okengine 0.10.2 → 0.11.0

package/src/console/server/serve.ts

@@ -40,8 +40,8 @@ export interface ServeConsoleOptions extends CreateConsoleAppOptions {
   /** Boot environment — use `"dev"` / `"prod"` so Bearer auth is production-like. */
   readonly env?: "dev" | "prod" | "test";
   /**
-   * Persist operators + secret under `.oke/` (default true).
-   * Set false for ephemeral test servers.
+   * Persist operators in Postgres `oke_console` (+ `.oke/console.secret`).
+   * Default true. Set false for ephemeral test servers.
    */
   readonly persist?: boolean;
 }
@@ -83,9 +83,18 @@ export async function serveConsole(
       : {}),
   });
 
-  // Console serve `"dev"` is the auth/session flavor — ConfigEnv uses `local`.
-  const env = options.env ?? "dev";
-  await handle.app.boot({ env: env === "dev" ? "local" : env });
+  // Console serve defaults to `test` drivers when compose isn't up; pass
+  // `env: "dev"` only with compose URLs (or memory overrides) available.
+  // Never inherit `OKE_DOCKER=1` from `oke dev` into capability minting —
+  // Console operator flows don't stamp Manifest effects, and docker+dev
+  // would otherwise hard-fail with OKE1008 on the first undeclared flow
+  // (`console.setup.status`). Compose URLs for Manifest panels bind via
+  // `bindManifest*` below, not this boot's driver map.
+  const env = options.env ?? "test";
+  await handle.app.boot({
+    env: env === "dev" || env === "test" || env === "prod" ? env : "test",
+    docker: false,
+  });
   handle.state.listRuns = async () => {
     const runs = handle.app.bootResult?.runs;
     if (!runs) return [];
@@ -182,7 +191,7 @@ export async function serveConsole(
     stop(closeActive = false) {
       server.stop(closeActive);
       void handle.app.stop();
-      persistence?.close();
+      void persistence?.close();
     },
   };
 }
@@ -195,7 +204,7 @@ export async function serveConsole(
 export async function startConsoleApp(
   options: CreateConsoleAppOptions & {
     readonly env?: "dev" | "prod" | "test";
-    /** Opt-in durable operators under `.oke/` (default false for unit tests). */
+    /** Opt-in durable operators in `oke_console` (default false for unit tests). */
     readonly persist?: boolean;
   } = {},
 ): Promise<ConsoleAppHandle> {

package/src/console/server/state.ts

@@ -58,7 +58,7 @@ import {
   type SimulateGatesInput,
   type SimulateGatesResult,
 } from "./gates.ts";
-import type { ConsoleVaultRow, VaultWriteInput } from "./vault.ts";
+import type { ConsoleVaultBackend, ConsoleVaultRow, VaultWriteInput } from "./vault.ts";
 import type { ChannelInbox } from "../../drivers/channel-types.ts";
 import type { ChannelRuntime, TemplateCatalog } from "../../elements/channel.ts";
 import type { ConsoleChannelPreview, ConsoleChannelsList, EmailAuthResult } from "./channels.ts";
@@ -68,6 +68,9 @@ import type { ConsolePluginsList } from "./plugins.ts";
 import type { ConsoleDiffProjection } from "./diff.ts";
 import { loadConsolePanel, type ConsolePanelId } from "./panel-load.ts";
 
