okengine 0.10.2 → 0.11.0

package/site/content/docs/reference/errors.mdx

@@ -29,18 +29,18 @@ string. Custom app codes stay message-less until registered.
 
 ## OKE numeric codes
 
-| Code   | Name              | Cause                                            | Fix                                                |
-| ------ | ----------------- | ------------------------------------------------ | -------------------------------------------------- |
-| `1001` | undeclared read   | Flow reads a resource not in `effects.reads`     | Add it to the flow's `effects.reads`               |
-| `1002` | undeclared write  | Flow writes a resource not in `effects.writes`   | Add it to the flow's `effects.writes`              |
-| `1003` | undeclared emit   | Flow emits a signal not in `effects.emits`       | Add it to the flow's `effects.emits`               |
-| `1004` | undeclared send   | Flow sends a template not in `effects.sends`     | Add it to the flow's `effects.sends`               |
-| `1005` | undeclared ask    | Flow asks a prompt not in `effects.asks`         | Add it to the flow's `effects.asks`                |
-| `1006` | undeclared secret | Flow reads a secret not in `effects.secrets`     | Add it to the flow's `effects.secrets`             |
-| `1007` | undeclared call   | Flow calls a flow not in `effects.calls`         | Add it to the flow's `effects.calls`               |
-| `1042` | orphan emit       | Emit with zero subscribers and `optional` false  | Add `on(signal, …)` or declare `optional: true`    |
-| `1043` | signal schema     | Emit payload failed the signal's `schema`        | Pass a payload that matches `schema`, or remove it |
-| `1101` | schema missing    | Domain table absent in docker/prod — no auto-DDL | Run `oke db migrate` against this environment      |
+| Code   | Name              | Cause                                           | Fix                                                |
+| ------ | ----------------- | ----------------------------------------------- | -------------------------------------------------- |
+| `1001` | undeclared read   | Flow reads a resource not in `effects.reads`    | Add it to the flow's `effects.reads`               |
+| `1002` | undeclared write  | Flow writes a resource not in `effects.writes`  | Add it to the flow's `effects.writes`              |
+| `1003` | undeclared emit   | Flow emits a signal not in `effects.emits`      | Add it to the flow's `effects.emits`               |
+| `1004` | undeclared send   | Flow sends a template not in `effects.sends`    | Add it to the flow's `effects.sends`               |
+| `1005` | undeclared ask    | Flow asks a prompt not in `effects.asks`        | Add it to the flow's `effects.asks`                |
+| `1006` | undeclared secret | Flow reads a secret not in `effects.secrets`    | Add it to the flow's `effects.secrets`             |
+| `1007` | undeclared call   | Flow calls a flow not in `effects.calls`        | Add it to the flow's `effects.calls`               |
+| `1042` | orphan emit       | Emit with zero subscribers and `optional` false | Add `on(signal, …)` or declare `optional: true`    |
+| `1043` | signal schema     | Emit payload failed the signal's `schema`       | Pass a payload that matches `schema`, or remove it |
+| `1101` | schema missing    | Domain table absent in `prod` — no auto-DDL     | Run `oke db migrate` against this environment      |
 
 <Callout title="Effects are usually inferred">
   The 1001–1007 family exists for flows that declare effects explicitly. Most apps never write an
@@ -69,23 +69,22 @@ Returned, not thrown — the request never reached `do`:
 
 Thrown by specific subsystems — each names its own cause:
 
