okengine 0.10.3 → 0.11.1

package/site/content/docs/get-started/installation.mdx

@@ -21,8 +21,11 @@ This page gets you from zero to a running app on Bun. The engine targets
 ### Prerequisites
 
 - [Bun](https://bun.sh) ≥ 1.3.14 (`bun --version`)
+- [Docker](https://docs.docker.com/get-docker/) with a running daemon (`docker info`)
 - A terminal and a code editor
 
+`oke dev` always starts Docker Compose for Postgres / Redis / S3 / SMTP (and other pinned images). Use `oke test` for PGLite tests without Compose.
+
 </Step>
 
 <Step>
@@ -59,23 +62,19 @@ bunx create-oke@latest my-app --sql postgres
 bunx create-oke@latest my-app --yes
 ```
 
-Two Notes starters: **standard** (local-first) and **advanced** (docker-ready +
-files/digest/AI). Both ship a minimal GitHub Actions workflow (typecheck +
-`bun test` on push/PR) so the first push has working CI.
+Two Notes starters: **standard** and **advanced** (adds `store.index` + optional AI).
+Both are Docker-first (`dev`/`prod` share production protocols; `test` uses PGLite /
+memory). Both ship a minimal GitHub Actions workflow (typecheck + `bun test`).
 
 On a TTY: pick a template, then **recommended defaults**, **customize**, or
-**reuse** matching saved settings (saved to `~/.oke/create-defaults.json`).
-
-Customize asks local or docker first, walks facets (including `store.index` with
-`none`), then **AI setup** (Recommended / Customize / Off). Project name rejects
-a non-empty existing path.
+**reuse** matching saved settings (`~/.oke/create-defaults.json`).
 
-Non-TTY / `--yes` stay scriptable. Defaults: local SQLite · Docker/prod Postgres.
-`--sql postgres` pins SQL; `--ai` runs the model wizard before install.
+Customize walks Docker-first facets (including `store.index` with `none`), then
+**AI setup** (Recommended / Customize / Off). Project name rejects a non-empty
+existing path.
 
-Scaffold writes `.oke/mode` (standard → `local`, advanced → `docker`) so the
-first `oke dev` skips the mode prompt unless you delete it or pass `--local` /
-`--docker`.
+Non-TTY / `--yes` stay scriptable. `--sql postgres` pins SQL; `--ai` runs the
+model wizard before install.
 
 </Step>
 
@@ -102,9 +101,9 @@ configured.**
 
 </Steps>
 
-## Local database sync
+## Database sync in `oke dev`
 
-Local mode watches schema paths and auto-runs `oke db push` so the database
+`oke dev` watches schema paths and auto-runs `oke db push` so the database
 stays in sync. Opt out with `oke dev --no-db-push` or
 `db: { autoPush: false }` in `oke.config.ts`.
 
@@ -116,25 +115,18 @@ oke db generate   # write drizzle/*.sql
 oke db migrate    # apply
 ```
 
-## Docker mode
+## Docker Compose under `oke dev`
 
-Want Postgres/Redis like production while the app stays on host Bun?
-
-<DevModes />
+`oke dev` always brings up Compose under `docker/` and runs the app on host Bun
+with the `dev` driver profile (filled from `prod` when omitted). Credentials and
+host ports are unique per project.
 
 ```bash title="Terminal"
-oke dev --docker   # or: oke dev -d
-# or set the saved default: oke mode docker
+oke dev                      # full Compose set from images
+oke dev -d store.sql,signal  # optional: only these roles
+oke test                     # PGLite tests — no Compose
 ```
 
-Uses the `docker` driver profile in `oke.config.ts` (filled from `prod` when
-omitted). Compose and credentials land under `docker/` (`.env.docker` beside
-compose); host ports are unique per project.
-
-Bare `oke dev` uses `.oke/mode` when present (seeded by create-oke). On a TTY
-with no saved mode it prompts once and writes the file; non-TTY defaults to
-`local`.
-
 | Protocol            | Env shape (generated)                                                                                           |
 | ------------------- | --------------------------------------------------------------------------------------------------------------- |
 | Postgres            | `DATABASE_URL` plus `OKE_STORE_SQL_*`                                                                           |
@@ -142,9 +134,11 @@ with no saved mode it prompts once and writes the file; non-TTY defaults to
 | S3-compatible files | `S3_ENDPOINT`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, `S3_BUCKET`, `S3_URL`, `S3_REGION`, `S3_CONSOLE_URL` |
 | SMTP email          | `SMTP_URL`, `SMTP_HOST`, `SMTP_PORT`, `MAILPIT_UI_URL`, optional `SMTP_USER` / `SMTP_PASSWORD`                  |
 
