = await Bun.file(barrelPath).text();
+    expect(text).toContain('export * as notes from "./notes/index.ts";');
+    expect(text).not.toContain("stale stub");
+    expect(await Bun.file(`${barrelPath}.tmp`).exists()).toBe(false);
+    const leftovers = (await readdir(join(dir, "src/flows"))).filter((f) => f.includes(".tmp"));
+    expect(leftovers).toEqual([]);
+  });
+
+  test("writeAdoptBarrel uses temp then rename — concurrent readers never see a torn file", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "oke-dev-adopt-race-"));
+    const flowsDir = join(dir, "src/flows");
+    await mkdir(flowsDir, { recursive: true });
+    const target = join(flowsDir, ADOPT_BARREL_FILE);
+
+    // Two complete, same-length payloads so a mid-write truncate would yield
+    // mixed or short content that fails both equality checks.
+    const markerA = "A";
+    const markerB = "B";
+    const body = (marker: string) => `// ${marker}\n` + `${marker.repeat(64)}\n`.repeat(2_000);
+    const payloadA = body(markerA);
+    const payloadB = body(markerB);
+    expect(payloadA.length).toBe(payloadB.length);
+    expect(payloadA).not.toBe(payloadB);
+
+    await writeAdoptBarrel(dir, payloadA);
+    expect(await Bun.file(target).text()).toBe(payloadA);
+
+    const reads: string[] = [];
+    let stop = false;
+    const reader = (async () => {
+      while (!stop) {
+        try {
+          reads.push(await Bun.file(target).text());
+        } catch {
+          // Target briefly missing only if rename races a delete — ignore.
+        }
+        // Yield so writers interleave; Bun.sleep(0) is enough on this loop.
+        await Bun.sleep(0);
+      }
+    })();
+
+    for (let i = 0; i < 80; i++) {
+      await writeAdoptBarrel(dir, i % 2 === 0 ? payloadB : payloadA);
+    }
+    stop = true;
+    await reader;
+
+    expect(reads.length).toBeGreaterThan(10);
+    for (const sample of reads) {
+      // Every observation is a complete prior or complete next payload —
+      // never a truncated prefix, never a mix of A/B markers.
+      const ok = sample === payloadA || sample === payloadB;
+      expect(ok).toBe(true);
+      expect(sample.length).toBe(payloadA.length);
+      expect(sample.includes(markerA) && sample.includes(markerB)).toBe(false);
+    }
+    expect(await Bun.file(`${target}.tmp`).exists()).toBe(false);
+
+    // Same helper the default `oke dev` path uses end-to-end.
+    const { source } = await generateAdoptBarrel({ rootDir: dir });
+    await writeAdoptBarrel(dir, source);
+    expect(await Bun.file(target).text()).toBe(source);
+  });
+});
+
 describe("oke dev mode resolution", () => {
   test("non-TTY + unset mode → local, zero ask, zero docker, no save", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-dev-mode-nontty-"));

package/src/cli/dev.ts

@@ -178,11 +178,13 @@ export interface DevOptions {
   readonly onDbAutoPush?: (filename: string) => void;
   /**
    * Injectable `.adopt()` barrel regeneration (tests). Default: real
-   * `generateAdoptBarrel` + write to `<cwd>/src/flows/generated.ts`. Runs
-   * once per `oke dev` session, before the entry is resolved/imported —
-   * a real file on disk, so `oke dev`'s runtime `import()` and `oke build`'s
-   * `Bun.build()` resolve it identically (unlike a virtual-module Bun
-   * plugin, which does not — see `compiler/generate-adopt.ts`).
+   * `generateAdoptBarrel` + atomic write to `<cwd>/src/flows/generated.ts`
+   * (`generated.ts.tmp` → rename). Runs once per `oke dev` session, before
+   * the entry is resolved/imported — a real file on disk, so `oke dev`'s
+   * runtime `import()` and `oke build`'s `Bun.build()` resolve it
+   * identically (unlike a virtual-module Bun plugin, which does not — see
+   * `compiler/generate-adopt.ts`). Atomic so a concurrent import during
+   * `bun --hot` never sees a torn mid-write file.
    *
    * @param cwd - Project root
    */
@@ -346,18 +348,18 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
   const cwd = options.cwd ?? process.cwd();
 
