okengine 0.10.2 → 0.11.0

package/site/content/docs/elements/vault.mdx

@@ -55,7 +55,7 @@ oke vault set STRIPE_KEY sk_test_your_key_here
 <Step>
 ### Read it in a Flow
 
-Flows read secrets through `fx.vault` — never through `process.env`. `fx.vault` returns a
+Flows read secrets through `fx.vault.get` — never through `process.env`. It resolves to a
 `Redacted<string>`: printing, logging, or serializing it yields a placeholder, never the value.
 Call `.reveal()` once at the boundary that needs the real credential:
 
@@ -66,7 +66,7 @@ export const charge = on(
     in: ChargeInput,
     out: z.object({ id: z.string() }),
     do: async (input, fx) => {
-      const key = fx.vault(stripeKey); // Redacted — safe to pass to fx.log
+      const key = await fx.vault.get(stripeKey); // Redacted — safe to pass to fx.log
       const intent = await stripe(key.reveal()).create(input);
       return { id: intent.id };
     },
@@ -87,9 +87,9 @@ That's the whole loop: declare → set → read. Everything below is what OKE gu
 
 <VaultRedacted />
 
-Pass the wrapper freely — `fx.log`, `String()`, and `JSON.stringify` all yield
-`[redacted]`. Call `.reveal()` once at the provider boundary that needs the
-credential.
+Pass the wrapper freely — `fx.log`, `String()`, `JSON.stringify`, and
+`console.log` / `util.inspect` all yield `[redacted]` (or a `Redacted<…>` label).
+Call `.reveal()` once at the provider boundary that needs the credential.
 
 ## Two kinds of contracts
 
@@ -100,6 +100,20 @@ credential.
 
 `vault(name, …)` is shorthand for `vault.secret(name, …)`.
 
+### Plain environment variables
+
+`vault.env` reads `process.env` synchronously for values that need no contract — a port, a feature flag, a log level. It never joins the resolution chain, never gets a fingerprint, and never gets redacted.
+
+| Call                             | Returns               | On a missing value                     |
+| -------------------------------- | --------------------- | -------------------------------------- |
+| `vault.env("LOG_LEVEL")`         | `string \| undefined` | `undefined` (empty counts as missing)  |
+| `vault.env.required("REGION")`   | `string`              | Throws, and boot lists it as a gap     |
+| `vault.env.int("PORT", 3000)`    | `number`              | The default; throws when none is given |
+| `vault.env.bool("DEBUG", false)` | `boolean`             | The default; throws when none is given |
+| `vault.env.json("FLAGS")`        | `T \| undefined`      | `undefined`; throws on malformed JSON  |
+
+Every name passed to `vault.env.required` is registered, so boot reports missing variables in the same `VaultBootError` as missing secrets — before it opens a database connection.
+
 ### Contract options
 
 | Option        | Type                  | Meaning                                                                  |
@@ -110,9 +124,9 @@ credential.
 | `dev`         | string                | Local-only fallback when no source provides a value (never used in prod) |
 | `sensitive`   | boolean               | Override the default (`true` for secrets, `false` for config)            |
 