+/** How long a built-in Vault backend probe is reused across list polls. */
+const VAULT_BACKEND_TTL_MS = 15_000;
+
 /** User-plane identity row for the Flows invoke-as picker. */
 export interface ConsoleIdentity {
   readonly id: string;
@@ -251,6 +254,7 @@ export interface ConsoleState {
   listVault: () => Promise<{
     readonly secrets: readonly ConsoleVaultRow[];
     readonly env: string;
+    readonly backend: ConsoleVaultBackend | null;
   }>;
   /** Set a vault value (write-only). */
   setVault: (
@@ -328,15 +332,15 @@ export interface ConsoleState {
   /** Whether first operator exists (wizard permanently closed). */
   get setupClosed(): boolean;
   /**
-   * Persist an operator after claim/create (SQLite under `.oke/`).
+   * Persist an operator after claim/create (`oke_console` schema).
    * No-op when persistence is disabled (tests / memory-only).
    */
-  persistOperator: (operatorId: string) => void;
+  persistOperator: (operatorId: string) => void | Promise<void>;
   /**
-   * Persist sessions after issue / revoke (SQLite under `.oke/`).
+   * Persist sessions after issue / revoke (`oke_console` schema).
    * No-op when persistence is disabled (tests / memory-only).
    */
-  persistSessions: () => void;
+  persistSessions: () => void | Promise<void>;
   /**
    * Per-email login attempt timestamps for credential-check rate limiting
    * (console §10.4 — same 5/60s strategy as setup-claim).
@@ -390,14 +394,14 @@ export interface CreateConsoleStateOptions {
   readonly okeConfig?: OkeConfig | null;
   /** Host plugin registry for scopes / capabilities. */
   readonly pluginRegistry?: PluginRegistry | null;
-  /** Pre-hydrated operator store (from `.oke/console.sqlite`). */
+  /** Pre-hydrated operator store (from `oke_console` / PGlite fallback). */
   readonly operators?: OperatorStore;
-  /** Pre-hydrated session store (from `.oke/console.sqlite`). */
+  /** Pre-hydrated session store (from `oke_console` / PGlite fallback). */
   readonly sessions?: SessionStore;
   /** Persist hook after claim/create. */
-  readonly persistOperator?: (operatorId: string) => void;
+  readonly persistOperator?: (operatorId: string) => void | Promise<void>;
   /** Persist hook after session issue / revoke. */
-  readonly persistSessions?: () => void;
+  readonly persistSessions?: () => void | Promise<void>;
 }
 
 /**
@@ -427,6 +431,23 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
     return loadConsolePanel<T>(id);
   };
 
+  // The Vault panel polls; probing the built-in backend opens a SQL
+  // connection, so hold the answer for a beat rather than per refresh.
+  let backendMemo: { readonly at: number; readonly value: ConsoleVaultBackend | null } | null =
+    null;
+  const vaultBackend = async (
+    vault: typeof import("./vault.ts"),
+  ): Promise<ConsoleVaultBackend | null> => {
+    const at = state.now();
+    if (backendMemo && at - backendMemo.at < VAULT_BACKEND_TTL_MS) return backendMemo.value;
+    const value = await vault.probeVaultBackend({
+      config: state.okeConfig,
+      env: state.production ? "prod" : "dev",
+    });
+    backendMemo = { at, value };
+    return value;
+  };
+
   const state: ConsoleState = {
     operators,
     sessions,
@@ -733,6 +754,7 @@ export function createConsoleState(options: CreateConsoleStateOptions = {}): Con
         journal: state.journalStore,
         env: state.vaultEnv,
         now: state.now,
+        backend: await vaultBackend(vault),
       });
     },
     setVault: async (input) => {

package/src/console/server/vault.test.ts

@@ -10,11 +10,15 @@ import type { Manifest } from "../../manifest/types.ts";
 import {
   assertNoSecretLeak,
   blastRadiusOf,
+  probeVaultBackend,
   projectVaultList,
   readersOf,
+  resolveVaultDriverId,
   rotateVaultValue,
   setVaultValue,
+  toConsoleVaultStatus,
 } from "./vault.ts";
+import type { VaultStatus } from "../../elements/vault/types.ts";
 
 const SECRET = "sk_live_console_vault_test_do_not_leak";
 
@@ -75,13 +79,13 @@ describe("projectVaultList", () => {
     const { secrets, env } = await projectVaultList({
       manifest: manifest(),
       runtime: rt,
-      env: "local",
+      env: "test",
       peerFingerprints: {
         STRIPE_KEY: { staging: fingerprintSecretSync(SECRET) },
       },
     });
 
-    expect(env).toBe("local");
+    expect(env).toBe("test");
     const stripe = secrets.find((s) => s.name === "STRIPE_KEY");
     const pub = secrets.find((s) => s.name === "PUBLIC_APP_URL");
     expect(stripe?.sensitive).toBe(true);
@@ -124,7 +128,7 @@ describe("projectVaultList", () => {
     const { secrets } = await projectVaultList({
       manifest: null,
       runtime: rt,
-      env: "local",
+      env: "test",
     });
     const row = secrets.find((s) => s.name === "KEY");
     expect(row?.winner).toBe(".env.local");
@@ -141,7 +145,7 @@ describe("projectVaultList", () => {
     const { secrets } = await projectVaultList({
       manifest: manifest(),
       runtime: rt,
-      env: "local",
+      env: "test",
     });
     expect(secrets.find((s) => s.name === "STRIPE_KEY")?.lastReadAt).toBe(1_700_000_000_000);
   });
@@ -202,13 +206,124 @@ describe("projectVaultList", () => {
       manifest: manifest(),
       runtime: rt,
       journal,
-      env: "local",
+      env: "test",
       now: () => now,
     });
     expect(secrets.find((s) => s.name === "STRIPE_KEY")?.blastRadius.count).toBe(2);
   });
 });
 
