okengine 0.18.4 → 0.19.0

package/site/content/docs/elements/vault.mdx

@@ -1,405 +0,0 @@
----
-title: "Vault"
-description: "Secrets, API keys, and config — declared once as typed contracts, resolved from a real vault in production, never leaked into logs."
-icon: "KeyRound"
-source: "docs/spec/unified-theory.md"
----
-
-Vault is where your app's **protected knowledge** lives: API keys, database URLs, tokens — plus non-secret config like a public app URL. This page shows how to declare a secret, give it a value, and read it in a Flow, then how OKE keeps it safe in production.
-
-<Callout title="The one rule">
-  You declare **contracts**, never values, in code. Values come from the environment at boot — a
-  secret that has no value anywhere fails the boot loudly, with every gap listed at once.
-</Callout>
-
-## Quick start
-
-<Steps>
-
-<Step>
-### Declare the contract
-
-In `src/vault.ts`, declare what your app needs. This says "a secret named `STRIPE_KEY` exists" — it does **not** contain the key itself:
-
-```typescript title="src/vault.ts"
-import { vault } from "okengine";
-import { z } from "zod";
-
-export const stripeKey = vault.secret("STRIPE_KEY", {
-  description: "Payments gateway key",
-  rotate: "90d",
-  schema: z.string().startsWith("sk_"),
-  dev: "sk_test_local", // used only by `oke dev` (local) when nothing else provides a value
-});
-```
-
-</Step>
-
-<Step>
-### Give it a value
-
-For local development, put the real value in `.env.local` (gitignored):
-
-```bash title=".env.local"
-STRIPE_KEY=sk_test_your_key_here
-```
-
-Or set it from the CLI — it writes to the right place for the active mode:
-
-```bash
-oke vault set STRIPE_KEY sk_test_your_key_here
-```
-
-</Step>
-
-<Step>
-### Read it in a Flow
-
-Flows read secrets through `fx.vault.get` — never through `process.env`. It resolves to a
-`Redacted<string>`: printing, logging, or serializing it yields a placeholder, never the value.
-Call `.reveal()` once at the boundary that needs the real credential:
-
-```typescript title="src/flows/billing/charge.ts"
-export const charge = on(
-  http.post("/charge"),
-  flow("billing.charge", {
-    in: ChargeInput,
-    out: z.object({ id: z.string() }),
-    do: async (input, fx) => {
-      const key = await fx.vault.get(stripeKey); // Redacted — safe to pass to fx.log
-      const intent = await stripe(key.reveal()).create(input);
-      return { id: intent.id };
-    },
-  }),
-);
-```
-
-`fx.log` masks any `Redacted` found in the logged data (nested included). A revealed string that
-still reaches `fx.log` is scrubbed by the boot redactor as before.
-
-</Step>
-
-</Steps>
-
-That's the whole loop: declare → set → read. Everything below is what OKE guarantees on top of it.
-
-## Redacted until you reveal
-
-<VaultRedacted />
-
-Pass the wrapper freely — `fx.log`, `String()`, `JSON.stringify`, and
-`console.log` / `util.inspect` all yield `[redacted]` (or a `Redacted<…>` label).
-Call `.reveal()` once at the provider boundary that needs the credential.
-
-## Two kinds of contracts
-
-| Declaration                         | Sensitive? | Console shows                       | Use for                     |
-| ----------------------------------- | ---------- | ----------------------------------- | --------------------------- |
-| `vault.secret("STRIPE_KEY", …)`     | yes        | fingerprint only                    | API keys, tokens, passwords |
-| `vault.config("PUBLIC_APP_URL", …)` | no         | **Config** band, value in the clear | Public URLs, feature flags  |
-
-`vault(name, …)` is shorthand for `vault.secret(name, …)`.
-
-<Callout title="Config is the one place for non-secret variables">
-  `vault.config()` is the contract the Console **Config** band lists and edits. Declare it once; set
-  the value from Console, `oke vault set`, or the resolution chain. Do not use `vault.env` for
-  values you want to see or change on `/vault`.
-</Callout>
-
-```typescript title="src/vault.ts"
-export const publicAppUrl = vault.config("PUBLIC_APP_URL", {
-  description: "Public site origin",
-  dev: "http://127.0.0.1:6530",
-});
-```
-
-```bash title=".env.local"
-PUBLIC_APP_URL=https://app.example.com
-```
-
-```typescript title="src/flows/site/render.ts"
-do: async (_input, fx) => {
-  const origin = (await fx.vault.get(publicAppUrl)).reveal();
-  return { canonical: `${origin}/` };
-},
-```
-
-**Consequence:** `/vault` lists this under **Config** in the clear. `fx.vault.get` still
-returns `Redacted` — `.reveal()` is the read. `vault.env("PUBLIC_APP_URL")` never appears
-on that page.