-### Zero-setup local fallback
+### Zero-setup Compose fallback
 
-`dev: vault.fromDocker("store.sql")` resolves the connection URL that `oke dev --docker` generated for that role — no manual copying of Postgres URLs:
+`dev: vault.fromDocker("store.sql")` resolves the connection URL that `oke dev` generated for that role — no manual copying of Postgres URLs:
 
 ```typescript
 export const dbUrl = vault.secret("DATABASE_URL", {
@@ -140,85 +154,82 @@ VaultBootError: 1 secret(s) missing:
 
 ## Setting and rotating values
 
-| Command                    | What it does                                                     |
-| -------------------------- | ---------------------------------------------------------------- |
-| `oke vault set NAME value` | Write a value (OpenBao API in docker mode, `.env.local` locally) |
-| `oke vault list`           | List names present in the active store                           |
-| `oke vault import <file>`  | Bulk-import names from a dotenv file                             |
+| Command                                            | What it does                                                         |
+| -------------------------------------------------- | -------------------------------------------------------------------- |
+| `oke vault set NAME value`                         | Write a value to the env file (`.env.local` by default)              |
+| `oke vault list`                                   | List names present in the active store                               |
+| `oke vault import <file>`                          | Bulk-import names from a dotenv file                                 |
+| `oke vault init`                                   | Initialize the built-in encrypted store (prints the master key once) |
+| `oke vault status` / `seal` / `unseal`             | Built-in seal lifecycle                                              |
+| `oke vault rotate <path>` / `rotate-master`        | Re-encrypt a secret, or rewrap every DEK under a new master          |
+| `oke vault audit` / `audit verify` / `audit purge` | Hash-chained audit (no secret values)                                |
+| `oke vault purge-expired [--dry-run] [--before]`   | Hard-delete secret rows past `expires_at` (operator cleanup)         |
+| `oke vault backup` / `restore`                     | Encrypted backup under a separate backup KEK                         |
 
-In docker mode, `oke vault set` writes straight to the running OpenBao — no git commit, no rebuild, no restart of the vault.
+Flows can write too, through the same capability gate as reads: `fx.vault.set(path, value, { ttlMs?, metadata? })`, `fx.vault.rotate(path, value)`, `fx.vault.delete(path)`, plus `fx.vault.list(prefix?)` and `fx.vault.status()`. These need the encrypted-at-rest backend (`drivers.vault = "vault"`) and throw without it; `fx.vault.get` works on every app.
 
 The **Console** (`:6533`) can also set and rotate values, but it is **write-only**: it shows a salted fingerprint (`sha256:…`) per secret, never the cleartext. When you rotate a key there, the panel shows the **blast radius** — which in-flight durable runs will wake up with the new value.
 
+<Callout title="Builtin master keys and expired rows">
+  Resolve the master key with `--key -` (stdin), `OKE_VAULT_MASTER_KEY`, or a hidden TTY prompt —
+  never put keys on argv in shared shells (history risk). Expired rows stay until `oke vault
+  purge-expired` (use `--dry-run` first, or schedule via cron).
+</Callout>
+
 <Callout title="Secrets never reach logs">
-  `fx.vault` returns `Redacted` — `fx.log` shows `[redacted]`. A revealed string that still reaches
-  a log is scrubbed by the boot redactor to `[redacted:secret]`. Traces and the Console get
+  `fx.vault.get` returns `Redacted` — `fx.log` shows `[redacted]`. A revealed string that still
+  reaches a log is scrubbed by the boot redactor to `[redacted:secret]`. Traces and the Console get
   fingerprints, never cleartext.
 </Callout>
 
 ## Per-environment drivers
 
-Which backend holds your values depends on the mode — configured once in `oke.config.ts`.
+Which backend holds your values depends on the environment — configured once in `oke.config.ts`.
 App boot and the Console share the same resolution-chain builder (`env` layers → backend):
 
