okengine 0.10.3 → 0.11.1

package/src/kernel/adopt-barrel-fresh.test.ts

@@ -3,8 +3,8 @@
  * flow under that unit — the stale/missing `.adopt()` barrel case.
  *
  * Mirrors `effects-stamping.test.ts`'s OKE1008 shape exactly: opt-in only
- * via `rootDir`, `local`/`test` warn once (dev-loop stays unbroken),
- * `docker`/`prod` hard-fail (`OKE1009`) — never a silently-incomplete route
+ * via `rootDir`, `test` warns once (dev-loop stays unbroken),
+ * `dev`+compose / `prod` hard-fail (`OKE1009`) — never a silently-incomplete route
  * table in a deploy-shaped environment.
  */
 
@@ -41,23 +41,23 @@ describe("assertAdoptBarrelFresh — direct", () => {
     try {
       await makeUnitDir(root, "notes");
       const notesFlow = flow("notes.create", { do: () => ({ ok: true as const }) });
-      await expect(assertAdoptBarrelFresh([notesFlow], "docker", root)).resolves.toBeUndefined();
+      await expect(assertAdoptBarrelFresh([notesFlow], "dev", root, true)).resolves.toBeUndefined();
     } finally {
       await rm(root, { recursive: true, force: true });
     }
   });
 
-  test("stale: unit on disk, zero adopted flows for it — docker hard-fails OKE1009", async () => {
+  test("stale: unit on disk, zero adopted flows for it — dev+compose hard-fails OKE1009", async () => {
     const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
     try {
       await makeUnitDir(root, "notes");
-      await expect(assertAdoptBarrelFresh([], "docker", root)).rejects.toThrow(/OKE1009/);
+      await expect(assertAdoptBarrelFresh([], "dev", root, true)).rejects.toThrow(/OKE1009/);
     } finally {
       await rm(root, { recursive: true, force: true });
     }
   });
 
-  test("stale: prod — same posture as docker", async () => {
+  test("stale: prod — same posture as dev+compose", async () => {
     const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
     try {
       await makeUnitDir(root, "notes");
@@ -67,11 +67,11 @@ describe("assertAdoptBarrelFresh — direct", () => {
     }
   });
 
-  test("stale: local — warns, never throws (dev-loop stays unbroken)", async () => {
+  test("stale: test — warns, never throws (dev-loop stays unbroken)", async () => {
     const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
     try {
       await makeUnitDir(root, "notes");
-      await expect(assertAdoptBarrelFresh([], "local", root)).resolves.toBeUndefined();
+      await expect(assertAdoptBarrelFresh([], "test", root)).resolves.toBeUndefined();
     } finally {
       await rm(root, { recursive: true, force: true });
     }
@@ -79,7 +79,7 @@ describe("assertAdoptBarrelFresh — direct", () => {
 });
 
 describe("boot-level: stale barrel through a real oke() boot", () => {
-  test("docker: real app.boot() hard-fails OKE1009 when a unit folder was never adopted", async () => {
+  test("dev+compose: real app.boot() hard-fails OKE1009 when a unit folder was never adopted", async () => {
     const root = await mkdtemp(join(tmpdir(), "oke-adopt-fresh-"));
     try {
       // "notes" exists on disk but this app only ever adopted "main" —
@@ -94,7 +94,22 @@ describe("boot-level: stale barrel through a real oke() boot", () => {
       const app = oke({ name: "stale-barrel", gate: { unguardedHttp: "allow" } });
 
       await expect(
-        app.boot({ env: "docker", rootDir: root, unguardedHttp: "allow", startScheduler: false }),
+        app.boot({
+          env: "dev",
+          docker: true,
+          rootDir: root,
+          unguardedHttp: "allow",
+          startScheduler: false,
+          config: {
+            drivers: {
+              store: {
+                sql: { dev: "memory" },
+                kv: { dev: "memory" },
+              },
+              channel: { email: { dev: "console" } },
+            },
+          },
+        }),
       ).rejects.toThrow(/OKE1009/);
     } finally {
       await rm(root, { recursive: true, force: true });

