okengine 0.10.3 → 0.11.0

package/src/cli/docker-clean.ts

@@ -12,7 +12,6 @@ import {
   resolveSelection,
   selectionKey,
   type DockerRunner,
-  type OkeContainer,
   type OkeStack,
 } from "../docker/cleanup.ts";
 import { EXIT_OK, EXIT_RUNTIME, EXIT_USAGE } from "./exit.ts";
@@ -49,8 +48,8 @@ export function dockerCleanHelp(): string {
 
 Remove leftover OKE docker compose stacks (containers, networks, volumes).
 
-Inside a project: focuses the current stack (oke-dev-<id>); optionally
-include other stacks on this machine.
+Selection is by compose project name (oke-dev-<id>) — never per-service.
+Inside a project: focuses the current stack; optionally include others.
 Outside a project: list every oke-dev-* stack and pick what to remove.
 
   --yes, -y   Non-interactive; required when stdin is not a TTY
@@ -235,10 +234,10 @@ async function runInteractive(options: {
     if (current.length === 0) {
       write(`No stack for this project (${currentProject}).\n`);
     } else {
-      const keys = await pickContainerKeys({
+      const keys = await pickProjectKeys({
         stacks: current,
         scope: "current",
-        message: `Containers for this project (${currentProject})`,
+        message: `Stack for this project (${currentProject})`,
         initialAll: true,
         pickKeys,
       });
@@ -256,7 +255,7 @@ async function runInteractive(options: {
         return EXIT_OK;
       }
       if (include) {
-        const keys = await pickContainerKeys({
+        const keys = await pickProjectKeys({
           stacks: others,
           scope: "other",
           message: "Other OKE stacks on this machine",
@@ -271,7 +270,7 @@ async function runInteractive(options: {
       }
     }
   } else {
-    const keys = await pickContainerKeys({
+    const keys = await pickProjectKeys({
       stacks,
       scope: "all",
       message: "OKE docker stacks on this machine",
@@ -330,7 +329,10 @@ async function askIncludeOthersPrompt(): Promise<boolean | null> {
   return value;
 }
 
-async function pickContainerKeys(options: {
+/**
+ * Multiselect compose projects (one row per `oke-dev-*` name).
+ */
+async function pickProjectKeys(options: {
   readonly stacks: readonly OkeStack[];
   readonly scope: "current" | "other" | "all";
   readonly message: string;
@@ -344,7 +346,7 @@ async function pickContainerKeys(options: {
   if (entries.length === 0) return [];
 
   const value = await multiselect({
-    message: `${message} — selecting any container removes its whole stack`,
+    message: `${message} — removes the whole stack (containers, networks, volumes)`,
     options: entries.map((e) => ({
       value: e.key,
       label: e.label,
@@ -357,34 +359,27 @@ async function pickContainerKeys(options: {
   return value;
 }
 
-function selectionEntries(stacks: readonly OkeStack[]): readonly {
+/**
+ * One selectable row per compose project.
+ *
+ * @param stacks - Discovered stacks
+ */
+export function selectionEntries(stacks: readonly OkeStack[]): readonly {
   readonly key: string;
   readonly label: string;
   readonly hint?: string;
 }[] {
-  const out: { key: string; label: string; hint?: string }[] = [];
-  for (const stack of stacks) {
-    if (stack.containers.length === 0) {
-      out.push({
-        key: selectionKey(stack.project),
-        label: stack.project,
-        hint: "no containers · volumes/networks may remain",
-      });
-      continue;
-    }
-    for (const c of stack.containers) {
-      out.push({
-        key: selectionKey(stack.project, c.name),
-        label: `${stack.project} · ${displayContainer(c)}`,
-        hint: c.state || undefined,
-      });
-    }
-  }
-  return out;
-}
-
-function displayContainer(c: OkeContainer): string {
-  return c.service && c.service !== c.name ? `${c.service} (${c.name})` : c.name;
+  return stacks.map((stack) => {
+    const n = stack.containers.length;
+    return {
+      key: selectionKey(stack.project),
+      label: stack.project,
+      hint:
+        n === 0
+          ? "no containers · volumes/networks may remain"
+          : `${n} container${n === 1 ? "" : "s"}`,
+    };
+  });
 }
 
