okengine 0.11.2 → 0.12.0

package/src/auth/password-policy.test.ts

@@ -5,17 +5,154 @@ import {
   sha1HexUpper,
   BreachCheckError,
 } from "./breach-check.ts";
-import { assertPasswordPolicy, PasswordPolicyError } from "./password-policy.ts";
+import {
+  assertPasswordPolicy,
+  DEFAULT_PASSWORD_POLICY,
+  generatePassword,
+  PasswordPolicyError,
+  resolvePasswordPolicy,
+} from "./password-policy.ts";
+import {
+  CONSOLE_PASSWORD_POLICY,
+  consolePasswordMeetsPolicy,
+  evaluateConsolePasswordRules,
+  generateConsolePassword,
+} from "../console/password-policy.ts";
 import { createBunCrypto } from "../runtime/primitives.ts";
 import { ARGON2ID_MEMORY_COST_FLOOR } from "../runtime/types.ts";
 import { createOperator, createOperatorStore } from "./operator.ts";
 import { createSessionStore, issueSession, rotateRefresh, SessionError } from "./sessions.ts";
 
 describe("password policy", () => {
-  test("defaults require length 12, letter, number", () => {
-    expect(() => assertPasswordPolicy("short1A", {})).toThrow(PasswordPolicyError);
-    expect(() => assertPasswordPolicy("longenoughword", {})).toThrow(PasswordPolicyError);
-    expect(() => assertPasswordPolicy("Longenough12", {})).not.toThrow();
+  test("defaults require length 8, upper, lower, number, special", () => {
+    expect(() => assertPasswordPolicy("Aa1!", {})).toThrow(PasswordPolicyError);
+    expect(() => assertPasswordPolicy("password", {})).toThrow(PasswordPolicyError);
+    expect(() => assertPasswordPolicy("Password1", {})).toThrow(PasswordPolicyError);
+    expect(() => assertPasswordPolicy("Password1!", {})).not.toThrow();
+  });
+
+  test("DEFAULT_PASSWORD_POLICY separates upper, lower, and requireSpecial", () => {
+    const resolved = resolvePasswordPolicy(DEFAULT_PASSWORD_POLICY);
+    expect(resolved.minLength).toBe(8);
+    expect(resolved.requireLetter).toBe(true);
+    expect(resolved.requireNumber).toBe(true);
+    expect(resolved.requireUppercase).toBe(true);
+    expect(resolved.requireLowercase).toBe(true);
+    expect(resolved.requireSpecial).toBe(true);
+
+    expect(() => assertPasswordPolicy("password1!", DEFAULT_PASSWORD_POLICY)).toThrow(
+      /requireUppercase/,
+    );
+    expect(() => assertPasswordPolicy("PASSWORD1!", DEFAULT_PASSWORD_POLICY)).toThrow(
+      /requireLowercase/,
+    );
+  });
+
+  test("rejects password missing ONLY a special character (Global + Console)", () => {
+    // Global: length 8+, upper, lower, number — no special.
+    const globalOnlyMissingSpecial = "Password1";
+    expect(globalOnlyMissingSpecial.length).toBeGreaterThanOrEqual(
+      DEFAULT_PASSWORD_POLICY.minLength,
+    );
+    expect(/[A-Z]/.test(globalOnlyMissingSpecial)).toBe(true);
+    expect(/[a-z]/.test(globalOnlyMissingSpecial)).toBe(true);
+    expect(/\d/.test(globalOnlyMissingSpecial)).toBe(true);
+    expect(/[^A-Za-z0-9]/.test(globalOnlyMissingSpecial)).toBe(false);
+    expect(() => assertPasswordPolicy(globalOnlyMissingSpecial, DEFAULT_PASSWORD_POLICY)).toThrow(
+      PasswordPolicyError,
+    );
+    try {
+      assertPasswordPolicy(globalOnlyMissingSpecial, DEFAULT_PASSWORD_POLICY);
+    } catch (err) {
+      expect(err).toBeInstanceOf(PasswordPolicyError);
+      expect((err as PasswordPolicyError).reasons).toEqual(["requireSpecial"]);
+    }
+
+    // Console: length 12+, upper, lower, number — no special.
+    const consoleOnlyMissingSpecial = "Password1234";
+    expect(consoleOnlyMissingSpecial.length).toBeGreaterThanOrEqual(
