okengine 0.11.1 → 0.12.0

package/src/cli/dev.ts

@@ -9,7 +9,9 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import type { SessionStore } from "../auth/sessions.ts";
 import type { ConsoleAppHandle } from "../console/server/app.ts";
+import { RUNS_INGEST_PATH } from "../console/server/runs-ingest.ts";
 import type { ConsoleState } from "../console/server/state.ts";
+import { RUNS_INGEST_SECRET_ENV, RUNS_INGEST_URL_ENV } from "../runs/bridge-to-console.ts";
 import {
   DEFAULT_DOCKER_DIR,
   deriveInfrastructure,
@@ -31,6 +33,7 @@ import {
   devStatusFromAiPhase,
   formatAppReadyLine,
   formatBootWarn,
+  formatClaimNote,
   formatCliChrome,
   formatDevBanner,
   formatDevHeroDetails,
@@ -38,6 +41,7 @@ import {
   formatServiceLine,
   formatStackSummary,
   formatStatusLine,
+  termColorEnabled,
   type BootProgress,
   type DevStatus,
   type StackSummaryService,
@@ -61,6 +65,12 @@ import {
 import { loadManifest, loadOkeConfig, resolveImages } from "./load-config.ts";
 import { mcpContextFromConsole } from "./mcp-from-console.ts";
 import { resolveDevPorts } from "./ports.ts";
+import {
+  shouldAttachConsoleVite,
+  startConsoleVite,
+  type ConsoleViteHandle,
+  type StartConsoleViteOptions,
+} from "./dev-console-vite.ts";
 import { clearDevSessionLock, writeDevSessionLock } from "./dev-session-lock.ts";
 
 /** Max wait for the `bun --hot` app child to bind a port. */
@@ -199,7 +209,7 @@ export interface DevOptions {
   readonly secret?: string;
   /** Seed Manifest into Console (and therefore MCP). */
   readonly manifest?: Manifest | null;
-  /** Suppress claim-code print (tests). */
+  /** Suppress kernel stdout claim print (default true — the live board owns it). */
   readonly silentClaim?: boolean;
   /** Port overrides (use `0` for ephemeral in tests). */
   readonly appPort?: number;
@@ -260,6 +270,17 @@ export interface DevOptions {
   readonly regenClient?: (appUrl: string) => Promise<void>;
   /** Serve Console (injectable). */
   readonly serveConsole?: (port: number) => Promise<DevConsoleHandle>;
+  /**
+   * Force (`true`) or skip (`false`) Console Vite HMR. Default: attach
+   * on an okengine source checkout so `dev:keel` does not need `bun run build`.
+   */
+  readonly consoleVite?: boolean;
+  /**
+   * Injectable Console Vite sidecar (tests). Default: {@link startConsoleVite}.
+   *
+   * @param options - Kernel port + listen preference
+   */
+  readonly startConsoleVite?: (options: StartConsoleViteOptions) => Promise<ConsoleViteHandle>;
   /**
    * Serve MCP against the live Console context (injectable).
    * Default: {@link serveMcp} on :6535.
@@ -328,10 +349,17 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     options.composeHealthRun ??
     (options.composeHealth ? async (): Promise<string> => "[]" : undefined);
   const previousWarn = console.warn;
+  const bootNotices: string[] = [];
+  const noticeSeen = new Set<string>();
+  let chromeReady = false;
   console.warn = (...args: unknown[]) => {
     const msg = args.map(String).join(" ");
     if (/^oke boot:/i.test(msg.trim())) {
-      write(formatBootWarn(msg.trim()));
+      const key = msg.trim().replace(/\s+/g, " ");
+      if (noticeSeen.has(key)) return;
+      noticeSeen.add(key);
+      if (chromeReady) write(formatBootWarn(msg.trim()));
+      else bootNotices.push(msg.trim());
       return;
     }
     previousWarn.apply(console, args as Parameters<typeof console.warn>);
@@ -358,8 +386,14 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     });
   try {
     await syncAdoptBarrel(cwd);
-  } catch {
-    /* best-effort — boot-time assertAdoptBarrelFresh (rootDir opt-in) is the real gate */
+  } catch (err) {
+    // Best-effort: boot-time assertAdoptBarrelFresh (rootDir opt-in) is the real gate.
+    // Still surface so a broken generator is not fully silent in the boot log.
+    write(
+      formatStatusLine(
+        `.adopt() barrel sync skipped — ${err instanceof Error ? err.message : String(err)}`,
+      ),
+    );
   }
 