-Each section also includes commented controls (Redis memory policy, Postgres
-init options, Bun S3 session tokens, Mailpit limits). Uncommented supported
-controls are preserved when `oke dev --docker` regenerates the file.
+Uncommented supported controls in the generated compose env are preserved when
+`oke dev` regenerates the file.
+
+Migrating from `local` / `docker` maps or `oke mode`?
+See [Migrating environments](/docs/reference/migrating-environments).
 
 ## Troubleshooting
 
@@ -156,6 +150,11 @@ controls are preserved when `oke dev --docker` regenerates the file.
   package name — only `okengine`.
 </Accordion>
 
+<Accordion title="Docker daemon not running">
+  `oke dev` requires Docker. Start Docker Desktop (or your engine), confirm with `docker info`, then
+  retry. For tests without Compose, use `oke test`.
+</Accordion>
+
 <Accordion title="Console is empty / no flows listed">
   Confirm `oke dev` is running and you opened `:6533`, not `:6530`. Flows appear only after the app
   boots and the Manifest is extracted — fix TypeScript errors in the terminal first.
@@ -168,12 +167,12 @@ controls are preserved when `oke dev --docker` regenerates the file.
 </Accordion>
 
 <Accordion title="Database out of sync after editing schema">
-  Local `oke dev` auto-pushes by default. If you passed `--no-db-push` or set `db.autoPush: false`,
-  run `oke db push` yourself, or re-enable auto-push.
+  `oke dev` auto-pushes by default. If you passed `--no-db-push` or set `db.autoPush: false`, run
+  `oke db push` yourself, or re-enable auto-push.
 </Accordion>
 
 <Accordion title="Docker containers left after deleting a project">
-  Each project gets its own `oke-dev-<id>` compose stack; `oke dev` stop keeps volumes. Run
+  Each project gets its own `oke-dev-<id>` compose project; `oke dev` stop keeps volumes. Run
   `oke docker clean` (TTY picker) or `oke docker clean --all --yes` from anywhere to remove
   leftover containers, networks, and volumes.
 </Accordion>
@@ -182,9 +181,10 @@ controls are preserved when `oke dev --docker` regenerates the file.
 
 ## Learn more
 
-- [CLI Reference](/docs/reference/cli) — `oke`, `create-oke`, mode, and db commands
+- [CLI Reference](/docs/reference/cli) — `oke`, `create-oke`, `oke test`, and db commands
 - [Environment variables](/docs/reference/environment-variables) — protocol-shaped env
 - [Configuration](/docs/reference/configuration) — `oke.config.ts` drivers and `db.autoPush`
+- [Migrating environments](/docs/reference/migrating-environments) — four-key maps → three
 
 ## Next
 

package/site/content/docs/get-started/introduction.mdx

@@ -144,6 +144,17 @@ derived from these ten names:
 import { on, flow, signal, store, clock, gate, vault, channel, ai, plugin } from "okengine";
 ```
 
+For HTTP-only apps, prefer the slim entry so the cold graph stays on the edge
+router:
+
+```ts title="okengine/http"
+import { on, flow, http, gate, oke, createBunRuntime } from "okengine/http";
+```
+
+Heavy surfaces (`runs`, journal factories, compiler extract, the legacy
+mega-barrel) live on `okengine/runs`, `okengine/journal`, `okengine/compiler`,
+and `okengine/full`.
+
 <Vocabulary />
 
 ## Learn more

package/site/content/docs/get-started/why.mdx

@@ -67,7 +67,7 @@ Local runs one vendor client, CI another, prod a third — three glue stories
 for the same database. "Works on my machine" is a driver mismatch.
 
 **OKE derives:** drivers are named after protocols (`postgres`, `redis`,
-`s3`), the vendor lives in `images`, and `oke dev --docker` runs the real
+`s3`), the vendor lives in `images`, and `oke dev` runs the real
 stack locally.
 
 ## The tax is drift
@@ -101,7 +101,7 @@ ninth element — the set of eight is closed.
 | Secrets / config   | Env sprawl; fails on first request                        | Vault contracts; `VaultBootError` at boot                               |
 | Observability      | Bolted on; separate source of truth                       | Console from the Manifest, dev and prod (`:6533`)                       |
 | Permissions        | Ad-hoc checks scattered in handlers                       | Least-privilege matrix from declared effects                            |
-| Local vs prod      | Vendor clients; one-off compose                           | Protocol drivers; vendor in `images`; `oke dev --docker`                |
+| Local vs prod      | Vendor clients; one-off compose                           | Protocol drivers; vendor in `images`; `oke dev`                         |
 | Client / agents    | Separate codegen or hand-kept schemas                     | Typed client and MCP (`:6535`) from the same Manifest                   |
 
 ## Ambition, stated plainly

package/site/content/docs/plugins/anonymous.mdx

@@ -26,7 +26,7 @@ import { anonymous } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(anonymous());
 ```