+      CONSOLE_PASSWORD_POLICY.minLength,
+    );
+    expect(/[A-Z]/.test(consoleOnlyMissingSpecial)).toBe(true);
+    expect(/[a-z]/.test(consoleOnlyMissingSpecial)).toBe(true);
+    expect(/\d/.test(consoleOnlyMissingSpecial)).toBe(true);
+    expect(/[^A-Za-z0-9]/.test(consoleOnlyMissingSpecial)).toBe(false);
+    expect(() => assertPasswordPolicy(consoleOnlyMissingSpecial, CONSOLE_PASSWORD_POLICY)).toThrow(
+      PasswordPolicyError,
+    );
+    try {
+      assertPasswordPolicy(consoleOnlyMissingSpecial, CONSOLE_PASSWORD_POLICY);
+    } catch (err) {
+      expect(err).toBeInstanceOf(PasswordPolicyError);
+      expect((err as PasswordPolicyError).reasons).toEqual(["requireSpecial"]);
+    }
+  });
+
+  test("requireUppercase, requireLowercase, and requireSpecial can be turned off", () => {
+    const loose = {
+      minLength: 8,
+      requireUppercase: false,
+      requireLowercase: false,
+      requireSpecial: false,
+      requireLetter: true,
+      requireNumber: true,
+    };
+    expect(() => assertPasswordPolicy("password1", loose)).not.toThrow();
+    expect(() => assertPasswordPolicy("PASSWORD1", loose)).not.toThrow();
+  });
+
+  test("ui-next checklist criteria match Console server validation exactly", () => {
+    const rules = evaluateConsolePasswordRules("");
+    expect(rules.map((r) => r.id)).toEqual([
+      "length",
+      "uppercase",
+      "lowercase",
+      "number",
+      "special",
+    ]);
+    expect(rules.find((r) => r.id === "length")?.label).toBe(
+      `At least ${CONSOLE_PASSWORD_POLICY.minLength} characters`,
+    );
+    expect(CONSOLE_PASSWORD_POLICY.minLength).toBe(12);
+    expect(CONSOLE_PASSWORD_POLICY.requireSpecial).toBe(true);
+
+    const samples = [
+      "",
+      "short",
+      "password1234",
+      "Password1234",
+      "PASSWORD1234!",
+      "Password!!!!!",
+      "Password12!!",
+      "CorrectHorse1!",
+    ];
+    for (const password of samples) {
+      const allMet = evaluateConsolePasswordRules(password).every((rule) => rule.met);
+      const serverOk = consolePasswordMeetsPolicy(password);
+      expect(allMet).toBe(serverOk);
+      if (serverOk) {
+        expect(() => assertPasswordPolicy(password, CONSOLE_PASSWORD_POLICY)).not.toThrow();
+      } else {
+        expect(() => assertPasswordPolicy(password, CONSOLE_PASSWORD_POLICY)).toThrow(
+          PasswordPolicyError,
+        );
+      }
+    }
+  });
+
+  test("generatePassword always satisfies the requested policy", () => {
+    const seen = new Set<string>();
+    for (let i = 0; i < 64; i++) {
+      const password = generatePassword(CONSOLE_PASSWORD_POLICY);
+      expect(password.length).toBeGreaterThanOrEqual(CONSOLE_PASSWORD_POLICY.minLength);
+      expect(() => assertPasswordPolicy(password, CONSOLE_PASSWORD_POLICY)).not.toThrow();
+      expect(consolePasswordMeetsPolicy(password)).toBe(true);
+      expect(evaluateConsolePasswordRules(password).every((rule) => rule.met)).toBe(true);
+      seen.add(password);
+    }
+    expect(seen.size).toBe(64);
+    expect(() => assertPasswordPolicy(generatePassword(), DEFAULT_PASSWORD_POLICY)).not.toThrow();
+    expect(generateConsolePassword()).toHaveLength(16);
   });
 
   test("createOperator rejects weak passwords by default without passwordPolicy", async () => {

package/src/auth/password-policy.ts

@@ -2,16 +2,23 @@
  * Password policy — length + character-class rules (never weaker defaults).
  */
 