 ```typescript title="oke.config.ts"
-vault: {
-  local: "env",      // .env.local — zero ceremony
-  docker: "openbao", // real vault in the compose stack
-  test: "memory",    // seeded map — deterministic tests
-  prod: "openbao",   // real vault in production
+drivers: {
+  vault: {
+    dev: "env", // process env / .env.local
+    test: "memory",
+    prod: "vault", // built-in encrypted store (Postgres you already run)
+  },
 },
 ```
 
-| Driver    | Backend         | Best for                                   |
-| --------- | --------------- | ------------------------------------------ |
-| `env`     | `.env.local`    | Local loop — no infra at all               |
-| `openbao` | OpenBao (KV v2) | Docker + prod — durable, access-controlled |
-| `memory`  | in-process map  | Tests                                      |
+Defaults are `env` / `memory` / `vault`. create-oke templates pin the built-in store for prod.
 
-Other drivers (`managed`) implement the same `VaultDriver` interface — adding one is a driver exercise, not an architecture change.
+| Driver    | Backend                                                             | Best for                           |
+| --------- | ------------------------------------------------------------------- | ---------------------------------- |
+| `env`     | process env                                                         | Local pins — no encryption at rest |
+| `vault`   | Postgres/PGlite envelope (AES-256-GCM)                              | Default prod — no extra container  |
+| `managed` | AWS Secrets Manager (`OKE_VAULT_PROVIDER`) or platform-injected env | Cloud SM / Fly / Railway / K8s     |
+| `memory`  | in-process map                                                      | Tests                              |
 
-## OpenBao in docker and prod
+### Threat model (honest)
 
-When you run `oke dev --docker` (or bring up a `--prod` stack), OKE runs a real OpenBao container with durable Raft storage — not an in-memory dev server.
+Built-in Vault protects a **database dump** (ciphertext + wrapped DEKs). It does **not** equal a separate process-isolated vault:
 
-<Steps>
+| Threat                                        | Built-in `vault`                   | Managed AWS SM / remote vault |
+| --------------------------------------------- | ---------------------------------- | ----------------------------- |
+| Postgres dump / backup leak                   | Protected (need master/KEK)        | Protected                     |
+| App RCE / memory dump                         | Game over (same process)           | Better if vault is isolated   |
+| Master key only in `.env` next to app secrets | Weak — use KMS auto-unseal in prod | Prefer non-exportable KEK     |
+| JS `Buffer.fill(0)` vs remote `mlock`         | Hygiene only — not claimed         | Stronger outside the app      |
 
-<Step>
-### First boot is automatic
+For production built-in stores, set `vault.encryption.masterKey` to a KMS source (optional peer `@aws-sdk/client-kms`) or use `managed` + AWS Secrets Manager. `oke doctor` warns when prod would take the master key from the environment.
 
-OKE initializes OpenBao (Shamir 1-of-1), unseals it, writes a least-privilege policy that covers **only your declared secrets**, and mints an app token bound to that policy. You never run raw `bao` commands.
+## Managed providers (official)
 
-</Step>
+Official managed provider: **AWS Secrets Manager** — set `drivers.vault` to `"managed"` and
+`OKE_VAULT_PROVIDER=aws-secrets-manager` (optional peer `@aws-sdk/client-secrets-manager`).
+Omit the provider when the platform already injects secrets as env vars.
 
-<Step>
-### Keys stay on the host
-
-The unseal key and root token are written to `.oke/openbao/` (mode `0600`, gitignored) — never into `docker/.env.docker`, never into YAML. Only the least-privilege app token lands in `.env.docker` as `OKE_VAULT_TOKEN`.
-
-</Step>
+## Community / plugin
 
-<Step>
-### Restarts just work
-
-On every later start OKE detects the sealed vault and unseals it with the host key. Secrets set before a container restart are still there after it — proven by an integration test, not assumed.