package/site/content/docs/plugins/magic-link.mdx

@@ -27,7 +27,7 @@ import { magicLink } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(magicLink({ baseUrl: "http://127.0.0.1:6530" }));
 ```
@@ -43,8 +43,8 @@ const { data } = await api.auth.requestMagicLink({ email: "ali@example.com" });
 // data.devToken only when exposeDevToken
 ```
 
-`POST /auth/magic-link/request`. Locally the `console` driver captures mail; with
-`oke dev --docker`, Mailpit receives the real SMTP message.
+`POST /auth/magic-link/request`. Under `oke test` the `console` driver captures mail; with
+`oke dev`, Mailpit receives the real SMTP message.
 
 </Step>
 
@@ -88,12 +88,12 @@ catalog bodies (`{{link}}`, `{{token}}`). Override copy by merging your own cata
 
 ## Delivery drivers
 
-| `drivers.channel.email` | Delivery                                                          |
-| ----------------------- | ----------------------------------------------------------------- |
-| `console`               | Dev inbox (local/test default)                                    |
-| `smtp`                  | Any SMTP host — Mailpit under `oke dev --docker` (docker default) |
-| `resend` / `sndr`       | Hosted email APIs                                                 |
-| `taqnyat-mail`          | Taqnyat Mail API (additive option)                                |
+| `drivers.channel.email` | Delivery                                              |
+| ----------------------- | ----------------------------------------------------- |
+| `console`               | Dev inbox (local/test default)                        |
+| `smtp`                  | Any SMTP host — Mailpit under `oke dev` (dev default) |
+| `resend` / `sndr`       | Hosted email APIs                                     |
+| `taqnyat-mail`          | Taqnyat Mail API (additive option)                    |
 
 ### Taqnyat Mail
 
@@ -101,7 +101,7 @@ catalog bodies (`{{link}}`, `{{token}}`). Override copy by merging your own cata
 export default {
   drivers: {
     channel: {
-      email: { local: "console", docker: "smtp", test: "console", prod: "taqnyat-mail" },
+      email: { dev: "smtp", test: "console", prod: "taqnyat-mail" },
     },
   },
 };
@@ -139,7 +139,7 @@ Token expired (default 10m), already used, or mistyped. Request a new link.
 <Accordion title="No email arrived">
 
 In `local` / `test` the `console` driver captures mail into the inbox — nothing hits a mailbox.
-Run `oke dev --docker` and open Mailpit (`MAILPIT_UI_URL`) to see the rendered message. For
+Run `oke dev` and open Mailpit (`MAILPIT_UI_URL`) to see the rendered message. For
 unit tests without SMTP, set `exposeDevToken: true`.
 
 </Accordion>

package/site/content/docs/plugins/otp.mdx

@@ -40,7 +40,7 @@ import { otp } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(
   otp({
@@ -122,7 +122,7 @@ const { data } = await api.auth.verifyOtp({
 export default {
   drivers: {
     channel: {
-      sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
+      sms: { test: "console", prod: "taqnyat" },
     },
   },
 };

package/site/content/docs/plugins/passkey.mdx

@@ -28,7 +28,7 @@ import { passkey } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(passkey({ origins: ["http://localhost", "https://localhost"] }));
 ```

package/site/content/docs/plugins/two-factor.mdx

@@ -27,7 +27,7 @@ import { twoFactor } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(twoFactor());
 ```

package/site/content/docs/plugins/username.mdx

@@ -26,7 +26,7 @@ import { username } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(username());
 ```

package/site/content/docs/recipes/caddy.mdx

@@ -43,7 +43,7 @@ Unset defaults to `localhost` — Caddy issues a **local** TLS cert instead of L
 ### Include the proxy layer
 
