okengine 0.10.2 → 0.11.0

package/src/cli/docker-clean.test.ts

@@ -8,7 +8,12 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { composeProjectName, type DockerRunner } from "../docker/cleanup.ts";
 import { dockerCli } from "./docker.ts";
-import { dockerCleanHelp, parseDockerCleanArgs, runDockerClean } from "./docker-clean.ts";
+import {
+  dockerCleanHelp,
+  parseDockerCleanArgs,
+  runDockerClean,
+  selectionEntries,
+} from "./docker-clean.ts";
 import { EXIT_OK, EXIT_USAGE } from "./exit.ts";
 import { formatOkeHelp, flagTokensFor, OKE_COMMANDS } from "./registry.ts";
 
@@ -176,4 +181,31 @@ describe("oke docker clean", () => {
     expect(flagTokensFor(docker, "clean")).toContain("--all");
     expect(formatOkeHelp()).toContain("clean");
   });
+
+  test("selectionEntries is one row per project (not per container)", () => {
+    const entries = selectionEntries([
+      {
+        project: "oke-dev-aaaaaa",
+        containers: [
+          {
+            id: "1",
+            name: "oke-dev-aaaaaa-redis-1",
+            service: "redis",
+            state: "running",
+            project: "oke-dev-aaaaaa",
+          },
+          {
+            id: "2",
+            name: "oke-dev-aaaaaa-postgres-1",
+            service: "postgres",
+            state: "running",
+            project: "oke-dev-aaaaaa",
+          },
+        ],
+      },
+    ]);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.label).toBe("oke-dev-aaaaaa");
+    expect(entries[0]?.hint).toContain("2 container");
+  });
 });

package/src/cli/docker-clean.ts

@@ -12,7 +12,6 @@ import {
   resolveSelection,
   selectionKey,
   type DockerRunner,
-  type OkeContainer,
   type OkeStack,
 } from "../docker/cleanup.ts";
 import { EXIT_OK, EXIT_RUNTIME, EXIT_USAGE } from "./exit.ts";
@@ -49,8 +48,8 @@ export function dockerCleanHelp(): string {
 
 Remove leftover OKE docker compose stacks (containers, networks, volumes).
 
-Inside a project: focuses the current stack (oke-dev-<id>); optionally
-include other stacks on this machine.
+Selection is by compose project name (oke-dev-<id>) — never per-service.
+Inside a project: focuses the current stack; optionally include others.
 Outside a project: list every oke-dev-* stack and pick what to remove.
 
   --yes, -y   Non-interactive; required when stdin is not a TTY
@@ -235,10 +234,10 @@ async function runInteractive(options: {
     if (current.length === 0) {
       write(`No stack for this project (${currentProject}).\n`);
     } else {
-      const keys = await pickContainerKeys({
+      const keys = await pickProjectKeys({
         stacks: current,
         scope: "current",
-        message: `Containers for this project (${currentProject})`,
+        message: `Stack for this project (${currentProject})`,
         initialAll: true,
         pickKeys,
       });
@@ -256,7 +255,7 @@ async function runInteractive(options: {
         return EXIT_OK;
       }
       if (include) {
-        const keys = await pickContainerKeys({
+        const keys = await pickProjectKeys({
           stacks: others,
           scope: "other",
           message: "Other OKE stacks on this machine",
@@ -271,7 +270,7 @@ async function runInteractive(options: {
       }
     }
   } else {
-    const keys = await pickContainerKeys({
+    const keys = await pickProjectKeys({
       stacks,
       scope: "all",
       message: "OKE docker stacks on this machine",
@@ -330,7 +329,10 @@ async function askIncludeOthersPrompt(): Promise<boolean | null> {
   return value;
 }
 
-async function pickContainerKeys(options: {
+/**
+ * Multiselect compose projects (one row per `oke-dev-*` name).
+ */
+async function pickProjectKeys(options: {
   readonly stacks: readonly OkeStack[];
   readonly scope: "current" | "other" | "all";
   readonly message: string;
@@ -344,7 +346,7 @@ async function pickContainerKeys(options: {
   if (entries.length === 0) return [];
 
   const value = await multiselect({
-    message: `${message} — selecting any container removes its whole stack`,
+    message: `${message} — removes the whole stack (containers, networks, volumes)`,
     options: entries.map((e) => ({
       value: e.key,
       label: e.label,
@@ -357,34 +359,27 @@ async function pickContainerKeys(options: {
   return value;
 }
 
