okengine 0.10.2 → 0.10.3

package/src/cli/load-config.images.test.ts

@@ -3,12 +3,42 @@
  */
 
 import { describe, expect, test } from "bun:test";
+import { flattenImagesConfig } from "../config/index.ts";
 import {
   defaultImagesFromConfig,
   resolveImages,
   dockerDevDriverMismatches,
 } from "./load-config.ts";
 
+describe("flattenImagesConfig", () => {
+  test("flattens store/channel nesting to dotted keys; flat roles pass through", () => {
+    expect(
+      flattenImagesConfig({
+        store: { sql: "postgres:18-alpine", kv: "redis:8-alpine", files: "rustfs/rustfs:1.0.0" },
+        channel: { email: "axllent/mailpit:v1.22.3" },
+        vault: "openbao/openbao:2.6.1",
+        ai: "ollama/ollama:0.32.6",
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+        proxy: "caddy:2-alpine",
+      }),
+    ).toEqual({
+      "store.sql": "postgres:18-alpine",
+      "store.kv": "redis:8-alpine",
+      "store.files": "rustfs/rustfs:1.0.0",
+      "channel.email": "axllent/mailpit:v1.22.3",
+      vault: "openbao/openbao:2.6.1",
+      ai: "ollama/ollama:0.32.6",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      proxy: "caddy:2-alpine",
+    });
+  });
+
+  test("undefined / empty input yields empty map", () => {
+    expect(flattenImagesConfig(undefined)).toEqual({});
+    expect(flattenImagesConfig({})).toEqual({});
+  });
+});
+
 describe("defaultImagesFromConfig", () => {
   test("maps postgres + redis prod drivers", () => {
     const images = defaultImagesFromConfig({
@@ -82,7 +112,7 @@ describe("resolveImages", () => {
           kv: { prod: "redis" },
         },
       },
-      images: { "store.sql": "pgvector/pgvector:pg17" },
+      images: { store: { sql: "pgvector/pgvector:pg17" } },
     });
     expect(images).toEqual({ "store.sql": "pgvector/pgvector:pg17" });
   });

package/src/cli/load-config.ts

@@ -3,7 +3,7 @@
  */
 
 import { resolve } from "node:path";
-import type { DriverRef, OkeConfig } from "../config/index.ts";
+import { flattenImagesConfig, type DriverRef, type OkeConfig } from "../config/index.ts";
 import type { Manifest } from "../manifest/types.ts";
 
 /** Default image pins when `images` is omitted but prod drivers need containers. */
@@ -145,7 +145,7 @@ export function resolveImages(
   config?: OkeConfig,
   manifest?: Manifest,
 ): Readonly<Record<string, string>> {
-  const explicit = config?.images ?? manifest?.images;
+  const explicit = config?.images ? flattenImagesConfig(config.images) : manifest?.images;
   if (explicit && Object.keys(explicit).length > 0) return explicit;
   if (config) return defaultImagesFromConfig(config);
   return {};

package/src/cli/safe-defaults.test.ts

@@ -16,7 +16,7 @@ describe("oke safe-default overrides", () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-safe-docker-"));
     await Bun.write(
       join(dir, "oke.config.ts"),
-      `export default { images: { "store.sql": "postgres:18-alpine" } }\n`,
+      `export default { images: { store: { sql: "postgres:18-alpine" } } }\n`,
     );
     // Without --prod, derive still runs but prod overlays are not requested.
     // We assert the parser default by calling runDockerDerive via dockerCli

package/src/compiler/extract.ts

@@ -1022,8 +1022,20 @@ function collectConfig(opts: AstNode | undefined, scope: ProjectScope): void {
   const images = objectProp(opts, "images");
   if (images) {
     const map: Record<string, string> = {};
+    // Nested like `drivers`: `store.*` / `channel.*` flatten to dotted keys;
+    // everything else (`vault`, `ai`, `pgdog`, `proxy`) is already flat.
+    for (const nestKey of ["store", "channel"] as const) {
+      const nested = objectProp(images, nestKey);
+      if (!nested || nested.type !== "ObjectExpression") continue;
+      for (const prop of objectProperties(nested)) {
+        const key = propKey(prop);
+        const val = stringArg((prop as AstNode & { value?: AstNode }).value);
+        if (key && val) map[`${nestKey}.${key}`] = val;
+      }
+    }
     for (const prop of objectProperties(images)) {
       const key = propKey(prop);
+      if (key === "store" || key === "channel") continue;
       const val = stringArg((prop as AstNode & { value?: AstNode }).value);
       if (key && val) map[key] = val;
     }