-| Error                         | Thrown when                                                        | What to do                                              |
-| ----------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------- |
-| `VaultBootError`              | A vault contract has no value in any resolution layer              | Set the missing names — the error lists every gap       |
-| `OpenBaoUnavailableError`     | Vault driver can't reach OpenBao, or it's sealed, in docker/prod   | Restore the vault or unseal it — never silently skipped |
-| `OpenBaoBootstrapError`       | First-boot init/unseal failed, or key material is missing/unsafe   | Read the message — it names the exact failing step      |
-| `AiPiiBuildError`             | Build: a flow sends PII fields to a third-party model              | Drop the fields or add `allowPii: true` — fields named  |
-| `AiSchemaValidationError`     | A model response failed the prompt's `out` schema                  | Fix the prompt or the schema — response didn't conform  |
-| `ScheduleNotOverridableError` | Console tried to edit a clock declared without `overridable: true` | Declare it overridable and redeploy                     |
-| `ClockResourceNotFoundError`  | Console action targeted an unknown clock name                      | Check the name against your `clock()` declarations      |
-| `DryRunWriteIsolationError`   | A write attempted inside a dry run                                 | Dry runs never write — use a real run                   |
-| `ManifestValidationError`     | The compiled Manifest failed schema validation                     | Re-run the build; the error names the offending entry   |
-| `CrossPlaneError`             | A user-plane token was used on the operator plane (or vice versa)  | Use the correct principal for the plane                 |
-| `AttenuationError`            | A token was used beyond its attenuated scope                       | Re-issue with the needed scope                          |
-| `SessionError`                | Session token invalid, expired, or malformed                       | Re-authenticate                                         |
-| `OperatorError`               | Operator-plane operation failed its checks                         | Error message names the failed check                    |
-| `AccessGrantError`            | Console access grant rejected                                      | Re-request access with a valid grant                    |
-| `UnsupportedPathError`        | A route path shape the router can't compile                        | Simplify the path pattern                               |
+| Error                         | Thrown when                                                        | What to do                                             |
+| ----------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------ |
+| `VaultBootError`              | A vault contract has no value in any resolution layer              | Set the missing names — the error lists every gap      |
+| `VaultError` (`UNSUPPORTED`)  | Managed provider unknown or not implemented in core                | Use `aws-secrets-manager`, built-in `vault`, or `env`  |
+| `AiPiiBuildError`             | Build: a flow sends PII fields to a third-party model              | Drop the fields or add `allowPii: true` — fields named |
+| `AiSchemaValidationError`     | A model response failed the prompt's `out` schema                  | Fix the prompt or the schema — response didn't conform |
+| `ScheduleNotOverridableError` | Console tried to edit a clock declared without `overridable: true` | Declare it overridable and redeploy                    |
+| `ClockResourceNotFoundError`  | Console action targeted an unknown clock name                      | Check the name against your `clock()` declarations     |
+| `DryRunWriteIsolationError`   | A write attempted inside a dry run                                 | Dry runs never write — use a real run                  |
+| `ManifestValidationError`     | The compiled Manifest failed schema validation                     | Re-run the build; the error names the offending entry  |
+| `CrossPlaneError`             | A user-plane token was used on the operator plane (or vice versa)  | Use the correct principal for the plane                |
+| `AttenuationError`            | A token was used beyond its attenuated scope                       | Re-issue with the needed scope                         |
+| `SessionError`                | Session token invalid, expired, or malformed                       | Re-authenticate                                        |
+| `OperatorError`               | Operator-plane operation failed its checks                         | Error message names the failed check                   |
+| `AccessGrantError`            | Console access grant rejected                                      | Re-request access with a valid grant                   |
+| `UnsupportedPathError`        | A route path shape the router can't compile                        | Simplify the path pattern                              |
 
 ## Learn more
 

package/site/content/docs/reference/fx.mdx

@@ -156,9 +156,16 @@ AI calls are nondeterministic: journaling is forced on and auto-cache disabled a
 