 async function tearDownProjects(

package/src/cli/docker-cli.test.ts

@@ -39,11 +39,12 @@ describe("oke docker CLI", () => {
     expect(code).toBe(0);
     expect(result).toBeDefined();
     expect(await Bun.file(join(dir, "docker/Dockerfile")).exists()).toBe(true);
-    expect(await Bun.file(join(dir, "docker/compose.store.sql.yml")).exists()).toBe(true);
-    const yml = await Bun.file(join(dir, "docker/compose.store.sql.yml")).text();
+    expect(await Bun.file(join(dir, "docker/docker-compose.yml")).exists()).toBe(true);
+    const yml = await Bun.file(join(dir, "docker/docker-compose.yml")).text();
     expect(yml).not.toContain("test-password-not-in-yaml");
     expect(yml).toContain(".env.docker");
-    expect(logs.join("")).toContain("docker/compose.override.yml");
+    expect(yml).toContain("/_/ready");
+    expect(logs.join("")).toContain("docker-compose.override.yml");
   });
 });
 
@@ -136,7 +137,7 @@ describe("oke images list", () => {
 });
 
 describe("oke schema generate", () => {
-  test("emits schema/oke.ts and --check catches drift", async () => {
+  test("emits .oke/schema/oke.ts and --check catches drift", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-cli-schema-"));
     const code = await runSchemaGenerate({
       cwd: dir,
@@ -144,7 +145,7 @@ describe("oke schema generate", () => {
       write: () => {},
     });
     expect(code).toBe(0);
-    const src = await Bun.file(join(dir, "schema/oke.ts")).text();
+    const src = await Bun.file(join(dir, ".oke/schema/oke.ts")).text();
     expect(src).toContain("bookings");
     expect(src).toContain("oke_roles");
 
@@ -156,7 +157,7 @@ describe("oke schema generate", () => {
     });
     expect(checkOk).toBe(0);
 
-    await Bun.write(join(dir, "schema/oke.ts"), emitSchemaSource(["other"]));
+    await Bun.write(join(dir, ".oke/schema/oke.ts"), emitSchemaSource(["other"]));
     const checkFail = await runSchemaGenerate({
       cwd: dir,
       extraTables: ["bookings"],
@@ -167,7 +168,7 @@ describe("oke schema generate", () => {
   });
 });
 
-describe("oke dev --docker", () => {
+describe("oke dev compose plan", () => {
   test("plans docker with postgres and writes nothing on dryRun", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-cli-dev-dry-"));
     await Bun.write(join(dir, "src/app.ts"), "export {}\n");
@@ -182,11 +183,11 @@ describe("oke dev --docker", () => {
     });
     expect(code).toBe(0);
     expect(plan?.stackRoles).toEqual(["store.sql"]);
-    expect(plan?.composeFiles?.some((f) => f.includes("store.sql"))).toBe(true);
-    expect(plan?.composeFiles).toContain("compose.yml");
+    expect(plan?.composeFiles).toContain("docker-compose.yml");
+    expect(plan?.composeFiles?.some((f) => f.includes("store.sql"))).toBe(false);
     expect(plan?.stackEnv?.DATABASE_URL).toContain("postgres://");
-    expect(await Bun.file(join(dir, "compose.yml")).exists()).toBe(false);
-    expect(await Bun.file(join(dir, "docker/compose.yml")).exists()).toBe(false);
+    expect(await Bun.file(join(dir, "docker-compose.yml")).exists()).toBe(false);
+    expect(await Bun.file(join(dir, "docker/docker-compose.yml")).exists()).toBe(false);
   });
 });
 

package/src/cli/docker.ts

@@ -1,12 +1,17 @@
 /**
- * `oke docker` — Dockerfile + per-role compose files · `clean` leftover stacks.
+ * `oke docker` — Dockerfile + compose artefacts · `clean` leftover stacks.
+ *
+ * Default layout is a single production-grade `docker-compose.yml`.
+ * Opt into `--split` (per-role files) or `--stack` (`docker-stack.yml`).
  */
 
