okengine 0.10.3 → 0.11.0

package/src/kernel/boot-bind/honor-config.test.ts

@@ -37,11 +37,11 @@ describe("boot binders honour drivers.* config", () => {
     process.env.APP_NAME = "honor-config";
     try {
       const result = await bootApplication({
-        env: "local",
+        env: "test",
         secrets: [vault.config("APP_NAME", { description: "app" })],
         config: {
           drivers: {
-            vault: { local: "env", docker: "openbao", test: "memory", prod: "openbao" },
+            vault: { test: "env" },
           },
         },
       });
@@ -58,21 +58,17 @@ describe("boot binders honour drivers.* config", () => {
     }
   });
 
-  test("vault: drivers.vault openbao with credentials selects openbao layer", () => {
-    process.env.OKE_VAULT_URL = "http://127.0.0.1:8200";
-    process.env.OKE_VAULT_TOKEN = "test-token";
+  test("vault: drivers.vault vault selects built-in layer behind env", () => {
     const chain = buildVaultBootChain({
-      driverId: "openbao",
-      env: "local",
-      missingOpenbao: "throw",
+      driverId: "vault",
+      env: "test",
     });
-    expect(chain.map((l) => l.driver.id)).toContain("openbao");
+    expect(chain.map((l) => l.driver.id)).toContain("vault");
     expect(chain.map((l) => l.driver.id)).toContain("env");
   });
 
-  test("vault: openbao without credentials fails loud in prod", async () => {
-    delete process.env.OKE_VAULT_URL;
-    delete process.env.OKE_VAULT_TOKEN;
+  test("vault: unknown driver id fails loud at boot", async () => {
+    const removed = ["open", "bao"].join("");
     await expect(
       bootApplication({
         env: "prod",
@@ -80,21 +76,23 @@ describe("boot binders honour drivers.* config", () => {
         vault: { allowDevFallbacks: true },
         config: {
           drivers: {
-            vault: { prod: "openbao" },
+            vault: { prod: removed },
           },
         },
       }),
-    ).rejects.toThrow(/openbao.*OKE_VAULT_URL/);
+    ).rejects.toThrow(/unknown vault driver/);
   });
 
   test("clock: drivers.clock memory binds memory CronStore", async () => {
+    // `test` env always forces frozen — pin under `dev` to honour memory.
     const result = await bootApplication({
-      env: "local",
+      env: "dev",
       startScheduler: false,
       clocks: [clock("tick", { every: "1h" })],
       config: {
         drivers: {
-          clock: { local: "memory", docker: "file", test: "frozen", prod: "file" },
+          clock: { dev: "memory" },
+          store: { sql: { dev: "memory" }, kv: { dev: "memory" } },
         },
       },
     });
@@ -110,12 +108,13 @@ describe("boot binders honour drivers.* config", () => {
     tmp = await mkdtemp(join(tmpdir(), "oke-clock-file-"));
     process.chdir(tmp);
     const result = await bootApplication({
-      env: "local",
+      env: "dev",
       startScheduler: false,
       clocks: [clock("tick", { every: "1h" })],
       config: {
         drivers: {
-          clock: { local: "file", docker: "file", test: "frozen", prod: "file" },
+          clock: { dev: "file" },
+          store: { sql: { dev: "memory" }, kv: { dev: "memory" } },
         },
       },
     });
@@ -135,12 +134,13 @@ describe("boot binders honour drivers.* config", () => {
     try {
       await expect(
         bootApplication({
-          env: "local",
+          env: "dev",
           startScheduler: false,
           clocks: [clock("tick", { every: "1h" })],
           config: {
             drivers: {
-              clock: { local: "postgres" },
+              clock: { dev: "postgres" },
+              store: { sql: { dev: "memory" }, kv: { dev: "memory" } },
             },
           },
         }),
@@ -155,7 +155,7 @@ describe("boot binders honour drivers.* config", () => {
 
   test("journal: durable flow binds memory journal by default", async () => {
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       startScheduler: false,
       flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
     });
@@ -170,7 +170,7 @@ describe("boot binders honour drivers.* config", () => {
 
