okengine 0.10.2 → 0.11.0

package/src/docker/stack-id.ts

@@ -131,9 +131,6 @@ export const STACK_CONTROL_KEYS = [
   "OKE_AI_CTX_SIZE",
   "OKE_PROXY_HOST",
   "OKE_PROXY_ACME_EMAIL",
-  // OpenBao app token — minted by bootstrap, must survive `writeDerivedFiles`.
-  "OKE_VAULT_TOKEN",
-  "OKE_VAULT_MOUNT",
 ] as const;
 
 /**
@@ -176,9 +173,6 @@ export async function loadExistingStackCredentials(
 /**
  * Load optional controls from `docker/.env.docker` when present.
  *
- * Falls back to `.oke/openbao/app.token` for `OKE_VAULT_TOKEN` when the env
- * file was regenerated without the bootstrap overlay (per-project token).
- *
  * @param cwd - Project root
  */
 export async function loadExistingStackControls(
@@ -192,31 +186,17 @@ export async function loadExistingStackControls(
     controls = parseStackControls(await file.text());
     break;
   }
-  // create-oke / `oke ai setup` write the chosen model into `.env.local`.
-  // Seed it into stack controls on first docker boot so `LLAMA_ARG_DOCKER_REPO`
-  // is not stuck on the recipe default (`smollm2`).
+  // create-oke / `oke ai setup` write the chosen model into `.env.local` as a
+  // commented hint (active would shadow `docker/.env.docker`). Seed active or
+  // commented `OKE_AI_MODEL` on first docker boot so `LLAMA_ARG_DOCKER_REPO`
+  // is not stuck on the recipe default (`granite3.3:2b`).
   if (!controls.OKE_AI_MODEL) {
     const localEnv = Bun.file(resolve(cwd, ".env.local"));
     if (await localEnv.exists()) {
-      const model = parseDotenv(await localEnv.text())
-        .get("OKE_AI_MODEL")
-        ?.trim();
+      const model = readEnvAssignment(await localEnv.text(), "OKE_AI_MODEL");
       if (model) controls = { ...controls, OKE_AI_MODEL: model };
     }
   }
-  if (!controls.OKE_VAULT_TOKEN) {
-    const tokenFile = Bun.file(resolve(cwd, ".oke", "openbao", "app.token"));
-    if (await tokenFile.exists()) {
-      const token = (await tokenFile.text()).trim();
-      if (token) {
-        controls = {
-          ...controls,
-          OKE_VAULT_TOKEN: token,
-          OKE_VAULT_MOUNT: controls.OKE_VAULT_MOUNT ?? "secret",
-        };
-      }
-    }
-  }
   return Object.keys(controls).length > 0 ? controls : undefined;
 }
 
@@ -228,14 +208,44 @@ function parseDotenv(text: string): Map<string, string> {
     const eq = trimmed.indexOf("=");
     if (eq <= 0) continue;
     const key = trimmed.slice(0, eq);
-    let value = trimmed.slice(eq + 1);
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
+    const value = unquoteEnvValue(trimmed.slice(eq + 1));
     map.set(key, value);
   }
   return map;
 }
+
+/**
+ * Read `KEY=value` from dotenv text — active line wins; otherwise the last
+ * `# KEY=value` hint (create-oke / `oke ai setup` leave AI stack keys commented).
+ *
+ * @param text - Dotenv contents
+ * @param key - Variable name
+ */
+function readEnvAssignment(text: string, key: string): string | undefined {
+  const active = parseDotenv(text).get(key)?.trim();
+  if (active) return active;
+  let hinted: string | undefined;
+  const prefix = `# ${key}=`;
+  const altPrefix = `#${key}=`;
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith(prefix)) {
+      hinted = unquoteEnvValue(trimmed.slice(prefix.length));
+    } else if (trimmed.startsWith(altPrefix)) {
+      hinted = unquoteEnvValue(trimmed.slice(altPrefix.length));
+    }
+  }
+  const value = hinted?.trim();
+  return value || undefined;
+}
+
+function unquoteEnvValue(raw: string): string {
+  let value = raw;
+  if (
+    (value.startsWith('"') && value.endsWith('"')) ||
+    (value.startsWith("'") && value.endsWith("'"))
+  ) {
+    value = value.slice(1, -1);
+  }
+  return value;
+}

package/src/docker/stack.integration.test.ts

@@ -55,8 +55,8 @@ describe("oke dev --docker postgres integration", () => {
           writeStackEnv: true,
         });
 