 ```bash
-docker compose -f compose.yml -f compose.proxy.yml … up -d
+docker compose -f docker-compose.yml up -d
 ```
 
 Generated `Caddyfile`: `{$OKE_PROXY_HOST:localhost} { reverse_proxy app:6530 }`.

package/site/content/docs/recipes/cockroachdb.mdx

@@ -34,7 +34,7 @@ images: {
 ### Bring the stack up
 
 ```bash
-oke dev --docker
+oke dev
 ```
 
 `oke docker` injects `COCKROACH_USER` / `COCKROACH_PASSWORD` / `COCKROACH_DATABASE`
@@ -94,7 +94,7 @@ not multi-region HA. For managed multi-region, use the
 <Accordions>
 <Accordion title="oke boot: postgres driver needs DATABASE_URL">
 
-Re-run `oke dev --docker` so the stack writes `docker/.env.docker`, or export
+Re-run `oke dev` so the stack writes `docker/.env.docker`, or export
 `DATABASE_URL` yourself when pointing at a remote Cockroach host.
 
 </Accordion>

package/site/content/docs/recipes/dragonfly.mdx

@@ -100,7 +100,7 @@ daemon / systemd limit, or run on a host that allows `memlock: -1`.
 </Accordion>
 <Accordion title="oke boot: redis driver needs REDIS_URL">
 
-Same driver failure as Redis — export `REDIS_URL` or let docker mode write it. Wrong
+Same driver failure as Redis — export `REDIS_URL` or let `oke dev` write it. Wrong
 password yields Redis-protocol `NOAUTH` / `WRONGPASS` from the server.
 
 </Accordion>

package/site/content/docs/recipes/index.mdx

@@ -10,7 +10,7 @@ and get env, healthcheck, and a connection URL for free.
 
 <Callout title="The one rule">
   Vendor choice lives in `images[…]` — never in `drivers.*`, which only ever say protocol ids
-  (`postgres`, `redis`, `s3`, `smtp`, `openbao`, `meilisearch`, `openai-compatible`, `ollama`, …).
+  (`postgres`, `redis`, `s3`, `smtp`, `meilisearch`, `openai-compatible`, `ollama`, …).
 </Callout>
 
 ## SQL
@@ -84,7 +84,6 @@ Opt-in via `images.proxy` — leave unset until you need HTTPS or `--scale app=N
     href="/docs/recipes/rustfs"
   />
   <Card title="Mailpit" description="SMTP catcher — UI on :8025." href="/docs/recipes/mailpit" />
-  <Card title="OpenBao" description="Raft vault — unseal key SPOF." href="/docs/recipes/openbao" />
   <Card
     title="Meilisearch"
     description="Full-text store.index on :7700."

package/site/content/docs/recipes/llama-cpp.mdx

@@ -23,7 +23,7 @@ for single-user / dev. Driver id stays `openai-compatible`.
 
 ```typescript title="oke.config.ts"
 drivers: {
-  ai: { local: "openai-compatible", docker: "openai-compatible", test: "mock" },
+  ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
   ai: "ghcr.io/ggml-org/llama.cpp:server-b10290", // never :latest
@@ -32,7 +32,7 @@ images: {
 
 Or `oke ai setup --provider llama-cpp` (TTY: banner → Ultra Fast / Fast /
 Balanced / Smart → up to 20 curated Docker Hub `ai/` picks per tier) / `--yes`
-for `smollm2`.
+for `granite3.3:2b`.
 
 </Step>
 
@@ -41,19 +41,16 @@ for `smollm2`.
 
 ```bash title="docker/.env.docker"
 OKE_AI_URL=http://127.0.0.1:8080/v1
-OKE_AI_MODEL=smollm2
+OKE_AI_MODEL=granite3.3:2b
 ```
 
 `OKE_AI_MODEL` is a Docker Hub `ai/<id>` model. The recipe writes
-`docker/llama-entrypoint.py`, which Hub-pulls into the cache volume (native
-`llama download -dr`, then a CNCF `model.weight` fallback for newer tags like
-gemma4), then starts `llama-server -m <gguf> --alias <id>` (single-model — not
-router `--models-preset` / bare `--docker-repo`, which hang on b10290+). Never
-set `LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` in the container env.
+`docker/llama-entrypoint.py`, which Hub-pulls into the cache volume, then starts
+`llama-server -m <gguf> --alias <id>` (single-model).
 