-
-</Step>
-
-</Steps>
-
-| File                      | Holds                     | Used by                          |
-| ------------------------- | ------------------------- | -------------------------------- |
-| `.oke/openbao/unseal.key` | The single unseal share   | `oke` (every start)              |
-| `.oke/openbao/root.token` | Root token                | `oke` (policy sync / token mint) |
-| `.oke/openbao/app.token`  | Least-privilege app token | the app + Console                |
-
-<Callout title="Single point of failure — read this once" type="warn">
-  Back up `.oke/openbao/unseal.key` to a separate safe location. Losing it means losing every secret
-  permanently, with no recovery.
-</Callout>
-
-This is by design: self-hosted single-node, Shamir 1-of-1, no cloud KMS. If OpenBao is initialized but the key is gone, boot fails with an explicit permanent-loss error — it never silently starts empty.
+OpenBao, HashiCorp Vault, Azure Key Vault, GCP Secret Manager, Doppler, and 1Password are not
+shipped in core. Implement a community adapter for the `managed` driver surface, or keep using
+built-in `vault` / `env`.
 
 ## Troubleshooting
 
@@ -228,31 +239,38 @@ This is by design: self-hosted single-node, Shamir 1-of-1, no cloud KMS. If Open
 A contract has no value in any layer of the chain. Fix by providing it in exactly one place:
 
 - locally: add `NAME=value` to `.env.local` (or run `oke vault set NAME value`)
-- docker mode: `oke vault set NAME value` writes to OpenBao directly
-- CI / hosting: set a real environment variable
+- built-in store: `oke vault init` then unseal, or set via Console (write-only)
+- CI / hosting: set a real environment variable (or AWS SM when `managed`)
 
 </Accordion>
-<Accordion title="OpenBao is sealed or unreachable in docker mode">
+<Accordion title="How do I rotate a key safely?">
 
-Re-run `oke dev --docker` — the bootstrap unseals with the host key on every start. If it reports the vault is initialized but `.oke/openbao/unseal.key` is missing, restore the key from your backup; the error is explicit because starting empty would look like "no secrets" instead of data loss.
+Set the new value (`oke vault set` or the Console). The Console's rotation view shows the blast radius — in-flight durable runs that will resume with the new value — before you commit. The `rotate: "90d"` hint on the contract drives the rotation-due signal.
 
 </Accordion>
-<Accordion title="Where is the root token?">
+<Accordion title="How do I pass the builtin master key without shell history?">
 
-`.oke/openbao/root.token`, mode `0600`, gitignored. It exists only for `oke` to sync policies and mint app tokens — the running app never sees it.
+Prefer `oke vault unseal --key -` and pipe the key on stdin, or omit `--key` on a
+TTY and type it at the hidden prompt. Avoid `--key <base64>` on shared hosts.
 
 </Accordion>
-<Accordion title="How do I rotate a key safely?">
+<Accordion title="Expired secrets still take space in Postgres">
 
-Set the new value (`oke vault set` or the Console). The Console's rotation view shows the blast radius — in-flight durable runs that will resume with the new value — before you commit. The `rotate: "90d"` hint on the contract drives the rotation-due signal.
+`expires_at` fails closed on read, but rows stay until you hard-delete them:
+
+```bash
+oke vault purge-expired --dry-run
+oke vault purge-expired
+```
+
+Schedule the live command with cron when you want automatic cleanup.
 
 </Accordion>
 </Accordions>
 
 ## Learn more
 
-- [Console · Vault](/docs/console/vault) — fingerprints, resolution chain, rotation blast radius
-- [Flow](/docs/elements/flow) — how `fx.vault` reads secrets inside `do`
+- [Flow](/docs/elements/flow) — how `fx.vault.get` reads secrets inside `do`
 - [CLI Reference](/docs/reference/cli) — `oke vault set` · `list` · `import`
 
 ## Next
@@ -264,9 +282,4 @@ Set the new value (`oke vault set` or the Console). The Console's rotation view
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/get-started/basic-usage.mdx

@@ -39,7 +39,7 @@ digest Clock, and an AI summarize stub.
 The standard starter already exports a named health Flow:
 