   test("journal: no durable flow → no journal runtime", async () => {
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       startScheduler: false,
       flows: [flow("plain", { do: () => ({ ok: true }) })],
     });
@@ -185,12 +185,12 @@ describe("boot binders honour drivers.* config", () => {
     tmp = await mkdtemp(join(tmpdir(), "oke-journal-file-"));
     process.chdir(tmp);
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       startScheduler: false,
       flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
       config: {
         drivers: {
-          journal: { local: "file", docker: "postgres", test: "memory", prod: "postgres" },
+          journal: { test: "file" },
         },
       },
     });
@@ -209,12 +209,12 @@ describe("boot binders honour drivers.* config", () => {
     try {
       await expect(
         bootApplication({
-          env: "local",
+          env: "test",
           startScheduler: false,
           flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
           config: {
             drivers: {
-              journal: { local: "postgres" },
+              journal: { test: "postgres" },
             },
           },
         }),
@@ -230,12 +230,12 @@ describe("boot binders honour drivers.* config", () => {
   test("journal: unknown driver fails loud", async () => {
     await expect(
       bootApplication({
-        env: "local",
+        env: "test",
         startScheduler: false,
         flows: [flow("charge", { durable: true, do: () => ({ ok: true }) })],
         config: {
           drivers: {
-            journal: { local: "neon" },
+            journal: { test: "neon" },
           },
         },
       }),
@@ -245,13 +245,13 @@ describe("boot binders honour drivers.* config", () => {
   test("gate: drivers.store.kv redis opens redis-backed oke:gates", async () => {
     const fake = createRedisFakeClient();
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       gates: [gate.rate({ max: 10, per: "1m" })],
       clients: { kv: fake },
       config: {
         drivers: {
           store: {
-            kv: { local: "redis", docker: "redis", prod: "redis" },
+            kv: { test: "redis", dev: "redis", prod: "redis" },
           },
         },
       },
@@ -268,12 +268,12 @@ describe("boot binders honour drivers.* config", () => {
     delete process.env.OKE_STORE_KV_URL;
     await expect(
       bootApplication({
-        env: "local",
+        env: "test",
         gates: [gate.rate({ max: 10, per: "1m" })],
         config: {
           drivers: {
             store: {
-              kv: { local: "redis", docker: "redis", prod: "redis" },
+              kv: { test: "redis", dev: "redis", prod: "redis" },
             },
           },
         },
@@ -283,12 +283,12 @@ describe("boot binders honour drivers.* config", () => {
 
   test("gate: drivers.store.kv memory keeps memory oke:gates", async () => {
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       gates: [gate.rate({ max: 10, per: "1m" })],
       config: {
         drivers: {
           store: {
-            kv: { local: "memory", docker: "redis", prod: "redis" },
+            kv: { dev: "redis", test: "memory", prod: "redis" },
           },
         },
       },
@@ -302,11 +302,11 @@ describe("boot binders honour drivers.* config", () => {
 
   test("signal: drivers.signal memory binds memory", async () => {
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       signals: [signal("ping", { delivery: "once" })],
       config: {
         drivers: {
-          signal: { local: "memory", docker: "redis", prod: "redis" },
+          signal: { dev: "redis", test: "memory", prod: "redis" },
         },
       },
     });
@@ -320,12 +320,12 @@ describe("boot binders honour drivers.* config", () => {
   test("signal: drivers.signal redis binds redis", async () => {
     const fake = createSignalRedisFake();
     const result = await bootApplication({
-      env: "local",
+      env: "test",
       signals: [signal("ping", { delivery: "once" })],
       clients: { signalRedis: fake },
       config: {
         drivers: {
-          signal: { local: "redis", docker: "redis", prod: "redis" },
+          signal: { test: "redis", dev: "redis", prod: "redis" },
         },
       },
     });
@@ -339,11 +339,11 @@ describe("boot binders honour drivers.* config", () => {
   test("signal: drivers.signal postgres fails loud (never silent memory)", async () => {
     await expect(
       bootApplication({
-        env: "local",
+        env: "test",
         signals: [signal("ping", { delivery: "once" })],
         config: {
           drivers: {
-            signal: { local: "postgres" },
+            signal: { test: "postgres" },
           },
         },
       }),
@@ -353,11 +353,11 @@ describe("boot binders honour drivers.* config", () => {
   test("signal: drivers.signal nats fails loud", async () => {
     await expect(
       bootApplication({
-        env: "local",
+        env: "test",
         signals: [signal("ping", { delivery: "once" })],
         config: {
           drivers: {
-            signal: { local: "nats" },
+            signal: { test: "nats" },
           },
         },
       }),