   const preferredApp = options.appPort ?? Number(Bun.env.PORT ?? APP_PORT);
@@ -425,7 +459,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     };
     if (typeof pkg.version === "string") okeVersion = pkg.version;
   } catch {
-    // shipped binary may not sit next to package.json
+    // Inconsequential: banner version only — shipped binaries may not sit next to package.json.
   }
   const earlyProfile = resolveDevProfile({ docker: true, nodeEnv: "development" });
   write(
@@ -473,8 +507,13 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
   let loadedConfig: Awaited<ReturnType<typeof loadOkeConfig>>["config"] | null = null;
   try {
     loadedConfig = (await loadOkeConfig(cwd)).config;
-  } catch {
+  } catch (err) {
     loadedConfig = null;
+    const msg = err instanceof Error ? err.message : String(err);
+    // Missing config is common for injectable/`--images` trees; surface parse bugs only.
+    if (!/no oke\.config\.ts found/i.test(msg)) {
+      write(formatStatusLine(`oke.config.ts load skipped — ${msg}`));
+    }
   }
 
   {
@@ -496,8 +535,12 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     } else if (!loadedConfig) {
       try {
         loadedConfig = (await loadOkeConfig(cwd)).config;
-      } catch {
+      } catch (err) {
         loadedConfig = null;
+        const msg = err instanceof Error ? err.message : String(err);
+        if (!/no oke\.config\.ts found/i.test(msg)) {
+          write(formatStatusLine(`oke.config.ts load skipped — ${msg}`));
+        }
       }
     }
     if (Array.isArray(options.docker)) {
@@ -823,6 +866,9 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     }
   };
 
+  let consoleState: ConsoleState | null = null;
+  let claimConsoleUrl: string | undefined;
+
   const paintBootBoard = (aiStatus: DevStatus | undefined) => {
     const aiSt = aiStatus ?? heroAiStatus;
     const elements = heroSnapshot.elements.map((row) => {
@@ -874,9 +920,13 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
           appDrivers: pendingStackSummary.appDrivers,
         })
       : "";
-    // Breath between elements and Docker — they read as two panes, not one block.
-    const gap = elementsBlock && stackBlock ? "\n" : "";
-    return `${elementsBlock}${gap}${stackBlock}`;
+    const claim =
+      consoleState && !consoleState.setupClosed
+        ? formatClaimNote(consoleState.claim.code, termColorEnabled(), {
+            ...(claimConsoleUrl !== undefined ? { consoleUrl: claimConsoleUrl } : {}),
+          })
+        : "";
+    return `${elementsBlock}${stackBlock}${claim}`;
   };
 
   // Drop ephemeral progress — final elements + Docker board replaces it.
@@ -934,25 +984,6 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     await Promise.race([firstAiPaint, Bun.sleep(2_500)]);
   }
 