-`oke dev -d` shows the model id in the hero / Docker summary and polls
-`/v1/models` in the background until status is `ready` (first boot may take
-minutes while the Hub image downloads).
+Never set `LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` — those hang on
+b10290+. `oke dev` shows the model id and polls `/v1/models` until `ready`
+(first boot may take minutes).
 
 </Step>
 
@@ -65,7 +62,7 @@ import { ai } from "okengine";
 
 export const smart = ai.model("smart", {
   provider: "openai-compatible",
-  model: process.env.OKE_AI_MODEL ?? "smollm2",
+  model: process.env.OKE_AI_MODEL ?? "granite3.3:2b",
 });
 ```
 
@@ -89,10 +86,10 @@ Postgres/Redis, stricter on the published interface because of GGUF CVE risk.
 
 ## Required env
 
-| Variable       | Required?         | Meaning                                 |
-| -------------- | ----------------- | --------------------------------------- |
-| `OKE_AI_URL`   | **Yes** in docker | Base URL including `/v1`                |
-| `OKE_AI_MODEL` | Recommended       | Docker Hub `ai/` id (default `smollm2`) |
+| Variable       | Required?         | Meaning                                       |
+| -------------- | ----------------- | --------------------------------------------- |
+| `OKE_AI_URL`   | **Yes** in docker | Base URL including `/v1`                      |
+| `OKE_AI_MODEL` | Recommended       | Docker Hub `ai/` id (default `granite3.3:2b`) |
 
 ## What the recipe configures
 
@@ -127,13 +124,14 @@ interfaces). `OKE_AI_URL` must include `/v1`.
 
 First start Hub-pulls the curated `ai/` model into the named cache volume
 (see logs: `oke ai: ensuring…` / download %). Prefer `oke ai setup` tiers
-(Ultra Fast → `smollm2`) for smoke tests. Confirm `OKE_AI_MODEL` is active in
-`.env.local` / `docker/.env.docker`. Watch `oke dev` (`AI … — waiting…` →
-`ready`). If status stays `loading` forever on an old stack that still uses
-`--models-preset`, regenerate `docker/` and recreate AI. Newer Hub tags use
-CNCF weight layers — the entrypoint falls back when native `llama download`
-cannot find `vnd.docker.ai.gguf.v3`. Do not mount random GGUF files. Never put
-`LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` in the container env.
+(Ultra Fast → `granite3.3:2b`) for smoke tests.
+
+Confirm `OKE_AI_MODEL` in `docker/.env.docker` (keep the `.env.local` hint commented so it does not shadow compose). Watch `oke
+dev` until AI status is `ready`.
+
+If status stays `loading` on Compose that still uses `--models-preset`,
+regenerate `docker/` and recreate AI. Never mount random GGUF or set
+`LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO`.
 
 </Accordion>
 </Accordions>

package/site/content/docs/recipes/mailpit.mdx

@@ -5,13 +5,13 @@ icon: "Mail"
 source: "docs/spec/unified-theory.md"
 ---
 
-Mailpit is the docker-mode email catcher — every message the `smtp` channel driver sends
-lands in a web UI instead of a real inbox. Pin it as `images["channel.email"]` when
-`drivers.channel.email.docker` is `smtp`.
+Mailpit is the `oke dev` email catcher — every message the `smtp` channel driver sends
+lands in a web UI instead of a real inbox. Pin it as `images.channel.email` when
+`drivers.channel.email.dev` is `smtp`.
 
 <Callout title="The one rule">
-  Docker ≈ prod for the **SMTP protocol** — same `SMTP_URL` shape. Mailpit is not a production MTA;
-  swap the image / URL for a real relay when you leave local docker.
+  `dev` ≈ `prod` for the **SMTP protocol** — same `SMTP_URL` shape. Mailpit is not a production MTA;
+  swap the image / URL for a real relay in production.
 </Callout>
 
 ## Quick start
@@ -24,11 +24,11 @@ lands in a web UI instead of a real inbox. Pin it as `images["channel.email"]` w
 ```typescript title="oke.config.ts"
 drivers: {
   channel: {
-    email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
+    email: { dev: "smtp", test: "console", prod: "smtp" },
   },
 },