package/src/kernel/boot-bind/journal.ts

@@ -66,8 +66,8 @@ export async function bindJournal(
     const url = process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL ?? undefined;
     if (!url) {
       throw new Error(
-        env === "docker"
-          ? 'oke boot: journal driver "postgres" needs DATABASE_URL (did `oke dev -d` write docker/.env.docker?)'
+        env === "dev"
+          ? 'oke boot: journal driver "postgres" needs DATABASE_URL (did `oke dev` write docker/.env.docker?)'
           : 'oke boot: journal driver "postgres" needs DATABASE_URL',
       );
     }

package/src/kernel/boot-bind/store.test.ts

@@ -36,66 +36,65 @@ describe("bindStore driver resolution", () => {
     else process.env.OKE_INDEX_DRIVER = prev.index;
   });
 
-  test("local env keeps sqlite / memory from config", () => {
+  test("test env keeps pglite / memory / fs from config", () => {
     const options = {
       config: {
         drivers: {
           store: {
-            sql: { local: "sqlite", docker: "postgres", prod: "postgres" },
-            kv: { local: "memory", docker: "redis", prod: "redis" },
-            files: { local: "fs", docker: "s3", prod: "s3" },
+            sql: { dev: "postgres", test: "pglite", prod: "postgres" },
+            kv: { dev: "redis", test: "memory", prod: "redis" },
+            files: { dev: "s3", test: "fs", prod: "s3" },
           },
         },
       },
     };
-    expect(resolveSqlDriverId(options, "local", false)).toBe("sqlite");
-    expect(resolveKvDriverId(options, "local", false)).toBe("memory");
-    expect(resolveFilesDriverId(options, "local", false)).toBe("fs");
+    expect(resolveSqlDriverId(options, "test", false)).toBe("pglite");
+    expect(resolveKvDriverId(options, "test", false)).toBe("memory");
+    expect(resolveFilesDriverId(options, "test", false)).toBe("fs");
   });
 
-  test("docker env uses docker profile (falls back to prod)", () => {
+  test("dev env uses compose profile (falls back to prod)", () => {
     const options = {
       config: {
         drivers: {
           store: {
-            sql: { local: "sqlite", docker: "postgres", prod: "postgres" },
-            kv: { local: "memory", prod: "redis" },
-            files: { local: "fs", prod: "s3" },
+            sql: { dev: "postgres", test: "pglite", prod: "postgres" },
+            kv: { dev: "redis", test: "memory", prod: "redis" },
+            files: { dev: "s3", test: "fs", prod: "s3" },
           },
         },
       },
     };
-    expect(resolveSqlDriverId(options, "docker", true)).toBe("postgres");
-    expect(resolveKvDriverId(options, "docker", true)).toBe("redis");
-    expect(resolveFilesDriverId(options, "docker", true)).toBe("s3");
+    expect(resolveSqlDriverId(options, "dev", true)).toBe("postgres");
+    expect(resolveKvDriverId(options, "dev", true)).toBe("redis");
+    expect(resolveFilesDriverId(options, "dev", true)).toBe("s3");
   });
 
   test("docker mode honours OKE_*_DRIVER overrides", () => {
     process.env.OKE_SQL_DRIVER = "postgres";
     process.env.OKE_KV_DRIVER = "redis";
     process.env.OKE_FILES_DRIVER = "s3";
-    expect(resolveSqlDriverId({}, "docker", true)).toBe("postgres");
-    expect(resolveKvDriverId({}, "docker", true)).toBe("redis");
-    expect(resolveFilesDriverId({}, "docker", true)).toBe("s3");
+    expect(resolveSqlDriverId({}, "dev", true)).toBe("postgres");
+    expect(resolveKvDriverId({}, "dev", true)).toBe("redis");
+    expect(resolveFilesDriverId({}, "dev", true)).toBe("s3");
   });
 