package/src/kernel/app-auth.ts

@@ -0,0 +1,98 @@
+/**
+ * Sync auth wiring for `oke({ gate: { auth } })`.
+ *
+ * Loaded only when auth is configured so HTTP-only cold graphs never import
+ * bindings / sessions / identity (`requirePackageModule` in `app.ts`).
+ */
+
+import type { ResolvedGateAuth } from "../auth/config.ts";
+import { auth as authPlugin } from "../auth/plugin.ts";
+import { createAuthHttpBindings, type AuthHttpMaterialization } from "../auth/bindings.ts";
+import { tokenFromCookieHeader } from "../auth/cookies.ts";
+import { setActiveGateAuthContext } from "../auth/method-context.ts";
+import type { ResolvedGateConfig } from "../elements/gate/config.ts";
+import { createAppAuthBinding, verifyBearerToken, type AppAuthBinding } from "./auth-resolve.ts";
+import type { PluginDef } from "./plugin.ts";
+
+/** Result of wiring Gate auth at construction. */
+export interface WiredGateAuth {
+  readonly materialization: AuthHttpMaterialization | undefined;
+  readonly authPlugin: PluginDef | undefined;
+  readonly authBinding: AppAuthBinding;
+  readonly verifyBearerToken: typeof verifyBearerToken;
+  readonly tokenFromCookieHeader: typeof tokenFromCookieHeader;
+  /** Rebuild binding when boot supplies a clock. */
+  rebind(now: () => number): AppAuthBinding;
+}
+
+/** Options for {@link wireGateAuth}. */
+export interface WireGateAuthOptions {
+  readonly gateConfig: ResolvedGateConfig & { readonly auth: ResolvedGateAuth };
+  /** Clock fallback when `gate.auth.now` is omitted (`oke({ fx: { now } })`). */
+  readonly now?: () => number;
+}
+
+/**
+ * Materialize auth HTTP bindings, absorb the builtin auth plugin, and publish
+ * the active Gate auth context for `.plug(username())` etc.
+ *
+ * @param options - Resolved Gate bag + optional clock
+ */
+export function wireGateAuth(options: WireGateAuthOptions): WiredGateAuth {
+  const { gateConfig } = options;
+  const auth = gateConfig.auth;
+  let materialization: AuthHttpMaterialization | undefined;
+  if (auth.http) {
+    materialization = createAuthHttpBindings(auth, {
+      rateLimitEnabled: gateConfig.rateLimitEnabled,
+      sessions: auth.sessions,
+    });
+  }
+
+  const pluginDef = authPlugin({
+    secret: auth.secret,
+    accessTtlMs: auth.session.accessTtlMs,
+    refreshTtlMs: auth.session.refreshTtlMs,
+    session: {
+      accessTtlMs: auth.session.accessTtlMs,
+      refreshTtlMs: auth.session.refreshTtlMs,
+      idleTtlMs: auth.session.idleTtlMs,
+      absoluteTtlMs: auth.session.absoluteTtlMs,
+      singleSessionPerUser: auth.session.singleSessionPerUser,
+    },
+    password: auth.password,
+    passwordPolicy: auth.passwordPolicy,
+    breachCheck: auth.breachCheck,
+  });
+
+  let authBinding = createAppAuthBinding({
+    secret: auth.secret,
+    sessions: materialization?.ctx.sessions ?? auth.sessions,
+    now: auth.now ?? options.now,
+  });
+
+  setActiveGateAuthContext({
+    secret: authBinding.secret,
+    sessions: authBinding.sessions,
+    now: authBinding.now,
+    passwordPolicy: auth.passwordPolicy,
+    password: auth.password,
+    breachCheck: auth.breachCheck,
+  });
+
+  return {
+    materialization,
+    authPlugin: pluginDef,
+    authBinding,
+    verifyBearerToken,
+    tokenFromCookieHeader,
+    rebind(now) {
+      authBinding = createAppAuthBinding({
+        secret: authBinding.secret,
+        sessions: authBinding.sessions,
+        now,
+      });
+      return authBinding;
+    },
+  };
+}

package/src/kernel/app.ts

@@ -6,12 +6,9 @@
  * pipeline, and wires `fx.call` to untriggered (and triggered) flows.
  */
 