package/src/compiler/fixtures/skyport/oke.config.ts

@@ -15,8 +15,10 @@ export default defineConfig({
     ai: { prod: { driver: "anthropic" } },
   },
   images: {
-    "store.sql": "pgvector/pgvector:pg17",
-    "store.kv": "valkey/valkey:8-alpine",
+    store: {
+      sql: "pgvector/pgvector:pg17",
+      kv: "valkey/valkey:8-alpine",
+    },
   },
   i18n: { locales: ["en", "ar"], default: "ar", dir: { ar: "rtl" } },
   tenancy: { isolation: "row" },

package/src/compiler/generate-adopt.ts

@@ -12,7 +12,7 @@
  * `<rootDir>/src/flows/*` has an `index.ts` barrel.
  */
 
-import { readdir } from "node:fs/promises";
+import { mkdir, readdir, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 /** Options for {@link generateAdoptBarrel}. */
@@ -37,9 +37,35 @@ const GENERATED_HEADER =
   "// AUTO-GENERATED by `oke dev` / `oke build` — do not edit by hand.\n" +
   "// Regenerated from every `src/flows/<unit>/index.ts` unit folder.\n";
 
+/** Filename of the on-disk `.adopt()` barrel under the flows directory. */
+export const ADOPT_BARREL_FILE = "generated.ts";
+
 /** A folder name usable as an `export * as <name>` binding. */
 const VALID_UNIT_NAME = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 
+/**
+ * Write the adopt barrel atomically: `generated.ts.tmp` → rename to
+ * `generated.ts`. Concurrent readers (e.g. `bun --hot` racing a save) never
+ * observe a torn/partial file — plain `writeFile` on the destination would
+ * truncate first.
+ *
+ * @param rootDir - Project root
+ * @param source - Full barrel source from {@link generateAdoptBarrel}
+ * @param flowsDir - Flows directory relative to root (default `"src/flows"`)
+ */
+export async function writeAdoptBarrel(
+  rootDir: string,
+  source: string,
+  flowsDir = "src/flows",
+): Promise<void> {
+  const dir = join(rootDir, flowsDir);
+  const target = join(dir, ADOPT_BARREL_FILE);
+  const tmp = `${target}.tmp`;
+  await mkdir(dir, { recursive: true });
+  await writeFile(tmp, source);
+  await rename(tmp, target);
+}
+
 /**
  * Scan `<rootDir>/<flowsDir>/*` and emit a barrel re-exporting every unit
  * folder's `index.ts` under its folder name — the same shape

