okengine 0.2.5 → 0.2.8

package/src/cli/doc-drift.ts

@@ -81,13 +81,12 @@ async function loadMermaid(): Promise<typeof import("mermaid").default> {
 }
 
 /** App section heading → example package directory name. */
-const APP_SECTIONS: ReadonlyArray<{ readonly re: RegExp; readonly app: string }> =
-  [
-    { re: /^# 1 · BASIC — Notes\b/m, app: "notes" },
-    { re: /^# 2 · INTERMEDIATE — Linkly\b/m, app: "linkly" },
-    { re: /^# 3 · ADVANCED — Provisions\b/m, app: "provisions" },
-    { re: /^# 4 · COMPLEX — Skyport\b/m, app: "skyport" },
-  ];
+const APP_SECTIONS: ReadonlyArray<{ readonly re: RegExp; readonly app: string }> = [
+  { re: /^# 1 · BASIC — Notes\b/m, app: "notes" },
+  { re: /^# 2 · INTERMEDIATE — Linkly\b/m, app: "linkly" },
+  { re: /^# 3 · ADVANCED — Provisions\b/m, app: "provisions" },
+  { re: /^# 4 · COMPLEX — Skyport\b/m, app: "skyport" },
+];
 
 /**
  * Normalize TypeScript source for containment comparison.
@@ -95,12 +94,9 @@ const APP_SECTIONS: ReadonlyArray<{ readonly re: RegExp; readonly app: string }>
  * @param text - Raw source
  */
 export function normalizeTs(text: string): string {
-  return text
-    .replace(/\r\n/g, "\n")
-    .split("\n")
-    .map((line) => line.replace(/[ \t]+$/g, ""))
-    .join("\n")
-    .trim();
+  // Collapse all whitespace so claimed fences match sources regardless of
+  // indent (e.g. oxfmt-formatted bodies inside `test(...)` callbacks).
+  return text.replace(/\s+/g, " ").trim();
 }
 
 /** One claimed fence extracted from a markdown document. */
@@ -136,9 +132,7 @@ export function parseMermaidFences(markdown: string): MermaidFence[] {
       i++;
     }
     if (i >= lines.length || !lines[i]!.startsWith("```")) {
-      throw new Error(
-        `doc-drift: unclosed mermaid fence (line ${startLine})`,
-      );
+      throw new Error(`doc-drift: unclosed mermaid fence (line ${startLine})`);
     }
     fences.push({ body: bodyLines.join("\n").trim(), startLine });
   }
@@ -165,15 +159,11 @@ export async function checkMermaidSyntax(
     try {
       const result = await mermaid.parse(fence.body);
       if (!result) {
-        failures.push(
-          `mermaid: parse returned false (line ${fence.startLine})`,
-        );
+        failures.push(`mermaid: parse returned false (line ${fence.startLine})`);
       }
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      failures.push(
-        `mermaid: invalid syntax (line ${fence.startLine}): ${detail.split("\n")[0]}`,
-      );
+      failures.push(`mermaid: invalid syntax (line ${fence.startLine}): ${detail.split("\n")[0]}`);
     }
   }
 
@@ -280,10 +270,7 @@ export function parseClaimedFences(markdown: string): ClaimedFence[] {
  * @param targetPath - File or directory (`tests/`)
  * @param expected - Normalized fence body
  */
-async function containsFence(
-  targetPath: string,
-  expected: string,
-): Promise<boolean> {
+async function containsFence(targetPath: string, expected: string): Promise<boolean> {
   const direct = Bun.file(targetPath);
   if (await direct.exists()) {
     const st = await direct.stat();
@@ -293,9 +280,7 @@ async function containsFence(
   }
 
   // Directory claim (`### \`tests/\``) — any nested file may contain the fence.
-  const dirPath = targetPath.endsWith("/")
-    ? targetPath.slice(0, -1)
-    : targetPath;
+  const dirPath = targetPath.endsWith("/") ? targetPath.slice(0, -1) : targetPath;
   try {
     const glob = new Bun.Glob("**/*.{ts,tsx,js,jsx}");
     for await (const rel of glob.scan({ cwd: dirPath, onlyFiles: true })) {
@@ -354,9 +339,7 @@ export async function runDocDrift(
 