-  // Live ● for the whole session — catch Docker Desktop stops / crashes.
-  // Updates the board only (no redis stopped / starting / ready log spam).
-  if (dockerStarted && composeFiles) {
-    const { startComposeHealthWatch } = await import("../docker/compose-health.ts");
-    const started = dockerStarted;
-    stopComposeHealthWatch = startComposeHealthWatch({
-      files: started.files,
-      cwd: started.cwd,
-      env: started.env,
-      run: composeHealthRun,
-      intervalMs: 2_000,
-      onChange: (map) => {
-        liveComposeHealth = map;
-        if (map.get("ai") === "error") heroAiStatus = "error";
-        repaintBoard();
-      },
-    });
-  }
-
   /** Snapshot keys we mutate so `stop()` can leave the parent shell clean. */
   const processEnvSnapshot = new Map<string, string | undefined>();
   const setProcessEnv = (key: string, value: string): void => {
@@ -984,9 +1015,11 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     const { syncDevSchema } = await import("./dev-schema-sync.ts");
     const configEnv = "dev" as const;
     try {
+      const injectedPush = options.dbPush;
       const result = await syncDevSchema(cwd, configEnv, {
         write: chromeWrite,
         quietComposeReady: true,
+        ...(injectedPush ? { pushFn: async (projectCwd: string) => injectedPush(projectCwd) } : {}),
       });
       write(
         formatStatusLine(
@@ -1003,11 +1036,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
         });
       }
     } catch (err) {
-      write(
-        formatStatusLine(
-          `oke db push (dev) skipped — ${err instanceof Error ? err.message : String(err)}`,
-        ),
-      );
+      write(await formatDevSchemaSyncFailure(cwd, err, "boot"));
     }
   }
 
@@ -1054,7 +1083,35 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       const next = await extractManifest({ rootDir: cwd });
       feedManifest(state, next);
     } catch {
-      // Source may be mid-edit — keep the last good Manifest.
+      // Inconsequential while watching: mid-edit parse failures are expected on every
+      // keystroke — keep the last good Manifest. Logging here would flood the Logs pane.
+    }
+  }
+
+  /** Host → Console WideEvent ingest secret (live Traces bridge). */
+  const runsIngestSecret = crypto.randomUUID();
+
+  let consoleVite: ConsoleViteHandle | null = null;
+  // Dry-run already returned above — Vite is a live sidecar, never planned.
+  const wantConsoleVite =
+    options.consoleVite === true ||
+    (options.consoleVite !== false &&
+      options.serveConsole === undefined &&
+      shouldAttachConsoleVite());
+  if (wantConsoleVite) {
+    const startVite = options.startConsoleVite ?? startConsoleVite;
+    try {
+      consoleVite = await startVite({
+        consolePort,
+        occupied: new Set([appPort, consolePort, mcpPort, docsMcpPort].filter((p) => p !== 0)),
+      });
+      write(formatStatusLine("Console UI hot reload"));
+    } catch (err) {
+      write(
+        formatStatusLine(
+          `Console UI hot reload skipped — ${err instanceof Error ? err.message : String(err)}`,
+        ),
+      );
     }
   }
 
@@ -1067,9 +1124,13 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
         hostname: "127.0.0.1",
         cwd,
         env: "dev",
-        silentClaim: options.silentClaim ?? false,
+        okeConfig: loadedConfig,
+        // CLI paints the claim on the live board — do not dump it to raw stdout.
+        silentClaim: options.silentClaim ?? true,
+        runsIngestSecret,
         ...(options.secret !== undefined ? { secret: options.secret } : {}),
         ...(seedManifest !== undefined && seedManifest !== null ? { manifest: seedManifest } : {}),
+        ...(consoleVite ? { spaProxy: { origin: consoleVite.origin } } : {}),
       });
       write(formatServiceLine("Console", `http://127.0.0.1:${server.port}`));
       return {
@@ -1130,24 +1191,64 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
           out: resolve(cwd, "oke-client.d.ts"),
         });
         write(formatStatusLine("regenerated oke-client.d.ts"));
-      } catch {
-        // App may not be ready yet — ignore until next save.
+      } catch (err) {
+        // App may not be ready yet on first tick — still surface so a stuck regen is visible.
+        write(
+          formatStatusLine(
+            `oke-client.d.ts regen skipped — ${err instanceof Error ? err.message : String(err)}`,
+          ),
+        );
       }
     });
 