-function selectionEntries(stacks: readonly OkeStack[]): readonly {
+/**
+ * One selectable row per compose project.
+ *
+ * @param stacks - Discovered stacks
+ */
+export function selectionEntries(stacks: readonly OkeStack[]): readonly {
   readonly key: string;
   readonly label: string;
   readonly hint?: string;
 }[] {
-  const out: { key: string; label: string; hint?: string }[] = [];
-  for (const stack of stacks) {
-    if (stack.containers.length === 0) {
-      out.push({
-        key: selectionKey(stack.project),
-        label: stack.project,
-        hint: "no containers · volumes/networks may remain",
-      });
-      continue;
-    }
-    for (const c of stack.containers) {
-      out.push({
-        key: selectionKey(stack.project, c.name),
-        label: `${stack.project} · ${displayContainer(c)}`,
-        hint: c.state || undefined,
-      });
-    }
-  }
-  return out;
-}
-
-function displayContainer(c: OkeContainer): string {
-  return c.service && c.service !== c.name ? `${c.service} (${c.name})` : c.name;
+  return stacks.map((stack) => {
+    const n = stack.containers.length;
+    return {
+      key: selectionKey(stack.project),
+      label: stack.project,
+      hint:
+        n === 0
+          ? "no containers · volumes/networks may remain"
+          : `${n} container${n === 1 ? "" : "s"}`,
+    };
+  });
 }
 
 async function tearDownProjects(

package/src/cli/docker-cli.test.ts

@@ -39,11 +39,12 @@ describe("oke docker CLI", () => {
     expect(code).toBe(0);
     expect(result).toBeDefined();
     expect(await Bun.file(join(dir, "docker/Dockerfile")).exists()).toBe(true);
-    expect(await Bun.file(join(dir, "docker/compose.store.sql.yml")).exists()).toBe(true);
-    const yml = await Bun.file(join(dir, "docker/compose.store.sql.yml")).text();
+    expect(await Bun.file(join(dir, "docker/docker-compose.yml")).exists()).toBe(true);
+    const yml = await Bun.file(join(dir, "docker/docker-compose.yml")).text();
     expect(yml).not.toContain("test-password-not-in-yaml");
     expect(yml).toContain(".env.docker");
-    expect(logs.join("")).toContain("docker/compose.override.yml");
+    expect(yml).toContain("/_/ready");
+    expect(logs.join("")).toContain("docker-compose.override.yml");
   });
 });
 
@@ -136,7 +137,7 @@ describe("oke images list", () => {
 });
 
 describe("oke schema generate", () => {
-  test("emits schema/oke.ts and --check catches drift", async () => {
+  test("emits .oke/schema/oke.ts and --check catches drift", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-cli-schema-"));
     const code = await runSchemaGenerate({
       cwd: dir,
@@ -144,7 +145,7 @@ describe("oke schema generate", () => {
       write: () => {},
     });
     expect(code).toBe(0);
-    const src = await Bun.file(join(dir, "schema/oke.ts")).text();
+    const src = await Bun.file(join(dir, ".oke/schema/oke.ts")).text();
     expect(src).toContain("bookings");
     expect(src).toContain("oke_roles");
 
@@ -156,7 +157,7 @@ describe("oke schema generate", () => {
     });
     expect(checkOk).toBe(0);
 
-    await Bun.write(join(dir, "schema/oke.ts"), emitSchemaSource(["other"]));
+    await Bun.write(join(dir, ".oke/schema/oke.ts"), emitSchemaSource(["other"]));
     const checkFail = await runSchemaGenerate({
       cwd: dir,
       extraTables: ["bookings"],
@@ -167,7 +168,7 @@ describe("oke schema generate", () => {
   });
 });
 
-describe("oke dev --docker", () => {
+describe("oke dev compose plan", () => {
   test("plans docker with postgres and writes nothing on dryRun", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-cli-dev-dry-"));
     await Bun.write(join(dir, "src/app.ts"), "export {}\n");
@@ -182,11 +183,11 @@ describe("oke dev --docker", () => {
     });
     expect(code).toBe(0);
     expect(plan?.stackRoles).toEqual(["store.sql"]);
-    expect(plan?.composeFiles?.some((f) => f.includes("store.sql"))).toBe(true);
-    expect(plan?.composeFiles).toContain("compose.yml");
+    expect(plan?.composeFiles).toContain("docker-compose.yml");
+    expect(plan?.composeFiles?.some((f) => f.includes("store.sql"))).toBe(false);
     expect(plan?.stackEnv?.DATABASE_URL).toContain("postgres://");
-    expect(await Bun.file(join(dir, "compose.yml")).exists()).toBe(false);
-    expect(await Bun.file(join(dir, "docker/compose.yml")).exists()).toBe(false);
+    expect(await Bun.file(join(dir, "docker-compose.yml")).exists()).toBe(false);
+    expect(await Bun.file(join(dir, "docker/docker-compose.yml")).exists()).toBe(false);
   });
 });
 