package/src/config/driver-defaults.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Driver-map defaults — per-key merge onto the real established defaults,
+ * never a whole-object replace and never leaking across driver maps.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { mergeEnvDriverMap } from "./index.ts";
+import {
+  CHANNEL_EMAIL_DEFAULTS,
+  CHANNEL_SMS_DEFAULTS,
+  CLOCK_DEFAULTS,
+  JOURNAL_DEFAULTS,
+  resolveEffectiveDrivers,
+  SIGNAL_DEFAULTS,
+  STORE_FILES_DEFAULTS,
+  STORE_KV_DEFAULTS,
+  STORE_SQL_DEFAULTS,
+  VAULT_DEFAULTS,
+} from "./driver-defaults.ts";
+
+describe("mergeEnvDriverMap", () => {
+  test("an unset key keeps the real default, not a sibling key's value", () => {
+    const merged = mergeEnvDriverMap({ local: "pglite" }, STORE_SQL_DEFAULTS);
+    expect(merged).toEqual({
+      local: "pglite",
+      docker: "postgres",
+      test: "memory",
+      prod: "postgres",
+    });
+  });
+
+  test("undefined override yields the untouched default map", () => {
+    expect(mergeEnvDriverMap(undefined, STORE_KV_DEFAULTS)).toEqual(STORE_KV_DEFAULTS);
+  });
+
+  test("a fully-specified override wins on every key", () => {
+    const override = { local: "a", docker: "b", test: "c", prod: "d" };
+    expect(mergeEnvDriverMap(override, STORE_SQL_DEFAULTS)).toEqual(override);
+  });
+});
+
+describe("resolveEffectiveDrivers — the drivers.store.sql.local discussion scenario", () => {
+  test("`{ store: { sql: { local: 'pglite' } } }` resolves sql to the real map, pglite only on local", () => {
+    const effective = resolveEffectiveDrivers({
+      store: { sql: { local: "pglite" } },
+    });
+
+    expect(effective.store.sql).toEqual({
+      local: "pglite",
+      docker: "postgres",
+      test: "memory",
+      prod: "postgres",
+    });
+  });
+
+  test("every other driver stays at its full, real, untouched default map", () => {
+    const effective = resolveEffectiveDrivers({
+      store: { sql: { local: "pglite" } },
+    });
+
+    expect(effective.store.kv).toEqual(STORE_KV_DEFAULTS);
+    expect(effective.store.files).toEqual(STORE_FILES_DEFAULTS);
+    expect(effective.signal).toEqual(SIGNAL_DEFAULTS);
+    expect(effective.clock).toEqual(CLOCK_DEFAULTS);
+    expect(effective.journal).toEqual(JOURNAL_DEFAULTS);
+    expect(effective.vault).toEqual(VAULT_DEFAULTS);
+    expect(effective.channel.email).toEqual(CHANNEL_EMAIL_DEFAULTS);
+    expect(effective.channel.sms).toEqual(CHANNEL_SMS_DEFAULTS);
+  });
+
+  test("overriding one driver's map has zero effect on a sibling driver's defaults", () => {
+    const effective = resolveEffectiveDrivers({
+      store: { kv: { local: "redis" } },
+    });
+
+    // The overridden driver (kv) reflects the override on its one set key.
+    expect(effective.store.kv).toEqual({
+      local: "redis",
+      docker: "redis",
+      test: "memory",
+      prod: "redis",
+    });
+    // sql / files (same element, different facet) stay fully at real defaults.
+    expect(effective.store.sql).toEqual(STORE_SQL_DEFAULTS);
+    expect(effective.store.files).toEqual(STORE_FILES_DEFAULTS);
+    // Unrelated elements stay fully at real defaults too.
+    expect(effective.signal).toEqual(SIGNAL_DEFAULTS);
+    expect(effective.vault).toEqual(VAULT_DEFAULTS);
+  });
+
+  test("overriding one env key leaves the other three at real defaults for that driver", () => {
+    const effective = resolveEffectiveDrivers({
+      vault: { local: "keychain" },
+    });
+
+    expect(effective.vault).toEqual({
+      local: "keychain",
+      docker: "env",
+      test: "memory",
+      prod: "env",
+    });
+  });
+
+  test("no drivers config at all yields the real, untouched defaults for every map", () => {
+    const effective = resolveEffectiveDrivers(undefined);
+    expect(effective).toEqual({
+      store: {
+        sql: STORE_SQL_DEFAULTS,
+        kv: STORE_KV_DEFAULTS,
+        files: STORE_FILES_DEFAULTS,
+      },
+      signal: SIGNAL_DEFAULTS,
+      clock: CLOCK_DEFAULTS,
+      journal: JOURNAL_DEFAULTS,
+      vault: VAULT_DEFAULTS,
+      channel: {
+        email: CHANNEL_EMAIL_DEFAULTS,
+        sms: CHANNEL_SMS_DEFAULTS,
+      },
+    });
+  });
+});