-        // Infra-only: network + role compose (no app build).
-        const composeFiles = ["compose.yml", "compose.store.sql.yml"];
+        // Infra-only: single docker-compose.yml (no app build).
+        const composeFiles = ["docker-compose.yml"];
         const up = Bun.spawn(
           [
             "docker",
@@ -122,24 +122,13 @@ describe("oke dev --docker postgres integration", () => {
         }
 
         // Prove credentials live in docker/.env.docker, not YAML.
-        const yml = await Bun.file(join(dockerDir, "compose.store.sql.yml")).text();
+        const yml = await Bun.file(join(dockerDir, "docker-compose.yml")).text();
         expect(yml).not.toContain("stack-integration-pass");
         expect(formatStackEnv(derived.stackEnv)).toContain("stack-integration-pass");
         expect(await Bun.file(join(dockerDir, ".env.docker")).exists()).toBe(true);
       } finally {
         await Bun.spawn(
-          [
-            "docker",
-            "compose",
-            "-p",
-            project,
-            "-f",
-            "compose.yml",
-            "-f",
-            "compose.store.sql.yml",
-            "down",
-            "-v",
-          ],
+          ["docker", "compose", "-p", project, "-f", "docker-compose.yml", "down", "-v"],
           { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
         ).exited.catch(() => {});
         await rm(dir, { recursive: true, force: true }).catch(() => {});

package/src/docker/types.ts

@@ -132,6 +132,15 @@ export interface ImageRecipe {
   url(spec: ServiceSpec, endpoint: ServiceEndpoint): string;
 }
 
+/**
+ * How derived compose artefacts are laid out under {@link DeriveOptions.composeDir}.
+ *
+ * - `single` (default) — one production-grade `docker-compose.yml`
+ * - `split` — `compose.yml` + per-role `compose.<role>.yml` (+ `compose.prod.yml` when prod)
+ * - `stack` — one Swarm-oriented `docker-stack.yml`
+ */
+export type ComposeLayout = "single" | "split" | "stack";
+
 /** Options for compose / Dockerfile derivation. */
 export interface DeriveOptions {
   /** Role → image pin (from `oke.config.ts` / Manifest). */
@@ -140,10 +149,30 @@ export interface DeriveOptions {
   readonly app?: string;
   /** App listen port (default 6530). */
   readonly appPort?: number;
-  /** When true, emit prod overlays (limits, secret refs, deploy.replicas). */
+  /**
+   * When true, fold production readiness (`/_/ready` HEALTHCHECK, deploy,
+   * restart policy, secret refs) and apportion {@link serverCpus} /
+   * {@link serverMemoryGb} across services. `oke docker` defaults true;
+   * `oke dev --docker` keeps false.
+   */
   readonly prod?: boolean;
   /**
-   * Include the `app` service in `compose.yml` (default true).
+   * Compose file layout (default `single` → `docker-compose.yml`).
+   * Pass `split` for layered `compose.<role>.yml`, or `stack` for `docker-stack.yml`.
+   */
+  readonly layout?: ComposeLayout;
+  /**
+   * Host CPU count used to size `deploy.resources` when {@link prod} is true
+   * (default 4).
+   */
+  readonly serverCpus?: number;
+  /**
+   * Host RAM in GiB used to size `deploy.resources` when {@link prod} is true
+   * (default 8).
+   */
+  readonly serverMemoryGb?: number;
+  /**
+   * Include the `app` service in the compose document (default true).
    * `oke dev --docker` sets false — host Bun runs the app; Docker is infra only.
    */
   readonly includeApp?: boolean;
@@ -193,6 +222,9 @@ export interface DeriveResult {
    * never embedded in YAML.
    */
   readonly stackEnv: Readonly<Record<string, string>>;
-  /** Compose `-f` merge order (four override layers). */
+  /**
+   * Compose `-f` merge order (includes a user-owned override that oke never
+   * writes — callers should skip it when the file is absent).
+   */
   readonly composeFiles: readonly string[];
 }