 images: {
-  "channel.email": "axllent/mailpit:v1.22.3",
+  channel: { email: "axllent/mailpit:v1.22.3" },
 },
 ```
 
@@ -100,7 +100,7 @@ if SMTP still accepts mail.
 <Accordion title="oke boot: smtp driver needs SMTP_URL">
 
 The smtp binder refuses to start without `SMTP_URL` (or `OKE_CHANNEL_EMAIL_URL`). In
-docker mode the error asks whether `oke dev -d` wrote `docker/.env.docker`. Also rejects
+under `oke dev` the error asks whether Compose wrote `docker/.env.docker`. Also rejects
 non-`smtp://` schemes: `oke boot: SMTP_URL must use smtp://`.
 
 </Accordion>
@@ -128,9 +128,9 @@ shift the host port).
     href="/docs/recipes/rustfs"
   />
   <Card
-    title="OpenBao"
-    description="Vault recipe for docker/prod secrets."
-    href="/docs/recipes/openbao"
+    title="Vault"
+    description="Secrets and built-in encrypted store."
+    href="/docs/elements/vault"
   />
   <Card title="Channel" description="How fx.email reaches humans." href="/docs/elements/channel" />
 </Cards>

package/site/content/docs/recipes/meilisearch.mdx

@@ -6,12 +6,12 @@ source: "docs/spec/unified-theory.md"
 ---
 
 Meilisearch backs the `meilisearch` index driver — typo-tolerant full-text search over
-HTTP. Pin `images["store.index"]` and set `drivers.store.index` to `meilisearch` where
-you need it (index does **not** auto-promote in docker).
+HTTP. Pin `images.store.index` and set `drivers.store.index` to `meilisearch` where
+you need it (index does **not** auto-promote under Compose).
 
 <Callout title="The one rule">
   Index stays `memory` in every environment until you set the driver map explicitly — there is no
-  silent docker fallback to Meilisearch or pgvector.
+  silent fallback to Meilisearch or pgvector.
 </Callout>
 
 ## Quick start
@@ -24,11 +24,11 @@ you need it (index does **not** auto-promote in docker).
 ```typescript title="oke.config.ts"
 drivers: {
   store: {
-    index: { local: "memory", docker: "meilisearch", prod: "meilisearch" },
+    index: { dev: "meilisearch", test: "memory", prod: "meilisearch" },
   },
 },
 images: {
-  "store.index": "getmeili/meilisearch:v1.14",
+  store: { index: "getmeili/meilisearch:v1.14" },
 },
 ```
 
@@ -53,8 +53,8 @@ Recipe injects into the container:
 <Step>
 ### Search from a flow
 
-Use `store.index(…)` without `{ dims }` for full-text (vector dims select pgvector /
-libsql). Writes wait on Meilisearch tasks before returning.
+Use `store.index(…)` without `{ dims }` for full-text (vector dims select pgvector).
+Writes wait on Meilisearch tasks before returning.
 
 </Step>
 
@@ -87,8 +87,8 @@ Always set a non-empty `OKE_STORE_INDEX_KEY` when `MEILI_ENV=production` — Mei
 refuses insecure production mode without a master key. Prefer network isolation (compose
 network only) plus the key; do not publish `:7700` on the public internet without auth.
 
-Vector `ai.embed` into a meilisearch index fails loud — embeddings need `pgvector` /
-`libsql`, not FTS. See [Store · Index](/docs/elements/store#index).
+Vector `ai.embed` into a meilisearch index fails loud — embeddings need `pgvector`,
+not FTS. See [Store · Index](/docs/elements/store#index).
 
 ## What the recipe configures
 
@@ -103,7 +103,7 @@ Vector `ai.embed` into a meilisearch index fails loud — embeddings need `pgvec
 <Accordions>
 <Accordion title="oke boot: meilisearch index needs OKE_STORE_INDEX_URL">
 
-No silent memory fallback. Re-run `oke dev --docker` or export `OKE_STORE_INDEX_URL`.
+No silent memory fallback. Re-run `oke dev` or export `OKE_STORE_INDEX_URL`.
 Docker-mode wording asks whether `docker/.env.docker` was written.
 
 </Accordion>

package/site/content/docs/recipes/meta.json

@@ -20,7 +20,6 @@
     "pgdog",
     "rustfs",
     "mailpit",
-    "openbao",
     "meilisearch",
     "---AI---",
     "llama-cpp",

package/site/content/docs/recipes/ollama.mdx

@@ -23,7 +23,7 @@ want its library pull UX. Pin `images.ai` and set `drivers.ai` to `ollama`.
 