package/src/config/driver-defaults.ts

@@ -0,0 +1,186 @@
+/**
+ * Real, already-established default driver ids per {@link ConfigEnv} —
+ * one source of truth for every driver map that has a single default table.
+ *
+ * These mirror the literal fallbacks that used to live inline in each
+ * `src/kernel/boot-bind/*.ts` resolver (`docker ? "postgres" : "memory"`,
+ * `env === "test" ? "frozen" : "memory"`, …). Kept here so
+ * {@link mergeEnvDriverMap} has one real map to merge a developer's partial
+ * override onto, instead of every resolver re-deriving its own default.
+ *
+ * `store.index`, `channel.whatsapp` / `push`, and `ai` are intentionally
+ * absent — they don't have one established default across all four envs
+ * (index/whatsapp/push default to nothing until configured; ai has no prod
+ * default at all and must be declared) and keep using
+ * {@link resolveDriverId}'s legacy cascade.
+ * @module
+ */
+
+import {
+  mergeEnvDriverMap,
+  normalizeEnvDriverMap,
+  type DriversConfig,
+  type EnvDriverMap,
+  type RawEnvDriverMap,
+} from "./index.ts";
+
+/** `drivers.store.sql` — Postgres for docker/prod, in-memory otherwise. */
+export const STORE_SQL_DEFAULTS: EnvDriverMap = {
+  local: "memory",
+  docker: "postgres",
+  test: "memory",
+  prod: "postgres",
+};
+
+/** `drivers.store.kv` — Redis for docker/prod, in-memory otherwise. */
+export const STORE_KV_DEFAULTS: EnvDriverMap = {
+  local: "memory",
+  docker: "redis",
+  test: "memory",
+  prod: "redis",
+};
+
+/** `drivers.store.files` — S3 for docker/prod, in-memory otherwise. */
+export const STORE_FILES_DEFAULTS: EnvDriverMap = {
+  local: "memory",
+  docker: "s3",
+  test: "memory",
+  prod: "s3",
+};
+
+/** `drivers.signal` — in-memory bus everywhere. */
+export const SIGNAL_DEFAULTS: EnvDriverMap = {
+  local: "memory",
+  docker: "memory",
+  test: "memory",
+  prod: "memory",
+};
+
+/** `drivers.clock` — frozen test clock in `test`, in-memory cron elsewhere. */
+export const CLOCK_DEFAULTS: EnvDriverMap = {
+  local: "memory",
+  docker: "memory",
+  test: "frozen",
+  prod: "memory",
+};
+
+/** `drivers.journal` — in-memory durable-run store everywhere. */
+export const JOURNAL_DEFAULTS: EnvDriverMap = {
+  local: "memory",
+  docker: "memory",
+  test: "memory",
+  prod: "memory",
+};
+
+/** `drivers.vault` — OS env vars everywhere except `test` (in-memory). */
+export const VAULT_DEFAULTS: EnvDriverMap = {
+  local: "env",
+  docker: "env",
+  test: "memory",
+  prod: "env",
+};
+
+/** `drivers.channel.email` — SMTP for docker/prod, console inbox otherwise. */
+export const CHANNEL_EMAIL_DEFAULTS: EnvDriverMap = {
+  local: "console",
+  docker: "smtp",
+  test: "console",
+  prod: "smtp",
+};
+
+/**
+ * `drivers.channel.sms` — no default provider in any env; SMS is opt-in
+ * only (an unconfigured env simply gets no SMS channel).
+ */
+export const CHANNEL_SMS_DEFAULTS: EnvDriverMap = {};
+
+/**
+ * Effective default map for a driver whose real default also depends on the
+ * boot-time `docker` flag (real docker-compose infra available), not just
+ * the active {@link ConfigEnv} key — `store.sql` / `store.kv` /
+ * `store.files` / `channel.email` / the Gate KV facet. Real usage always
+ * pairs `docker: true` with `env: "docker"` / `"prod"`, so the static table
+ * (`docker`/`prod` → real infra id) applies as-is; with the flag `false`
+ * (`oke dev -l`, `test`, or a boot that deliberately decouples `env` from
+ * infra availability) every key falls back to the same safe, no-external-
+ * deps id the real table already uses for `test`.
+ *
+ * @param defaults - Real per-env default table (its `docker`/`prod` slots
+ *   assume real infra is actually up)
+ * @param docker - Boot-time docker/compose-infra flag
+ */
+export function dockerFlagDefaults(defaults: EnvDriverMap, docker: boolean): EnvDriverMap {
+  if (docker) return defaults;
+  const safe = defaults.test;
+  return { local: safe, docker: safe, test: safe, prod: safe };
+}
+
+/** Every driver map with one established default table, grouped by element. */
+export const DRIVER_DEFAULTS = {
+  store: {
+    sql: STORE_SQL_DEFAULTS,
+    kv: STORE_KV_DEFAULTS,
+    files: STORE_FILES_DEFAULTS,
+  },
+  signal: SIGNAL_DEFAULTS,
+  clock: CLOCK_DEFAULTS,
+  journal: JOURNAL_DEFAULTS,
+  vault: VAULT_DEFAULTS,
+  channel: {
+    email: CHANNEL_EMAIL_DEFAULTS,
+    sms: CHANNEL_SMS_DEFAULTS,
+  },
+} as const;
+
+/**
+ * Every driver map from {@link DRIVER_DEFAULTS}, fully resolved — the
+ * developer's `oke.config.ts` override merged onto the real default,
+ * per-key, for all four {@link ConfigEnv} slots at once. This is the "full
+ * picture" `oke doctor` prints: what boot actually uses for every env, even
+ * when the config on disk only pins one key.
+ */
+export interface EffectiveDriversConfig {
+  readonly store: {
+    readonly sql: EnvDriverMap;
+    readonly kv: EnvDriverMap;
+    readonly files: EnvDriverMap;
+  };
+  readonly signal: EnvDriverMap;
+  readonly clock: EnvDriverMap;
+  readonly journal: EnvDriverMap;
+  readonly vault: EnvDriverMap;
+  readonly channel: {
+    readonly email: EnvDriverMap;
+    readonly sms: EnvDriverMap;
+  };
+}
+
+/**
+ * Merge every driver map in {@link DRIVER_DEFAULTS} against the matching
+ * slot of a loaded `oke.config.ts` `drivers` block.
+ *
+ * @param drivers - `drivers` block from a loaded `oke.config.ts` (already
+ *   normalized if it came through `defineConfig`; normalized again here so
+ *   an un-normalized/raw block is still handled)
+ */
+export function resolveEffectiveDrivers(
+  drivers: DriversConfig | undefined,
+): EffectiveDriversConfig {
+  const merge = (map: EnvDriverMap | undefined, defaults: EnvDriverMap) =>
+    mergeEnvDriverMap(normalizeEnvDriverMap(map as RawEnvDriverMap), defaults);
+  return {
+    store: {
+      sql: merge(drivers?.store?.sql, STORE_SQL_DEFAULTS),
+      kv: merge(drivers?.store?.kv, STORE_KV_DEFAULTS),
+      files: merge(drivers?.store?.files, STORE_FILES_DEFAULTS),
+    },
+    signal: merge(drivers?.signal, SIGNAL_DEFAULTS),
+    clock: merge(drivers?.clock, CLOCK_DEFAULTS),
+    journal: merge(drivers?.journal, JOURNAL_DEFAULTS),
+    vault: merge(drivers?.vault, VAULT_DEFAULTS),
+    channel: {
+      email: merge(drivers?.channel?.email, CHANNEL_EMAIL_DEFAULTS),
+      sms: merge(drivers?.channel?.sms, CHANNEL_SMS_DEFAULTS),
+    },
+  };
+}