-  const app = await startApp(plan.entry, env);
-  const boundAppPort = app.port ?? appPort;
+  // Console before host so ingest URL/secret are real when the child boots.
   const consoleServer = await serveConsole(consolePort);
   const boundConsolePort = consoleServer.port ?? consolePort;
+  consoleState = consoleServer.console?.state ?? null;
+  claimConsoleUrl = `http://127.0.0.1:${boundConsolePort}`;
+  if (consoleState && !consoleState.setupClosed && process.stdout.isTTY !== true) {
+    repaintBoard();
+  }
+  env.OKE_DEV_HERO_CONSOLE = `http://127.0.0.1:${boundConsolePort}`;
+  const ingestSecret = consoleServer.console?.state.runsIngestSecret;
+  if (ingestSecret) {
+    env[RUNS_INGEST_URL_ENV] = `http://127.0.0.1:${boundConsolePort}${RUNS_INGEST_PATH}`;
+    env[RUNS_INGEST_SECRET_ENV] = ingestSecret;
+  }
+
+  const app = await startApp(plan.entry, env);
+  const boundAppPort = app.port ?? appPort;
 
   let mcpServer: DevMcpHandle | null = null;
-  let consoleState: ConsoleState | null = null;
   let secret: string | null = null;
   let sessions: SessionStore | null = null;
+  let attachedHost: { readonly stop: () => Promise<void> } | null = null;
 
   if (consoleServer.console) {
     const state = consoleServer.console.state;
     consoleState = state;
+    try {
+      const { attachHostToConsole } = await import("./attach-host-console.ts");
+      attachedHost = await attachHostToConsole({
+        entry: plan.entry,
+        cwd,
+        state,
+        ...(ingestSecret
+          ? {
+              runsBridge: {
+                url: `http://127.0.0.1:${boundConsolePort}${RUNS_INGEST_PATH}`,
+                secret: ingestSecret,
+              },
+            }
+          : {}),
+      });
+    } catch (err) {
+      write(
+        formatStatusLine(
+          `host attach skipped — ${err instanceof Error ? err.message : String(err)}`,
+        ),
+      );
+    }
     secret = state.secret;
     sessions = state.sessions;
     mcpServer = await serveMcpSurface({
@@ -1196,18 +1297,63 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     write(formatStatusLine("oke db push (schema change)"));
     try {
       await dbPush(cwd);
-    } catch {
-      // Mid-edit / kit unavailable — next save retries.
+    } catch (err) {
+      // Dev-loop stays up (next save retries) — but definition errors must not look like a quiet skip.
+      write(await formatDevSchemaSyncFailure(cwd, err, "watch"));
     }
   });
 
-  // Initial sync so local DB matches schema.ts without a prior manual push.
-  if (autoPushEnabled) {
-    lastSchemaFilename = "src/schema.ts";
-    autoPushRunner.trigger();
-  }
+  const paintReadyChrome = (): void => {
+    const tty = process.stdout.isTTY === true;
+    if (tty) {
+      write(clearTerminalScreen());
+      bootBoard.reset();
+      write(
+        formatDevBanner({
+          profile: earlyProfile,
+          runtimeEnv: resolveDevRuntimeEnv(earlyProfile),
+          system: formatHeroSystemLine(),
+          version: okeVersion,
+          phase: "ready",
+        }),
+      );
+    }
+    bootBoard.paint(paintBootBoard(heroAiStatus));
+    for (const notice of bootNotices) {
+      write(formatBootWarn(notice));
+    }
+    bootNotices.length = 0;
+    write(formatAppReadyLine(`http://127.0.0.1:${boundAppPort}`));
+    write(formatServiceLine("Console", `http://127.0.0.1:${boundConsolePort}`));
+    if (mcpServer) {
+      write(formatServiceLine("MCP", `http://127.0.0.1:${boundMcpPort}`));
+    }
+    if (docsMcpServer) {
+      write(formatServiceLine("Docs MCP", `http://127.0.0.1:${boundDocsMcpPort}`));
+    }
+    write(formatDevLogSeparator());
+    chromeReady = true;
+  };
+  paintReadyChrome();
 