 import { resolve } from "node:path";
 import {
   DEFAULT_DOCKER_DIR,
+  DEFAULT_SERVER_BUDGET,
   deriveInfrastructure,
   writeDerivedFiles,
+  type ComposeLayout,
   type DeriveOptions,
   type DeriveResult,
 } from "../docker/index.ts";
@@ -18,7 +23,14 @@ import { loadOkeConfig, loadManifest, resolveImages } from "./load-config.ts";
 export interface DockerCliOptions {
   readonly cwd?: string;
   readonly outDir?: string;
+  /** Production overlays + resource budget (default true for `oke docker`). */
   readonly prod?: boolean;
+  /** Compose layout (default `single`). */
+  readonly layout?: ComposeLayout;
+  /** Host CPUs for resource apportioning (default 4). */
+  readonly serverCpus?: number;
+  /** Host RAM GiB for resource apportioning (default 8). */
+  readonly serverMemoryGb?: number;
   readonly configPath?: string;
   readonly manifestPath?: string;
   readonly write?: (text: string) => void;
@@ -75,11 +87,19 @@ export async function runDockerDerive(
     return { code: 1 };
   }
 
+  const layout = options.layout ?? "single";
+  const prod = options.prod ?? true;
+  const serverCpus = options.serverCpus ?? DEFAULT_SERVER_BUDGET.cpus;
+  const serverMemoryGb = options.serverMemoryGb ?? DEFAULT_SERVER_BUDGET.memoryGb;
+
   try {
     const result = deriveInfrastructure({
       images,
       app,
-      prod: options.prod ?? false,
+      prod,
+      layout,
+      serverCpus,
+      serverMemoryGb,
       outDir,
       composeDir,
       includeApp: true,
@@ -90,25 +110,22 @@ export async function runDockerDerive(
       await writeDerivedFiles(result, outDir, { writeStackEnv: false });
     }
 
-    const vaultSpec = result.specs.find((s) => s.role === "vault");
-    if (vaultSpec) {
-      const rel = composeDir === "." ? ".oke/openbao/" : `${composeDir}/../.oke/openbao/`;
-      write(
-        `oke docker: OpenBao first boot — bring the stack up (e.g. \`oke dev -d\`), and oke ` +
-          `will initialize + unseal it once. Root/unseal material stays on the host at ${rel} ` +
-          `(0600, gitignored) — back it up; losing it loses every secret permanently.\n`,
-      );
-    }
-
     write(`oke docker: wrote ${result.files.length} file(s) → ${composeDir}/\n`);
     for (const f of result.files) write(`  ${composeDir}/${f.path}\n`);
     write(
-      `compose merge order (cwd ${composeDir}/):\n${result.composeFiles.map((f) => `  -f ${f}`).join("\n")}\n`,
+      `layout: ${layout} · server budget: ${serverCpus} CPU / ${serverMemoryGb} GiB` +
+        (prod ? " · production-grade\n" : "\n"),
     );
     write(
-      `(${composeDir}/compose.override.yml is layer 4 — user-owned, never written by oke)\n` +
-        `(${composeDir}/compose.all.yml is layers 1–3 merged — single-file alternative for Swarm / one \`-c\`)\n`,
+      `compose merge order (cwd ${composeDir}/):\n${result.composeFiles.map((f) => `  -f ${f}`).join("\n")}\n`,
     );
+    if (layout === "single") {
+      write(`(${composeDir}/docker-compose.override.yml is user-owned — never written by oke)\n`);
+    } else if (layout === "split") {
+      write(`(${composeDir}/compose.override.yml is user-owned — never written by oke)\n`);
+    } else {
+      write(`(Swarm: docker stack deploy -c ${composeDir}/docker-stack.yml <name>)\n`);
+    }
     return { code: 0, result };
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
@@ -127,21 +144,61 @@ export async function dockerCli(args: readonly string[]): Promise<number> {
     return dockerCleanCli(rest);
   }
 