 ```typescript title="oke.config.ts"
 drivers: {
-  ai: { local: "ollama", docker: "ollama", test: "mock" }, // prod: set deliberately
+  ai: { dev: "ollama", test: "mock", prod: "ollama" }, // or set prod deliberately
 },
 images: {
   ai: "ollama/ollama:0.32.6", // never :latest — floor 0.17.1 (CVE-2026-7482)

package/site/content/docs/recipes/pgdog.mdx

@@ -1,6 +1,6 @@
 ---
 title: "PgDog"
-description: "Postgres wire-protocol pooler — transaction mode on :6432, generated pgdog.toml / users.toml, DATABASE_URL rewrite."
+description: "Postgres wire-protocol pooler — transaction mode on :6432, generated pgdog/ configs, DATABASE_URL rewrite."
 icon: "Package"
 source: "docs/spec/unified-theory.md"
 ---
@@ -21,6 +21,8 @@ transaction-pooling proxy — same wire protocol, no app code changes.
 <Step>
 ### Pin both images
 
+create-oke asks **Add PgDog connection pooling…?** (or pass `--pgdog`). Manually:
+
 ```typescript title="oke.config.ts"
 images: {
   "store.sql": "postgres:18-alpine",
@@ -37,8 +39,9 @@ images: {
 oke docker
 ```
 
-Writes `./pgdog.toml` (listen + one primary database) and `./users.toml` (same
-user/password/database as Postgres). The pooler waits on `store-sql` health before start.
+Writes `./pgdog/pgdog.toml` (listen + one primary database) and
+`./pgdog/users.toml` (same user/password/database as Postgres). The pooler
+waits on `store-sql` health before start.
 
 </Step>
 
@@ -59,7 +62,7 @@ echo "$OKE_STORE_SQL_URL"   # still the direct Postgres URL when you need it
 
 | Variable                                 | Role                                                             |
 | ---------------------------------------- | ---------------------------------------------------------------- |
-| `OKE_STORE_SQL_USER` / `PASSWORD` / `DB` | Copied into `users.toml` for client + server auth                |
+| `OKE_STORE_SQL_USER` / `PASSWORD` / `DB` | Copied into `pgdog/users.toml` for client + server auth          |
 | `DATABASE_URL`                           | Rewritten to the pooler URL (`:6432`) when PgDog is in the stack |
 | `OKE_PGDOG_URL`                          | Same value as pooled `DATABASE_URL` when both are present        |
 | `OKE_STORE_SQL_URL`                      | Direct Postgres host — bypass the pooler for admin / migrations  |
@@ -68,10 +71,10 @@ PgDog itself has no separate credential env — it mounts the generated TOML fil
 
 ## Data and backup
 
-| Mount                               | What it is                                                         |
-| ----------------------------------- | ------------------------------------------------------------------ |
-| `./pgdog.toml:/pgdog/pgdog.toml:ro` | Generated listen + `[[databases]]` (host `store-sql`, port `5432`) |
-| `./users.toml:/pgdog/users.toml:ro` | Generated `[[users]]` credentials                                  |
+| Mount                                     | What it is                                                         |
+| ----------------------------------------- | ------------------------------------------------------------------ |
+| `./pgdog/pgdog.toml:/pgdog/pgdog.toml:ro` | Generated listen + `[[databases]]` (host `store-sql`, port `5432`) |
+| `./pgdog/users.toml:/pgdog/users.toml:ro` | Generated `[[users]]` credentials                                  |
 
 **No database state lives in the PgDog container.** Backing up PgDog means keeping those
 two config files (they are regenerated by `oke docker`). Durable data stays on the
@@ -104,7 +107,7 @@ not wired into the generated stack yet.
 <Accordions>
 <Accordion title="pgdog unhealthy — pg_isready on :6432 fails">
 
-Usually the backend is not ready, or `users.toml` credentials do not match Postgres.
+Usually the backend is not ready, or `pgdog/users.toml` credentials do not match Postgres.
 Confirm `store-sql` is healthy first, then re-run `oke docker` so TOML matches
 `OKE_STORE_SQL_*`. Logs often show auth failures against `store-sql:5432`.