-  write(formatDevLogSeparator());
+  // Live ● after the ready board — mid-boot health ticks were rewriting
+  // elements/Docker on top of db-push lines and tearing the claim box.
+  if (dockerStarted && composeFiles) {
+    const { startComposeHealthWatch } = await import("../docker/compose-health.ts");
+    const started = dockerStarted;
+    stopComposeHealthWatch = startComposeHealthWatch({
+      files: started.files,
+      cwd: started.cwd,
+      env: started.env,
+      run: composeHealthRun,
+      intervalMs: 2_000,
+      onChange: (map) => {
+        liveComposeHealth = map;
+        if (map.get("ai") === "error") heroAiStatus = "error";
+        repaintBoard();
+      },
+    });
+  }
 
   const watchFs: DevWatchFn =
     options.watchFs ?? ((path, watchOptions, listener) => watch(path, watchOptions, listener));
@@ -1239,10 +1385,16 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     bootBoard.stop();
     autoPushRunner.cancel();
     watcher.close();
+    const host = attachedHost;
+    attachedHost = null;
+    void host?.stop();
     app.stop();
     consoleServer.stop();
     mcpServer?.stop();
     docsMcpServer?.stop();
+    const vite = consoleVite;
+    consoleVite = null;
+    void vite?.stop();
     void clearDevSessionLock(cwd);
     if (dockerStarted) {
       const started = dockerStarted;
@@ -1335,26 +1487,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     };
     const refreshChrome = async (): Promise<void> => {
       await syncComposeBoard();
-      write(clearTerminalScreen());
-      bootBoard.reset();
-      write(
-        formatDevBanner({
-          profile: earlyProfile,
-          runtimeEnv: resolveDevRuntimeEnv(earlyProfile),
-          system: formatHeroSystemLine(),
-          version: okeVersion,
-        }),
-      );
-      bootBoard.paint(paintBootBoard(heroAiStatus));
-      write(formatAppReadyLine(`http://127.0.0.1:${boundAppPort}`));
-      write(formatServiceLine("Console", `http://127.0.0.1:${boundConsolePort}`));
-      if (mcpServer) {
-        write(formatServiceLine("MCP", `http://127.0.0.1:${boundMcpPort}`));
-      }
-      if (docsMcpServer) {
-        write(formatServiceLine("Docs MCP", `http://127.0.0.1:${boundDocsMcpPort}`));
-      }
-      write(formatDevLogSeparator());
+      paintReadyChrome();
     };
     const composeAction = async (action: DevComposeControlAction): Promise<void> => {
       const files = started.files;
@@ -1394,7 +1527,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       // Esc / unmount without q — still tear down.
       stop();
     } catch {
-      // Ink optional — fall back to keep-alive without keyboard chrome.
+      // Inconsequential: Ink/TUI is optional chrome — fall back to keep-alive without keyboard.
       await new Promise(() => {});
     }
     return { code: 0, plan: session.plan, session };
@@ -1420,6 +1553,75 @@ function isSparseManifest(manifest: Manifest): boolean {
   return Object.keys(flows).length === 0;
 }
 