 ```typescript title="flows/main"
-import { on, flow, http, gate } from "okengine";
+import { on, flow, http, gate } from "okengine/http";
 import { z } from "zod";
 
 export const health = on(
@@ -63,17 +63,17 @@ same Manifest.
 Adopted modules become namespaces on the client:
 
 ```typescript title="app"
-import { oke } from "okengine";
-import * as main from "./flows/main";
-import * as notes from "./flows/notes";
-import { db } from "./core";
+import "@/core";
 
-export const app = oke({ name: "notes", stores: [db] }).adopt({ main, notes });
+import { oke } from "okengine/http";
+import * as routes from "@/flows/generated";
+
+export const app = oke({ name: "notes" }).adopt(routes);
 export type App = typeof app;
 ```
 
-The scaffolded `src/app.ts` also registers secrets, signals, and channel
-templates in the same `oke({ … })` call — no post-construction mutation.
+`import "@/core"` loads stores, secrets, channels, and message catalogs
+(via `locales/index.ts`) so they auto-register before `oke()`.
 
 ```typescript title="client"
 import { createClient } from "okengine/client";
@@ -146,7 +146,6 @@ bun test
 - [Flow](/docs/elements/flow) — triggers, contracts, effects, and composition
 - [Store](/docs/elements/store) — SQL, KV, files, index
 - [fx](/docs/reference/fx) — the full effect surface
-- [Console · Overview](/docs/console/overview) — Manifest-derived panels
 
 ## Next
 
@@ -161,9 +160,4 @@ bun test
     description="SQL, KV, files, index, and declarative resources."
     href="/docs/elements/store"
   />
-  <Card
-    title="Console"
-    description="Manifest-derived flows, effects, traces, and architecture."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/get-started/installation.mdx

@@ -21,8 +21,11 @@ This page gets you from zero to a running app on Bun. The engine targets
 ### Prerequisites
 
 - [Bun](https://bun.sh) ≥ 1.3.14 (`bun --version`)
+- [Docker](https://docs.docker.com/get-docker/) with a running daemon (`docker info`)
 - A terminal and a code editor
 
+`oke dev` always starts Docker Compose for Postgres / Redis / S3 / SMTP (and other pinned images). Use `oke test` for PGLite tests without Compose.
+
 </Step>
 
 <Step>
@@ -59,23 +62,19 @@ bunx create-oke@latest my-app --sql postgres
 bunx create-oke@latest my-app --yes
 ```
 
-Two Notes starters: **standard** (local-first) and **advanced** (docker-ready +
-files/digest/AI). Both ship a minimal GitHub Actions workflow (typecheck +
-`bun test` on push/PR) so the first push has working CI.
+Two Notes starters: **standard** and **advanced** (adds `store.index` + optional AI).
+Both are Docker-first (`dev`/`prod` share production protocols; `test` uses PGLite /
+memory). Both ship a minimal GitHub Actions workflow (typecheck + `bun test`).
 
 On a TTY: pick a template, then **recommended defaults**, **customize**, or
-**reuse** matching saved settings (saved to `~/.oke/create-defaults.json`).
-
-Customize asks local or docker first, walks facets (including `store.index` with
-`none`), then **AI setup** (Recommended / Customize / Off). Project name rejects
-a non-empty existing path.
+**reuse** matching saved settings (`~/.oke/create-defaults.json`).
 
-Non-TTY / `--yes` stay scriptable. Defaults: local SQLite · Docker/prod Postgres.
-`--sql postgres` pins SQL; `--ai` runs the model wizard before install.
+Customize walks Docker-first facets (including `store.index` with `none`), then
+**AI setup** (Recommended / Customize / Off). Project name rejects a non-empty
+existing path.
 
-Scaffold writes `.oke/mode` (standard → `local`, advanced → `docker`) so the
-first `oke dev` skips the mode prompt unless you delete it or pass `--local` /
-`--docker`.
+Non-TTY / `--yes` stay scriptable. `--sql postgres` pins SQL; `--ai` runs the
+model wizard before install.
 
 </Step>
 
@@ -102,9 +101,9 @@ configured.**
 
 </Steps>
 
-## Local database sync
+## Database sync in `oke dev`
 
-Local mode watches schema paths and auto-runs `oke db push` so the database
+`oke dev` watches schema paths and auto-runs `oke db push` so the database
 stays in sync. Opt out with `oke dev --no-db-push` or
 `db: { autoPush: false }` in `oke.config.ts`.
 