package/src/drivers/ai-ollama.integration.test.ts

@@ -147,12 +147,12 @@ describe("ollama live — real completion", () => {
 
         const runtime = bindAi(
           {
-            config: { drivers: { ai: { local: "ollama", test: "ollama" } } },
+            config: { drivers: { ai: { test: "ollama", dev: "ollama" } } },
             ai: { models: [smart], prompts: [ping] },
           },
           undefined,
           () => Date.now(),
-          "local",
+          "test",
           false,
         );
         expect(runtime.prompts.has("ollama-ping")).toBe(true);

package/src/drivers/conformance.test.ts

@@ -12,21 +12,17 @@ import {
   runTextIndexConformance,
 } from "./conformance.ts";
 import { fsDriver } from "./fs.ts";
-import { libsqlDriver, libsqlIndexDriver } from "./libsql.ts";
 import { memoryFilesDriver, memoryIndexDriver, memoryKvDriver, memorySqlDriver } from "./memory.ts";
 import { meilisearchDriver } from "./meilisearch.ts";
 import { createMeilisearchFakeFetch } from "./meilisearch.test.ts";
-import { pgliteDriver } from "./pglite.ts";
+import { PGLITE_DEFAULT_DATADIR, pgliteDriver, resolvePgliteDataDir } from "./pglite.ts";
 import { pgvectorDriver } from "./pgvector.ts";
 import { createPostgresFakeClient, postgresDriver } from "./postgres.ts";
 import { createRedisFakeClient, redisDriver } from "./redis.ts";
 import { createS3FakeClient, s3Driver } from "./s3.ts";
-import { sqliteDriver } from "./sqlite.ts";
 
 describe("sql conformance", () => {
   test("memory", () => runSqlConformance(memorySqlDriver));
-  test("sqlite", () => runSqlConformance(sqliteDriver, { url: ":memory:" }));
-  test("libsql", () => runSqlConformance(libsqlDriver, { url: ":memory:" }));
   // pglite cold-starts WASM + extension load — slow disks / CI need > default 5s
   test("pglite", () => runSqlConformance(pgliteDriver, { url: "memory://" }), 15_000);
   test("postgres (fake Bun.SQL client)", () =>
@@ -35,6 +31,16 @@ describe("sql conformance", () => {
     }));
 });
 
+describe("pglite dataDir resolution", () => {
+  test("memory:// stays in-process; :memory: persists under .oke/pgdata", () => {
+    expect(resolvePgliteDataDir("memory://")).toBe("memory");
+    expect(resolvePgliteDataDir("memory://suite")).toBe("memory");
+    expect(resolvePgliteDataDir(":memory:")).toBe(PGLITE_DEFAULT_DATADIR);
+    expect(resolvePgliteDataDir(undefined)).toBe(PGLITE_DEFAULT_DATADIR);
+    expect(resolvePgliteDataDir(".oke/custom")).toBe(".oke/custom");
+  });
+});
+
 describe("kv conformance", () => {
   test("memory", () => runKvConformance(memoryKvDriver));
   test("redis (fake Bun.redis client)", () =>
@@ -54,7 +60,6 @@ describe("files conformance", () => {
 describe("index conformance", () => {
   test("memory", () => runIndexConformance(memoryIndexDriver, { dims: 3 }));
   test("pgvector", () => runIndexConformance(pgvectorDriver, { dims: 3 }));
-  test("libsql", () => runIndexConformance(libsqlIndexDriver, { dims: 3 }));
 });
 