-  let prod = false;
+  let prod: boolean | undefined;
+  let layout: ComposeLayout | undefined;
+  let serverCpus: number | undefined;
+  let serverMemoryGb: number | undefined;
   let outDir: string | undefined;
   let configPath: string | undefined;
   let manifestPath: string | undefined;
   for (let i = 0; i < args.length; i++) {
     const a = args[i]!;
     if (a === "--prod" || a === "-p") prod = true;
-    else if (a === "--out" || a === "-o") outDir = args[++i];
+    else if (a === "--no-prod") prod = false;
+    else if (a === "--split") layout = "split";
+    else if (a === "--stack") layout = "stack";
+    else if (a === "--single") layout = "single";
+    else if (a === "--cpus" || a === "--cpu") {
+      const raw = args[++i];
+      const n = Number(raw);
+      if (!raw || !(n > 0)) {
+        console.error("oke docker: --cpus requires a positive number");
+        return 1;
+      }
+      serverCpus = n;
+    } else if (a === "--memory" || a === "--mem" || a === "--memory-gb") {
+      const raw = args[++i];
+      const n = Number(raw);
+      if (!raw || !(n > 0)) {
+        console.error("oke docker: --memory requires a positive GiB number");
+        return 1;
+      }
+      serverMemoryGb = n;
+    } else if (a === "--out" || a === "-o") outDir = args[++i];
     else if (a === "--config" || a === "-c") configPath = args[++i];
     else if (a === "--manifest" || a === "-m") manifestPath = args[++i];
     else if (a === "--help" || a === "-h") {
-      console.log(`oke docker [--prod|-p] [--out|-o docker] [--config|-c oke.config.ts]
+      console.log(`oke docker [options]
 
-Derive Dockerfile + compose.<role>.yml under docker/ (default).
---prod is opt-in (never the default). Credentials are never written into YAML.
+Derive production-grade Docker artefacts under docker/ (default).
+
+Layouts (mutually exclusive; default --single):
+  --single          docker-compose.yml + Dockerfile (+ .env.docker via oke dev)
+  --split           compose.yml + compose.<role>.yml (+ compose.prod.yml)
+  --stack           docker-stack.yml for docker stack deploy
+
+Server budget (sizes deploy.resources; default 4 CPU / 8 GiB):
+  --cpus <n>        host CPUs
+  --memory <gib>    host RAM in GiB
+
+Other:
+  --prod / -p       production overlays (default on)
+  --no-prod         skip readiness / deploy / resource budget
+  --out / -o        output directory (default docker)
+  --config / -c     oke.config.ts path
+  --manifest / -m   Manifest path
+
+Credentials are never written into YAML. PgDog configs land in docker/pgdog/.
 
 ${dockerCleanHelp()}`);
       return EXIT_OK;
@@ -149,10 +206,28 @@ ${dockerCleanHelp()}`);
       console.error(`oke docker: unknown subcommand ${a}`);
       console.error("Run `oke docker --help` for usage.");
       return 1;
+    } else {
+      console.error(`oke docker: unknown flag ${a}`);
+      console.error("Run `oke docker --help` for usage.");
+      return 1;
+    }
+  }
+  {
+    const layoutFlags = [
+      args.includes("--split"),
+      args.includes("--stack"),
+      args.includes("--single"),
+    ].filter(Boolean).length;
+    if (layoutFlags > 1) {
+      console.error("oke docker: use only one of --single, --split, --stack");
+      return 1;
     }
   }
   const { code } = await runDockerDerive({
     prod,
+    layout,
+    serverCpus,
+    serverMemoryGb,
     outDir,
     configPath,
     manifestPath,

package/src/cli/doctor.test.ts

@@ -84,6 +84,46 @@ describe("oke doctor", () => {
     expect(findings).toHaveLength(0);
   });
 