 ## Vault
 
-| Signature            | Records | Returns / notes                                                                           |
-| -------------------- | ------- | ----------------------------------------------------------------------------------------- |
-| `fx.vault(contract)` | `read`  | `Redacted<string>` — prints/logs as a placeholder; `.reveal()` at the credential boundary |
+| Signature                          | Records  | Returns / notes                                                                                    |
+| ---------------------------------- | -------- | -------------------------------------------------------------------------------------------------- |
+| `fx.vault.get(contract)`           | `secret` | `Promise<Redacted<string>>` — prints/logs as a placeholder; `.reveal()` at the credential boundary |
+| `fx.vault.set(path, value, opts?)` | `secret` | `{ path, version }` — needs a bound Vault backend                                                  |
+| `fx.vault.rotate(path, value)`     | `secret` | `{ path, version }` — new version with a fresh data key                                            |
+| `fx.vault.delete(path)`            | `secret` | `boolean` — crypto-shreds the path                                                                 |
+| `fx.vault.list(prefix?)`           | —        | Secret paths, never values                                                                         |
+| `fx.vault.status()`                | —        | `{ sealed, initialized, backend }`                                                                 |
+
+`get` reads through the boot resolution chain. Everything else needs the encrypted-at-rest backend (`drivers.vault = "vault"`) and throws without it.
 
 ## Clock
 
@@ -205,7 +212,7 @@ Register catalogs with `defineLocale` before boot (nested trees → dot keys). A
 `Register` so keys autocomplete and typos fail at compile time:
 
 ```typescript
-import { defineLocale, defineMessages, type MessagesFor } from "okengine";
+import { defineLocale, defineMessages, type MessagesFor } from "okengine/i18n";
 
 export const en = defineMessages({
   greeting: "Hello, {name}",
@@ -259,9 +266,9 @@ must log who started the call chain.
 ## Not on `fx`
 
 <Callout title="No fx.metric">
-  Investigated and declined. [Runs](/docs/console/runs) already own per-invocation observability as
-  wide events. Native alerting is `fx.runs` + Clock + Channel — not a second counter/gauge API.
-  Optional OTLP export for existing Grafana/Datadog stacks is additive and never required.
+  Investigated and declined. `fx.runs` already provides per-invocation observability as wide events.
+  Native alerting is `fx.runs` + Clock + Channel — not a second counter/gauge API. Optional OTLP
+  export for existing Grafana/Datadog stacks is additive and never required.
 </Callout>
 
 ## Learn more

package/site/content/docs/reference/i18n.mdx

@@ -22,19 +22,22 @@ format inside a Flow with `fx.t`. Configure supported locales once in
 ### Configure locales
 
 ```typescript title="oke.config.ts"
-i18n: { locales: ["en", "ar"], default: "en", dir: { ar: "rtl" } },
+i18n: { locales: ["en"], default: "en" },
 ```
 
-If `i18n` is omitted, boot still defaults to `locales: ["en", "ar"]` and
-`default: "en"`.
+create-oke scaffolds English-only. Choose **Add more languages** (or
+`--locales ar,fr`) to write locale files + `locales/index.ts` and expand
+`i18n.locales` (Arabic also gets `dir: { ar: "rtl" }`).
+
+If `i18n` is omitted, boot defaults to `locales: ["en"]` and `default: "en"`.
 
 </Step>
 
 <Step>
 ### Register catalogs
 
-Side-effect import locale modules before boot (the starter already does this
-from `src/app.ts`):
+Each locale file calls `defineLocale`. The starter pulls them in once from
+`core.ts` via `locales/index.ts` — `app.ts` only needs `import "@/core"`:
 
 ```typescript title="src/locales/en.ts"
 import { defineMessages, defineLocale } from "okengine";
@@ -55,7 +58,7 @@ declare module "okengine" {
 
 ```typescript title="src/locales/ar.ts"
 import { defineLocale, type MessagesFor } from "okengine";
-import { en } from "./en";
+import type { en } from "./en";
 
 defineLocale("ar", {
   greeting: "مرحباً، {name}",
@@ -64,6 +67,14 @@ defineLocale("ar", {
 } satisfies MessagesFor<typeof en>);
 ```
 
+```typescript title="src/locales/index.ts"
+import "./en";
+import "./ar";
+```
+
+When you add `ar` via create-oke, the Arabic catalog is filled in and
+`locales/index.ts` gains `import "./ar"`. Other tags get an English stub.
+
 </Step>
 