 describe("text index conformance", () => {
@@ -70,8 +75,6 @@ describe("protocol naming", () => {
   test("driver ids are protocols, never vendors", () => {
     const ids = [
       memorySqlDriver.id,
-      sqliteDriver.id,
-      libsqlDriver.id,
       pgliteDriver.id,
       postgresDriver.id,
       memoryKvDriver.id,
@@ -81,13 +84,10 @@ describe("protocol naming", () => {
       s3Driver.id,
       memoryIndexDriver.id,
       pgvectorDriver.id,
-      libsqlIndexDriver.id,
       meilisearchDriver.id,
     ];
     expect(ids).toEqual([
       "memory",
-      "sqlite",
-      "libsql",
       "pglite",
       "postgres",
       "memory",
@@ -97,7 +97,6 @@ describe("protocol naming", () => {
       "s3",
       "memory",
       "pgvector",
-      "libsql",
       "meilisearch",
     ]);
     for (const id of ids) {

package/src/drivers/drizzle-dialect.test.ts

@@ -8,17 +8,13 @@ import { drizzleDialectFromSqlDriver, SQL_DRIVER_TO_DRIZZLE_DIALECT } from "./dr
 describe("SQL_DRIVER_TO_DRIZZLE_DIALECT", () => {
   test("maps owned SQL drivers", () => {
     expect(SQL_DRIVER_TO_DRIZZLE_DIALECT).toEqual({
-      sqlite: "sqlite",
       postgres: "postgresql",
-      libsql: "sqlite",
       pglite: "postgresql",
     });
   });
 
   test("drizzleDialectFromSqlDriver resolves", () => {
-    expect(drizzleDialectFromSqlDriver("sqlite")).toBe("sqlite");
     expect(drizzleDialectFromSqlDriver("postgres")).toBe("postgresql");
-    expect(drizzleDialectFromSqlDriver("libsql")).toBe("sqlite");
     expect(drizzleDialectFromSqlDriver("pglite")).toBe("postgresql");
   });
 });

package/src/drivers/drizzle-dialect.ts

@@ -1,18 +1,14 @@
 /**
  * Map OKE `store.sql` driver ids to drizzle-kit dialects.
  *
- * drizzle-kit `1.0.0-rc.4` dialects (from its schema validator):
- * `postgresql` · `mysql` · `sqlite` · `turso` · `singlestore` · `mssql` ·
- * `cockroach` · `duckdb`. OKE owns kit-facing SQL drivers `sqlite` /
- * `postgres` / `libsql` / `pglite` only — map those, never infer from
- * connection URLs. `libsql` speaks the sqlite wire dialect; `pglite` speaks
- * postgresql (same dialect as `postgres`, different transport).
+ * Owned SQL drivers are Postgres-family only (`postgres` · `pglite`) — both
+ * map to kit dialect `postgresql`. Never infer from connection URLs.
  */
 
 import type { StoreDriverId } from "./types.ts";
 
-/** drizzle-kit `Dialect` values OKE currently emits for owned SQL drivers. */
-export type OkeDrizzleKitDialect = "sqlite" | "postgresql";
+/** drizzle-kit `Dialect` values OKE emits for owned SQL drivers. */
+export type OkeDrizzleKitDialect = "postgresql";
 
 /**
  * Exhaustive map: adding a new SQL id to `StoreDriverId` without updating
@@ -20,22 +16,20 @@ export type OkeDrizzleKitDialect = "sqlite" | "postgresql";
  * dialect months later.
  */
 export const SQL_DRIVER_TO_DRIZZLE_DIALECT: Record<
-  Extract<StoreDriverId, "sqlite" | "postgres" | "libsql" | "pglite">,
+  Extract<StoreDriverId, "postgres" | "pglite">,
   OkeDrizzleKitDialect
 > = {
-  sqlite: "sqlite",
   postgres: "postgresql",
-  libsql: "sqlite",
   pglite: "postgresql",
 };
 