-import {
-  compileRoute,
-  encodeExecuteResult,
-  encodeFailure,
-  type CompiledRoute,
-} from "../compiler/index.ts";
+import { compileRoute } from "../compiler/dynamic.ts";
+import type { CompiledRoute } from "../compiler/aot.ts";
+import { encodeExecuteResult, encodeFailure } from "../compiler/response.ts";
 import { validate } from "../validation/standard-schema.ts";
 import {
   accumulateAdoptArgs,
@@ -25,22 +22,22 @@ import {
 // when an app actually boots (AGENTS.md / unified-theory budget: cold start < 75 ms).
 import type { BootOptions, BootResult, ElementRuntimes } from "./boot.ts";
 import type { CapabilityToken } from "./capability.ts";
-import { createAppAuthBinding, verifyBearerToken, type AppAuthBinding } from "./auth-resolve.ts";
-import { createAuthHttpBindings, type AuthHttpMaterialization } from "../auth/bindings.ts";
-import { auth as authPlugin } from "../auth/plugin.ts";
-import { tokenFromCookieHeader } from "../auth/cookies.ts";
-import { setActiveGateAuthContext } from "../auth/method-context.ts";
+import type { AppAuthBinding } from "./auth-resolve.ts";
+import type { AuthHttpMaterialization } from "../auth/bindings.ts";
+import type { WiredGateAuth } from "./app-auth.ts";
 import {
   resolveGateConfig,
   type GateOptions,
   type ResolvedGateConfig,
 } from "../elements/gate/config.ts";
+import { requirePackageModule } from "../shared/lazy-src.ts";
 import type { TemplateCatalog } from "../elements/channel/runtime.ts";
 import { parseAcceptLanguage } from "../elements/channel/locale.ts";
 import { runWithLocale } from "../i18n/locale-context.ts";
 import { getMessageCatalogs, matchConfiguredLocale } from "../i18n/messages.ts";
 import { runDurable } from "../elements/clock/durable.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
+import { failureCodeOf, runCompensationPhase } from "./compensate.ts";
 import { fxRetry } from "./concurrency.ts";
 import {
   createFxContext,
@@ -85,6 +82,7 @@ import type { JournalRuntime } from "./boot-bind/journal.ts";
 import { listBindings, resetBindings, type Binding } from "./on.ts";
 import {
   channelTemplateRegistry,
+  requiredEnvRegistry,
   secretRegistry,
   signalRegistry,
   storeRegistry,
@@ -159,11 +157,11 @@ export interface OkeOptions {
    * subject key.
    */
   readonly archiveInputFields?: readonly string[];
-  /** Active environment for {@link OkeApp.boot} (defaults to `local`). */
+  /** Active environment for {@link OkeApp.boot} (`dev` / `test` / `prod`). */
   readonly env?: BootOptions["env"];
   /**
-   * Docker mode (`oke dev -d` / `OKE_DOCKER=1`) — force the `docker`
-   * driver profile at boot.
+   * Compose mode (`oke dev` / `OKE_DOCKER=1`) — select the `dev` driver
+   * profile at boot when `env` is omitted.
    */
   readonly docker?: BootOptions["docker"];
   /** Optional `oke.config.ts` document consumed at boot. */
@@ -485,22 +483,35 @@ export function oke(options: OkeOptions): OkeApp {
   // explicitly-passed decl that is also in the registry is not doubled.
   const registrySnapshot =
     registry === "ignore"
-      ? { stores: [], secrets: [], signals: [], channelTemplates: [] }
+      ? { stores: [], secrets: [], requiredEnv: [], signals: [], channelTemplates: [] }
       : {
           stores: storeRegistry.slice(),
           secrets: secretRegistry.slice(),
+          requiredEnv: requiredEnvRegistry.slice(),
           signals: signalRegistry.slice(),
           channelTemplates: channelTemplateRegistry.slice(),
         };
   if (registry === "consume") {
     storeRegistry.length = 0;
     secretRegistry.length = 0;
+    requiredEnvRegistry.length = 0;
     signalRegistry.length = 0;
     channelTemplateRegistry.length = 0;
   }
   const effectiveStores = mergeUnique(options.stores, registrySnapshot.stores);
   const effectiveSecrets = mergeUnique(options.secrets, registrySnapshot.secrets);
   const effectiveSignals = mergeUnique(options.signals, registrySnapshot.signals);
+  /**
+   * Fold registered `vault.env.required` names into the vault boot options so
+   * boot reports missing env vars in the same gap list as missing secrets.
+   *
+   * @param base - Vault options from `oke({ vault })` / a boot override
+   */
+  const withRequiredEnv = (base: BootOptions["vault"]): BootOptions["vault"] => {
+    const names = [...new Set([...(base?.requiredEnv ?? []), ...registrySnapshot.requiredEnv])];
+    if (names.length === 0) return base;
+    return { ...(base ?? {}), requiredEnv: names };
+  };
   // Stay `undefined` (never a defined-but-empty object) when neither an
   // explicit `options.channel` nor a registered template exists — a defined
   // object here would flip `resolveElementNeeds`'s `channel` need to `true`
@@ -519,14 +530,6 @@ export function oke(options: OkeOptions): OkeApp {
     gate: options.gate,
     env: options.env,
   });
-  let authMaterialization: AuthHttpMaterialization | undefined;
-  if (gateConfig.auth?.http) {
-    authMaterialization = createAuthHttpBindings(gateConfig.auth, {
-      rateLimitEnabled: gateConfig.rateLimitEnabled,
-      sessions: gateConfig.auth.sessions,
-    });
-    adopted.push(...authMaterialization.bindings);
-  }
 