@@ -116,25 +115,18 @@ oke db generate   # write drizzle/*.sql
 oke db migrate    # apply
 ```
 
-## Docker mode
+## Docker Compose under `oke dev`
 
-Want Postgres/Redis like production while the app stays on host Bun?
-
-<DevModes />
+`oke dev` always brings up Compose under `docker/` and runs the app on host Bun
+with the `dev` driver profile (filled from `prod` when omitted). Credentials and
+host ports are unique per project.
 
 ```bash title="Terminal"
-oke dev --docker   # or: oke dev -d
-# or set the saved default: oke mode docker
+oke dev                      # full Compose set from images
+oke dev -d store.sql,signal  # optional: only these roles
+oke test                     # PGLite tests — no Compose
 ```
 
-Uses the `docker` driver profile in `oke.config.ts` (filled from `prod` when
-omitted). Compose and credentials land under `docker/` (`.env.docker` beside
-compose); host ports are unique per project.
-
-Bare `oke dev` uses `.oke/mode` when present (seeded by create-oke). On a TTY
-with no saved mode it prompts once and writes the file; non-TTY defaults to
-`local`.
-
 | Protocol            | Env shape (generated)                                                                                           |
 | ------------------- | --------------------------------------------------------------------------------------------------------------- |
 | Postgres            | `DATABASE_URL` plus `OKE_STORE_SQL_*`                                                                           |
@@ -142,9 +134,11 @@ with no saved mode it prompts once and writes the file; non-TTY defaults to
 | S3-compatible files | `S3_ENDPOINT`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, `S3_BUCKET`, `S3_URL`, `S3_REGION`, `S3_CONSOLE_URL` |
 | SMTP email          | `SMTP_URL`, `SMTP_HOST`, `SMTP_PORT`, `MAILPIT_UI_URL`, optional `SMTP_USER` / `SMTP_PASSWORD`                  |
 
-Each section also includes commented controls (Redis memory policy, Postgres
-init options, Bun S3 session tokens, Mailpit limits). Uncommented supported
-controls are preserved when `oke dev --docker` regenerates the file.
+Uncommented supported controls in the generated compose env are preserved when
+`oke dev` regenerates the file.
+
+Migrating from `local` / `docker` maps or `oke mode`?
+See [Migrating environments](/docs/reference/migrating-environments).
 
 ## Troubleshooting
 
@@ -156,6 +150,11 @@ controls are preserved when `oke dev --docker` regenerates the file.
   package name — only `okengine`.
 </Accordion>
 
+<Accordion title="Docker daemon not running">
+  `oke dev` requires Docker. Start Docker Desktop (or your engine), confirm with `docker info`, then
+  retry. For tests without Compose, use `oke test`.
+</Accordion>
+
 <Accordion title="Console is empty / no flows listed">
   Confirm `oke dev` is running and you opened `:6533`, not `:6530`. Flows appear only after the app
   boots and the Manifest is extracted — fix TypeScript errors in the terminal first.
@@ -168,12 +167,12 @@ controls are preserved when `oke dev --docker` regenerates the file.
 </Accordion>
 
 <Accordion title="Database out of sync after editing schema">
-  Local `oke dev` auto-pushes by default. If you passed `--no-db-push` or set `db.autoPush: false`,
-  run `oke db push` yourself, or re-enable auto-push.
+  `oke dev` auto-pushes by default. If you passed `--no-db-push` or set `db.autoPush: false`, run
+  `oke db push` yourself, or re-enable auto-push.
 </Accordion>
 
 <Accordion title="Docker containers left after deleting a project">
-  Each project gets its own `oke-dev-<id>` compose stack; `oke dev` stop keeps volumes. Run
+  Each project gets its own `oke-dev-<id>` compose project; `oke dev` stop keeps volumes. Run
   `oke docker clean` (TTY picker) or `oke docker clean --all --yes` from anywhere to remove
   leftover containers, networks, and volumes.
 </Accordion>
@@ -182,9 +181,10 @@ controls are preserved when `oke dev --docker` regenerates the file.
 
 ## Learn more
 
-- [CLI Reference](/docs/reference/cli) — `oke`, `create-oke`, mode, and db commands
+- [CLI Reference](/docs/reference/cli) — `oke`, `create-oke`, `oke test`, and db commands
 - [Environment variables](/docs/reference/environment-variables) — protocol-shaped env
 - [Configuration](/docs/reference/configuration) — `oke.config.ts` drivers and `db.autoPush`
+- [Migrating environments](/docs/reference/migrating-environments) — four-key maps → three
 
 ## Next
 

package/site/content/docs/get-started/introduction.mdx

@@ -144,6 +144,17 @@ derived from these ten names:
 import { on, flow, signal, store, clock, gate, vault, channel, ai, plugin } from "okengine";
 ```
 