 <Step>

package/site/content/docs/reference/index.mdx

@@ -15,6 +15,11 @@ Dense tables and command lists. Reach for these when you already know what you a
     description="Every option in oke.config.ts."
     href="/docs/reference/configuration"
   />
+  <Card
+    title="Migrating environments"
+    description="local/docker maps → dev/test/prod."
+    href="/docs/reference/migrating-environments"
+  />
   <Card title="fx" description="The complete fx surface and effects." href="/docs/reference/fx" />
   <Card
     title="i18n"

package/site/content/docs/reference/meta.json

@@ -4,6 +4,7 @@
   "pages": [
     "index",
     "configuration",
+    "migrating-environments",
     "fx",
     "i18n",
     "client",

package/site/content/docs/reference/migrating-environments.mdx

@@ -0,0 +1,158 @@
+---
+title: "Migrating environments"
+description: "Move from local/docker/test/prod driver maps to the Docker-first dev/test/prod model."
+icon: "ArrowRightLeft"
+---
+
+Older projects used four driver-map keys (`local` · `docker` · `test` · `prod`) and an optional
+`oke mode` switch. Today there are three environments, `oke dev` always starts Docker Compose, and
+SQLite-family drivers (`sqlite`, `libsql`) are gone.
+
+There is **no** soft-compat and **no** upgrade codemod for this change. Edit `oke.config.ts` by
+hand using this page.
+
+<Callout title="The one rule">
+  Rename maps to `dev` / `test` / `prod`, pin `pglite` for SQL tests, delete `.oke/mode`, then run
+  `oke dev` / `oke test`.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Edit the three-key shape
+
+```typescript title="oke.config.ts"
+import { defineConfig } from "okengine/config";
+
+export default defineConfig({
+  drivers: {
+    store: {
+      sql: { dev: "postgres", test: "pglite", prod: "postgres" },
+      kv: { dev: "redis", test: "memory", prod: "redis" },
+    },
+  },
+});
+```
+
+</Step>
+
+<Step>
+### Drop mode and use the new commands
+
+```bash title="Terminal"
+rm -f .oke/mode          # no longer read
+oke dev                  # always Docker Compose
+oke test                 # PGLite test posture (no Compose)
+```
+
+`oke mode` prints an error and exits — it was removed.
+
+</Step>
+
+</Steps>
+
+## Key rename table
+
+| Old key  | New key | Notes                                            |
+| -------- | ------- | ------------------------------------------------ |
+| `local`  | `dev`   | Compose laptop                                   |
+| `docker` | `dev`   | Same Compose / prod-shaped protocols             |
+| `stack`  | `dev`   | Legacy alias                                     |
+| `test`   | `test`  | Unchanged; SQL must be `pglite`                  |
+| `prod`   | `prod`  | Unchanged; missing `dev` still fills from `prod` |
+
+## sqlite / libsql removal
+
+| Old pin                           | Replacement                                   |
+| --------------------------------- | --------------------------------------------- |
+| `sql.*: "sqlite"` / `"libsql"`    | `dev` / `prod`: `postgres`                    |
+| `sql.test: "sqlite"` / `"libsql"` | `test: "pglite"`                              |
+| `sql.test: "memory"`              | `test: "pglite"` (required by `defineConfig`) |
+| `index.*: "libsql"`               | `dev` / `prod`: `pgvector`; `test`: `memory`  |
+
+`OKE_SQLITE_URL` / `OKE_LIBSQL_URL` are unused — use `DATABASE_URL` (Compose Postgres) or
+`OKE_PGLITE_URL` (`memory://` under `oke test`).
+
+## Before / after
+
+```typescript title="Before (removed)"
+drivers: {
+  store: {
+    sql: { local: "sqlite", docker: "postgres", test: "memory", prod: "postgres" },
+    kv: { local: "memory", docker: "redis", test: "memory", prod: "redis" },
+  },
+},
+```
+
+```typescript title="After"
+drivers: {
+  store: {
+    sql: { dev: "postgres", test: "pglite", prod: "postgres" },
+    kv: { dev: "redis", test: "memory", prod: "redis" },
+  },
+},
+```
+
+## CLI changes
+
+| Old                       | New                                             |
+| ------------------------- | ----------------------------------------------- |
+| `oke mode local\|docker`  | Removed — error message points at `oke dev`     |
+| `oke dev --local` / `-l`  | Removed — exits with guidance to use `oke test` |
+| `oke dev` (local default) | Always Docker Compose                           |
+| `oke dev --docker` / `-d` | Optional **role filter** only (still Compose)   |
+| —                         | `oke test` — `bun test` + PGLite posture        |
+
+Loading `oke.config.ts` with a `local:` env key or a `"sqlite"` pin fails immediately:
+
+```text
+Error: "local" is no longer a valid environment key in oke.config.ts.
+```
+
+```text
+Error: "sqlite" is no longer a valid driver in oke.config.ts.
+```
+
+## Troubleshooting
+
+<Accordions>
+
+<Accordion title='CLI says "local" / "sqlite" is no longer valid'>
+  Edit `oke.config.ts` using the tables above. There is no automatic rewrite — fix the file, then
+  re-run the command.
+</Accordion>
+
+<Accordion title="defineConfig throws on sqlite, libsql, or non-pglite test SQL">
+  Those pins are hard errors. Fix the map, then restart `oke dev` / `oke test`. Exact messages are
+  documented under [Configuration · Safety](/docs/reference/configuration#safety-rules).
+</Accordion>
+
+</Accordions>
+
+## Learn more
+
+- [Configuration](/docs/reference/configuration) — full `oke.config.ts` reference
+- [CLI Reference](/docs/reference/cli) — `oke dev` · `oke test`
+- [Installation](/docs/get-started/installation) — Docker-first quick start
+
+## Next
+
+<Cards>
+  <Card
+    title="Configuration"
+    description="Drivers, images, db, ports."
+    href="/docs/reference/configuration"
+  />
+  <Card
+    title="CLI Reference"
+    description="oke and create-oke commands."
+    href="/docs/reference/cli"
+  />
+  <Card
+    title="Docker deployment"
+    description="Production compose shape."
+    href="/docs/deployment/docker"
+  />
+</Cards>