+  test("fails closed in prod when builtin vault master key is env-sourced", async () => {
+    const { code, findings } = await runDoctor({
+      secrets: [],
+      ports: [],
+      isPortInUse: async () => false,
+      skipDbDrift: true,
+      configEnv: "prod",
+      driversConfig: {
+        vault: { dev: "vault", test: "memory", prod: "vault" },
+      },
+      vaultConfig: {
+        encryption: { masterKey: { kind: "env", name: "OKE_VAULT_MASTER_KEY" } },
+      },
+      write: () => {},
+    });
+    expect(code).toBe(2);
+    const finding = findings.find((f) => f.code === "vault_master_key");
+    expect(finding?.severity).toBe("error");
+    expect(finding?.message).toContain("environment variable");
+  });
+
+  test("NODE_ENV=production selects prod env for the vault master-key gate", async () => {
+    const { code, findings } = await runDoctor({
+      secrets: [],
+      ports: [],
+      isPortInUse: async () => false,
+      skipDbDrift: true,
+      env: (k) => (k === "NODE_ENV" ? "production" : undefined),
+      driversConfig: {
+        vault: { dev: "vault", test: "memory", prod: "vault" },
+      },
+      vaultConfig: {
+        encryption: { masterKey: { kind: "env", name: "OKE_VAULT_MASTER_KEY" } },
+      },
+      write: () => {},
+    });
+    expect(code).toBe(2);
+    expect(findings.some((f) => f.code === "vault_master_key")).toBe(true);
+  });
+
   test("fails with flow name when PII reaches unguarded ask", async () => {
     const manifest: Manifest = {
       oke: "1.0",

package/src/cli/doctor.ts

@@ -3,7 +3,13 @@
  */
 
 import { resolve } from "node:path";
-import type { ConfigEnv, DriverRef, DriversConfig, EnvDriverMap } from "../config/index.ts";
+import type {
+  ConfigEnv,
+  DriverRef,
+  DriversConfig,
+  EnvDriverMap,
+  VaultElementConfig,
+} from "../config/index.ts";
 import { resolveEffectiveDrivers, type EffectiveDriversConfig } from "../config/driver-defaults.ts";
 import type { Manifest } from "../manifest/types.ts";
 import { APP_PORT, CONSOLE_PORT, MCP_PORT } from "../runtime/types.ts";
@@ -61,7 +67,7 @@ function formatDriversSummary(drivers: EffectiveDriversConfig, configEnv: Config
   const lines = [`drivers (env=${configEnv}):`];
   for (const [name, map] of rows) {
     const active = driverRefId(map[configEnv]);
-    const full = `local=${driverRefId(map.local)} docker=${driverRefId(map.docker)} test=${driverRefId(map.test)} prod=${driverRefId(map.prod)}`;
+    const full = `dev=${driverRefId(map.dev)} test=${driverRefId(map.test)} prod=${driverRefId(map.prod)}`;
     lines.push(`  ${name.padEnd(nameWidth)}  ${active.padEnd(activeWidth)}  { ${full} }`);
   }
   return lines.join("\n");
@@ -76,7 +82,8 @@ export interface DoctorFinding {
     | "db_drift"
     | "tenancy"
     | "driver"
-    | "pii_ask";
+    | "pii_ask"
+    | "vault_master_key";
   readonly severity: "error" | "warn";
   readonly message: string;
 }
@@ -116,9 +123,13 @@ export interface DoctorOptions {
    */
   readonly driversConfig?: DriversConfig;
   /**
-   * Active {@link ConfigEnv} for the drivers summary. Default: `docker` when
-   * `OKE_DOCKER=1` (via {@link env}), else `local` — the same resolution
-   * `oke boot` uses without an explicit `env`.
+   * Inject the `vault` block directly (tests). When omitted, it is read
+   * from the same best-effort `oke.config.ts` load as {@link driversConfig}.
+   */
+  readonly vaultConfig?: VaultElementConfig;
+  /**
+   * Active {@link ConfigEnv} for the drivers summary. Default: `dev` when
+   * `OKE_DOCKER=1` (via {@link env}), else `test`.
    */
   readonly configEnv?: ConfigEnv;
   readonly write?: (text: string) => void;
@@ -161,15 +172,20 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
   // Fully-resolved `drivers.*` — real defaults + every override merged, so
   // the picture is complete even when `oke.config.ts` only pins one key.
   let driversConfig = options.driversConfig;
-  if (driversConfig === undefined) {
+  let vaultConfig = options.vaultConfig;
+  if (driversConfig === undefined || vaultConfig === undefined) {
     try {
-      driversConfig = (await loadOkeConfig(cwd)).config.drivers;
+      const loaded = (await loadOkeConfig(cwd)).config;
+      driversConfig ??= loaded.drivers;
+      vaultConfig ??= loaded.vault;
     } catch {
       // No oke.config.ts (or it failed to load) — show real defaults only.
     }
   }
+  // Match `bootApplication`: production NODE_ENV → prod; compose → dev; else test.
   const configEnv: ConfigEnv =
-    options.configEnv ?? (env("OKE_DOCKER") === "1" ? "docker" : "local");
+    options.configEnv ??
+    (env("NODE_ENV") === "production" ? "prod" : env("OKE_DOCKER") === "1" ? "dev" : "test");
   const effectiveDrivers = resolveEffectiveDrivers(driversConfig);
 