-  test("pinning only `local` never leaks into docker/test/prod — each keeps its real default", () => {
+  test("pinning only `test` never leaks into dev/prod — each keeps its real default", () => {
     const options = {
       config: {
         drivers: {
           store: {
-            sql: { local: "pglite" },
+            sql: { test: "pglite" },
           },
         },
       },
     };
-    expect(resolveSqlDriverId(options, "local", false)).toBe("pglite");
-    expect(resolveSqlDriverId(options, "docker", true)).toBe("postgres");
-    expect(resolveSqlDriverId(options, "test", false)).toBe("memory");
+    expect(resolveSqlDriverId(options, "test", false)).toBe("pglite");
+    expect(resolveSqlDriverId(options, "dev", true)).toBe("postgres");
     expect(resolveSqlDriverId(options, "prod", true)).toBe("postgres");
     // kv / files are untouched by the sql-only override.
-    expect(resolveKvDriverId(options, "local", false)).toBe("memory");
-    expect(resolveKvDriverId(options, "docker", true)).toBe("redis");
+    expect(resolveKvDriverId(options, "test", false)).toBe("memory");
+    expect(resolveKvDriverId(options, "dev", true)).toBe("redis");
   });
 });
 
@@ -118,12 +117,12 @@ describe("bindStore files fs multi-instance warn", () => {
           config: {
             drivers: {
               store: {
-                files: { local: "fs", docker: "s3", prod: "s3" },
+                files: { dev: "s3", test: "fs", prod: "s3" },
               },
             },
           },
         },
-        "local",
+        "test",
         () => Date.now(),
         false,
       );
@@ -133,12 +132,12 @@ describe("bindStore files fs multi-instance warn", () => {
           config: {
             drivers: {
               store: {
-                files: { local: "fs", docker: "s3", prod: "s3" },
+                files: { dev: "s3", test: "fs", prod: "s3" },
               },
             },
           },
         },
-        "local",
+        "test",
         () => Date.now(),
         false,
       );
@@ -162,12 +161,12 @@ describe("bindStore files fs multi-instance warn", () => {
           config: {
             drivers: {
               store: {
-                files: { local: "memory", docker: "s3", prod: "s3" },
+                files: { dev: "s3", test: "memory", prod: "s3" },
               },
             },
           },
         },
-        "local",
+        "test",
         () => Date.now(),
         false,
       );
@@ -187,8 +186,8 @@ describe("bindStore index driver resolution", () => {
   });
 
   test("defaults to memory when no index driver is configured", () => {
-    expect(resolveIndexDriverId({}, "local", false)).toBe("memory");
-    expect(resolveIndexDriverId({}, "docker", true)).toBe("memory");
+    expect(resolveIndexDriverId({}, "test", false)).toBe("memory");
+    expect(resolveIndexDriverId({}, "dev", true)).toBe("memory");
     expect(indexDriverFor("memory").id).toBe("memory");
   });
 
@@ -197,37 +196,37 @@ describe("bindStore index driver resolution", () => {
       config: {
         drivers: {
           store: {
-            index: { local: "memory", docker: "pgvector", prod: "pgvector" },
+            index: { dev: "pgvector", test: "memory", prod: "pgvector" },
           },
         },
       },
     };
-    expect(resolveIndexDriverId(options, "local", false)).toBe("memory");
-    expect(resolveIndexDriverId(options, "docker", true)).toBe("pgvector");
+    expect(resolveIndexDriverId(options, "test", false)).toBe("memory");
+    expect(resolveIndexDriverId(options, "dev", true)).toBe("pgvector");
     expect(resolveIndexDriverId(options, "prod", false)).toBe("pgvector");
   });
 