package/site/content/docs/reference/plugins.mdx

@@ -54,7 +54,7 @@ export const app = oke({ name: "shop", env: "dev" }).plug(audit);
 <Step>
 ### Everything derives as usual
 
-Plugin flows appear in the Manifest, plugin tables land in `schema.generated.ts` on the next `oke db push`, plugin panels show up in the Console. No extra wiring — a contribution is ordinary OKE, just authored elsewhere.
+Plugin flows appear in the Manifest, plugin tables land in `schema.drizzle.ts` on the next `oke db push`, plugin panels show up in the Console. No extra wiring — a contribution is ordinary OKE, just authored elsewhere.
 
 </Step>
 
@@ -225,7 +225,7 @@ Extending an existing **app-owned** table with plugin columns is not supported i
     two configurations of one plugin would silently diverge. Pass identical config, or rename one
     instance.
   </Accordion>
-  <Accordion title="My plugin table is missing from schema.generated.ts">
+  <Accordion title="My plugin table is missing from schema.drizzle.ts">
     The CLI reads table contributions from the live app entry. Make sure the plugin is actually
     `.plug()`ed in `src/app.ts` (or `db.entry` if overridden), then re-run `oke db push`.
   </Accordion>

package/src/auth/gate-auth.test.ts

@@ -11,7 +11,7 @@ import { resolveAuthSchema } from "./schema.ts";
 import { emitSchemaSource, runSchemaGenerate } from "../cli/schema.ts";
 import { isSessionFresh, AUTH_SESSION_GATE } from "./bindings.ts";
 import { resolveGateAuth } from "./config.ts";
-import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -60,8 +60,8 @@ describe("gate.auth — config", () => {
 