   /** Retained for test harness / boot merges. */
   const $options = options;
@@ -540,27 +543,26 @@ export function oke(options: OkeOptions): OkeApp {
   /** Runtime route table — types accumulate on the returned {@link OkeApp}. */
   const routes: RuntimeRouteMap = {};
 
-  // Absorb auth() tables into gate.auth — `.needs("auth")` sees plugin name.
+  let authMaterialization: AuthHttpMaterialization | undefined;
+  let wiredAuth: WiredGateAuth | undefined;
+  let authBinding: AppAuthBinding | undefined;
   if (gateConfig.auth) {
-    applyPlugin(
-      pluginRegistry,
-      authPlugin({
-        secret: gateConfig.auth.secret,
-        accessTtlMs: gateConfig.auth.session.accessTtlMs,
-        refreshTtlMs: gateConfig.auth.session.refreshTtlMs,
-        session: {
-          accessTtlMs: gateConfig.auth.session.accessTtlMs,
-          refreshTtlMs: gateConfig.auth.session.refreshTtlMs,
-          idleTtlMs: gateConfig.auth.session.idleTtlMs,
-          absoluteTtlMs: gateConfig.auth.session.absoluteTtlMs,
-          singleSessionPerUser: gateConfig.auth.session.singleSessionPerUser,
-        },
-        password: gateConfig.auth.password,
-        passwordPolicy: gateConfig.auth.passwordPolicy,
-        breachCheck: gateConfig.auth.breachCheck,
-      }),
-      appPluginScope,
+    const { wireGateAuth } = requirePackageModule<typeof import("./app-auth.ts")>(
+      "kernel/app-auth",
+      "app-auth",
     );
+    wiredAuth = wireGateAuth({
+      gateConfig: { ...gateConfig, auth: gateConfig.auth },
+      now: options.fx?.now,
+    });
+    authMaterialization = wiredAuth.materialization;
+    authBinding = wiredAuth.authBinding;
+    if (authMaterialization) {
+      adopted.push(...authMaterialization.bindings);
+    }
+    if (wiredAuth.authPlugin) {
+      applyPlugin(pluginRegistry, wiredAuth.authPlugin, appPluginScope);
+    }
   }
 