-  test("libsql resolves from config", () => {
+  test("pgvector resolves from config", () => {
     const options = {
-      config: { drivers: { store: { index: { local: "libsql" } } } },
+      config: { drivers: { store: { index: { test: "pgvector" } } } },
     };
-    expect(resolveIndexDriverId(options, "local", false)).toBe("libsql");
-    expect(indexDriverFor("libsql").id).toBe("libsql");
+    expect(resolveIndexDriverId(options, "test", false)).toBe("pgvector");
+    expect(indexDriverFor("pgvector").id).toBe("pgvector");
   });
 
   test("meilisearch resolves from config as a fourth id", () => {
     const options = {
-      config: { drivers: { store: { index: { local: "meilisearch", docker: "meilisearch" } } } },
+      config: { drivers: { store: { index: { dev: "meilisearch", test: "meilisearch" } } } },
     };
-    expect(resolveIndexDriverId(options, "local", false)).toBe("meilisearch");
-    expect(resolveIndexDriverId(options, "docker", true)).toBe("meilisearch");
+    expect(resolveIndexDriverId(options, "test", false)).toBe("meilisearch");
+    expect(resolveIndexDriverId(options, "dev", true)).toBe("meilisearch");
     expect(indexDriverFor("meilisearch").id).toBe("meilisearch");
   });
 
   test("docker mode honours OKE_INDEX_DRIVER override", () => {
     process.env.OKE_INDEX_DRIVER = "pgvector";
-    expect(resolveIndexDriverId({}, "docker", true)).toBe("pgvector");
-    expect(resolveIndexDriverId({}, "local", false)).toBe("memory");
+    expect(resolveIndexDriverId({}, "dev", true)).toBe("pgvector");
+    expect(resolveIndexDriverId({}, "test", false)).toBe("memory");
   });
 
   test("indexDriverFor returns the configured driver and throws on unknown ids", () => {

package/src/kernel/boot-bind/store.ts

@@ -4,13 +4,11 @@
 
 import { resolveDomainDdlMode, resolveDriverId, type ConfigEnv } from "../../config/index.ts";
 import {
-  dockerFlagDefaults,
   STORE_FILES_DEFAULTS,
   STORE_KV_DEFAULTS,
   STORE_SQL_DEFAULTS,
 } from "../../config/driver-defaults.ts";
 import { fsDriver } from "../../drivers/fs.ts";
-import { libsqlDriver, libsqlIndexDriver } from "../../drivers/libsql.ts";
 import { meilisearchDriver } from "../../drivers/meilisearch.ts";
 import { memoryDrivers } from "../../drivers/memory.ts";
 import { pgliteDriver } from "../../drivers/pglite.ts";
@@ -18,7 +16,6 @@ import { pgvectorDriver } from "../../drivers/pgvector.ts";
 import { postgresDriver } from "../../drivers/postgres.ts";
 import { redisDriver } from "../../drivers/redis.ts";
 import { s3Driver } from "../../drivers/s3.ts";
-import { sqliteDriver } from "../../drivers/sqlite.ts";
 import type { FilesDriver, IndexDriver, KvDriver, SqlDriver } from "../../drivers/types.ts";
 import { createStoreRuntime, type StoreRuntime } from "../../elements/store.ts";
 import type { StoreDecl } from "../../elements/store/declare.ts";
@@ -28,8 +25,8 @@ import type { BootOptions } from "../boot.ts"; // type-only — no cycle at runt
 /**
  * Construct a Store runtime and register facet declarations.
  *
- * In docker mode (`env === "docker"` / `OKE_DOCKER=1`), SQL/KV resolve from the
- * `docker` driver map (falling back to `prod`) and URLs from `docker/.env.docker`.
+ * With compose infra (`OKE_DOCKER=1` / `oke dev`), SQL/KV URLs come from
+ * `docker/.env.docker`. `env: "test"` uses PGLite (`memory://` by default).
  *
  * @param options - Boot options
  * @param env - Active environment
@@ -68,7 +65,7 @@ export function bindStore(
   const filesId = resolveFilesDriverId(options, env, docker);
   const indexId = resolveIndexDriverId(options, env, docker);
   if (filesId === "fs") warnFilesFsMultiInstance();
-  const sqlUrl = sqlUrlFor(sqlId, docker);
+  const sqlUrl = sqlUrlFor(sqlId, docker, env);
   const kvUrl = kvUrlFor(kvId, docker);
   const filesRoot = filesRootFor(filesId);
 