package/src/cli/docker.ts

@@ -1,12 +1,17 @@
 /**
- * `oke docker` — Dockerfile + per-role compose files · `clean` leftover stacks.
+ * `oke docker` — Dockerfile + compose artefacts · `clean` leftover stacks.
+ *
+ * Default layout is a single production-grade `docker-compose.yml`.
+ * Opt into `--split` (per-role files) or `--stack` (`docker-stack.yml`).
  */
 
 import { resolve } from "node:path";
 import {
   DEFAULT_DOCKER_DIR,
+  DEFAULT_SERVER_BUDGET,
   deriveInfrastructure,
   writeDerivedFiles,
+  type ComposeLayout,
   type DeriveOptions,
   type DeriveResult,
 } from "../docker/index.ts";
@@ -18,7 +23,14 @@ import { loadOkeConfig, loadManifest, resolveImages } from "./load-config.ts";
 export interface DockerCliOptions {
   readonly cwd?: string;
   readonly outDir?: string;
+  /** Production overlays + resource budget (default true for `oke docker`). */
   readonly prod?: boolean;
+  /** Compose layout (default `single`). */
+  readonly layout?: ComposeLayout;
+  /** Host CPUs for resource apportioning (default 4). */
+  readonly serverCpus?: number;
+  /** Host RAM GiB for resource apportioning (default 8). */
+  readonly serverMemoryGb?: number;
   readonly configPath?: string;
   readonly manifestPath?: string;
   readonly write?: (text: string) => void;
@@ -75,11 +87,19 @@ export async function runDockerDerive(
     return { code: 1 };
   }
 
+  const layout = options.layout ?? "single";
+  const prod = options.prod ?? true;
+  const serverCpus = options.serverCpus ?? DEFAULT_SERVER_BUDGET.cpus;
+  const serverMemoryGb = options.serverMemoryGb ?? DEFAULT_SERVER_BUDGET.memoryGb;
+
   try {
     const result = deriveInfrastructure({
       images,
       app,
-      prod: options.prod ?? false,
+      prod,
+      layout,
+      serverCpus,
+      serverMemoryGb,
       outDir,
       composeDir,
       includeApp: true,
@@ -90,25 +110,22 @@ export async function runDockerDerive(
       await writeDerivedFiles(result, outDir, { writeStackEnv: false });
     }
 
-    const vaultSpec = result.specs.find((s) => s.role === "vault");
-    if (vaultSpec) {
-      const rel = composeDir === "." ? ".oke/openbao/" : `${composeDir}/../.oke/openbao/`;
-      write(
-        `oke docker: OpenBao first boot — bring the stack up (e.g. \`oke dev -d\`), and oke ` +
-          `will initialize + unseal it once. Root/unseal material stays on the host at ${rel} ` +
-          `(0600, gitignored) — back it up; losing it loses every secret permanently.\n`,
-      );
-    }
-
     write(`oke docker: wrote ${result.files.length} file(s) → ${composeDir}/\n`);
     for (const f of result.files) write(`  ${composeDir}/${f.path}\n`);
     write(
-      `compose merge order (cwd ${composeDir}/):\n${result.composeFiles.map((f) => `  -f ${f}`).join("\n")}\n`,
+      `layout: ${layout} · server budget: ${serverCpus} CPU / ${serverMemoryGb} GiB` +
+        (prod ? " · production-grade\n" : "\n"),
     );
     write(
-      `(${composeDir}/compose.override.yml is layer 4 — user-owned, never written by oke)\n` +
-        `(${composeDir}/compose.all.yml is layers 1–3 merged — single-file alternative for Swarm / one \`-c\`)\n`,
+      `compose merge order (cwd ${composeDir}/):\n${result.composeFiles.map((f) => `  -f ${f}`).join("\n")}\n`,
     );
+    if (layout === "single") {
+      write(`(${composeDir}/docker-compose.override.yml is user-owned — never written by oke)\n`);
+    } else if (layout === "split") {
+      write(`(${composeDir}/compose.override.yml is user-owned — never written by oke)\n`);
+    } else {
+      write(`(Swarm: docker stack deploy -c ${composeDir}/docker-stack.yml <name>)\n`);
+    }
     return { code: 0, result };
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
@@ -127,21 +144,61 @@ export async function dockerCli(args: readonly string[]): Promise<number> {
     return dockerCleanCli(rest);
   }
 