+/** Non-alphanumeric special character (any Unicode letter/digit excluded via ASCII class). */
+const SPECIAL_CHAR_RE = /[^A-Za-z0-9]/;
+
 /** Options for {@link assertPasswordPolicy}. */
 export interface PasswordPolicyOptions {
-  /** Minimum length (default 12). */
+  /** Minimum length (default {@link DEFAULT_PASSWORD_MIN_LENGTH}). */
   readonly minLength?: number;
   /** Require at least one letter (default true). */
   readonly requireLetter?: boolean;
   /** Require at least one digit (default true). */
   readonly requireNumber?: boolean;
-  /** Require at least one non-alphanumeric symbol (default false). */
-  readonly requireSymbol?: boolean;
+  /** Require at least one uppercase letter (default true). */
+  readonly requireUppercase?: boolean;
+  /** Require at least one lowercase letter (default true). */
+  readonly requireLowercase?: boolean;
+  /** Require at least one non-alphanumeric special character (default true). */
+  readonly requireSpecial?: boolean;
 }
 
 /** Resolved policy with defaults applied. */
@@ -19,11 +26,26 @@ export interface ResolvedPasswordPolicy {
   readonly minLength: number;
   readonly requireLetter: boolean;
   readonly requireNumber: boolean;
-  readonly requireSymbol: boolean;
+  readonly requireUppercase: boolean;
+  readonly requireLowercase: boolean;
+  readonly requireSpecial: boolean;
 }
 
-/** Default minimum password length. */
-export const DEFAULT_PASSWORD_MIN_LENGTH = 12;
+/** Default minimum password length (global / Gate auth). */
+export const DEFAULT_PASSWORD_MIN_LENGTH = 8;
+
+/**
+ * Global password policy defaults (Gate auth / `createIdentity` / `createOperator`
+ * when no `passwordPolicy` is passed). Console claim uses a stricter constant.
+ */
+export const DEFAULT_PASSWORD_POLICY: ResolvedPasswordPolicy = {
+  minLength: DEFAULT_PASSWORD_MIN_LENGTH,
+  requireLetter: true,
+  requireNumber: true,
+  requireUppercase: true,
+  requireLowercase: true,
+  requireSpecial: true,
+};
 
 /**
  * Resolve policy options with safe defaults.
@@ -32,13 +54,24 @@ export const DEFAULT_PASSWORD_MIN_LENGTH = 12;
  */
 export function resolvePasswordPolicy(options: PasswordPolicyOptions = {}): ResolvedPasswordPolicy {
   return {
-    minLength: options.minLength ?? DEFAULT_PASSWORD_MIN_LENGTH,
-    requireLetter: options.requireLetter ?? true,
-    requireNumber: options.requireNumber ?? true,
-    requireSymbol: options.requireSymbol ?? false,
+    minLength: options.minLength ?? DEFAULT_PASSWORD_POLICY.minLength,
+    requireLetter: options.requireLetter ?? DEFAULT_PASSWORD_POLICY.requireLetter,
+    requireNumber: options.requireNumber ?? DEFAULT_PASSWORD_POLICY.requireNumber,
+    requireUppercase: options.requireUppercase ?? DEFAULT_PASSWORD_POLICY.requireUppercase,
+    requireLowercase: options.requireLowercase ?? DEFAULT_PASSWORD_POLICY.requireLowercase,
+    requireSpecial: options.requireSpecial ?? DEFAULT_PASSWORD_POLICY.requireSpecial,
   };
 }
 
+/**
+ * Whether `password` contains a non-alphanumeric special character.
+ *
+ * @param password - Plaintext
+ */
+export function passwordHasSpecial(password: string): boolean {
+  return SPECIAL_CHAR_RE.test(password);
+}
+
 /**
  * Validate a password against policy. Throws {@link PasswordPolicyError}.
  *
@@ -54,17 +87,100 @@ export function assertPasswordPolicy(password: string, options: PasswordPolicyOp
   if (policy.requireLetter && !/[A-Za-z]/.test(password)) {
     reasons.push("requireLetter");
   }
+  if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+    reasons.push("requireUppercase");
+  }
+  if (policy.requireLowercase && !/[a-z]/.test(password)) {
+    reasons.push("requireLowercase");
+  }
   if (policy.requireNumber && !/\d/.test(password)) {
     reasons.push("requireNumber");
   }
-  if (policy.requireSymbol && !/[^A-Za-z0-9]/.test(password)) {
-    reasons.push("requireSymbol");
+  if (policy.requireSpecial && !passwordHasSpecial(password)) {
+    reasons.push("requireSpecial");
   }
   if (reasons.length > 0) {
     throw new PasswordPolicyError(reasons);
   }
 }
 