   for (const name of secretNames) {
@@ -184,6 +200,25 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
     }
   }
 
+  // An env-var master key is only as protected as the process environment:
+  // it lands in shell history, orchestrator manifests, and crash dumps.
+  const usesBuiltinVault =
+    vaultConfig !== undefined || driverRefId(effectiveDrivers.vault[configEnv]) === "vault";
+  if (
+    configEnv === "prod" &&
+    usesBuiltinVault &&
+    (vaultConfig?.encryption?.masterKey?.kind ?? "env") === "env"
+  ) {
+    findings.push({
+      code: "vault_master_key",
+      // Fail closed in prod: an env-sourced master key collapses envelope
+      // protection the moment DB + env are stolen together.
+      severity: "error",
+      message:
+        'vault master key comes from an environment variable in prod — set vault.encryption.masterKey = { kind: "kms", keyId } (or use managed aws-secrets-manager) so the key is never readable from the process environment',
+    });
+  }
+
   const ports = options.ports ?? [APP_PORT, CONSOLE_PORT, MCP_PORT];
   const probe = options.isPortInUse ?? isPortInUse;
   for (const port of ports) {
@@ -213,13 +248,13 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
         code: "schema_drift",
         severity: "error",
         message:
-          "core stub schema drift — run `oke schema generate` (schema/oke.ts; not domain migrations)",
+          "core stub schema drift — run `oke schema generate` (.oke/schema/oke.ts; not domain migrations)",
       });
     } else if (expected !== null && current === null) {
       findings.push({
         code: "schema_drift",
         severity: "error",
-        message: "schema/oke.ts missing — run `oke schema generate` (core/plugin stubs)",
+        message: ".oke/schema/oke.ts missing — run `oke schema generate` (core/plugin stubs)",
       });
     }
   }
@@ -237,7 +272,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
           severity: "error",
           message:
             drift.detail ??
-            "domain schema differs from the database — run `oke db generate` then `oke db migrate` (or `oke db push` in local)",
+            "domain schema differs from the database — run `oke db generate` then `oke db migrate` (or `oke db push` in dev)",
         });
       }
     }
@@ -299,18 +334,23 @@ export async function doctorCli(args: readonly string[]): Promise<number> {
     if (a === "--manifest" || a === "-m") manifestPath = args[++i];
     else if (a === "--env" || a === "-e") {
       const value = args[++i];
-      if (value === "local" || value === "docker" || value === "test" || value === "prod") {
+      if (value === "dev" || value === "test" || value === "prod") {
         configEnv = value;
+      } else if (value === "local") {
+        configEnv = "test";
+      } else if (value === "docker") {
+        configEnv = "dev";
       }
     } else if (a === "--help" || a === "-h") {
-      console.log(`oke doctor [--manifest|-m path] [--env|-e local|docker|test|prod] [--json|-j]
+      console.log(`oke doctor [--manifest|-m path] [--env|-e dev|test|prod] [--json|-j]
 oke doctor --diff|-d [--before|-b <path> --after|-a <path>] [--base|-B <branch>]
 
 Verify secrets, ports, schema drift, and PII→model egress before serving.
 Also prints drivers.* fully resolved (every default + every override merged)
 for the active env, from oke.config.ts.
 