-  let prod = false;
+  let prod: boolean | undefined;
+  let layout: ComposeLayout | undefined;
+  let serverCpus: number | undefined;
+  let serverMemoryGb: number | undefined;
   let outDir: string | undefined;
   let configPath: string | undefined;
   let manifestPath: string | undefined;
   for (let i = 0; i < args.length; i++) {
     const a = args[i]!;
     if (a === "--prod" || a === "-p") prod = true;
-    else if (a === "--out" || a === "-o") outDir = args[++i];
+    else if (a === "--no-prod") prod = false;
+    else if (a === "--split") layout = "split";
+    else if (a === "--stack") layout = "stack";
+    else if (a === "--single") layout = "single";
+    else if (a === "--cpus" || a === "--cpu") {
+      const raw = args[++i];
+      const n = Number(raw);
+      if (!raw || !(n > 0)) {
+        console.error("oke docker: --cpus requires a positive number");
+        return 1;
+      }
+      serverCpus = n;
+    } else if (a === "--memory" || a === "--mem" || a === "--memory-gb") {
+      const raw = args[++i];
+      const n = Number(raw);
+      if (!raw || !(n > 0)) {
+        console.error("oke docker: --memory requires a positive GiB number");
+        return 1;
+      }
+      serverMemoryGb = n;
+    } else if (a === "--out" || a === "-o") outDir = args[++i];
     else if (a === "--config" || a === "-c") configPath = args[++i];
     else if (a === "--manifest" || a === "-m") manifestPath = args[++i];
     else if (a === "--help" || a === "-h") {
-      console.log(`oke docker [--prod|-p] [--out|-o docker] [--config|-c oke.config.ts]
+      console.log(`oke docker [options]
 
-Derive Dockerfile + compose.<role>.yml under docker/ (default).
---prod is opt-in (never the default). Credentials are never written into YAML.
+Derive production-grade Docker artefacts under docker/ (default).
+
+Layouts (mutually exclusive; default --single):
+  --single          docker-compose.yml + Dockerfile (+ .env.docker via oke dev)
+  --split           compose.yml + compose.<role>.yml (+ compose.prod.yml)
+  --stack           docker-stack.yml for docker stack deploy
+
+Server budget (sizes deploy.resources; default 4 CPU / 8 GiB):
+  --cpus <n>        host CPUs
+  --memory <gib>    host RAM in GiB
+
+Other:
+  --prod / -p       production overlays (default on)
+  --no-prod         skip readiness / deploy / resource budget
+  --out / -o        output directory (default docker)
+  --config / -c     oke.config.ts path
+  --manifest / -m   Manifest path
+
+Credentials are never written into YAML. PgDog configs land in docker/pgdog/.
 
 ${dockerCleanHelp()}`);
       return EXIT_OK;
@@ -149,10 +206,28 @@ ${dockerCleanHelp()}`);
       console.error(`oke docker: unknown subcommand ${a}`);
       console.error("Run `oke docker --help` for usage.");
       return 1;
+    } else {
+      console.error(`oke docker: unknown flag ${a}`);
+      console.error("Run `oke docker --help` for usage.");
+      return 1;
+    }
+  }
+  {
+    const layoutFlags = [
+      args.includes("--split"),
+      args.includes("--stack"),
+      args.includes("--single"),
+    ].filter(Boolean).length;
+    if (layoutFlags > 1) {
+      console.error("oke docker: use only one of --single, --split, --stack");
+      return 1;
     }
   }
   const { code } = await runDockerDerive({
     prod,
+    layout,
+    serverCpus,
+    serverMemoryGb,
     outDir,
     configPath,
     manifestPath,

package/src/cli/doctor.test.ts

@@ -84,6 +84,46 @@ describe("oke doctor", () => {
     expect(findings).toHaveLength(0);
   });
 
+  test("fails closed in prod when builtin vault master key is env-sourced", async () => {
+    const { code, findings } = await runDoctor({
+      secrets: [],
+      ports: [],
+      isPortInUse: async () => false,
+      skipDbDrift: true,
+      configEnv: "prod",
+      driversConfig: {
+        vault: { dev: "vault", test: "memory", prod: "vault" },
+      },
+      vaultConfig: {
+        encryption: { masterKey: { kind: "env", name: "OKE_VAULT_MASTER_KEY" } },
+      },
+      write: () => {},
+    });
+    expect(code).toBe(2);
+    const finding = findings.find((f) => f.code === "vault_master_key");
+    expect(finding?.severity).toBe("error");
+    expect(finding?.message).toContain("environment variable");
+  });
+
+  test("NODE_ENV=production selects prod env for the vault master-key gate", async () => {
+    const { code, findings } = await runDoctor({
+      secrets: [],
+      ports: [],
+      isPortInUse: async () => false,
+      skipDbDrift: true,
+      env: (k) => (k === "NODE_ENV" ? "production" : undefined),
+      driversConfig: {
+        vault: { dev: "vault", test: "memory", prod: "vault" },
+      },
+      vaultConfig: {
+        encryption: { masterKey: { kind: "env", name: "OKE_VAULT_MASTER_KEY" } },
+      },
+      write: () => {},
+    });
+    expect(code).toBe(2);
+    expect(findings.some((f) => f.code === "vault_master_key")).toBe(true);
+  });
+
   test("fails with flow name when PII reaches unguarded ask", async () => {
     const manifest: Manifest = {
       oke: "1.0",