   for (const path of paths) {
     const abs = resolve(ROOT, path);
-    const label = abs.startsWith(ROOT + "/")
-      ? abs.slice(ROOT.length + 1)
-      : abs;
+    const label = abs.startsWith(ROOT + "/") ? abs.slice(ROOT.length + 1) : abs;
     const requireClaimed = !label.startsWith("site/");
     const markdown = await Bun.file(abs).text();
     const fences = parseClaimedFences(markdown);
@@ -371,14 +354,10 @@ export async function runDocDrift(
       total += fences.length;
       if (!result.ok) {
         ok = false;
-        messages.push(
-          `doc-drift: ${result.failures.length} failure(s) in ${label}`,
-        );
+        messages.push(`doc-drift: ${result.failures.length} failure(s) in ${label}`);
         for (const f of result.failures) messages.push(`  · ${f}`);
       } else {
-        messages.push(
-          `doc-drift: ok — ${fences.length} claimed fence(s) in ${label}`,
-        );
+        messages.push(`doc-drift: ok — ${fences.length} claimed fence(s) in ${label}`);
       }
     }
 
@@ -388,21 +367,16 @@ export async function runDocDrift(
       const mermaidResult = await checkMermaidSyntax(mermaidFences);
       if (!mermaidResult.ok) {
         ok = false;
-        messages.push(
-          `doc-drift: ${mermaidResult.failures.length} mermaid failure(s) in ${label}`,
-        );
+        messages.push(`doc-drift: ${mermaidResult.failures.length} mermaid failure(s) in ${label}`);
         for (const f of mermaidResult.failures) messages.push(`  · ${f}`);
       } else {
-        messages.push(
-          `doc-drift: ok — ${mermaidFences.length} mermaid fence(s) in ${label}`,
-        );
+        messages.push(`doc-drift: ok — ${mermaidFences.length} mermaid fence(s) in ${label}`);
       }
     }
   }
 
   if (ok && checkedFiles > 1) {
-    const mermaidNote =
-      mermaidTotal > 0 ? ` · ${mermaidTotal} mermaid fence(s)` : "";
+    const mermaidNote = mermaidTotal > 0 ? ` · ${mermaidTotal} mermaid fence(s)` : "";
     messages.push(
       `doc-drift: ok — ${total} claimed fence(s) across ${checkedFiles} file(s)${mermaidNote}`,
     );
@@ -413,10 +387,7 @@ export async function runDocDrift(
 
 async function main(): Promise<number> {
   const args = process.argv.slice(2);
-  const paths =
-    args.length > 0
-      ? args
-      : [...REQUIRED_DOCS, ...(await discoverSiteDocs(ROOT))];
+  const paths = args.length > 0 ? args : [...REQUIRED_DOCS, ...(await discoverSiteDocs(ROOT))];
   const { ok, messages } = await runDocDrift(paths);
   for (const m of messages) {
     if (ok) console.log(m);

package/src/cli/doc-staleness.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Gate: removed legacy stack-mode soft-compat stays gone.
+ *
+ * Mirrors {@link ../drivers/vault-driver-removal.test.ts} — `git grep` over the
+ * tracked tree must find zero hits (changelog history may still document the
+ * rename; upgrade codemods may still rewrite the old tokens).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dir, "../..");
+
+/** Forbidden CLI flag, split so this file does not match itself. */
+const FORBIDDEN_STACK_FLAG = ["--", "stack"].join("");
+/** Forbidden compose env filename. */
+const FORBIDDEN_ENV_STACK = [".env.", "stack"].join("");
+/** Forbidden env var — name avoids the contiguous token so this file is clean. */
+const FORBIDDEN_LEGACY_ENV = ["OKE_", "STACK"].join("");
+/** Forbidden vault helper. */
+const FORBIDDEN_FROM_STACK = ["from", "Stack"].join("");
+
+/**
+ * Run `git grep -F` and assert zero matches after ignoring allow-listed paths.
+ *
+ * @param pattern - Fixed-string pattern
+ * @param ignorePrefixes - Path prefixes to ignore (`path:line:` hits)
+ */
+function assertZeroGitGrep(pattern: string, ignorePrefixes: readonly string[] = []): void {
+  const proc = Bun.spawnSync(["git", "grep", "-F", "-n", "-e", pattern, "--"], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  // git grep exits 1 when there are no matches.
+  if (proc.exitCode === 1) {
+    expect(proc.stdout.toString()).toBe("");
+    return;
+  }
+  const hits = proc.stdout
+    .toString()
+    .trim()
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .filter((line) => !ignorePrefixes.some((prefix) => line.startsWith(prefix)));
+  expect(hits.join("\n")).toBe("");
+}
+
+describe("legacy stack-mode removal gate", () => {
+  test("tracked tree has zero legacy docker-mode flag outside changelog", () => {
+    assertZeroGitGrep(FORBIDDEN_STACK_FLAG, ["docs/changelog.md:"]);
+  });
+
+  test("tracked tree has zero legacy compose env filename outside changelog", () => {
+    assertZeroGitGrep(FORBIDDEN_ENV_STACK, ["docs/changelog.md:"]);
+  });
+
+  test("tracked tree has zero legacy OKE env outside changelog", () => {
+    assertZeroGitGrep(FORBIDDEN_LEGACY_ENV, ["docs/changelog.md:"]);
+  });
+
+  test("tracked tree has zero legacy vault helper outside changelog + upgrade", () => {
+    assertZeroGitGrep(FORBIDDEN_FROM_STACK, [
+      "docs/changelog.md:",
+      "src/upgrade/codemods.ts:",
+      "src/upgrade/codemods.test.ts:",
+    ]);
+  });
+});

package/src/cli/docker-cli.test.ts

@@ -1,5 +1,5 @@
 /**
- * `oke docker` / `oke stack` / `oke images pin` / `oke schema` / `oke dev --stack`.
+ * `oke docker` / `oke stack` / `oke images pin` / `oke schema` / `oke dev --docker`.
  */
 
 import { describe, expect, test } from "bun:test";
@@ -39,12 +39,10 @@ describe("oke docker CLI", () => {
     expect(code).toBe(0);
     expect(result).toBeDefined();
     expect(await Bun.file(join(dir, "docker/Dockerfile")).exists()).toBe(true);
-    expect(
-      await Bun.file(join(dir, "docker/compose.store.sql.yml")).exists(),
-    ).toBe(true);
+    expect(await Bun.file(join(dir, "docker/compose.store.sql.yml")).exists()).toBe(true);
     const yml = await Bun.file(join(dir, "docker/compose.store.sql.yml")).text();
     expect(yml).not.toContain("test-password-not-in-yaml");
-    expect(yml).toContain("../.env.stack");
+    expect(yml).toContain(".env.docker");
     expect(logs.join("")).toContain("docker/compose.override.yml");
   });
 });
@@ -149,13 +147,14 @@ describe("oke schema generate", () => {
   });
 });
 
-describe("oke dev --stack", () => {
-  test("plans stack with postgres and writes nothing on dryRun", async () => {
+describe("oke dev --docker", () => {
+  test("plans docker with postgres and writes nothing on dryRun", async () => {
     const dir = await mkdtemp(join(tmpdir(), "oke-cli-dev-dry-"));
     await Bun.write(join(dir, "src/app.ts"), "export {}\n");
     const { code, plan } = await runDev({
+      stdinIsTTY: false,
       cwd: dir,
-      stack: ["store.sql"],
+      docker: ["store.sql"],
       images,
       credentials,
       dryRun: true,

package/src/cli/docker.ts

@@ -93,9 +93,7 @@ export async function runDockerDerive(
     write(
       `compose merge order (cwd ${composeDir}/):\n${result.composeFiles.map((f) => `  -f ${f}`).join("\n")}\n`,
     );
-    write(
-      `(${composeDir}/compose.override.yml is layer 4 — user-owned, never written by oke)\n`,
-    );
+    write(`(${composeDir}/compose.override.yml is layer 4 — user-owned, never written by oke)\n`);
     return { code: 0, result };
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));

package/src/cli/doctor-diff-examples.ts

@@ -47,9 +47,7 @@ export async function runDoctorDiffExamples(): Promise<number> {
   }
 
   if (failed > 0) {
-    console.log(
-      "Acknowledge intentional breaks with `breaking: true` on the owning flow.",
-    );
+    console.log("Acknowledge intentional breaks with `breaking: true` on the owning flow.");
   }
   return failed > 0 ? 1 : 0;
 }

package/src/cli/doctor-diff.test.ts

@@ -9,10 +9,7 @@ import type { Manifest } from "../manifest/types.ts";
 import { parseManifest } from "../manifest/validate.ts";
 import { runDoctorDiff } from "./doctor-diff.ts";
 
-const baseUrl = new URL(
-  "../manifest/fixtures/base.manifest.json",
-  import.meta.url,
-);
+const baseUrl = new URL("../manifest/fixtures/base.manifest.json", import.meta.url);
 
 async function loadBase(): Promise<Manifest> {
   return parseManifest(await Bun.file(baseUrl).text());
@@ -88,4 +85,3 @@ describe("oke doctor --diff", () => {
     }
   });
 });
-

package/src/cli/doctor-diff.ts

@@ -34,10 +34,7 @@ export interface DoctorDiffOptions {
    * @param cwd - Repo root
    * @param baseBranch - Preferred base
    */
-  readonly resolveMergeBase?: (
-    cwd: string,
-    baseBranch?: string,
-  ) => Promise<string | null>;
+  readonly resolveMergeBase?: (cwd: string, baseBranch?: string) => Promise<string | null>;
   /**
    * Read a file at a git revision (tests).
    *
@@ -45,11 +42,7 @@ export interface DoctorDiffOptions {
    * @param rev - Commit-ish
    * @param path - Path relative to repo root
    */
-  readonly readAtRevision?: (
-    cwd: string,
-    rev: string,
-    path: string,
-  ) => Promise<string | null>;
+  readonly readAtRevision?: (cwd: string, rev: string, path: string) => Promise<string | null>;
   /** Manifest relative path when using git (default: auto-detect). */
   readonly manifestPath?: string;
   readonly write?: (text: string) => void;
@@ -67,9 +60,7 @@ export interface DoctorDiffResult {
  *
  * @param options - Paths / injections / git helpers
  */
-export async function runDoctorDiff(
-  options: DoctorDiffOptions = {},
-): Promise<DoctorDiffResult> {
+export async function runDoctorDiff(options: DoctorDiffOptions = {}): Promise<DoctorDiffResult> {
   const write = options.write ?? ((t) => process.stdout.write(t));
   const cwd = options.cwd ?? process.cwd();
 
@@ -86,15 +77,11 @@ export async function runDoctorDiff(
     return { code: EXIT_OK, undeclared, allChanges: all };
   }
 
-  write(
-    `oke doctor --diff: ${undeclared.length} undeclared contract-breaking change(s)\n`,
-  );
+  write(`oke doctor --diff: ${undeclared.length} undeclared contract-breaking change(s)\n`);
   for (const c of undeclared) {
     write(`  [contract-breaking] ${c.path}: ${c.summary}\n`);
   }
-  write(
-    "Acknowledge intentional breaks with `breaking: true` on the owning flow.\n",
-  );
+  write("Acknowledge intentional breaks with `breaking: true` on the owning flow.\n");
   return { code: EXIT_RUNTIME, undeclared, allChanges: all };
 }
 
@@ -125,20 +112,16 @@ async function resolveManifests(
     );
   }
 
-  const rel =
-    options.manifestPath ??
-    (await detectManifestRel(cwd));
+  const rel = options.manifestPath ?? (await detectManifestRel(cwd));
   if (!rel) {
     throw new Error(
       "oke doctor --diff: no oke.manifest.json or manifest.oke.json in cwd — pass --before/--after",
     );
   }
 
-  const after =
-    options.after ?? (await loadManifest(resolve(cwd, rel)));
+  const after = options.after ?? (await loadManifest(resolve(cwd, rel)));
 
-  const resolveBase =
-    options.resolveMergeBase ?? gitMergeBase;
+  const resolveBase = options.resolveMergeBase ?? gitMergeBase;
   const readAt = options.readAtRevision ?? gitShow;
   const mergeBase = await resolveBase(cwd, options.baseBranch);
   if (!mergeBase) {
@@ -177,23 +160,18 @@ async function detectManifestRel(cwd: string): Promise<string | null> {
  * @param cwd - Repo root
  * @param baseBranch - Preferred base
  */
-export async function gitMergeBase(
-  cwd: string,
-  baseBranch?: string,
-): Promise<string | null> {
+export async function gitMergeBase(cwd: string, baseBranch?: string): Promise<string | null> {
   const candidates = baseBranch
     ? [baseBranch, ...BASE_BRANCH_CANDIDATES.filter((b) => b !== baseBranch)]
     : [...BASE_BRANCH_CANDIDATES];
 
   for (const base of candidates) {
-    const proc = Bun.spawn(
-      ["git", "merge-base", "HEAD", base],
-      { cwd, stdout: "pipe", stderr: "pipe" },
-    );
-    const [stdout, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      proc.exited,
-    ]);
+    const proc = Bun.spawn(["git", "merge-base", "HEAD", base], {
+      cwd,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
     if (exitCode === 0) {
       const rev = stdout.trim();
       if (rev.length > 0) return rev;
@@ -209,20 +187,13 @@ export async function gitMergeBase(
  * @param rev - Commit-ish
  * @param path - Path relative to repo root
  */
-export async function gitShow(
-  cwd: string,
-  rev: string,
-  path: string,
-): Promise<string | null> {
+export async function gitShow(cwd: string, rev: string, path: string): Promise<string | null> {
   const proc = Bun.spawn(["git", "show", `${rev}:${path}`], {
     cwd,
     stdout: "pipe",
     stderr: "pipe",
   });
-  const [stdout, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    proc.exited,
-  ]);
+  const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
   if (exitCode !== 0) return null;
   return stdout;
 }

package/src/cli/doctor-pii.ts

@@ -4,10 +4,7 @@
  * Reuses {@link assertAllowPiiForAsk} — does not reimplement matching.
  */
 
-import {
-  AiPiiBuildError,
-  assertAllowPiiForAsk,
-} from "../elements/ai/pii.ts";
+import { AiPiiBuildError, assertAllowPiiForAsk } from "../elements/ai/pii.ts";
 import type {
   AiPrompt,
   ClassificationValue,
@@ -23,9 +20,7 @@ import type { DoctorFinding } from "./doctor.ts";
  *
  * @param manifest - Extracted Manifest
  */
-export function checkManifestPiiAsks(
-  manifest: Manifest,
-): readonly DoctorFinding[] {
+export function checkManifestPiiAsks(manifest: Manifest): readonly DoctorFinding[] {
   const findings: DoctorFinding[] = [];
   const classifications = collectClassifications(manifest);
   const flows = manifest.flows ?? {};

package/src/cli/doctor.test.ts

@@ -14,13 +14,12 @@ describe("oke doctor", () => {
       ports: [],
       currentSchemaFingerprint: null,
       expectedSchemaFingerprint: undefined,
+      skipDbDrift: true,
       write: () => {},
     });
     expect(code).toBe(2);
     expect(findings.some((f) => f.code === "missing_secret")).toBe(true);
-    expect(
-      findings.find((f) => f.message.includes("STRIPE_KEY")),
-    ).toBeDefined();
+    expect(findings.find((f) => f.message.includes("STRIPE_KEY"))).toBeDefined();
   });
 
   test("catches a port conflict", async () => {
@@ -30,6 +29,7 @@ describe("oke doctor", () => {
       isPortInUse: async (p) => p === 6530,
       currentSchemaFingerprint: "abc",
       expectedSchemaFingerprint: "abc",
+      skipDbDrift: true,
       write: () => {},
     });
     expect(code).toBe(2);
@@ -37,17 +37,36 @@ describe("oke doctor", () => {
     expect(findings[0]!.message).toContain("6530");
   });
 
-  test("catches schema drift", async () => {
+  test("catches core stub schema drift", async () => {
     const { code, findings } = await runDoctor({
       secrets: [],
       ports: [],
       isPortInUse: async () => false,
       expectedSchemaFingerprint: "aaa",
       currentSchemaFingerprint: "bbb",
+      skipDbDrift: true,
       write: () => {},
     });
     expect(code).toBe(2);
     expect(findings.some((f) => f.code === "schema_drift")).toBe(true);
+    expect(findings.find((f) => f.code === "schema_drift")?.message).toContain(
+      "oke schema generate",
+    );
+  });
+
+  test("catches domain db_drift from drizzle-kit probe", async () => {
+    const { code, findings } = await runDoctor({
+      secrets: [],
+      ports: [],
+      isPortInUse: async () => false,
+      currentSchemaFingerprint: null,
+      skipDbDrift: false,
+      detectDbDrift: async () => ({ drifted: true, detail: "pending migrations" }),
+      write: () => {},
+    });
+    expect(code).toBe(2);
+    expect(findings.some((f) => f.code === "db_drift")).toBe(true);
+    expect(findings.find((f) => f.code === "db_drift")?.message).toContain("pending");
   });
 
   test("ok when secrets present, ports free, schema matches", async () => {
@@ -58,6 +77,7 @@ describe("oke doctor", () => {
       isPortInUse: async () => false,
       expectedSchemaFingerprint: "same",
       currentSchemaFingerprint: "same",
+      skipDbDrift: true,
       write: () => {},
     });
     expect(code).toBe(0);
@@ -99,6 +119,7 @@ describe("oke doctor", () => {
       secrets: [],
       ports: [],
       currentSchemaFingerprint: null,
+      skipDbDrift: true,
       write: () => {},
     });
 
@@ -142,6 +163,7 @@ describe("oke doctor", () => {
       ports: [],
       expectedSchemaFingerprint: "same",
       currentSchemaFingerprint: "same",
+      skipDbDrift: true,
       write: () => {},
     });
     expect(code).toBe(0);

package/src/cli/doctor.ts

@@ -20,6 +20,7 @@ export interface DoctorFinding {
     | "missing_secret"
     | "port_conflict"
     | "schema_drift"
+    | "db_drift"
     | "tenancy"
     | "driver"
     | "pii_ask";
@@ -44,6 +45,16 @@ export interface DoctorOptions {
   readonly expectedSchemaFingerprint?: string;
   /** Current schema fingerprint (tests). */
   readonly currentSchemaFingerprint?: string | null;
+  /**
+   * Inject domain DB drift probe (tests). When unset, runs drizzle-kit
+   * push explain when `drizzle.config.ts` exists.
+   */
+  readonly detectDbDrift?: () => Promise<{
+    readonly drifted: boolean;
+    readonly detail?: string;
+  }>;
+  /** Skip live DB drift probe (default false). */
+  readonly skipDbDrift?: boolean;
   readonly write?: (text: string) => void;
   /** Write hints / progress (defaults to stderr). */
   readonly writeErr?: (text: string) => void;
@@ -79,9 +90,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
   }
 
   const env = options.env ?? ((k) => Bun.env[k] ?? process.env[k]);
-  const secretNames =
-    options.secrets ??
-    (manifest?.vault ? Object.keys(manifest.vault) : []);
+  const secretNames = options.secrets ?? (manifest?.vault ? Object.keys(manifest.vault) : []);
 
   for (const name of secretNames) {
     const value = env(name);
@@ -90,9 +99,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
       findings.push({
         code: "missing_secret",
         severity: "error",
-        message: description
-          ? `missing secret ${name}: ${description}`
-          : `missing secret ${name}`,
+        message: description ? `missing secret ${name}: ${description}` : `missing secret ${name}`,
       });
     }
   }
@@ -120,24 +127,42 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
     options.currentSchemaFingerprint !== undefined
   ) {
     const expected =
-      options.expectedSchemaFingerprint ??
-      (await schemaFingerprint(cwd).catch(() => null));
+      options.expectedSchemaFingerprint ?? (await schemaFingerprint(cwd).catch(() => null));
     if (expected !== null && current !== null && expected !== current) {
       findings.push({
         code: "schema_drift",
         severity: "error",
         message:
-          "schema drift detected — run `oke schema generate` (or --check in CI)",
+          "core stub schema drift — run `oke schema generate` (schema/oke.ts; not domain migrations)",
       });
     } else if (expected !== null && current === null) {
       findings.push({
         code: "schema_drift",
         severity: "error",
-        message: "schema/oke.ts missing — run `oke schema generate`",
+        message: "schema/oke.ts missing — run `oke schema generate` (core/plugin stubs)",
       });
     }
   }
 
+  // Domain schema ↔ live DB — drizzle-kit is the single source of truth.
+  if (!options.skipDbDrift) {
+    const drizzleConfig = Bun.file(resolve(cwd, "drizzle.config.ts"));
+    if (options.detectDbDrift || (await drizzleConfig.exists())) {
+      const { detectDbDrift } = await import("./db.ts");
+      const probe = options.detectDbDrift ?? (() => detectDbDrift({ cwd }));
+      const drift = await probe();
+      if (drift.drifted) {
+        findings.push({
+          code: "db_drift",
+          severity: "error",
+          message:
+            drift.detail ??
+            "domain schema differs from the database — run `oke db generate` then `oke db migrate` (or `oke db push` in local)",
+        });
+      }
+    }
+  }
+
   if (manifest?.tenancy?.isolation) {
     // Structural tenancy check is compile-time; doctor warns when isolation
     // is set but no tenant resolver string is recorded on the Manifest.
@@ -205,4 +230,3 @@ Verify secrets, ports, schema drift, and PII→model egress before serving.
   const { code } = await runDoctor({ manifestPath, json });
   return code;
 }
-