   // One-shot `.adopt()` barrel regen for the session — real file on disk
-  // (`src/flows/generated.ts`), written before the entry is resolved/imported
-  // below so a freshly-added flows unit is adoptable without a hand edit.
-  // Best-effort like `syncDevSchema` below: a project with no `src/flows`
-  // yet (or a synthetic test tree) never blocks the dev session.
+  // (`src/flows/generated.ts`), written atomically (tmp → rename) before the
+  // entry is resolved/imported below so a freshly-added flows unit is
+  // adoptable without a hand edit. Best-effort like `syncDevSchema` below:
+  // a project with no `src/flows` yet (or a synthetic test tree) never
+  // blocks the dev session.
   const syncAdoptBarrel =
     options.syncAdoptBarrel ??
     (async (root: string) => {
-      const { generateAdoptBarrel } = await import("../compiler/generate-adopt.ts");
-      const { mkdir, writeFile } = await import("node:fs/promises");
+      const { generateAdoptBarrel, writeAdoptBarrel } =
+        await import("../compiler/generate-adopt.ts");
       const { source, units } = await generateAdoptBarrel({ rootDir: root });
-      await mkdir(resolve(root, "src/flows"), { recursive: true });
-      await writeFile(resolve(root, "src/flows/generated.ts"), source);
+      await writeAdoptBarrel(root, source);
       return units;
     });
   try {

package/src/cli/doctor.ts

@@ -3,17 +3,70 @@
  */
 
 import { resolve } from "node:path";
+import type { ConfigEnv, DriverRef, DriversConfig, EnvDriverMap } from "../config/index.ts";
+import { resolveEffectiveDrivers, type EffectiveDriversConfig } from "../config/driver-defaults.ts";
 import type { Manifest } from "../manifest/types.ts";
 import { APP_PORT, CONSOLE_PORT, MCP_PORT } from "../runtime/types.ts";
 import { hasFlag, wantsJson } from "./args.ts";
 import { checkManifestPiiAsks } from "./doctor-pii.ts";
 import { EXIT_OK, EXIT_RUNTIME } from "./exit.ts";
-import { loadManifest } from "./load-config.ts";
+import { loadManifest, loadOkeConfig } from "./load-config.ts";
 import { isPortInUse } from "./ports.ts";
 import { schemaFingerprint, readSchemaFingerprint } from "./schema.ts";
 
 export { isPortInUse } from "./ports.ts";
 
+/**
+ * `label → merged EnvDriverMap` pairs, in the fixed order shown by
+ * {@link formatDriversSummary} / the `drivers` JSON key.
+ *
+ * @param drivers - Fully-resolved drivers config
+ */
+function flattenEffectiveDrivers(
+  drivers: EffectiveDriversConfig,
+): ReadonlyArray<readonly [string, EnvDriverMap]> {
+  return [
+    ["store.sql", drivers.store.sql],
+    ["store.kv", drivers.store.kv],
+    ["store.files", drivers.store.files],
+    ["signal", drivers.signal],
+    ["clock", drivers.clock],
+    ["journal", drivers.journal],
+    ["vault", drivers.vault],
+    ["channel.email", drivers.channel.email],
+    ["channel.sms", drivers.channel.sms],
+  ];
+}
+
+/**
+ * @param ref - Driver ref (string id, rich `{ driver }` object, or unset)
+ */
+function driverRefId(ref: DriverRef | undefined): string {
+  if (ref === undefined) return "—";
+  return typeof ref === "string" ? ref : ref.driver;
+}
+
+/**
+ * Render the fully-resolved drivers config as aligned text lines — every
+ * default plus every override, per env, for a developer whose own
+ * `oke.config.ts` only pins a handful of keys.
+ *
+ * @param drivers - Fully-resolved drivers config
+ * @param configEnv - Active env (marked in the active-driver column)
+ */
+function formatDriversSummary(drivers: EffectiveDriversConfig, configEnv: ConfigEnv): string {
+  const rows = flattenEffectiveDrivers(drivers);
+  const nameWidth = Math.max(...rows.map(([name]) => name.length));
+  const activeWidth = Math.max(...rows.map(([, map]) => driverRefId(map[configEnv]).length));
+  const lines = [`drivers (env=${configEnv}):`];
+  for (const [name, map] of rows) {
+    const active = driverRefId(map[configEnv]);
+    const full = `local=${driverRefId(map.local)} docker=${driverRefId(map.docker)} test=${driverRefId(map.test)} prod=${driverRefId(map.prod)}`;
+    lines.push(`  ${name.padEnd(nameWidth)}  ${active.padEnd(activeWidth)}  { ${full} }`);
+  }
+  return lines.join("\n");
+}
+
 /** One doctor finding. */
 export interface DoctorFinding {
   readonly code:
@@ -55,6 +108,19 @@ export interface DoctorOptions {
   }>;
   /** Skip live DB drift probe (default false). */
   readonly skipDbDrift?: boolean;
+  /**
+   * Inject the `drivers` block directly (tests) — skips loading
+   * `oke.config.ts` from disk. When omitted, `oke doctor` best-effort loads
+   * `oke.config.ts` from {@link cwd}; a project without one just gets the
+   * real, untouched defaults in the drivers summary.
+   */
+  readonly driversConfig?: DriversConfig;
+  /**
+   * Active {@link ConfigEnv} for the drivers summary. Default: `docker` when
+   * `OKE_DOCKER=1` (via {@link env}), else `local` — the same resolution
+   * `oke boot` uses without an explicit `env`.
+   */
+  readonly configEnv?: ConfigEnv;
   readonly write?: (text: string) => void;
   /** Write hints / progress (defaults to stderr). */
   readonly writeErr?: (text: string) => void;
@@ -92,6 +158,20 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
   const env = options.env ?? ((k) => Bun.env[k] ?? process.env[k]);
   const secretNames = options.secrets ?? (manifest?.vault ? Object.keys(manifest.vault) : []);
 