 describe("gate.auth — autoBoot / posture", () => {
   test("auth HTTP bindings are in adopted and fail posture without gates", async () => {
-    // Force a gap by constructing bindings then auditing with empty gates stripped —
-    // real materialization always attaches gate.public / auth.session.
+    // Auth HTTP Bindings materialize lazily in doBoot (keeps auth/zod off the
+    // cold graph for public-gate apps). Boot first, then inspect adopted.
     const app = oke({
       name: "auth-posture",
       env: "test",
@@ -74,6 +74,7 @@ describe("gate.auth — autoBoot / posture", () => {
         unguardedHttp: "deny",
       },
     });
+    await app.boot({ env: "test" });
     const authPaths = app.bindings
       .filter((b) => b.trigger.kind === "http")
       .map(
@@ -87,14 +88,13 @@ describe("gate.auth — autoBoot / posture", () => {
       if (b.trigger.kind !== "http") continue;
       expect((b.trigger as { gates: readonly unknown[] }).gates.length).toBeGreaterThan(0);
     }
-    await app.boot({ env: "test" });
     await app.stop();
   });
 
   test("bare oke gate.auth fetch goes through ensureBoot → doBoot", async () => {
     const app = oke({
       name: "auth-autoboot",
-      env: "local",
+      env: "test",
       registry: "ignore",
       gate: {
         auth: {
@@ -118,10 +118,10 @@ describe("gate.auth — autoBoot / posture", () => {
     await app.stop();
   });
 
-  test("auth routes are not registry flows[] alone — they are Bindings", () => {
+  test("auth routes are not registry flows[] alone — they are Bindings", async () => {
     const app = oke({
       name: "auth-bindings",
-      env: "local",
+      env: "test",
       registry: "ignore",
       gate: {
         auth: {
@@ -130,9 +130,11 @@ describe("gate.auth — autoBoot / posture", () => {
         },
       },
     });
+    await app.boot({ env: "test" });
     expect(app.bindings.length).toBeGreaterThan(0);
     expect(app.bindings.every((b) => b.flow && b.trigger)).toBe(true);
     expect(app.router.match("POST", "/auth/sign-in/email")).toBeTruthy();
+    await app.stop();
   });
 
   test(".needs(auth) satisfied by gate.auth without .plug(auth())", async () => {
@@ -312,14 +314,14 @@ describe("gate.auth — email Flows + security", () => {
     on(http.get("/open"), flow("open", { do: () => ({ ok: true }) }));
     const app = oke({
       name: "gap",
-      env: "local",
+      env: "test",
       gate: {
         auth: { secret: "test-secret-at-least-16", http: false },
         unguardedHttp: "deny",
       },
       startScheduler: false,
     });
-    await expect(app.boot({ env: "local", startScheduler: false })).rejects.toBeInstanceOf(
+    await expect(app.boot({ env: "test", startScheduler: false })).rejects.toBeInstanceOf(
       GateBootError,
     );
   });
@@ -341,7 +343,6 @@ describe("oke schema generate — auth columns", () => {
 
     const dir = await mkdtemp(join(tmpdir(), "oke-schema-"));
     try {
-      await mkdir(join(dir, "schema"), { recursive: true });
       const code = await runSchemaGenerate({
         cwd: dir,
         authSchema: {
@@ -353,6 +354,7 @@ describe("oke schema generate — auth columns", () => {
         write: () => {},
       });
       expect(code).toBe(0);
+      expect(await Bun.file(join(dir, ".oke/schema/oke.ts")).exists()).toBe(true);
       const checkOk = await runSchemaGenerate({
         cwd: dir,
         check: true,