@@ -145,11 +142,7 @@ export function resolveSqlDriverId(options: BootOptions, env: ConfigEnv, docker:
   const fromEnv = process.env.OKE_SQL_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
   // Defaults cover every ConfigEnv key, so this is never undefined.
-  return resolveDriverId(
-    options.config?.drivers?.store?.sql,
-    env,
-    dockerFlagDefaults(STORE_SQL_DEFAULTS, docker),
-  )!;
+  return resolveDriverId(options.config?.drivers?.store?.sql, env, STORE_SQL_DEFAULTS)!;
 }
 
 /**
@@ -161,11 +154,7 @@ export function resolveKvDriverId(options: BootOptions, env: ConfigEnv, docker:
   const fromEnv = process.env.OKE_KV_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
   // Defaults cover every ConfigEnv key, so this is never undefined.
-  return resolveDriverId(
-    options.config?.drivers?.store?.kv,
-    env,
-    dockerFlagDefaults(STORE_KV_DEFAULTS, docker),
-  )!;
+  return resolveDriverId(options.config?.drivers?.store?.kv, env, STORE_KV_DEFAULTS)!;
 }
 
 /**
@@ -181,17 +170,13 @@ export function resolveFilesDriverId(
   const fromEnv = process.env.OKE_FILES_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
   // Defaults cover every ConfigEnv key, so this is never undefined.
-  return resolveDriverId(
-    options.config?.drivers?.store?.files,
-    env,
-    dockerFlagDefaults(STORE_FILES_DEFAULTS, docker),
-  )!;
+  return resolveDriverId(options.config?.drivers?.store?.files, env, STORE_FILES_DEFAULTS)!;
 }
 
 /**
  * Index driver — same resolution chain as sql/kv/files. Defaults to `memory`;
- * a configured `pgvector` / `libsql` is honoured at real boot (and fails loud
- * if its SQL engine or peer is missing — never silently back to memory).
+ * a configured `pgvector` is honoured at real boot (and fails loud if its
+ * SQL engine or peer is missing — never silently back to memory).
  *
  * @param options - Boot options
  * @param env - Active env
@@ -213,10 +198,6 @@ function sqlDriverFor(id: string): SqlDriver {
   switch (id) {
     case "postgres":
       return postgresDriver;
-    case "sqlite":
-      return sqliteDriver;
-    case "libsql":
-      return libsqlDriver;
     case "pglite":
       return pgliteDriver;
     case "memory":
@@ -260,8 +241,6 @@ export function indexDriverFor(id: string): IndexDriver {
       return memoryDrivers.index;
     case "pgvector":
       return pgvectorDriver;
-    case "libsql":
-      return libsqlIndexDriver;
     case "meilisearch":
       return meilisearchDriver;
     default:
@@ -269,28 +248,24 @@ export function indexDriverFor(id: string): IndexDriver {
   }
 }
 