   const smart = createRouter<Binding>(options.router ?? "default");
@@ -655,30 +657,11 @@ export function oke(options: OkeOptions): OkeApp {
   let bootResult: BootResult | undefined;
   let bootPromise: Promise<BootResult> | undefined;
   let readyState: ReadyState = "booting";
-  let bootEnv: BootOptions["env"] = options.env ?? "local";
-  let authBinding: AppAuthBinding | undefined =
-    gateConfig.auth !== undefined
-      ? createAppAuthBinding({
-          secret: gateConfig.auth.secret,
-          sessions: authMaterialization?.ctx.sessions ?? gateConfig.auth.sessions,
-          now: gateConfig.auth.now ?? options.fx?.now,
-        })
-      : undefined;
-  if (authBinding) {
-    setActiveGateAuthContext({
-      secret: authBinding.secret,
-      sessions: authBinding.sessions,
-      now: authBinding.now,
-      passwordPolicy: gateConfig.auth?.passwordPolicy,
-      password: gateConfig.auth?.password,
-      breachCheck: gateConfig.auth?.breachCheck,
-    });
-  } else {
-    setActiveGateAuthContext(undefined);
-  }
+  let bootEnv: BootOptions["env"] = options.env;
   // Fallback journal for pre-boot / `autoBoot: false` unit tests. A booted
   // app replaces this with the bound `drivers.journal` store (postgres etc.).
-  const fallbackJournalStore = createMemoryJournalStore();
+  // Constructed on first use so non-durable HTTP apps skip the alloc.
+  let fallbackJournalStore: JournalStore | undefined;
   const fallbackJournalInstanceId = `app-${crypto.randomUUID()}`;
   const sleepingRuns = new Map<
     string,
@@ -700,6 +683,7 @@ export function oke(options: OkeOptions): OkeApp {
     if (bound) {
       return { store: bound.store, instanceId: bound.instanceId, leaseMs: bound.leaseMs };
     }
+    fallbackJournalStore ??= createMemoryJournalStore();
     return {
       store: fallbackJournalStore,
       instanceId: fallbackJournalInstanceId,
@@ -787,7 +771,7 @@ export function oke(options: OkeOptions): OkeApp {
     }
   }
 
-  /** Boot-time orphan scan — `running`/`sleeping` runs with no live lease. */
+  /** Boot-time orphan scan — `running`/`sleeping`/`compensating` with no live lease. */
   async function resumeOrphanedDurableRuns(): Promise<void> {
     const { store } = activeJournal();
     if (!hasJournalLease(store)) return;
@@ -807,7 +791,15 @@ export function oke(options: OkeOptions): OkeApp {
     const { bootApplication, resolveElementNeeds } = await import("./boot.ts");
     const { assertHttpGatePosture } = await import("../elements/gate/boot.ts");
     const { assertPluginNeeds, buildAvailableNeedTokens } = await import("./plugin-needs.ts");
-    bootEnv = overrides?.env ?? options.env ?? "local";
+    const dockerFlag =
+      overrides?.docker === true ||
+      (overrides?.docker !== false &&
+        (options.docker === true || (options.docker !== false && process.env.OKE_DOCKER === "1")));
+    // Mirror bootApplication: prod / compose-dev / else test (PGLite + memory).
+    bootEnv =
+      overrides?.env ??
+      options.env ??
+      (process.env.NODE_ENV === "production" ? "prod" : dockerFlag ? "dev" : "test");
 