package/src/config/index.ts

@@ -81,8 +81,55 @@ export interface DriversConfig {
   readonly runs?: EnvDriverMap;
 }
 
-/** Image lock entries keyed by element role (`store.sql`, …). */
-export type ImagesConfig = Readonly<Record<string, string>>;
+/**
+ * Container image pins, nested the same way as {@link DriversConfig}:
+ * `store.*` / `channel.*` facets nest under their owning element; roles with
+ * no driver counterpart (`vault` picks a driver but pins its own image;
+ * `ai`, `pgdog`, `proxy` have no config-level element at all) stay flat.
+ *
+ * Always fully explicit — `images` has no hidden default merge. Omitted keys
+ * mean "no container for that role," never "inherit a default image."
+ */
+export interface ImagesConfig {
+  readonly store?: {
+    readonly sql?: string;
+    readonly kv?: string;
+    readonly files?: string;
+    readonly index?: string;
+  };
+  readonly channel?: {
+    readonly email?: string;
+  };
+  readonly vault?: string;
+  readonly ai?: string;
+  readonly pgdog?: string;
+  readonly proxy?: string;
+}
+
+/**
+ * Flatten {@link ImagesConfig} to the dotted-role `Record<string, string>`
+ * every internal consumer (compose role matching, credentials, env prefixes)
+ * has always kept working with — the nesting is a config-surface / type-safety
+ * concern only, not an internal representation change.
+ *
+ * @param images - Nested config-surface images (or `undefined`)
+ */
+export function flattenImagesConfig(
+  images: ImagesConfig | undefined,
+): Readonly<Record<string, string>> {
+  if (!images) return {};
+  const out: Record<string, string> = {};
+  if (images.store?.sql) out["store.sql"] = images.store.sql;
+  if (images.store?.kv) out["store.kv"] = images.store.kv;
+  if (images.store?.files) out["store.files"] = images.store.files;
+  if (images.store?.index) out["store.index"] = images.store.index;
+  if (images.channel?.email) out["channel.email"] = images.channel.email;
+  if (images.vault) out.vault = images.vault;
+  if (images.ai) out.ai = images.ai;
+  if (images.pgdog) out.pgdog = images.pgdog;
+  if (images.proxy) out.proxy = images.proxy;
+  return out;
+}
 