-function sqlUrlFor(sqlId: string, docker: boolean): string {
+function sqlUrlFor(sqlId: string, docker: boolean, env: ConfigEnv): string {
   if (sqlId === "postgres") {
     const url = process.env.DATABASE_URL ?? process.env.OKE_STORE_SQL_URL ?? undefined;
     if (!url) {
       throw new Error(
         docker
-          ? "oke boot: postgres driver needs DATABASE_URL (did `oke dev -d` write docker/.env.docker?)"
+          ? "oke boot: postgres driver needs DATABASE_URL (did `oke dev` write docker/.env.docker?)"
           : "oke boot: postgres driver needs DATABASE_URL",
       );
     }
     return url;
   }
-  if (sqlId === "sqlite") {
-    return process.env.OKE_SQLITE_URL ?? ".oke/app.sqlite";
-  }
-  if (sqlId === "libsql") {
-    return process.env.OKE_LIBSQL_URL ?? ".oke/app.libsql";
-  }
   if (sqlId === "pglite") {
-    return process.env.OKE_PGLITE_URL ?? ".oke/pgdata";
+    return process.env.OKE_PGLITE_URL ?? (env === "test" ? "memory://" : ".oke/pgdata");
   }
-  return ":memory:";
+  // In-process `memory` SQL driver ignores URL; keep a non-path token so a
+  // mis-wired pglite connect never creates a literal `./:memory:` datadir.
+  return "memory://";
 }
 
 function kvUrlFor(kvId: string, docker: boolean): string | undefined {
@@ -299,7 +274,7 @@ function kvUrlFor(kvId: string, docker: boolean): string | undefined {
   if (!url) {
     throw new Error(
       docker
-        ? "oke boot: redis driver needs REDIS_URL (did `oke dev -d` write docker/.env.docker?)"
+        ? "oke boot: redis driver needs REDIS_URL (did `oke dev` write docker/.env.docker?)"
         : "oke boot: redis driver needs REDIS_URL",
     );
   }
@@ -317,7 +292,7 @@ function indexUrlFor(docker: boolean): string {
   if (!url) {
     throw new Error(
       docker
-        ? "oke boot: meilisearch index needs OKE_STORE_INDEX_URL (did `oke dev -d` write docker/.env.docker?)"
+        ? "oke boot: meilisearch index needs OKE_STORE_INDEX_URL (did `oke dev` write docker/.env.docker?)"
         : "oke boot: meilisearch index needs OKE_STORE_INDEX_URL",
     );
   }

package/src/kernel/boot-bind/vault.ts

@@ -4,7 +4,13 @@
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
 import { VAULT_DEFAULTS } from "../../config/driver-defaults.ts";
-import { createVaultRuntime, type VaultRuntime } from "../../elements/vault.ts";
+import {
+  createVaultRuntime,
+  listRequiredEnvNames,
+  requiredEnvGaps,
+  VaultBootError,
+  type VaultRuntime,
+} from "../../elements/vault.ts";
 import { buildVaultBootChain, normalizeVaultDriverId } from "../../elements/vault/boot-chain.ts";
 import type { BootOptions } from "../boot.ts";
 
@@ -30,6 +36,14 @@ export function resolveVaultDriverId(options: BootOptions, env: ConfigEnv): stri
  */
 export async function bindVault(options: BootOptions, env: ConfigEnv): Promise<VaultRuntime> {
   const vaultSecrets = options.vault?.secrets ?? options.secrets ?? [];
+  const requiredEnv = options.vault?.requiredEnv ?? listRequiredEnvNames();
+  // Fail before the chain is built: the builtin `vault` driver opens SQL at
+  // `open()`, and a boot that is already doomed by a missing env var should
+  // never pay for (or leak) a database connection first.
+  const envGaps = requiredEnvGaps(requiredEnv, new Set(vaultSecrets.map((s) => s.name)));
+  if (envGaps.length > 0) {
+    throw new VaultBootError(envGaps);
+  }
   const chain =
     options.vault?.chain ??
     buildVaultBootChain({
@@ -40,6 +54,7 @@ export async function bindVault(options: BootOptions, env: ConfigEnv): Promise<V
     });
   const vault = createVaultRuntime({
     secrets: vaultSecrets,
+    requiredEnv,
     chain,
     allowDevFallbacks: options.vault?.allowDevFallbacks ?? env !== "prod",
     now: options.vault?.now,