     // Prod without a real secret fails even if construction minted a dev secret.
     if (gateConfig.auth?.secretMinted && bootEnv === "prod") {
@@ -830,7 +822,7 @@ export function oke(options: OkeOptions): OkeApp {
       config: overrides?.config ?? options.config,
       elements: overrides?.elements ?? options.elements,
       secrets: overrides?.secrets ?? effectiveSecrets,
-      vault: overrides?.vault ?? options.vault,
+      vault: withRequiredEnv(overrides?.vault ?? options.vault),
       gates: [...baseGates, ...authGates],
       signals: overrides?.signals ?? effectiveSignals,
       clocks: overrides?.clocks ?? options.clocks,
@@ -900,7 +892,7 @@ export function oke(options: OkeOptions): OkeApp {
       rootDir: overrides?.rootDir ?? options.rootDir,
       elements: overrides?.elements ?? options.elements,
       secrets: [...baseSecrets, ...pluginSecrets],
-      vault: overrides?.vault ?? options.vault,
+      vault: withRequiredEnv(overrides?.vault ?? options.vault),
       gates: [...baseGates, ...authGates, ...pluginGates],
       unguardedHttp,
       signals: [...baseSignals, ...pluginSignals],
@@ -955,12 +947,9 @@ export function oke(options: OkeOptions): OkeApp {
       readyState = "ready";
     }
     // Prefer the booted clock for access-token expiry checks.
-    if (authBinding) {
-      authBinding = createAppAuthBinding({
-        secret: authBinding.secret,
-        sessions: authBinding.sessions,
-        now: result.clock?.now.bind(result.clock) ?? authBinding.now,
-      });
+    if (wiredAuth && authBinding) {
+      const now = result.clock?.now.bind(result.clock) ?? authBinding.now;
+      authBinding = wiredAuth.rebind(now);
     }
     return result;
   }
@@ -1013,7 +1002,7 @@ export function oke(options: OkeOptions): OkeApp {
     registerFlow(flowDef);
 
     const i18nConfig = options.config?.i18n;
-    const configuredLocales = i18nConfig?.locales ?? ["en", "ar"];
+    const configuredLocales = i18nConfig?.locales ?? ["en"];
     const defaultLocale = i18nConfig?.default ?? "en";
     const acceptLanguage = extras?.request?.headers.get("accept-language") ?? undefined;
     const resolvedLocale = matchConfiguredLocale(
@@ -1121,21 +1110,24 @@ export function oke(options: OkeOptions): OkeApp {
 
       const binding = authBinding;
       const cookieOpts = gateConfig.auth?.cookies;
+      const verifyBearer = wiredAuth?.verifyBearerToken;
+      const cookieToken = wiredAuth?.tokenFromCookieHeader;
       const elementHooks = createElementPipelineHooks({
         gates: booted.gate,
         principals,
         telemetry,
         allowTestPrincipals: testMode,
-        verifyBearer: binding ? async (token) => verifyBearerToken(binding, token) : undefined,
+        verifyBearer:
+          binding && verifyBearer ? async (token) => verifyBearer(binding, token) : undefined,
         // Phase 1a: opt-in cookie → Bearer when Authorization is absent.
         resolveToken:
-          binding && cookieOpts?.enabled
+          binding && cookieOpts?.enabled && cookieToken
             ? (request) => {
                 const header = request.headers.get("authorization");
                 if (header?.startsWith("Bearer ")) {
                   return header.slice("Bearer ".length).trim() || undefined;
                 }
-                return tokenFromCookieHeader(request.headers.get("cookie"), cookieOpts);
+                return cookieToken(request.headers.get("cookie"), cookieOpts);
               }
             : undefined,
       });
@@ -1281,30 +1273,13 @@ export function oke(options: OkeOptions): OkeApp {
         });
       } else if (!sleeping && isTerminalFailure(result)) {
         const terminalErr = result.failure ?? result.ctx.error;
-        if (flowDef.compensate) {
-          try {
-            const completedSteps = journalSession.run.entries
-              .filter((e) => e.kind === "step")
-              .map((e) => e.name);
-            await flowDef.compensate(
-              {
-                input: ctx.input as never,
-                error: terminalErr,
-                completedSteps,
-              },
-              fx,
-            );
-          } catch (compErr) {
-            await journalSession.commit("failed", {
-              error: `compensate:${failureCodeOf(compErr)}`,
-            });
-          }
-        }
-        if (journalSession.run.status === "running") {
-          await journalSession.commit("failed", {
-            error: failureCodeOf(terminalErr),
-          });
-        }
+        await runCompensationPhase({
+          flow: flowDef,
+          input: ctx.input,
+          session: journalSession,
+          fx,
+          error: terminalErr,
+        });
       } else if (!sleeping) {
         await journalSession.commit("completed", { output: result.output });
       }
@@ -1699,14 +1674,6 @@ function isTerminalFailure(result: PipelineResult): boolean {
   return result.ctx.error !== undefined && !isJournalSuspend(result.ctx.error);
 }
 