+/** Extra options for {@link generatePassword}. */
+export interface GeneratePasswordOptions extends PasswordPolicyOptions {
+  /** Output length (default `max(minLength, 16)`). */
+  readonly length?: number;
+}
+
+const GEN_UPPER = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+const GEN_LOWER = "abcdefghijkmnpqrstuvwxyz";
+const GEN_DIGITS = "23456789";
+const GEN_SPECIAL = "!@#$%^&*-_=+?";
+
+/**
+ * Cryptographically random password that satisfies {@link assertPasswordPolicy}.
+ * Ambiguous glyphs (`0O1Il`) are omitted so a revealed value is easy to retype.
+ *
+ * @param options - Policy + optional length
+ */
+export function generatePassword(options: GeneratePasswordOptions = {}): string {
+  const policy = resolvePasswordPolicy(options);
+  const length = options.length ?? Math.max(policy.minLength, 16);
+  if (length < policy.minLength) {
+    throw new Error(`generatePassword: length ${length} is below minLength ${policy.minLength}`);
+  }
+
+  const classes: string[] = [];
+  if (policy.requireUppercase) classes.push(GEN_UPPER);
+  if (policy.requireLowercase) classes.push(GEN_LOWER);
+  if (policy.requireLetter && !policy.requireUppercase && !policy.requireLowercase) {
+    classes.push(GEN_UPPER + GEN_LOWER);
+  }
+  if (policy.requireNumber) classes.push(GEN_DIGITS);
+  if (policy.requireSpecial) classes.push(GEN_SPECIAL);
+  const pool = classes.length > 0 ? classes.join("") : GEN_UPPER + GEN_LOWER + GEN_DIGITS;
+  if (length < classes.length) {
+    throw new Error(`generatePassword: length ${length} cannot cover ${classes.length} classes`);
+  }
+
+  const chars: string[] = classes.map((set) => pickChar(set));
+  while (chars.length < length) chars.push(pickChar(pool));
+  shuffleInPlace(chars);
+  const password = chars.join("");
+  assertPasswordPolicy(password, policy);
+  return password;
+}
+
+function pickChar(set: string): string {
+  return set[randomInt(set.length)] ?? set[0]!;
+}
+
+function shuffleInPlace(items: string[]): void {
+  for (let i = items.length - 1; i > 0; i--) {
+    const j = randomInt(i + 1);
+    const a = items[i]!;
+    items[i] = items[j]!;
+    items[j] = a;
+  }
+}
+
+/** Unbiased `0 .. maxExclusive-1` from `crypto.getRandomValues`. */
+function randomInt(maxExclusive: number): number {
+  if (!Number.isInteger(maxExclusive) || maxExclusive <= 0) {
+    throw new Error("randomInt: maxExclusive must be a positive integer");
+  }
+  const bytes = maxExclusive <= 256 ? 1 : 2;
+  const range = bytes === 1 ? 256 : 65536;
+  if (maxExclusive > range) {
+    throw new Error(`randomInt: maxExclusive ${maxExclusive} exceeds ${range}`);
+  }
+  const limit = range - (range % maxExclusive);
+  const buf = new Uint8Array(bytes);
+  for (;;) {
+    crypto.getRandomValues(buf);
+    const value = bytes === 1 ? (buf[0] ?? 0) : ((buf[0] ?? 0) << 8) | (buf[1] ?? 0);
+    if (value < limit) return value % maxExclusive;
+  }
+}
+
 /** Password failed policy checks. */
 export class PasswordPolicyError extends Error {
   readonly reasons: readonly string[];

package/src/auth/plugin.ts

@@ -40,8 +40,8 @@ export interface AuthPluginOptions {
    */
   readonly password?: PasswordHashOptions;
   /**
-   * Password length / character-class policy (defaults: minLength 12,
-   * letter + number). Credential-set paths enforce defaults unless a
+   * Password length / character-class policy (defaults: minLength 8,
+   * letter, number, upper, lower, symbol). Credential-set paths enforce defaults unless a
    * caller passes `skipPasswordPolicy` (tests only).
    */
   readonly passwordPolicy?: PasswordPolicyOptions;