 /** i18n config. */
 export interface I18nConfig {
@@ -293,6 +340,32 @@ export function normalizeDriversConfig(
   };
 }
 
+/**
+ * Merge a developer's partial {@link EnvDriverMap} onto the real default map
+ * for one specific driver — per environment key, never a whole-object
+ * replace. An unset key keeps that driver's own real default; it never
+ * inherits a sibling key's value (the old `docker → prod → local → test`
+ * cascade in {@link resolveDriverId} did that, which is exactly the bug this
+ * fixes — `{ local: "pglite" }` no longer leaks `pglite` into `docker`).
+ *
+ * Scoped strictly to the `{ local?, docker?, test?, prod? }` shape — not a
+ * generic deep merge, and never applied to a whole config object.
+ *
+ * @param override - Developer-supplied partial map (may be `undefined`)
+ * @param defaults - Real, already-established default map for this driver
+ */
+export function mergeEnvDriverMap(
+  override: EnvDriverMap | undefined,
+  defaults: EnvDriverMap,
+): EnvDriverMap {
+  return {
+    local: override?.local ?? defaults.local,
+    docker: override?.docker ?? defaults.docker,
+    test: override?.test ?? defaults.test,
+    prod: override?.prod ?? defaults.prod,
+  };
+}
+
 /**
  * Fill missing `docker` pins from `prod` (compose infra ≈ production protocols).
  *
@@ -365,22 +438,39 @@ export function defineConfig(config: OkeConfig): OkeConfig {
 /**
  * Resolve a driver id for an env from an {@link EnvDriverMap}.
  *
- * `docker` falls back to `prod` then `local` so existing configs keep working
- * until an explicit `docker:` pin is added. Legacy keys are normalized first.
+ * With `defaults` given, the developer's map is merged onto it per-key via
+ * {@link mergeEnvDriverMap} and the active env's slot is read directly — a
+ * key the developer never set keeps that driver's real default, full stop.
+ * This is the path every driver map with an established default should use.
+ *
+ * Without `defaults` (legacy path — `store.index`, `channel.whatsapp` /
+ * `push`, `ai`, which have no single established default table): `docker`
+ * falls back to `prod` then `local` then `test` so existing configs keep
+ * working until an explicit `docker:` pin is added. Legacy `dev`/`stack`
+ * keys are normalized first either way.
  *
  * @param map - Env → driver map
  * @param env - Active environment
+ * @param defaults - Real default map for this specific driver (per-key merge)
  */
 export function resolveDriverId(
   map: EnvDriverMap | RawEnvDriverMap | undefined,
   env: ConfigEnv,
+  defaults?: EnvDriverMap,
 ): string | undefined {
+  const normalized = normalizeEnvDriverMap(map as RawEnvDriverMap);
+  if (defaults) {
+    const merged = mergeEnvDriverMap(normalized, defaults);
+    const ref = merged[env];
+    if (ref === undefined) return undefined;
+    return typeof ref === "string" ? ref : ref.driver;
+  }
   if (!map) return undefined;
-  const normalized = normalizeEnvDriverMap(map as RawEnvDriverMap) ?? map;
+  const resolved = normalized ?? map;
   const ref =
     env === "docker"
-      ? (normalized.docker ?? normalized.prod ?? normalized.local ?? normalized.test)
-      : (normalized[env] ?? normalized.local ?? normalized.test);
+      ? (resolved.docker ?? resolved.prod ?? resolved.local ?? resolved.test)
+      : (resolved[env] ?? resolved.local ?? resolved.test);
   if (ref === undefined) return undefined;
   return typeof ref === "string" ? ref : ref.driver;
 }