 /**
  * Resolve the drizzle-kit dialect for an OKE SQL driver id.
  *
- * @param driverId - Protocol driver id (`sqlite` | `postgres` | `libsql` | `pglite`)
+ * @param driverId - Protocol driver id (`postgres` | `pglite`)
  */
 export function drizzleDialectFromSqlDriver(
-  driverId: Extract<StoreDriverId, "sqlite" | "postgres" | "libsql" | "pglite">,
+  driverId: Extract<StoreDriverId, "postgres" | "pglite">,
 ): OkeDrizzleKitDialect {
   return SQL_DRIVER_TO_DRIZZLE_DIALECT[driverId];
 }

package/src/drivers/index.ts

@@ -66,8 +66,6 @@ export {
   memoryDrivers,
 } from "./memory.ts";
 
-export { sqliteDriver, connectSqlite } from "./sqlite.ts";
-
 export {
   postgresDriver,
   connectPostgres,
@@ -86,8 +84,6 @@ export { s3Driver, openS3Bucket, createS3FakeClient } from "./s3.ts";
 
 export { pgvectorDriver, openPgvectorIndex } from "./pgvector.ts";
 
-export { libsqlDriver, connectLibsql, libsqlIndexDriver, openLibsqlIndex } from "./libsql.ts";
-
 export {
   meilisearchDriver,
   openMeilisearchIndex,
@@ -95,7 +91,12 @@ export {
   type MeilisearchIndexOptions,
 } from "./meilisearch.ts";
 
-export { pgliteDriver, connectPglite } from "./pglite.ts";
+export {
+  pgliteDriver,
+  connectPglite,
+  PGLITE_DEFAULT_DATADIR,
+  resolvePgliteDataDir,
+} from "./pglite.ts";
 
 export { memorySignalDriver, openMemorySignal } from "./signal-memory.ts";
 
@@ -139,8 +140,24 @@ export type { VaultDriverId, VaultOpenOptions, VaultBag, VaultDriver } from "./v
 
 export { memoryVaultDriver } from "./vault-memory.ts";
 export { envVaultDriver } from "./vault-env.ts";
-export { openbaoVaultDriver, OpenBaoUnavailableError } from "./vault-openbao.ts";
-export { managedVaultDriver } from "./vault-managed.ts";
+export {
+  builtinVaultDriver,
+  openBuiltinVaultAdapter,
+  VAULT_MASTER_KEY_ENV,
+  type OpenBuiltinVaultOptions,
+  type OpenedBuiltinVault,
+} from "./vault-builtin.ts";
+export {
+  managedVaultDriver,
+  createManagedVaultBag,
+  type ManagedVaultOptions,
+  type ManagedVaultProviderId,
+} from "./vault-managed.ts";
+export {
+  openAwsSecretsManagerBag,
+  type AwsSecretsManagerClient,
+  type OpenAwsSecretsManagerOptions,
+} from "./vault-aws-secrets-manager.ts";
 
 export type {
   ChannelDriverId,

package/src/drivers/journal-postgres.test.ts

@@ -142,18 +142,20 @@ describe("postgres JournalStore (fake)", () => {
     await store.close();
   });
 
-  test("listOrphans: running/sleeping without a live lease; never completed", async () => {
+  test("listOrphans: running/sleeping/compensating without a live lease; never completed", async () => {
     const store = await createPostgresJournalStore({ sql: createPostgresJournalFake() });
     await store.put(seedRun({ id: "running-unlocked" }));
     await store.put(seedRun({ id: "running-expired", lockedBy: "dead", leaseExpiresAt: 10 }));
     await store.put(seedRun({ id: "running-live", lockedBy: "alive", leaseExpiresAt: 9_000 }));
     await store.put(seedRun({ id: "sleeping-future", status: "sleeping", wakeAt: 99_000 }));
+    await store.put(seedRun({ id: "compensating-open", status: "compensating" }));
     await store.put(seedRun({ id: "done", status: "completed" }));
 
     const orphans = (await store.listOrphans(1_000)).map((r) => r.id);
     expect(orphans).toContain("running-unlocked");
     expect(orphans).toContain("running-expired");
     expect(orphans).toContain("sleeping-future");
+    expect(orphans).toContain("compensating-open");
     expect(orphans).not.toContain("running-live");
     expect(orphans).not.toContain("done");
     await store.close();

package/src/drivers/journal-postgres.ts

@@ -60,7 +60,7 @@ const CLAIM_LEASE_SQL = `SELECT * FROM oke_journal_runs WHERE id=? AND ((locked_
 const CLAIM_DUE_SQL = `SELECT * FROM oke_journal_runs WHERE status='sleeping' AND wake_at<=? AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?)) ORDER BY wake_at ASC LIMIT 1 FOR UPDATE SKIP LOCKED`;
 