package/src/cli/ai-setup/ai-setup.test.ts

@@ -151,7 +151,7 @@ export default defineConfig({
 
       const config = readFileSync(join(dir, "oke.config.ts"), "utf8");
       expect(config).toContain('dev: "ollama"');
-      expect(config).toContain('ai: "ollama/ollama:0.32.6"');
+      expect(config).toContain('ai: "ollama/ollama:0.32.13"');
       const env = readFileSync(join(dir, ".env.local"), "utf8");
       expect(env).toContain("# OKE_AI_DRIVER=ollama");
       expect(env).toMatch(/^#\s*OKE_AI_MODEL=gemma4:e4b$/m);

package/src/cli/ai-setup/apply.ts

@@ -5,7 +5,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { OLLAMA_IMAGE } from "../../docker/recipes/index.ts";
-import { DEFAULT_DOCKER_DIR } from "../../docker/types.ts";
 
 /** Choices applied to the project. */
 export type AiSetupApplyInput = {
@@ -70,10 +69,8 @@ export function applyAiSetup(
     : existsSync(envExample)
       ? readFileSync(envExample, "utf8")
       : "";
-  // Driver / URL / model stay commented so docker mode can hydrate from
-  // `docker/.env.docker` without being shadowed. The chosen model is still
-  // written into `.env.local` as a hint (and into `.env.docker` when present);
-  // `loadExistingStackControls` seeds commented `OKE_AI_MODEL` on first boot.
+  // Driver / URL / model stay commented so `oke dev --docker` can write
+  // the live compose URL into `.env.local` without a leftover pin winning.
   env = upsertEnv(env, "OKE_AI_DRIVER", input.driver, { comment: true });
   if (input.baseUrl) env = upsertEnv(env, "OKE_AI_URL", input.baseUrl, { comment: true });
   if (input.chatModel) {
@@ -94,18 +91,6 @@ export function applyAiSetup(
   }
   writeFileSync(envPath, env.endsWith("\n") ? env : `${env}\n`, "utf8");
 
-  // `docker/.env.docker` is regenerated from `.env.local` only on its first
-  // boot (existing values there are treated as durable, possibly hand-edited
-  // pins — see stack-id.ts). Once it exists, a later `oke ai setup` run must
-  // update it directly, or the docker profile keeps the old model forever.
-  if (input.chatModel) {
-    const dockerEnvPath = join(cwd, DEFAULT_DOCKER_DIR, ".env.docker");
-    if (existsSync(dockerEnvPath)) {
-      const dockerEnv = readFileSync(dockerEnvPath, "utf8");
-      writeFileSync(dockerEnvPath, upsertEnv(dockerEnv, "OKE_AI_MODEL", input.chatModel), "utf8");
-    }
-  }
-
   const aiTsPath = writeAiModels(cwd, input);
 
   return { configPath, envPath, aiTsPath };
@@ -162,7 +147,7 @@ export function upsertImage(source: string, key: string, image: string): string
 export type UpsertEnvOptions = {
   /**
    * When true, write `# KEY=value` (opt-in override). Used for AI stack keys
-   * so they do not shadow `docker/.env.docker`.
+   * so `oke dev --docker` can write the live compose URL into `.env.local`.
    */
   readonly comment?: boolean;
 };

package/src/cli/ai-setup/index.ts

@@ -205,7 +205,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "granite3.3:2b",
       visionModel: null,
       embedModel: null,
-      image: "ghcr.io/ggml-org/llama.cpp:server-b10290",
+      image: "ghcr.io/ggml-org/llama.cpp:server-b10450",
     };
   }
   if (provider === "ollama") {
@@ -215,7 +215,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "gemma4:e4b",
       visionModel: args.vision === undefined ? "qwen3-vl:4b" : args.vision || null,
       embedModel: args.embed ?? "nomic-embed-text",
-      image: "ollama/ollama:0.32.6",
+      image: "ollama/ollama:0.32.13",
     };
   }
   if (provider === "vllm") {
@@ -225,7 +225,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "Qwen/Qwen3-0.6B",
       visionModel: null,
       embedModel: null,
-      image: "vllm/vllm-openai:v0.26.0",
+      image: "vllm/vllm-openai:v0.27.1",
     };
   }
   if (provider === "sglang") {
@@ -235,7 +235,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "Qwen/Qwen3-0.6B",
       visionModel: null,
       embedModel: null,
-      image: "lmsysorg/sglang:v0.5.16-runtime",
+      image: "lmsysorg/sglang:v0.5.17-runtime",
     };
   }
   if (provider === "anthropic") {