+/**
+ * Environmental syncDevSchema throws that are fine to soft-skip in the
+ * compose (`dev`) boot path — no Store / no docker images yet, etc.
+ *
+ * @param message - Caught error message
+ */
+function isBenignDevSchemaEnvSkip(message: string): boolean {
+  return (
+    message.startsWith("docker mode: oke.config.ts not found") ||
+    message.startsWith("docker mode: no images configured")
+  );
+}
+
+/**
+ * Whether a caught sync/push error is a schema.decl definition failure
+ * (import evaluation, emit, duplicate tables, bad `.references()`, …).
+ *
+ * Message text alone is insufficient — emit-time bugs often look like bare
+ * TypeErrors (`target.tableName`) — so also inspect the stack for declare /
+ * emit frames.
+ *
+ * @param err - Caught value
+ * @param declarePath - Resolved schema.decl path for this project
+ */
+function isSchemaDeclDefinitionError(err: unknown, declarePath: string): boolean {
+  const msg = err instanceof Error ? err.message : String(err);
+  const stack = err instanceof Error ? (err.stack ?? "") : "";
+  const blob = `${msg}\n${stack}`;
+  if (/failed to load schema declare|store schema:|oke schema emit:/i.test(blob)) return true;
+  if (/schema\.decl/i.test(blob)) return true;
+  if (/emit-drizzle|emitColumnSource|emitDrizzleSource|maybeEmitDomainSchema/i.test(blob)) {
+    return true;
+  }
+  return declarePath.length > 0 && blob.includes(declarePath);
+}
+
+/**
+ * Frame a schema-sync failure for the `oke dev` loop: warn loud for developer
+ * bugs, soft-skip only known environmental gaps. Never crashes the session.
+ *
+ * Matches the fail-loud status style used by compose controls (`failed —` +
+ * red ●), and ADOPT_BARREL_STALE's "never silent" posture — without turning
+ * this path into a hard boot failure.
+ *
+ * @param cwd - Project root
+ * @param err - Caught value from {@link syncDevSchema} / watch push
+ * @param context - Boot one-shot vs schema-watch auto-push
+ */
+async function formatDevSchemaSyncFailure(
+  cwd: string,
+  err: unknown,
+  context: "boot" | "watch",
+): Promise<string> {
+  const msg = err instanceof Error ? err.message : String(err);
+  const color = termColorEnabled();
+  if (isBenignDevSchemaEnvSkip(msg)) {
+    return formatStatusLine(`oke db push (dev) skipped — ${msg}`, color);
+  }
+
+  const { resolveEmitPaths } = await import("../elements/store/emit-drizzle.ts");
+  const { declarePath } = resolveEmitPaths(cwd);
+  if (isSchemaDeclDefinitionError(err, declarePath)) {
+    return formatStatusLine(`schema.decl.ts has an error — ${msg}`, color, "error");
+  }
+
+  const label = context === "watch" ? "oke db push (schema change)" : "oke db push (dev)";
+  return formatStatusLine(`${label} failed — ${msg}`, color, "error");
+}
+
 /**
  * Load Manifest — prefer AoT extract from `src/` when it has flows;
  * otherwise on-disk JSON snapshots; otherwise a sparse extract.
@@ -1432,7 +1634,8 @@ async function tryLoadProjectManifest(cwd: string): Promise<Manifest | null | un
     const { extractManifest } = await import("../compiler/extract.ts");
     extracted = await extractManifest({ rootDir: cwd });
   } catch {
-    // Fall through to JSON snapshots.
+    // Inconsequential here: extract is one of two sources — fall through to on-disk JSON
+    // snapshots. A broken source tree still boots Console with the last good Manifest file.
   }
 
   let fromDisk: Manifest | undefined;
@@ -1474,8 +1677,8 @@ async function startAppHot(
     OKE_DEV_SURFACE: "Backend",
   };
 
-  // `--no-clear-screen`: Bun must not wipe the hero; the runner clears only
-  // request logs on soft reload and reprints Backend / Console / MCP URLs.
+  // `--no-clear-screen`: Bun must not wipe the parent board (claim + Docker).
+  // The runner reprints only the Backend ready line on soft reload.
   const proc = Bun.spawn(["bun", "--hot", "--no-clear-screen", runner], {
     cwd,
     env,
@@ -1492,7 +1695,7 @@ async function startAppHot(
       // open (create-oke afterEach `rmSync` otherwise races the child exit).
       proc.kill("SIGKILL");
     } catch {
-      // already exited
+      // Inconsequential: process already exited — kill is idempotent best-effort.
     }
     void unlink(readyPath).catch(() => {});
   };

package/src/cli/docker-cli.test.ts

@@ -42,7 +42,7 @@ describe("oke docker CLI", () => {
     expect(await Bun.file(join(dir, "docker/docker-compose.yml")).exists()).toBe(true);
     const yml = await Bun.file(join(dir, "docker/docker-compose.yml")).text();
     expect(yml).not.toContain("test-password-not-in-yaml");
-    expect(yml).toContain(".env.docker");
+    expect(yml).toContain(".env.local");
     expect(yml).toContain("/_/ready");
     expect(logs.join("")).toContain("docker-compose.override.yml");
   });
@@ -72,7 +72,7 @@ describe("oke stack", () => {
     const code = await runStackPreview({
       cwd: dir,
       images: {
-        "channel.email": "axllent/mailpit:v1.22.3",
+        "channel.email": "axllent/mailpit:v1.30.7",
       },
       write: (t) => {
         out += t;

package/src/cli/docker.ts

@@ -183,7 +183,7 @@ export async function dockerCli(args: readonly string[]): Promise<number> {
 Derive production-grade Docker artefacts under docker/ (default).
 