+describe("backend badge", () => {
+  const builtinStatus: VaultStatus = {
+    sealed: true,
+    initialized: true,
+    masterKeyPresent: true,
+    kekVersion: 2,
+    secretCount: 3,
+    sealCount: 1,
+    lastSealedAt: new Date(1_700_000_100_000),
+    lastUnsealedAt: new Date(1_700_000_000_000),
+    rewrapTargetKekVersion: 3,
+  };
+
+  test("driver id comes from config, falling back to framework defaults", () => {
+    expect(resolveVaultDriverId(null, "dev")).toBe("env");
+    expect(resolveVaultDriverId(null, "test")).toBe("memory");
+    expect(resolveVaultDriverId(null, "prod")).toBe("vault");
+    expect(resolveVaultDriverId({ drivers: { vault: { dev: "managed" } } }, "dev")).toBe("managed");
+    expect(resolveVaultDriverId({ drivers: { vault: { dev: "builtin" } } }, "dev")).toBe("vault");
+    // An unknown id is a boot concern — the Console still renders.
+    expect(resolveVaultDriverId({ drivers: { vault: { dev: "nope" } } }, "dev")).toBe("env");
+    expect(
+      resolveVaultDriverId({ drivers: { vault: { dev: ["open", "bao"].join("") } } }, "dev"),
+    ).toBe("env");
+  });
+
+  test("non-builtin driver reports its id and no status", async () => {
+    const backend = await probeVaultBackend({
+      config: { drivers: { vault: { dev: "managed" } } },
+      env: "dev",
+      processEnv: {},
+    });
+    expect(backend).toEqual({
+      driverId: "managed",
+      builtin: false,
+      status: null,
+      unavailable: null,
+    });
+  });
+
+  test("builtin status is JSON-safe and sealed follows the master key", async () => {
+    const sealed = await probeVaultBackend({
+      config: { drivers: { vault: { dev: "vault" } } },
+      env: "dev",
+      processEnv: {},
+      loadStatus: async () => builtinStatus,
+    });
+    expect(sealed.builtin).toBe(true);
+    expect(sealed.status).toEqual({
+      ...toConsoleVaultStatus(builtinStatus),
+      sealed: true,
+    });
+    expect(sealed.status?.lastUnsealedAt).toBe(1_700_000_000_000);
+    expect(sealed.status?.rewrapTargetKekVersion).toBe(3);
+
+    const unsealed = await probeVaultBackend({
+      config: { drivers: { vault: { dev: "vault" } } },
+      env: "dev",
+      processEnv: { OKE_VAULT_MASTER_KEY: "a-base64-key" },
+      loadStatus: async () => builtinStatus,
+    });
+    expect(unsealed.status?.sealed).toBe(false);
+  });
+
+  test("an unreachable builtin backend degrades to a reason, never a throw", async () => {
+    const backend = await probeVaultBackend({
+      config: { drivers: { vault: { dev: "vault" } } },
+      env: "dev",
+      processEnv: {},
+      loadStatus: async () => {
+        throw new Error("relation oke_vault_status does not exist");
+      },
+    });
+    expect(backend.status).toBeNull();
+    expect(backend.unavailable).toContain("oke_vault_status");
+  });
+
+  test("builtin backend with no SQL configured says so instead of spinning PGlite", async () => {
+    const backend = await probeVaultBackend({
+      config: { drivers: { vault: { dev: "vault" } } },
+      env: "dev",
+      processEnv: {},
+    });
+    expect(backend.status).toBeNull();
+    expect(backend.unavailable).toContain("DATABASE_URL");
+  });
+
+  test("the projection passes the backend through untouched", async () => {
+    const rt = await runtime();
+    const backend = await probeVaultBackend({
+      config: { drivers: { vault: { dev: "memory" } } },
+      env: "dev",
+      processEnv: {},
+    });
+    const listed = await projectVaultList({
+      manifest: manifest(),
+      runtime: rt,
+      env: "test",
+      backend,
+    });
+    expect(listed.backend).toEqual(backend);
+
+    const unprobed = await projectVaultList({
+      manifest: manifest(),
+      runtime: rt,
+      env: "test",
+    });
+    expect(unprobed.backend).toBeNull();
+  });
+});
+
 describe("set / rotate", () => {
   test("set updates fingerprint and never returns value", async () => {
     const rt = await runtime();