+For HTTP-only apps, prefer the slim entry so the cold graph stays on the edge
+router:
+
+```ts title="okengine/http"
+import { on, flow, http, gate, oke, createBunRuntime } from "okengine/http";
+```
+
+Heavy surfaces (`runs`, journal factories, compiler extract, the legacy
+mega-barrel) live on `okengine/runs`, `okengine/journal`, `okengine/compiler`,
+and `okengine/full`.
+
 <Vocabulary />
 
 ## Learn more

package/site/content/docs/get-started/why.mdx

@@ -49,7 +49,7 @@ shared lifecycle, optional live DB config, nothing to re-copy.
 Your observability stack learned your routes from sampled traffic. The Flow
 you deployed an hour ago is invisible until someone wires it by hand.
 
-**OKE derives:** the [Console](/docs/console/overview) reads the Manifest —
+**OKE derives:** its operator interface reads the Manifest —
 flows, effects, traces, architecture — current on every save, in dev and prod
 (`:6533`).
 
@@ -67,7 +67,7 @@ Local runs one vendor client, CI another, prod a third — three glue stories
 for the same database. "Works on my machine" is a driver mismatch.
 
 **OKE derives:** drivers are named after protocols (`postgres`, `redis`,
-`s3`), the vendor lives in `images`, and `oke dev --docker` runs the real
+`s3`), the vendor lives in `images`, and `oke dev` runs the real
 stack locally.
 
 ## The tax is drift
@@ -101,7 +101,7 @@ ninth element — the set of eight is closed.
 | Secrets / config   | Env sprawl; fails on first request                        | Vault contracts; `VaultBootError` at boot                               |
 | Observability      | Bolted on; separate source of truth                       | Console from the Manifest, dev and prod (`:6533`)                       |
 | Permissions        | Ad-hoc checks scattered in handlers                       | Least-privilege matrix from declared effects                            |
-| Local vs prod      | Vendor clients; one-off compose                           | Protocol drivers; vendor in `images`; `oke dev --docker`                |
+| Local vs prod      | Vendor clients; one-off compose                           | Protocol drivers; vendor in `images`; `oke dev`                         |
 | Client / agents    | Separate codegen or hand-kept schemas                     | Typed client and MCP (`:6535`) from the same Manifest                   |
 
 ## Ambition, stated plainly
@@ -118,7 +118,6 @@ ninth element — the set of eight is closed.
 - [Flow](/docs/elements/flow) — how effects are recorded and inferred
 - [Vault](/docs/elements/vault) — fail-loud secret contracts
 - [Plugins](/docs/reference/plugins) — the official HTTP glue set
-- [Console · Overview](/docs/console/overview) — the Manifest-derived operator UI
 
 ## Next
 

package/site/content/docs/index.mdx

@@ -31,7 +31,6 @@ on(orderPlaced, sendReceipt);
     description="Official extensions — security, ops, performance."
     href="/docs/plugins"
   />
-  <Card title="Console" description="Manifest-derived operator panels." href="/docs/console" />
   <Card
     title="Deployment"
     description="Compose, Swarm, Kubernetes, reverse proxy."