-/** Machine-readable code for journal / Runs failure fields. */
-function failureCodeOf(err: unknown): string {
-  if (isFlowFailure(err)) return err.error.code;
-  if (err instanceof Error && err.name && err.name !== "Error") return err.name;
-  if (err instanceof Error && err.message) return err.message.slice(0, 120);
-  return "Error";
-}
-
 /** Coerce a thrown value into a FlowFailure for Runs wide events. */
 function failureFromUnknown(err: unknown): FlowFailure {
   if (isFlowFailure(err)) return err;

package/src/kernel/auto-registry.test.ts

@@ -40,7 +40,7 @@ describe("oke() auto-registry — stores/secrets/signals/channel.templates", ()
         sends: ["before-note-created"],
       },
       do: async (_input, fx) => {
-        const secret = fx.vault(secretBefore);
+        const secret = await fx.vault.get(secretBefore);
         await fx.emit(signalBefore, {});
         await fx.send(templateBefore, { to: "you@localhost", data: {} });
         return { secret };
@@ -78,7 +78,7 @@ describe("oke() auto-registry — stores/secrets/signals/channel.templates", ()
         sends: ["after-note-created"],
       },
       do: async (_input, fx) => {
-        const secret = fx.vault(secretAfter);
+        const secret = await fx.vault.get(secretAfter);
         await fx.emit(signalAfter, {});
         await fx.send(templateAfter, { to: "you@localhost", data: {} });
         return { secret };

package/src/kernel/boot-bind/ai.test.ts

@@ -16,15 +16,15 @@ describe("ai boot binder", () => {
   });
 
   test("resolveAiDriverId defaults to mock; honours config + OKE_AI_DRIVER in docker", () => {
-    expect(resolveAiDriverId({}, "local")).toBe("mock");
-    expect(resolveAiDriverId({ config: { drivers: { ai: { local: "ollama" } } } }, "local")).toBe(
+    expect(resolveAiDriverId({}, "test")).toBe("mock");
+    expect(resolveAiDriverId({ config: { drivers: { ai: { test: "ollama" } } } }, "test")).toBe(
       "ollama",
     );
 
     const prev = process.env.OKE_AI_DRIVER;
     process.env.OKE_AI_DRIVER = "ollama";
     try {
-      expect(resolveAiDriverId({}, "local", true)).toBe("ollama");
+      expect(resolveAiDriverId({}, "test", true)).toBe("ollama");
     } finally {
       if (prev === undefined) delete process.env.OKE_AI_DRIVER;
       else process.env.OKE_AI_DRIVER = prev;
@@ -48,12 +48,12 @@ describe("ai boot binder", () => {
   test("bindAi uses injected defaultDriver over config (tests stay on mock)", () => {
     const runtime = bindAi(
       {
-        config: { drivers: { ai: { local: "ollama" } } },
+        config: { drivers: { ai: { test: "ollama" } } },
         ai: { defaultDriver: mockAiDriver },
       },
       undefined,
       () => 0,
-      "local",
+      "test",
     );
     expect(runtime.autoCacheDisabled).toBe(true);
   });