package/src/console/server/vault.ts

@@ -6,8 +6,10 @@
  * rotation blast radius are derived — never reimplemented in the UI.
  */
 
-import type { ConfigEnv } from "../../config/index.ts";
-import { buildVaultBootChain } from "../../elements/vault/boot-chain.ts";
+import { resolveDriverId, type ConfigEnv, type OkeConfig } from "../../config/index.ts";
+import { VAULT_DEFAULTS } from "../../config/driver-defaults.ts";
+import type { VaultDriverId } from "../../drivers/vault-types.ts";
+import { buildVaultBootChain, normalizeVaultDriverId } from "../../elements/vault/boot-chain.ts";
 import {
   createVaultRuntime,
   vault as declareVault,
@@ -16,6 +18,7 @@ import {
   type VaultRuntime,
   type VaultSecretDecl,
 } from "../../elements/vault.ts";
+import type { VaultStatus } from "../../elements/vault/types.ts";
 import type { JournalRun, JournalStore } from "../../kernel/journal.ts";
 import type { Manifest } from "../../manifest/types.ts";
 
@@ -58,11 +61,11 @@ export interface ConsoleVaultRow {
   readonly winner: VaultResolutionSource | null;
   /** Full resolution chain for the current environment. */
   readonly resolution: readonly VaultResolutionStep[];
-  /** Flow ids that declare `fx.vault(name)` in Manifest effects. */
+  /** Flow ids that declare `fx.vault.get(name)` in Manifest effects. */
   readonly readers: readonly string[];
   /** In-flight durable runs that will wake holding a new key after rotate. */
   readonly blastRadius: ConsoleVaultBlastRadius;
-  /** Epoch-ms of last `fx.vault` / runtime read; `null` if never read. */
+  /** Epoch-ms of last `fx.vault.get` / runtime read; `null` if never read. */
   readonly lastReadAt: number | null;
   /**
    * When the current fingerprint equals another environment's — warning,
@@ -71,12 +74,63 @@ export interface ConsoleVaultRow {
   readonly sharedFingerprintEnvs: readonly VaultEnvLabel[];
 }
 