 /** Boot-time orphan discovery: running/sleeping runs with no live lease. */
-const ORPHANS_SQL = `SELECT * FROM oke_journal_runs WHERE (status='running' OR status='sleeping') AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?))`;
+const ORPHANS_SQL = `SELECT * FROM oke_journal_runs WHERE (status='running' OR status='sleeping' OR status='compensating') AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?))`;
 
 const UPDATE_LEASE_SQL = `UPDATE oke_journal_runs SET locked_by = ?, lease_expires_at = ? WHERE id = ?`;
 
@@ -284,7 +284,9 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
         const cutoff = Number(params[0]);
         return state.rows
           .filter(
-            (r) => (r.status === "running" || r.status === "sleeping") && noLiveLease(r, cutoff),
+            (r) =>
+              (r.status === "running" || r.status === "sleeping" || r.status === "compensating") &&
+              noLiveLease(r, cutoff),
           )
           .map((r) => ({ ...r }));
       }

package/src/drivers/meilisearch.ts

@@ -1,7 +1,7 @@
 /**
  * `meilisearch` index driver — full-text search over the Meilisearch HTTP API.
  *
- * Product-as-protocol id (same pattern as `openbao` / `pgvector`); the image
+ * Product-as-protocol id (same pattern as `pgvector`); the image
  * pin lives in `images["store.index"]` (e.g. `getmeili/meilisearch`). This is
  * a genuinely different capability from the vector ANN drivers — typo-tolerant
  * / faceted full-text relevance, not cosine similarity.

package/src/drivers/pglite.ts

@@ -7,9 +7,8 @@
  *
  * Honest latency trade-off (measured on `@electric-sql/pglite@0.5.4`): first
  * init ~900 ms one-time (WASM instantiation); reopen of an existing datadir
- * ~44 ms; warm CRUD ~45 ms vs ~3 ms for `bun:sqlite` (~15× slower). Choose
- * `pglite` for dialect/pgvector parity on a laptop — never as a
- * latency-competitive default. `local` stays on `sqlite`.
+ * ~44 ms; warm CRUD ~45 ms. Default for `env: "test"` (`memory://`);
+ * `dev`/`prod` use real Postgres via Docker.
  */
 
 import { toPostgresParams } from "./postgres.ts";
@@ -39,6 +38,24 @@ async function loadPgliteVector(): Promise<PgliteVectorModule> {
   }
 }
 
+/** Default on-disk PGlite datadir (under the project `.oke/` tree). */
+export const PGLITE_DEFAULT_DATADIR = ".oke/pgdata";
+
+/**
+ * Resolve a PGlite URL to either in-memory (`memory://…`) or an on-disk datadir.
+ *
+ * SQLite's `":memory:"` is **not** in-memory for PGlite — it would create a
+ * literal `./:memory:` folder. Map that legacy token to {@link PGLITE_DEFAULT_DATADIR}.
+ *
+ * @param url - Raw connect URL / path
+ */
+export function resolvePgliteDataDir(url: string | undefined): string | "memory" {
+  const raw = url && url.length > 0 ? url : PGLITE_DEFAULT_DATADIR;
+  if (raw.startsWith("memory://")) return "memory";
+  if (raw === ":memory:") return PGLITE_DEFAULT_DATADIR;
+  return raw;
+}
+
 /**
  * Open a PGlite connection implementing {@link SqlConnection}.
  *
@@ -52,8 +69,14 @@ export async function connectPglite(options: SqlConnectOptions = {}): Promise<Sq
   const role = options.role ?? "primary";
   const { PGlite } = await loadPglite();
   const { vector } = await loadPgliteVector();
-  const dataDir = options.url && options.url.length > 0 ? options.url : ".oke/pgdata";
-  const db = await PGlite.create(dataDir, { extensions: { vector } });
+  const resolved = resolvePgliteDataDir(options.url);
+  // `memory://…` must be a fresh in-memory instance every connect — passing the
+  // string as dataDir is not reliably isolated across boots (IF NOT EXISTS then
+  // keeps a prior INTEGER column after we switch DDL to BIGINT).
+  const db =
+    resolved === "memory"
+      ? await PGlite.create({ extensions: { vector } })
+      : await PGlite.create(resolved, { extensions: { vector } });
   return {
     driverId: "pglite",
     role,