package/src/kernel/boot-bind/ai.ts

@@ -33,7 +33,7 @@ export function bindAi(
   options: BootOptions,
   gate: GateRuntime | undefined,
   now: () => number,
-  env: ConfigEnv = "local",
+  env: ConfigEnv = "test",
   docker = false,
 ): AiRuntime {
   const id = resolveAiDriverId(options, env, docker);
@@ -115,6 +115,7 @@ export function openDefaultsFor(id: string, docker = false): AiOpenOptions {
     return {
       ...(apiKey ? { apiKey } : {}),
       ...(baseUrl ? { baseUrl } : {}),
+      ...(process.env.OKE_AI_MODEL?.trim() ? { model: process.env.OKE_AI_MODEL.trim() } : {}),
     };
   }
   return {};

package/src/kernel/boot-bind/channel.test.ts

@@ -58,23 +58,23 @@ describe("bindChannel driver resolution", () => {
     config: {
       drivers: {
         channel: {
-          email: { local: "console", docker: "smtp", test: "console", prod: "sndr" },
-          sms: { local: "console", docker: "taqnyat", test: "msegat", prod: "taqnyat" },
+          email: { dev: "smtp", test: "console", prod: "sndr" },
+          sms: { dev: "taqnyat", test: "msegat", prod: "taqnyat" },
         },
       },
     },
   };
 
   test("uses console locally and smtp in docker", () => {
-    expect(resolveEmailDriverId(options, "local", false)).toBe("console");
-    expect(resolveEmailDriverId(options, "docker", true)).toBe("smtp");
+    expect(resolveEmailDriverId(options, "test", false)).toBe("console");
+    expect(resolveEmailDriverId(options, "dev", true)).toBe("smtp");
     expect(resolveEmailDriverId(options, "prod", false)).toBe("sndr");
   });
 
   test("resolves sms driver ids", () => {
-    expect(resolveSmsDriverId(options, "local")).toBe("console");
-    expect(resolveSmsDriverId(options, "docker")).toBe("taqnyat");
     expect(resolveSmsDriverId(options, "test")).toBe("msegat");
+    expect(resolveSmsDriverId(options, "dev")).toBe("taqnyat");
+    expect(resolveSmsDriverId(options, "prod")).toBe("taqnyat");
   });
 
   test("parses SMTP_URL and optional auth overrides", () => {

package/src/kernel/boot-bind/channel.ts

@@ -3,11 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
-import {
-  CHANNEL_EMAIL_DEFAULTS,
-  CHANNEL_SMS_DEFAULTS,
-  dockerFlagDefaults,
-} from "../../config/driver-defaults.ts";
+import { CHANNEL_EMAIL_DEFAULTS, CHANNEL_SMS_DEFAULTS } from "../../config/driver-defaults.ts";
 import { openConsoleChannel } from "../../drivers/channel-console.ts";
 import { openMsegatChannel } from "../../drivers/channel-msegat.ts";
 import { openResendChannel } from "../../drivers/channel-resend.ts";
@@ -86,12 +82,9 @@ export function resolveEmailDriverId(
   env: ConfigEnv,
   docker: boolean,
 ): string {
+  void docker;
   // Defaults cover every ConfigEnv key, so this is never undefined.
-  return resolveDriverId(
-    options.config?.drivers?.channel?.email,
-    env,
-    dockerFlagDefaults(CHANNEL_EMAIL_DEFAULTS, docker),
-  )!;
+  return resolveDriverId(options.config?.drivers?.channel?.email, env, CHANNEL_EMAIL_DEFAULTS)!;
 }
 
 /**