+/**
+ * Built-in Vault backend state, JSON-safe (dates become epoch-ms).
+ *
+ * Mirrors {@link VaultStatus} minus the resume cursor, which is an internal
+ * rewrap detail with no operator meaning.
+ */
+export interface ConsoleVaultBuiltinStatus {
+  /** Whether `oke vault init` has run against this backend. */
+  readonly initialized: boolean;
+  /**
+   * Whether the Console process can open secrets. The built-in store keeps
+   * the master key in memory per process, so this is `true` whenever
+   * `OKE_VAULT_MASTER_KEY` is absent — even if another process is unsealed.
+   */
+  readonly sealed: boolean;
+  /** Whether a master-key record exists in the backend. */
+  readonly masterKeyPresent: boolean;
+  /** KEK generation new writes are wrapped under. */
+  readonly kekVersion: number;
+  /** Live (non-deleted) secret paths. */
+  readonly secretCount: number;
+  /** Seals since initialization. */
+  readonly sealCount: number;
+  /** Epoch-ms of the last seal, or `null`. */
+  readonly lastSealedAt: number | null;
+  /** Epoch-ms of the last unseal, or `null`. */
+  readonly lastUnsealedAt: number | null;
+  /** KEK generation an in-flight master rotation is migrating toward. */
+  readonly rewrapTargetKekVersion: number | null;
+}
+
+/**
+ * Which backend terminates the resolution chain, and its state.
+ *
+ * Only the built-in `vault` driver has a seal lifecycle to report; every
+ * other driver surfaces its id alone so the operator still knows where the
+ * last layer reads from.
+ */
+export interface ConsoleVaultBackend {
+  /** `drivers.vault` id resolved for the current environment. */
+  readonly driverId: VaultDriverId;
+  /** Whether {@link driverId} is okengine's own encrypted-at-rest store. */
+  readonly builtin: boolean;
+  /** Backend status — `null` for non-builtin drivers or when unreachable. */
+  readonly status: ConsoleVaultBuiltinStatus | null;
+  /** Why {@link status} is missing for a builtin backend; `null` otherwise. */
+  readonly unavailable: string | null;
+}
+
 /** Options when projecting the vault list. */
 export interface ProjectVaultOptions {
   readonly manifest: Manifest | null;
   readonly runtime: VaultRuntime | null;
   /** Current process environment label. */
   readonly env?: VaultEnvLabel;
+  /** Backend badge from {@link probeVaultBackend}; `null` when unprobed. */
+  readonly backend?: ConsoleVaultBackend | null;
   /**
    * Optional peer-environment fingerprints (e.g. staging from a remote
    * probe). Never values — fingerprints only.
@@ -95,8 +149,9 @@ export interface ProjectVaultOptions {
 export async function projectVaultList(options: ProjectVaultOptions): Promise<{
   readonly secrets: readonly ConsoleVaultRow[];
   readonly env: VaultEnvLabel;
+  readonly backend: ConsoleVaultBackend | null;
 }> {
-  const env = options.env ?? "local";
+  const env = options.env ?? "dev";
   const now = options.now ?? (() => Date.now());
   const names = collectNames(options.manifest, options.runtime);
   const journalRuns = options.journal
@@ -150,7 +205,144 @@ export async function projectVaultList(options: ProjectVaultOptions): Promise<{
     });
   }
 