package/src/cli/ai-setup/ai-setup.test.ts

@@ -3,7 +3,7 @@
  */
 
 import { describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { applyAiSetup, renderAiTs, upsertAiDrivers, upsertEnv } from "./apply.ts";
@@ -48,8 +48,7 @@ describe("apply", () => {
   drivers: {
     channel: {
       email: {
-        local: "console",
-        docker: "smtp",
+        dev: "smtp",
         test: "console",
         prod: "smtp",
       },
@@ -65,7 +64,11 @@ describe("apply", () => {
     const config = new Function("defineConfig", body)(<T>(c: T): T => c) as {
       drivers?: { ai?: unknown; channel?: { ai?: unknown; email?: unknown } };
     };
-    expect(config.drivers?.ai).toMatchObject({ local: "ollama", docker: "ollama" });
+    expect(config.drivers?.ai).toMatchObject({
+      dev: "ollama",
+      test: "mock",
+      prod: "ollama",
+    });
     expect(config.drivers?.channel?.ai).toBeUndefined();
     expect(config.drivers?.channel?.email).toBeDefined();
   });
@@ -99,7 +102,7 @@ describe("apply", () => {
     expect(ts).toContain("docsEmbed");
   });
 
-  test("applyAiSetup writes config, env, core/ai.ts", () => {
+  test("applyAiSetup writes config, env, AI models in core.ts", () => {
     const dir = mkdtempSync(join(tmpdir(), "oke-ai-setup-"));
     try {
       writeFileSync(
@@ -109,22 +112,32 @@ export default defineConfig({
   drivers: {
     channel: {
       email: {
-        local: "console",
-        docker: "smtp",
+        dev: "smtp",
         test: "console",
         prod: "smtp",
       },
     },
   },
   images: {
-    "store.sql": "postgres:18-alpine",
+    store: {
+      sql: "postgres:18-alpine",
+    },
   },
 });
 `,
         "utf8",
       );
       mkdirSync(join(dir, "src"), { recursive: true });
-      writeFileSync(join(dir, "src", "app.ts"), `export const app = {};\n`, "utf8");
+      writeFileSync(
+        join(dir, "src", "core.ts"),
+        `import { store } from "okengine";\n\nexport const db = store.sql("app");\n`,
+        "utf8",
+      );
+      writeFileSync(
+        join(dir, "src", "app.ts"),
+        `import "@/core";\nexport const app = {};\n`,
+        "utf8",
+      );
 
       applyAiSetup(dir, {
         driver: "ollama",
@@ -135,18 +148,19 @@ export default defineConfig({
       });
 
       const config = readFileSync(join(dir, "oke.config.ts"), "utf8");
-      expect(config).toContain('local: "ollama"');
+      expect(config).toContain('dev: "ollama"');
       expect(config).toContain('ai: "ollama/ollama:0.32.6"');
       const env = readFileSync(join(dir, ".env.local"), "utf8");
       expect(env).toContain("# OKE_AI_DRIVER=ollama");
-      expect(env).toMatch(/^OKE_AI_MODEL=gemma4:e4b$/m);
-      expect(env).not.toMatch(/^#\s*OKE_AI_MODEL=gemma4:e4b$/m);
+      expect(env).toMatch(/^#\s*OKE_AI_MODEL=gemma4:e4b$/m);
+      expect(env).not.toMatch(/^OKE_AI_MODEL=/m);
       expect(env).toContain("# OKE_AI_URL=http://127.0.0.1:11434");
       expect(env).not.toMatch(/^OKE_AI_URL=/m);
-      const aiTs = readFileSync(join(dir, "src", "core", "ai.ts"), "utf8");
-      expect(aiTs).toContain("smart");
-      const app = readFileSync(join(dir, "src", "app.ts"), "utf8");
-      expect(app).toContain('import "./core/ai"');
+      const core = readFileSync(join(dir, "src", "core.ts"), "utf8");
+      expect(core).toContain('import { ai, store } from "okengine"');
+      expect(core).toContain("smart");
+      expect(core).toContain('ai.model("vision"');
+      expect(existsSync(join(dir, "src", "core", "ai.ts"))).toBe(false);
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }