okengine 0.2.8 → 0.3.2

package/src/cli/resolve-dev-sql-env.test.ts

@@ -0,0 +1,48 @@
+/**
+ * Active SQL env resolution from `.oke/mode` / session overrides.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { writeDevMode } from "./dev-mode.ts";
+import { resolveDevSqlEnv } from "./resolve-dev-sql-env.ts";
+
+const dirs: string[] = [];
+
+afterEach(async () => {
+  await Promise.all(dirs.splice(0).map((d) => rm(d, { recursive: true, force: true })));
+});
+
+async function tempDir(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "oke-sqlenv-"));
+  dirs.push(dir);
+  return dir;
+}
+
+describe("resolveDevSqlEnv", () => {
+  test("defaults to local when nothing set", async () => {
+    const dir = await tempDir();
+    expect(await resolveDevSqlEnv(dir)).toBe("local");
+  });
+
+  test("explicit env override wins", async () => {
+    const dir = await tempDir();
+    await writeDevMode(dir, "local");
+    expect(await resolveDevSqlEnv(dir, { env: "docker" })).toBe("docker");
+  });
+
+  test("session docker flag wins over saved mode", async () => {
+    const dir = await tempDir();
+    await writeDevMode(dir, "local");
+    expect(await resolveDevSqlEnv(dir, { docker: true })).toBe("docker");
+    expect(await resolveDevSqlEnv(dir, { docker: false })).toBe("local");
+  });
+
+  test("reads saved .oke/mode", async () => {
+    const dir = await tempDir();
+    await writeDevMode(dir, "docker");
+    expect(await resolveDevSqlEnv(dir)).toBe("docker");
+  });
+});

package/src/cli/resolve-dev-sql-env.ts

@@ -0,0 +1,42 @@
+/**
+ * Resolve the active SQL env for schema tooling (`oke db`, `oke mode`,
+ * `oke dev` one-shot sync) from session overrides and the saved dev mode.
+ */
+
+import type { ConfigEnv } from "../config/index.ts";
+import { readDevMode } from "./dev-mode.ts";
+
+/** Options for {@link resolveDevSqlEnv}. */
+export interface ResolveDevSqlEnvOptions {
+  /**
+   * Session override — `true` means docker (e.g. `OKE_DOCKER=1` or
+   * `oke dev --docker`). `false` means local. `undefined` → auto-resolve.
+   */
+  readonly docker?: boolean;
+  /**
+   * Explicit env override (e.g. `oke db --env docker`). Wins over `.oke/mode`.
+   */
+  readonly env?: ConfigEnv;
+}
+
+/**
+ * Resolve the SQL env (`local` | `docker` for dev tooling) without prompting.
+ *
+ * Order:
+ * 1. Explicit `options.env` (CLI flag)
+ * 2. Session docker flag (`options.docker`)
+ * 3. `.oke/mode` persisted preference
+ * 4. Default `local`
+ *
+ * @param cwd - Project root
+ * @param options - Session / CLI overrides
+ */
+export async function resolveDevSqlEnv(
+  cwd: string,
+  options: ResolveDevSqlEnvOptions = {},
+): Promise<ConfigEnv> {
+  if (options.env !== undefined) return options.env;
+  if (options.docker !== undefined) return options.docker ? "docker" : "local";
+  const saved = await readDevMode(cwd);
+  return saved ?? "local";
+}

package/src/cli/stack.ts

@@ -2,7 +2,7 @@
  * `oke stack` — preview resolved images/tags/ports (writes nothing).
  */
 
-import { formatStackPreview, resolveStack } from "../docker/index.ts";
+import { formatStackPreview, resolveStack, stackInstanceId } from "../docker/index.ts";
 import { wantsJson } from "./args.ts";
 import { EXIT_OK, EXIT_RUNTIME } from "./exit.ts";
 import { loadOkeConfig, resolveImages } from "./load-config.ts";
@@ -26,10 +26,11 @@ export async function runStackPreview(options: StackCliOptions = {}): Promise<nu
   const write = options.write ?? ((t) => process.stdout.write(t));
   const writeErr = options.writeErr ?? ((t) => process.stderr.write(t));
   const json = options.json ?? false;
+  const cwd = options.cwd ?? process.cwd();
   let images = options.images;
   if (!images) {
     try {
-      const loaded = await loadOkeConfig(options.cwd ?? process.cwd(), options.configPath);
+      const loaded = await loadOkeConfig(cwd, options.configPath);
       images = resolveImages(loaded.config);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -41,7 +42,8 @@ export async function runStackPreview(options: StackCliOptions = {}): Promise<nu
       return EXIT_RUNTIME;
     }
   }
-  const rows = resolveStack({ images });
+  // Match `oke dev --docker` host ports (stable per-project offsets).
+  const rows = resolveStack({ images, instanceId: stackInstanceId(cwd) });
   if (json) {
     write(`${JSON.stringify({ ok: true, rows }, null, 2)}\n`);
     if (rows.length === 0) {
@@ -67,7 +69,8 @@ export async function stackCli(args: readonly string[]): Promise<number> {
     else if (a === "--help" || a === "-h") {
       console.log(`oke stack [--config|-c oke.config.ts] [--json|-j]
 
-Preview resolved images, recipes, and ports. Writes nothing.
+Preview resolved images, recipes, and ports (same per-project host ports as
+oke dev --docker). Writes nothing.
 --json  Machine-parseable JSON on stdout; hints on stderr.
 `);
       return EXIT_OK;

package/src/cli/vault-cmd.ts

@@ -2,9 +2,43 @@
  * `oke vault` — set · list · import · key rotate.
  */
 
+import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { parseDotenv, formatDotenv } from "../drivers/vault-dotenv-parse.ts";
 
+/** Resolved OpenBao target for direct API writes (docker / prod vault). */
+interface OpenBaoTarget {
+  readonly url: string;
+  readonly token: string;
+  readonly mount: string;
+}
+
+/**
+ * Resolve a live OpenBao target when the active vault is OpenBao.
+ *
+ * Sources, in order: `OKE_VAULT_*` env · persisted `.oke/openbao/` host
+ * material + `docker/.env.docker` URL. Returns `null` when neither resolves
+ * (local dotenv loop) so `oke vault set` keeps the file path.
+ *
+ * @param cwd - Project root
+ */
+export async function resolveOpenBaoTarget(cwd: string): Promise<OpenBaoTarget | null> {
+  const mount = process.env.OKE_VAULT_MOUNT ?? "secret";
+  const envUrl = process.env.OKE_VAULT_URL;
+  const envToken = process.env.OKE_VAULT_TOKEN;
+  if (envUrl && envToken) {
+    return { url: envUrl.replace(/\/$/, ""), token: envToken, mount };
+  }
+  const appTokenPath = resolve(cwd, ".oke/openbao/app.token");
+  const composeEnvPath = resolve(cwd, "docker/.env.docker");
+  if (!existsSync(appTokenPath) || !existsSync(composeEnvPath)) return null;
+  const envFile = parseDotenv(readFileSync(composeEnvPath, "utf8"));
+  const url = envFile.get("OKE_VAULT_URL");
+  const token = readFileSync(appTokenPath, "utf8").trim();
+  if (!url || !token) return null;
+  return { url: url.replace(/\/$/, ""), token, mount };
+}
+
 /** In-memory / file-backed vault bag for CLI (dotenv-shaped). */
 export interface VaultCliStore {
   get(name: string): string | undefined;
@@ -78,6 +112,35 @@ oke vault key rotate
       console.error("Usage: oke vault set <NAME> [value]");
       return 1;
     }
+    const ob = await resolveOpenBaoTarget(cwd);
+    if (ob && !options.store && !options.envFile) {
+      let value = rest[1];
+      if (value === undefined) {
+        const read =
+          options.readLine ??
+          (async () => {
+            write(`Enter value for ${name}: `);
+            const chunks: Buffer[] = [];
+            for await (const chunk of Bun.stdin.stream()) {
+              chunks.push(Buffer.from(chunk));
+              if (Buffer.concat(chunks).includes(0x0a)) break;
+            }
+            return Buffer.concat(chunks).toString("utf8").trim();
+          });
+        value = await read(`Enter value for ${name}: `);
+      }
+      const res = await fetch(`${ob.url}/v1/${ob.mount}/data/${encodeURIComponent(name)}`, {
+        method: "POST",
+        headers: { "X-Vault-Token": ob.token, "content-type": "application/json" },
+        body: JSON.stringify({ data: { value } }),
+      });
+      if (!res.ok) {
+        console.error(`oke vault: OpenBao write failed (${res.status}) — sealed / unauthorized?`);
+        return 1;
+      }
+      write(`oke vault: set ${name} (openbao)\n`);
+      return 0;
+    }
     let value = rest[1];
     if (value === undefined) {
       const read =

package/src/client/types.ts

@@ -122,6 +122,8 @@ export interface TransportError {
 
 /**
  * Client call result — errors are values, never thrown for flow failures.
+ * Success may carry an optional top-level `meta` (Stripe-style envelope,
+ * e.g. paginated lists).
  *
  * @typeParam O - Success data
  * @typeParam E - Declared error map
@@ -130,7 +132,11 @@ export type ClientResult<
   O = unknown,
   E extends Record<string, unknown> = Record<string, unknown>,
 > =
-  | { readonly data: O; readonly error: null }
+  | {
+      readonly data: O;
+      readonly error: null;
+      readonly meta?: Record<string, unknown>;
+    }
   | { readonly data: null; readonly error: ClientError<E> | TransportError };
 
 /** Minimal fetch signature (avoids DOM `HeadersInit` / `preconnect` coupling). */

package/src/compiler/extract.test.ts

@@ -241,3 +241,43 @@ export const db = store.sql("app", { schema: { notes } });
     });
   });
 });
+
+describe("extractManifest — on(http.resource(...))", () => {
+  test("expands the mount into five CRUD bindings with store effects", async () => {
+    const source = `
+import { on, http, store } from "okengine";
+
+export const db = store.sql("notes", { schema: {} });
+
+const notesR = store.resource(db, {}, { unit: "notes", breaking: true });
+
+const mounted = on(http.resource("/notes", notesR.all()));
+
+export const list = mounted.list;
+export const create = mounted.create;
+export const get = mounted.get;
+export const update = mounted.update;
+export const remove = mounted.remove;
+`;
+    const manifest = await extractFromSources({ "src/flows/notes.ts": source });
+
+    expect(manifest.flows?.list?.trigger).toEqual({
+      http: { method: "GET", path: "/notes" },
+    });
+    expect(manifest.flows?.create?.trigger).toEqual({
+      http: { method: "POST", path: "/notes" },
+    });
+    expect(manifest.flows?.get?.trigger).toEqual({
+      http: { method: "GET", path: "/notes/:id" },
+    });
+    expect(manifest.flows?.update?.trigger).toEqual({
+      http: { method: "PATCH", path: "/notes/:id" },
+    });
+    expect(manifest.flows?.remove?.trigger).toEqual({
+      http: { method: "DELETE", path: "/notes/:id" },
+    });
+    expect(manifest.flows?.list?.effects?.reads).toEqual(["sql:notes"]);
+    expect(manifest.flows?.create?.effects?.writes).toEqual(["sql:notes"]);
+    expect(manifest.flows?.list?.breaking).toBe(true);
+  });
+});

package/src/compiler/extract.ts

@@ -88,6 +88,11 @@ interface ProjectScope {
   flows: Record<string, Flow>;
   /** Export name → flow id (for agent tools). */
   flowExports: Map<string, string>;
+  /** Local binding name → store.resource declaration (for on(http.resource)). */
+  resources: Map<
+    string,
+    { storeName: string; storeRef: string; unit?: string; breaking?: boolean }
+  >;
 }
 
 /**
@@ -116,6 +121,7 @@ export async function extractManifest(options: ExtractManifestOptions = {}): Pro
     drivers: {},
     flows: {},
     flowExports: new Map(),
+    resources: new Map(),
   };
 
   const parsed = files.map((file) => {
@@ -603,6 +609,27 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
           });
         }
       }
+
+      // store.resource(db, table, { … }) — remember for on(http.resource(…))
+      if (prop === "resource") {
+        const bindingName = enclosingConstName(call, program);
+        const dbName = identifierName(call.arguments[0]);
+        const storeBinding = dbName ? scope.bindings.get(dbName) : undefined;
+        const ref =
+          storeBinding?.kind === "store" ? storeBinding.ref : (`sql:${dbName ?? "store"}` as const);
+        const storeName = ref.split(":")[1] ?? dbName ?? "store";
+        const unit = stringProp(objectArg(call.arguments[2]) ?? ({} as never), "unit");
+        const opts = objectArg(call.arguments[2]);
+        const breaking = opts ? boolProp(opts, "breaking") === true : false;
+        if (bindingName) {
+          scope.resources.set(bindingName, {
+            storeName,
+            storeRef: ref,
+            unit,
+            ...(breaking ? { breaking: true } : {}),
+          });
+        }
+      }
     }
 
     // store.schema.table("notes", { … })
@@ -996,7 +1023,14 @@ function collectFlows(file: SourceFile, program: AstNode, scope: ProjectScope):
     if (callee === "on") {
       const triggerNode = call.arguments[0];
       const flowNode = call.arguments[1];
-      if (!triggerNode || !flowNode) return;
+      if (!triggerNode) return;
+
+      // on(http.resource(path, bag)) — expand the mount into five bindings.
+      if (!flowNode) {
+        registerResourceMount(call, triggerNode, file, program, scope);
+        return;
+      }
+
       const flowCall = unwrapFlowCall(flowNode);
       if (!flowCall) return;
       const exportName = enclosingConstName(call, program);
@@ -1139,6 +1173,7 @@ function registerFlow(args: {
 
   if (boolProp(opts, "durable")) flow.durable = true;
   if (boolProp(opts, "live") || liveFromTrigger) flow.live = true;
+  if (boolProp(opts, "breaking")) flow.breaking = true;
 
   const slo = parseSlo(objectProp(opts, "slo"));
   if (slo) flow.slo = slo;
@@ -1213,6 +1248,93 @@ function registerFlow(args: {
   args.scope.flows[name] = flow;
 }
 
+/**
+ * Expand `on(http.resource(path, bag))` into the five CRUD flows.
+ *
+ * The flows are synthesized at runtime by `store.resource(…)`; statically we
+ * register list/create/get/update/remove with their HTTP triggers and the
+ * resource's store effects so the Manifest stays complete.
+ *
+ * @param onCall - The outer `on(…)` call
+ * @param triggerNode - `http.resource(…)` expression
+ * @param file - Source file
+ * @param program - Program root (for export-name lookup)
+ * @param scope - Project scope
+ */
+function registerResourceMount(
+  onCall: CallExpression,
+  triggerNode: AstNode,
+  file: SourceFile,
+  program: AstNode,
+  scope: ProjectScope,
+): void {
+  if (triggerNode.type !== "CallExpression") return;
+  const httpCall = triggerNode as CallExpression;
+  const callee = httpCall.callee;
+  if (callee.type !== "MemberExpression") return;
+  const member = callee as AstNode & { object: AstNode; property: AstNode };
+  if (identifierName(member.object) !== "http") return;
+  if (identifierName(member.property) !== "resource") return;
+
+  const path = stringArg(httpCall.arguments[0]);
+  if (!path) return;
+
+  // bag: `notesR.all()` → resolve `notesR` to its store.resource declaration.
+  const bagNode = httpCall.arguments[1];
+  let baseName: string | undefined;
+  if (bagNode?.type === "CallExpression") {
+    const bagCallee = (bagNode as CallExpression).callee;
+    if (bagCallee.type === "MemberExpression") {
+      baseName = identifierName((bagCallee as AstNode & { object: AstNode }).object);
+    }
+  } else if (bagNode?.type === "Identifier") {
+    baseName = identifierName(bagNode);
+  }
+  const resource = baseName ? scope.resources.get(baseName) : undefined;
+
+  const unit = resource?.unit;
+  const storeRef = resource?.storeRef as Effects["reads"] extends readonly (infer R)[] | undefined
+    ? R
+    : never;
+  const effects: Effects | undefined = storeRef
+    ? { reads: [storeRef], writes: [storeRef] }
+    : undefined;
+  const idPath = `${path}/:id`;
+  const line = lineAt(file.source, onCall.start ?? 0);
+
+  const verbs = [
+    { op: "list", method: "GET", p: path, eff: storeRef ? { reads: [storeRef] } : undefined },
+    { op: "create", method: "POST", p: path, eff: storeRef ? { writes: [storeRef] } : undefined },
+    { op: "get", method: "GET", p: idPath, eff: storeRef ? { reads: [storeRef] } : undefined },
+    { op: "update", method: "PATCH", p: idPath, eff: effects },
+    {
+      op: "remove",
+      method: "DELETE",
+      p: idPath,
+      eff: storeRef ? { writes: [storeRef] } : undefined,
+    },
+  ] as const;
+
+  for (const v of verbs) {
+    // Short op names match `export const list = mounted.list` so Manifest Diff
+    // keeps flow identity across a handwritten → store.resource migration.
+    const name = v.op;
+    const flow: Flow = {
+      trigger: { http: { method: v.method as never, path: v.p } },
+      ...(v.eff ? { effects: v.eff as Effects } : {}),
+      ...(resource?.breaking ? { breaking: true } : {}),
+      source: `${file.path}:${line}`,
+    };
+    scope.flows[name] = flow;
+    scope.bindings.set(name, { kind: "flow", ref: name });
+  }
+
+  const exportName = enclosingConstName(onCall, program);
+  if (exportName) {
+    scope.bindings.set(exportName, { kind: "flow", ref: unit ?? baseName ?? exportName });
+  }
+}
+
 interface ParsedTrigger {
   trigger: Trigger;
   gates?: string[];

package/src/compiler/fixtures/skyport/oke.config.ts

@@ -2,7 +2,7 @@ import { defineConfig } from "okengine/config";
 
 export default defineConfig({
   drivers: {
-    prod: ["postgres", "redis", "s3", "smtp", "sops", "anthropic", "pgvector"],
+    prod: ["postgres", "redis", "s3", "smtp", "openbao", "anthropic", "pgvector"],
     store: {
       sql: { local: "sqlite", prod: { driver: "postgres" } },
       kv: { prod: "redis" },
@@ -10,7 +10,7 @@ export default defineConfig({
       index: { prod: "pgvector" },
     },
     signal: { prod: "postgres" },
-    vault: { prod: "sops" },
+    vault: { prod: "openbao" },
     channel: { email: { prod: "smtp" } },
     ai: { prod: { driver: "anthropic" } },
   },

package/src/compiler/fixtures/skyport.expected.json

@@ -162,7 +162,7 @@
     }
   },
   "drivers": {
-    "prod": ["postgres", "redis", "s3", "smtp", "sops", "anthropic", "pgvector"]
+    "prod": ["postgres", "redis", "s3", "smtp", "openbao", "anthropic", "pgvector"]
   },
   "tenancy": {
     "isolation": "row"

package/src/compiler/response.ts

@@ -5,6 +5,7 @@
  */
 
 import type { FlowFailure } from "../kernel/errors.ts";
+import { isJsonResult } from "../kernel/fx.ts";
 import { isFlowFailure } from "../kernel/hooks.ts";
 import { VALIDATION_ERROR_CODE } from "../validation/standard-schema.ts";
 
@@ -12,6 +13,7 @@ import { VALIDATION_ERROR_CODE } from "../validation/standard-schema.ts";
 export interface SuccessEnvelope {
   readonly data: unknown;
   readonly error: null;
+  readonly meta?: Record<string, unknown>;
 }
 
 /** Failure envelope. */
@@ -45,10 +47,20 @@ export function statusForFailure(failure: FlowFailure): number {
 
 /**
  * Encode a successful output as JSON `{ data, error: null }`.
+ * An `fx.json` carrier overrides status (`create` → 201) and attaches
+ * top-level `meta` (Stripe-style envelope).
  *
  * @param output - Handler output (`undefined` → 204)
  */
 export function encodeSuccess(output: unknown): Response {
+  if (isJsonResult(output)) {
+    if (output.status === 204) {
+      return new Response(null, { status: 204 });
+    }
+    const body: SuccessEnvelope = { data: output.value, error: null };
+    const envelope = output.meta === undefined ? body : { ...body, meta: output.meta };
+    return Response.json(envelope, { status: output.status });
+  }
   if (output === undefined) {
     return new Response(null, { status: 204 });
   }

package/src/config/define-config.test.ts

@@ -25,10 +25,8 @@ describe("fillDockerFromProd / defineConfig", () => {
     ).toBe("memory");
   });
 
-  test("vault sops → docker dotenv", () => {
-    expect(fillDockerFromProd({ local: "dotenv", prod: "sops" }, { vault: true })?.docker).toBe(
-      "dotenv",
-    );
+  test("vault prod → docker copies the prod driver", () => {
+    expect(fillDockerFromProd({ local: "dotenv", prod: "openbao" })?.docker).toBe("openbao");
   });
 
   test("defineConfig fills every element from prod", () => {
@@ -41,7 +39,7 @@ describe("fillDockerFromProd / defineConfig", () => {
         },
         signal: { local: "memory", prod: "postgres" },
         clock: { local: "memory", prod: "postgres" },
-        vault: { local: "dotenv", prod: "sops" },
+        vault: { local: "dotenv", prod: "openbao" },
         channel: {
           email: { local: "console", prod: "smtp" },
         },
@@ -53,7 +51,7 @@ describe("fillDockerFromProd / defineConfig", () => {
     expect(cfg.drivers?.store?.files?.docker).toBe("s3");
     expect(cfg.drivers?.signal?.docker).toBe("postgres");
     expect(cfg.drivers?.clock?.docker).toBe("postgres");
-    expect(cfg.drivers?.vault?.docker).toBe("dotenv");
+    expect(cfg.drivers?.vault?.docker).toBe("openbao");
     expect(cfg.drivers?.channel?.email?.docker).toBe("smtp");
     expect(cfg.drivers?.ai?.docker).toBe("anthropic");
   });

package/src/config/index.ts

@@ -293,24 +293,11 @@ export function normalizeDriversConfig(
 /**
  * Fill missing `docker` pins from `prod` (compose infra ≈ production protocols).
  *
- * Vault is the exception: `prod: "sops"` becomes `docker: "dotenv"` so
- * `oke dev -d` can read `docker/.env.docker` without age keys.
- *
  * @param map - Env → driver map
- * @param options - Element-specific defaults
  */
-export function fillDockerFromProd(
-  map: EnvDriverMap | undefined,
-  options: { readonly vault?: boolean } = {},
-): EnvDriverMap | undefined {
+export function fillDockerFromProd(map: EnvDriverMap | undefined): EnvDriverMap | undefined {
   if (!map) return undefined;
   if (map.docker !== undefined || map.prod === undefined) return map;
-  if (options.vault) {
-    const prodId = typeof map.prod === "string" ? map.prod : map.prod.driver;
-    if (prodId === "sops") {
-      return { ...map, docker: "dotenv" };
-    }
-  }
   return { ...map, docker: map.prod };
 }
 
@@ -346,7 +333,7 @@ export function fillDriversDockerFromProd(
     ...(store !== undefined ? { store } : {}),
     signal: fillDockerFromProd(drivers.signal),
     clock: fillDockerFromProd(drivers.clock),
-    vault: fillDockerFromProd(drivers.vault, { vault: true }),
+    vault: fillDockerFromProd(drivers.vault),
     ...(channel !== undefined ? { channel } : {}),
     ai: fillDockerFromProd(drivers.ai),
     runs: fillDockerFromProd(drivers.runs),

package/src/console/server/app.ts

@@ -56,6 +56,8 @@ export function createConsoleApp(options: CreateConsoleAppOptions = {}): Console
 
   const app = oke({
     name: options.name ?? "console",
+    // Isolated source — leftover host `on()` registrations never enter Console.
+    registry: "ignore",
     bindings,
     autoBoot: false,
     fx: { now: state.now },

package/src/console/server/vault.ts

@@ -6,12 +6,15 @@
  * rotation blast radius are derived — never reimplemented in the UI.
  */
 
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import type { ConfigEnv } from "../../config/index.ts";
-import { envVaultDriver, memoryVaultDriver } from "../../drivers/index.ts";
+import { envVaultDriver, memoryVaultDriver, openbaoVaultDriver } from "../../drivers/index.ts";
+import { parseDotenv } from "../../drivers/vault-dotenv-parse.ts";
 import {
   createVaultRuntime,
   vault as declareVault,
+  type VaultChainLayer,
   type VaultResolutionSource,
   type VaultResolutionStep,
   type VaultRuntime,
@@ -234,6 +237,22 @@ export async function createManifestVaultRuntime(
 
   const seed = options.seed ?? {};
   const composeEnv = resolveComposeEnvPath(cwd);
+  const envMap = parseDotenv(readFileSync(composeEnv.path, "utf8").toString());
+  const openbaoUrl = process.env.OKE_VAULT_URL ?? envMap.get("OKE_VAULT_URL");
+  const openbaoToken = process.env.OKE_VAULT_TOKEN ?? envMap.get("OKE_VAULT_TOKEN");
+  const openbaoMount = process.env.OKE_VAULT_MOUNT ?? envMap.get("OKE_VAULT_MOUNT") ?? "secret";
+  const driverLayer: VaultChainLayer =
+    openbaoUrl && openbaoToken
+      ? {
+          driver: openbaoVaultDriver,
+          source: "driver",
+          options: { url: openbaoUrl, token: openbaoToken, mount: openbaoMount },
+        }
+      : {
+          driver: memoryVaultDriver,
+          source: "driver",
+          options: { secrets: seed },
+        };
   const runtime = createVaultRuntime({
     secrets,
     allowDevFallbacks: options.allowDevFallbacks ?? (options.env ?? "local") !== "prod",
@@ -250,11 +269,7 @@ export async function createManifestVaultRuntime(
         source: composeEnv.source,
         options: { path: composeEnv.path },
       },
-      {
-        driver: memoryVaultDriver,
-        source: "driver",
-        options: { secrets: seed },
-      },
+      driverLayer,
     ],
   });
   await runtime.boot();