package/site/content/docs/meta.json

@@ -6,7 +6,6 @@
     "get-started",
     "elements",
     "plugins",
-    "console",
     "deployment",
     "recipes",
     "providers",

package/site/content/docs/plugins/anonymous.mdx

@@ -26,7 +26,7 @@ import { anonymous } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(anonymous());
 ```

package/site/content/docs/plugins/magic-link.mdx

@@ -27,7 +27,7 @@ import { magicLink } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(magicLink({ baseUrl: "http://127.0.0.1:6530" }));
 ```
@@ -43,8 +43,8 @@ const { data } = await api.auth.requestMagicLink({ email: "ali@example.com" });
 // data.devToken only when exposeDevToken
 ```
 
-`POST /auth/magic-link/request`. Locally the `console` driver captures mail; with
-`oke dev --docker`, Mailpit receives the real SMTP message.
+`POST /auth/magic-link/request`. Under `oke test` the `console` driver captures mail; with
+`oke dev`, Mailpit receives the real SMTP message.
 
 </Step>
 
@@ -88,12 +88,12 @@ catalog bodies (`{{link}}`, `{{token}}`). Override copy by merging your own cata
 
 ## Delivery drivers
 
-| `drivers.channel.email` | Delivery                                                          |
-| ----------------------- | ----------------------------------------------------------------- |
-| `console`               | Dev inbox (local/test default)                                    |
-| `smtp`                  | Any SMTP host — Mailpit under `oke dev --docker` (docker default) |
-| `resend` / `sndr`       | Hosted email APIs                                                 |
-| `taqnyat-mail`          | Taqnyat Mail API (additive option)                                |
+| `drivers.channel.email` | Delivery                                              |
+| ----------------------- | ----------------------------------------------------- |
+| `console`               | Dev inbox (local/test default)                        |
+| `smtp`                  | Any SMTP host — Mailpit under `oke dev` (dev default) |
+| `resend` / `sndr`       | Hosted email APIs                                     |
+| `taqnyat-mail`          | Taqnyat Mail API (additive option)                    |
 
 ### Taqnyat Mail
 
@@ -101,7 +101,7 @@ catalog bodies (`{{link}}`, `{{token}}`). Override copy by merging your own cata
 export default {
   drivers: {
     channel: {
-      email: { local: "console", docker: "smtp", test: "console", prod: "taqnyat-mail" },
+      email: { dev: "smtp", test: "console", prod: "taqnyat-mail" },
     },
   },
 };
@@ -139,7 +139,7 @@ Token expired (default 10m), already used, or mistyped. Request a new link.
 <Accordion title="No email arrived">
 
 In `local` / `test` the `console` driver captures mail into the inbox — nothing hits a mailbox.
-Run `oke dev --docker` and open Mailpit (`MAILPIT_UI_URL`) to see the rendered message. For
+Run `oke dev` and open Mailpit (`MAILPIT_UI_URL`) to see the rendered message. For
 unit tests without SMTP, set `exposeDevToken: true`.
 
 </Accordion>

package/site/content/docs/plugins/otp.mdx

@@ -40,7 +40,7 @@ import { otp } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(
   otp({
@@ -122,7 +122,7 @@ const { data } = await api.auth.verifyOtp({
 export default {
   drivers: {
     channel: {
-      sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
+      sms: { test: "console", prod: "taqnyat" },
     },
   },
 };

package/site/content/docs/plugins/passkey.mdx

@@ -28,7 +28,7 @@ import { passkey } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(passkey({ origins: ["http://localhost", "https://localhost"] }));
 ```

package/site/content/docs/plugins/two-factor.mdx

@@ -27,7 +27,7 @@ import { twoFactor } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(twoFactor());
 ```