 Layouts (mutually exclusive; default --single):
-  --single          docker-compose.yml + Dockerfile (+ .env.docker via oke dev)
+  --single          docker-compose.yml + Dockerfile (+ .env.local via oke dev)
   --split           compose.yml + compose.<role>.yml (+ compose.prod.yml)
   --stack           docker-stack.yml for docker stack deploy
 

package/src/cli/doctor.ts

@@ -41,6 +41,7 @@ function flattenEffectiveDrivers(
     ["vault", drivers.vault],
     ["channel.email", drivers.channel.email],
     ["channel.sms", drivers.channel.sms],
+    ["runs", drivers.runs],
   ];
 }
 
@@ -215,7 +216,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
       // protection the moment DB + env are stolen together.
       severity: "error",
       message:
-        'vault master key comes from an environment variable in prod — set vault.encryption.masterKey = { kind: "kms", keyId } (or use managed aws-secrets-manager) so the key is never readable from the process environment',
+        'vault master key comes from an environment variable in prod — set vault.encryption.masterKey = { kind: "kms", keyId } (or use a managed provider) so the key is never readable from the process environment',
     });
   }
 

package/src/cli/drizzle-env.test.ts

@@ -3,7 +3,7 @@
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { OkeConfig } from "../config/index.ts";
@@ -39,11 +39,7 @@ describe("resolveDrizzleKitEnv", () => {
 
   test("dev env → postgresql dialect + DATABASE_URL from compose env", async () => {
     const dir = await tempDir();
-    await mkdir(join(dir, "docker"), { recursive: true });
-    await writeFile(
-      join(dir, "docker", ".env.docker"),
-      "DATABASE_URL=postgres://u:p@127.0.0.1:5432/oke\n",
-    );
+    await writeFile(join(dir, ".env.local"), "DATABASE_URL=postgres://u:p@127.0.0.1:5432/oke\n");
     const prevDb = process.env["DATABASE_URL"];
     delete process.env["DATABASE_URL"];
     try {
@@ -72,11 +68,10 @@ describe("resolveDrizzleKitEnv", () => {
 });
 
 describe("applyComposeEnvToProcess", () => {
-  test("fills unset keys from docker/.env.docker without overwriting", async () => {
+  test("fills unset keys from .env.local without overwriting", async () => {
     const dir = await tempDir();
-    await mkdir(join(dir, "docker"), { recursive: true });
     await writeFile(
-      join(dir, "docker", ".env.docker"),
+      join(dir, ".env.local"),
       "DATABASE_URL=postgres://u:p@127.0.0.1:5432/oke\nREDIS_URL=redis://127.0.0.1:6379\n",
     );
     const prevDb = process.env["DATABASE_URL"];

package/src/cli/drizzle-env.ts

@@ -22,7 +22,7 @@ export interface DrizzleKitEnvContext {
 }
 
 /**
- * Load `docker/.env.docker` (or legacy `.env.docker`) as a name→value map.
+ * Load `.env.local` as a name→value map.
  *
  * @param cwd - Project root
  */
@@ -38,7 +38,7 @@ export async function readComposeEnv(cwd: string): Promise<Map<string, string>>
 }
 
 /**
- * Fill unset `process.env` keys from compose `.env.docker` (never overwrites).
+ * Fill unset `process.env` keys from `.env.local` (never overwrites).
  *
  * SQL / Redis binders read `process.env` directly — Vault can resolve the
  * same file, but `oke db seed` must hydrate env before `app.boot()`.