---env   Env to resolve drivers for (default: docker when OKE_DOCKER=1, else local).
+--env   Env to resolve drivers for (default: prod when NODE_ENV=production,
+        dev when OKE_DOCKER=1 / \`oke dev\`, else test).
 --diff  CI gate: block undeclared contract breaks (Manifest Diff).
         Default baseline is git merge-base (main/master) vs the working
         tree; pass --before/--after for an explicit comparison.

package/src/cli/drizzle-env.test.ts

@@ -24,22 +24,20 @@ async function tempDir(): Promise<string> {
 const dualConfig = {
   drivers: {
     store: {
-      sql: { local: "sqlite", docker: "postgres", prod: "postgres", test: "memory" },
+      sql: { dev: "postgres", test: "pglite", prod: "postgres" },
     },
   },
 } as unknown as OkeConfig;
 
 describe("resolveDrizzleKitEnv", () => {
-  test("local env → sqlite dialect + sqlite url", async () => {
+  test("test env → postgresql dialect (pglite)", async () => {
     const dir = await tempDir();
-    const ctx = await resolveDrizzleKitEnv(dir, dualConfig, "local");
-    expect(ctx.dialect).toBe("sqlite");
-    expect(ctx.overlay.OKE_DRIZZLE_DIALECT).toBe("sqlite");
-    expect(ctx.overlay.OKE_SQLITE_URL).toContain(".oke/app.sqlite");
-    expect(ctx.overlay.DATABASE_URL).toBeUndefined();
+    const ctx = await resolveDrizzleKitEnv(dir, dualConfig, "test");
+    expect(ctx.dialect).toBe("postgresql");
+    expect(ctx.overlay.OKE_DRIZZLE_DIALECT).toBe("postgresql");
   });
 
-  test("docker env → postgresql dialect + DATABASE_URL from compose env", async () => {
+  test("dev env → postgresql dialect + DATABASE_URL from compose env", async () => {
     const dir = await tempDir();
     await mkdir(join(dir, "docker"), { recursive: true });
     await writeFile(
@@ -49,7 +47,7 @@ describe("resolveDrizzleKitEnv", () => {
     const prevDb = process.env["DATABASE_URL"];
     delete process.env["DATABASE_URL"];
     try {
-      const ctx = await resolveDrizzleKitEnv(dir, dualConfig, "docker");
+      const ctx = await resolveDrizzleKitEnv(dir, dualConfig, "dev");
       expect(ctx.dialect).toBe("postgresql");
       expect(ctx.overlay.OKE_DRIZZLE_DIALECT).toBe("postgresql");
       expect(ctx.overlay.DATABASE_URL).toBe("postgres://u:p@127.0.0.1:5432/oke");
@@ -60,16 +58,16 @@ describe("resolveDrizzleKitEnv", () => {
     }
   });
 
-  test("docker dialect is postgresql even when DATABASE_URL unset (no URL guessing)", async () => {
+  test("dev dialect is postgresql even when DATABASE_URL unset (no URL guessing)", async () => {
     const dir = await tempDir();
-    const ctx = await resolveDrizzleKitEnv(dir, dualConfig, "docker");
+    const ctx = await resolveDrizzleKitEnv(dir, dualConfig, "dev");
     expect(ctx.dialect).toBe("postgresql");
   });
 
   test("unsupported driver id errors clearly", async () => {
     const dir = await tempDir();
-    const bad = { drivers: { store: { sql: { local: "memory" } } } } as unknown as OkeConfig;
-    await expect(resolveDrizzleKitEnv(dir, bad, "local")).rejects.toThrow(/not supported/);
+    const bad = { drivers: { store: { sql: { test: "memory" } } } } as unknown as OkeConfig;
+    await expect(resolveDrizzleKitEnv(dir, bad, "test")).rejects.toThrow(/not supported/);
   });
 });