package/src/cli/ai-setup/prompts.ts

@@ -250,7 +250,7 @@ async function askSelfHostedGpuPath(
 ): Promise<AiSetupApplyInput | null> {
   const port = provider === "vllm" ? 8000 : 30000;
   const image =
-    provider === "vllm" ? "vllm/vllm-openai:v0.26.0" : "lmsysorg/sglang:v0.5.16-runtime";
+    provider === "vllm" ? "vllm/vllm-openai:v0.27.1" : "lmsysorg/sglang:v0.5.17-runtime";
   const model = await text({
     message: "Hugging Face model id",
     placeholder: "Qwen/Qwen3-0.6B",

package/src/cli/ask-seed.test.ts

@@ -32,6 +32,33 @@ describe("maybeAskSeed", () => {
     }
   });
 
+  test("re-asks when the seed identity changes", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "ask-seed-"));
+    try {
+      mkdirSync(join(dir, "src", "db", "seed"), { recursive: true });
+      writeFileSync(join(dir, "src", "db", "seed", "index.ts"), "export default {};\n");
+      mkdirSync(join(dir, ".oke"), { recursive: true });
+      writeFileSync(
+        join(dir, PROJECT_STATE_REL),
+        `${JSON.stringify({ seededAt: "2026-01-01T00:00:00.000Z", seed: "notes" }, null, 2)}\n`,
+      );
+      let calls = 0;
+      await maybeAskSeed({
+        cwd: dir,
+        env: "test",
+        stdinIsTTY: true,
+        confirmFn: async () => true,
+        seedFn: async () => {
+          calls += 1;
+          return 0;
+        },
+      });
+      expect(calls).toBe(1);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("asks once then writes .oke/state.json seededAt", async () => {
     const dir = mkdtempSync(join(tmpdir(), "ask-seed-"));
     try {

package/src/cli/ask-seed.ts

@@ -4,8 +4,9 @@
 
 import { confirm, isCancel } from "@clack/prompts";
 import type { ConfigEnv } from "../config/index.ts";
+import { resolveSeedIdentity, seedPromptMessage } from "../elements/store/seed.ts";
 import { formatCliChrome } from "../term.ts";
-import { resolveSeedModulePath, runSeed } from "./db-seed.ts";
+import { loadSeedDef, resolveSeedModulePath, runSeed } from "./db-seed.ts";
 import { isProjectSeeded, markProjectSeeded } from "./project-state.ts";
 
 /** @deprecated Use `.oke/state.json` `seededAt` via {@link isProjectSeeded}. */
@@ -26,8 +27,9 @@ export interface AskSeedOptions {
 }
 
 /**
- * After a successful `oke db push`, ask once whether to seed sample data.
- * Skips when non-TTY, already seeded, or no seed module.
+ * After a successful `oke db push`, ask once whether to seed this app
+ * (`defineSeed({ name })` or the project folder). Skips when non-TTY,
+ * already seeded for that identity, or no seed module.
  *
  * @param options - Project / env / injectables
  */
@@ -37,11 +39,13 @@ export async function maybeAskSeed(options: AskSeedOptions): Promise<void> {
   if (!tty) return;
 
   const cwd = options.cwd;
-  if (await isProjectSeeded(cwd)) return;
-
   const seedPath = await resolveSeedModulePath(cwd);
   if (!(await Bun.file(seedPath).exists())) return;
 
+  const def = await loadSeedDef(cwd).catch(() => undefined);
+  const identity = resolveSeedIdentity(def, cwd);
+  if (await isProjectSeeded(cwd, identity.name)) return;
+
   const write = options.write ?? ((t) => process.stdout.write(t));
   const chromeWrite = (t: string) => write(formatCliChrome(t));
   const ok =
@@ -49,7 +53,7 @@ export async function maybeAskSeed(options: AskSeedOptions): Promise<void> {
       ? await options.confirmFn()
       : await (async () => {
           const value = await confirm({
-            message: "Run oke db seed (essential + sample data)?",
+            message: seedPromptMessage(identity),
             initialValue: true,
           });
           if (isCancel(value)) return false;
@@ -73,6 +77,6 @@ export async function maybeAskSeed(options: AskSeedOptions): Promise<void> {
       }));
   const code = await seed(cwd, options.env);
   if (code === 0) {
-    await markProjectSeeded(cwd);
+    await markProjectSeeded(cwd, { seed: identity.name });
   }
 }