+  // Fully-resolved `drivers.*` — real defaults + every override merged, so
+  // the picture is complete even when `oke.config.ts` only pins one key.
+  let driversConfig = options.driversConfig;
+  if (driversConfig === undefined) {
+    try {
+      driversConfig = (await loadOkeConfig(cwd)).config.drivers;
+    } catch {
+      // No oke.config.ts (or it failed to load) — show real defaults only.
+    }
+  }
+  const configEnv: ConfigEnv =
+    options.configEnv ?? (env("OKE_DOCKER") === "1" ? "docker" : "local");
+  const effectiveDrivers = resolveEffectiveDrivers(driversConfig);
+
   for (const name of secretNames) {
     const value = env(name);
     if (value === undefined || value.length === 0) {
@@ -177,7 +257,9 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
   const code = ok ? EXIT_OK : EXIT_RUNTIME;
 
   if (json) {
-    write(`${JSON.stringify({ ok, findings }, null, 2)}\n`);
+    write(
+      `${JSON.stringify({ ok, findings, drivers: { env: configEnv, resolved: effectiveDrivers } }, null, 2)}\n`,
+    );
     if (!ok) {
       writeErr("Hint: fix error-severity findings, then re-run oke doctor.\n");
     }
@@ -186,6 +268,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
 
   if (findings.length === 0) {
     write("oke doctor: ok\n");
+    write(`${formatDriversSummary(effectiveDrivers, configEnv)}\n`);
     return { code: EXIT_OK, findings };
   }
 
@@ -193,6 +276,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
   for (const f of findings) {
     write(`  [${f.severity}] ${f.code}: ${f.message}\n`);
   }
+  write(`${formatDriversSummary(effectiveDrivers, configEnv)}\n`);
   return { code, findings };
 }
 
@@ -208,16 +292,25 @@ export async function doctorCli(args: readonly string[]): Promise<number> {
   }
 
   let manifestPath: string | undefined;
+  let configEnv: ConfigEnv | undefined;
   const json = wantsJson(args);
   for (let i = 0; i < args.length; i++) {
     const a = args[i]!;
     if (a === "--manifest" || a === "-m") manifestPath = args[++i];
-    else if (a === "--help" || a === "-h") {
-      console.log(`oke doctor [--manifest|-m path] [--json|-j]
+    else if (a === "--env" || a === "-e") {
+      const value = args[++i];
+      if (value === "local" || value === "docker" || value === "test" || value === "prod") {
+        configEnv = value;
+      }
+    } else if (a === "--help" || a === "-h") {
+      console.log(`oke doctor [--manifest|-m path] [--env|-e local|docker|test|prod] [--json|-j]
 oke doctor --diff|-d [--before|-b <path> --after|-a <path>] [--base|-B <branch>]
 
 Verify secrets, ports, schema drift, and PII→model egress before serving.
+Also prints drivers.* fully resolved (every default + every override merged)
+for the active env, from oke.config.ts.
 
+--env   Env to resolve drivers for (default: docker when OKE_DOCKER=1, else local).
 --diff  CI gate: block undeclared contract breaks (Manifest Diff).
         Default baseline is git merge-base (main/master) vs the working
         tree; pass --before/--after for an explicit comparison.
@@ -227,6 +320,6 @@ Verify secrets, ports, schema drift, and PII→model egress before serving.
       return EXIT_OK;
     }
   }
-  const { code } = await runDoctor({ manifestPath, json });
+  const { code } = await runDoctor({ manifestPath, configEnv, json });
   return code;
 }