package/src/drivers/types.ts

@@ -9,9 +9,7 @@ import type { ColumnClassification, StoreFacet } from "../manifest/types.ts";
 
 /** Protocol ids for store drivers in scope. */
 export type StoreDriverId =
-  | "sqlite"
   | "postgres"
-  | "libsql"
   | "pglite"
   | "memory"
   | "redis"
@@ -31,14 +29,14 @@ export type SqlRow = Record<string, unknown>;
 
 /** Options when opening a SQL connection. */
 export interface SqlConnectOptions {
-  /** Connection URL or path (`:memory:`, `file:…`, `postgres://…`). */
+  /** Connection URL or path (`memory://`, `.oke/pgdata`, `postgres://…`). */
   readonly url?: string;
   /** Explicit role (defaults to primary). */
   readonly role?: SqlRole;
-  /** Pool / open hint — ignored by memory/sqlite. */
+  /** Pool / open hint — ignored by memory drivers. */
   readonly pool?: { readonly max?: number };
   /**
-   * Injected client for tests (Bun.SQL-compatible query fn, or bun:sqlite Database).
+   * Injected client for tests (Bun.SQL-compatible query fn).
    * Production code omits this and binds the native client.
    */
   readonly client?: unknown;
@@ -47,7 +45,7 @@ export interface SqlConnectOptions {
 /** Low-level SQL connection used by every sql driver. */
 export interface SqlConnection {
   /** Protocol driver id. */
-  readonly driverId: "sqlite" | "postgres" | "libsql" | "pglite" | "memory";
+  readonly driverId: "postgres" | "pglite" | "memory";
   /** Primary vs replica. */
   readonly role: SqlRole;
   /**
@@ -71,7 +69,7 @@ export interface SqlConnection {
 /** SQL driver factory. */
 export interface SqlDriver {
   /** Protocol id. */
-  readonly id: "sqlite" | "postgres" | "libsql" | "pglite" | "memory";
+  readonly id: "postgres" | "pglite" | "memory";
   /** Facet this driver serves. */
   readonly facet: "sql";
   /**
@@ -262,7 +260,7 @@ export interface IndexHit {
 
 /** Vector (ANN) index handle. */
 export interface VectorIndexStore {
-  readonly driverId: "memory" | "pgvector" | "libsql";
+  readonly driverId: "memory" | "pgvector";
   /**
    * Upsert a vector.
    *
@@ -356,7 +354,7 @@ export interface IndexOpenOptions {
 
 /** Vector index driver factory. */
 export interface VectorIndexDriver {
-  readonly id: "memory" | "pgvector" | "libsql";
+  readonly id: "memory" | "pgvector";
   readonly facet: "index";
   /**
    * Open a vector index.
@@ -384,8 +382,8 @@ export type IndexDriver = VectorIndexDriver | TextIndexDriver;
 /** True when the index driver shares the sql facet's engine (never memory). */
 export function indexDriverNeedsSql(
   driver: IndexDriver,
-): driver is VectorIndexDriver & { id: "pgvector" | "libsql" } {
-  return driver.id === "pgvector" || driver.id === "libsql";
+): driver is VectorIndexDriver & { id: "pgvector" } {
+  return driver.id === "pgvector";
 }
 
 /** Union of all store drivers. */