-  return { secrets, env };
+  return { secrets, env, backend: options.backend ?? null };
+}
+
+/**
+ * Environment variable holding the base64 master key. Mirrors the driver's
+ * own constant so the probe stays free of a static `drivers/` import.
+ */
+const VAULT_MASTER_KEY_ENV = "OKE_VAULT_MASTER_KEY";
+
+/**
+ * Resolve `drivers.vault` for an environment, falling back to the framework
+ * defaults (`env` in dev, `memory` in test, the built-in store in prod).
+ *
+ * @param config - Loaded `oke.config`, when available
+ * @param env - Active config environment
+ */
+export function resolveVaultDriverId(
+  config: OkeConfig | null | undefined,
+  env: ConfigEnv,
+): VaultDriverId {
+  const raw = resolveDriverId(config?.drivers?.vault, env, VAULT_DEFAULTS);
+  if (raw === undefined) return "env";
+  try {
+    return normalizeVaultDriverId(raw);
+  } catch {
+    // An unknown id is a boot concern; the Console still renders the list.
+    return "env";
+  }
+}
+
+/** Options for {@link probeVaultBackend}. */
+export interface ProbeVaultBackendOptions {
+  /** Loaded `oke.config` — supplies `drivers.vault`. */
+  readonly config?: OkeConfig | null;
+  /** Active config environment (default `dev`). */
+  readonly env?: ConfigEnv;
+  /** Process environment for SQL URL / master-key capability (default `process.env`). */
+  readonly processEnv?: Readonly<Record<string, string | undefined>>;
+  /**
+   * Status source. Injected by tests; by default the built-in adapter is
+   * opened *sealed* over the configured SQL URL, so the probe never unseals
+   * and never writes an unseal audit row.
+   */
+  readonly loadStatus?: () => Promise<VaultStatus>;
+}
+
+/**
+ * Report which backend serves the terminal chain layer, plus its state when
+ * that backend is the built-in store.
+ *
+ * The Console never holds the master key on the operator's behalf: the probe
+ * reads backend facts only, and reports `sealed` from whether this process
+ * has `OKE_VAULT_MASTER_KEY` at all.
+ *
+ * @param options - Config / env / status source
+ */
+export async function probeVaultBackend(
+  options: ProbeVaultBackendOptions = {},
+): Promise<ConsoleVaultBackend> {
+  const env = options.env ?? "dev";
+  const driverId = resolveVaultDriverId(options.config, env);
+  if (driverId !== "vault") {
+    return { driverId, builtin: false, status: null, unavailable: null };
+  }
+
+  const processEnv = options.processEnv ?? process.env;
+  const keyHeld = (processEnv[VAULT_MASTER_KEY_ENV] ?? "").trim().length > 0;
+
+  const load = options.loadStatus ?? defaultBuiltinStatusLoader(processEnv);
+  if (!load) {
+    return {
+      driverId,
+      builtin: true,
+      status: null,
+      unavailable: "No SQL URL configured — set DATABASE_URL or OKE_STORE_SQL_URL",
+    };
+  }
+
+  try {
+    const status = await load();
+    return {
+      driverId,
+      builtin: true,
+      status: { ...toConsoleVaultStatus(status), sealed: !keyHeld },
+      unavailable: null,
+    };
+  } catch (error) {
+    // Uninitialized / unreachable is an ordinary operator state, not a crash.
+    return {
+      driverId,
+      builtin: true,
+      status: null,
+      unavailable: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+/**
+ * Convert an adapter {@link VaultStatus} into the JSON-safe Console shape.
+ *
+ * @param status - Adapter status
+ */
+export function toConsoleVaultStatus(status: VaultStatus): ConsoleVaultBuiltinStatus {
+  return {
+    initialized: status.initialized,
+    sealed: status.sealed,
+    masterKeyPresent: status.masterKeyPresent,
+    kekVersion: status.kekVersion,
+    secretCount: status.secretCount,
+    sealCount: status.sealCount,
+    lastSealedAt: status.lastSealedAt?.getTime() ?? null,
+    lastUnsealedAt: status.lastUnsealedAt?.getTime() ?? null,
+    rewrapTargetKekVersion: status.rewrapTargetKekVersion ?? null,
+  };
+}
+
+/**
+ * Build the default status loader: open the built-in adapter sealed over the
+ * configured SQL URL. Returns `null` when no SQL is configured — spinning up
+ * a throwaway PGlite instance would report an empty vault that does not exist.
+ *
+ * @param processEnv - Environment supplying the SQL URL
+ */
+function defaultBuiltinStatusLoader(
+  processEnv: Readonly<Record<string, string | undefined>>,
+): (() => Promise<VaultStatus>) | null {
+  const url = processEnv.DATABASE_URL ?? processEnv.OKE_STORE_SQL_URL;
+  if (url === undefined || url.trim().length === 0) return null;
+  return async () => {
+    const { openBuiltinVaultAdapter } = await import("../../drivers/vault-builtin.ts");
+    // `masterKey: ""` keeps the adapter sealed — status needs no unseal.
+    const opened = await openBuiltinVaultAdapter({ url, env: processEnv, masterKey: "" });
+    try {
+      return await opened.adapter.status();
+    } finally {
+      await opened.close();
+    }
+  };
 }
 
 /** Input for set / rotate. */
@@ -206,6 +398,11 @@ export async function createManifestVaultRuntime(
     readonly allowDevFallbacks?: boolean;
     readonly seed?: Readonly<Record<string, string>>;
     readonly now?: () => number;
+    /**
+     * Backend driver for the terminal layer. Defaults to the built-in
+     * `vault` store when `drivers.vault` is not consulted.
+     */
+    readonly driverId?: VaultDriverId;
   } = {},
 ): Promise<VaultRuntime | null> {
   const entries = Object.entries(manifest.vault ?? {});
@@ -231,19 +428,18 @@ export async function createManifestVaultRuntime(
   });
 
   const seed = options.seed ?? {};
-  const env = options.env ?? "local";
-  // Auto-detect: prefer OpenBao when credentials exist; soft-fallback to memory
-  // (historical Console behaviour — never fail the Console for missing vault).
+  const env = options.env ?? "dev";
+  // Soft-fallback to memory when the backend is unreachable — the Console
+  // must never fail to list contracts because a vault is missing.
   const runtime = createVaultRuntime({
     secrets,
     allowDevFallbacks: options.allowDevFallbacks ?? env !== "prod",
     now: options.now,
     chain: buildVaultBootChain({
       cwd,
-      driverId: "openbao",
-      env,
+      driverId: options.driverId ?? "vault",
+      env: env === "dev" || env === "test" || env === "prod" ? env : "dev",
       seed,
-      missingOpenbao: "memory",
     }),
   });
   await runtime.boot();