-
-### Plain environment variables
-
-`vault.env` reads `process.env` synchronously for values that need no contract — a port, a feature flag, a log level. It never joins the resolution chain, never appears in the Console, never gets a fingerprint, and never gets redacted.
-
-| Call                             | Returns               | On a missing value                     |
-| -------------------------------- | --------------------- | -------------------------------------- |
-| `vault.env("LOG_LEVEL")`         | `string \| undefined` | `undefined` (empty counts as missing)  |
-| `vault.env.required("REGION")`   | `string`              | Throws, and boot lists it as a gap     |
-| `vault.env.int("PORT", 3000)`    | `number`              | The default; throws when none is given |
-| `vault.env.bool("DEBUG", false)` | `boolean`             | The default; throws when none is given |
-| `vault.env.json("FLAGS")`        | `T \| undefined`      | `undefined`; throws on malformed JSON  |
-
-Every name passed to `vault.env.required` is registered, so boot reports missing variables in the same `VaultBootError` as missing secrets — before it opens a database connection.
-
-### Contract options
-
-| Option        | Type                  | Meaning                                                                                                                                          |
-| ------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `description` | string                | Human title in boot-gap listings and the Console (falls back to the key)                                                                         |
-| `rotate`      | string                | Cadence (`"90d"`) or `"never"` when the secret must not rotate. Omit is the same as `"never"`. Console shows `no rotate` and skips `is:overdue`. |
-| `schema`      | zod / Standard Schema | Validated at boot; a bad value fails boot like a missing one                                                                                     |
-| `dev`         | string                | Local-only fallback when no source provides a value (never used in prod)                                                                         |
-| `sensitive`   | boolean               | Override the default (`true` for secrets, `false` for config)                                                                                    |
-| `perTenant`   | boolean               | Resolve at request time under `{tenantId}/{contract}`. Default `true` when `gate.auth.tenant` is on. Boot skips these contracts.                 |
-
-### Zero-setup Compose fallback
-
-`dev: vault.fromDocker("store.sql")` resolves the connection URL that `oke dev` generated for that role — no manual copying of Postgres URLs:
-
-```typescript
-export const dbUrl = vault.secret("DATABASE_URL", {
-  dev: vault.fromDocker("store.sql"),
-});
-```
-
-## Where values come from
-
-At boot, each contract is resolved through this chain — **first hit wins**.
-A value already in the vault / managed backend wins over a leftover env pin.
-
-<VaultResolution />
-
-If every layer misses a contract, boot **fails** before any request is served:
-
-```text
-vault boot failed — 1 missing secret(s):
-  - STRIPE_KEY: Payments gateway key
-```
-
-<Callout title="Good to know">
-  This is the fail-loud contract: an app with a missing secret **never** boots halfway and fails
-  later at request time. All gaps are listed in one error, not one at a time.
-</Callout>
-
-## Setting and rotating values
-
-| Command                                            | What it does                                                                  |
-| -------------------------------------------------- | ----------------------------------------------------------------------------- |
-| `oke vault set NAME value`                         | Write a value to the env file (`.env.local` by default)                       |
-| `oke vault list`                                   | List names present in the active store                                        |
-| `oke vault import <file>`                          | Bulk-import names from a dotenv file                                          |
-| `oke vault init`                                   | Initialize the built-in encrypted store (prints the master key once)          |
-| `oke vault status` / `seal` / `unseal`             | Built-in seal lifecycle                                                       |
-| `oke vault rotate <path>` / `rotate-master`        | Re-encrypt a secret, or rewrap every DEK under a new master (exclusive lease) |
-| `oke vault audit` / `audit verify` / `audit purge` | Hash-chained audit (serialized appends; no secret values)                     |
-| `oke vault purge-expired [--dry-run] [--before]`   | Hard-delete secret rows past `expires_at` (operator cleanup)                  |
-| `oke vault backup` / `restore`                     | Encrypted backup (atomic write + end marker; separate backup KEK)             |
-
-Flows can write too, through the same capability gate as reads: `fx.vault.set(path, value, { ttlMs?, metadata? })`, `fx.vault.rotate(path, value)`, `fx.vault.delete(path)`, plus `fx.vault.list(prefix?)` and `fx.vault.status()`. These need the encrypted-at-rest backend (`drivers.vault = "vault"`) and throw without it; `fx.vault.get` works on every app.
-
-The **Console** (`:6533`) **Vault** page (`/vault`) groups **Secrets** and
-**Config**. Secrets are write-only: a salted fingerprint (`sha256:…`), never
-the cleartext. Config rows show the value — that is `vault.config()`.
-
-API keys are principals — mint them on **Access** (`/access`), not Vault.
-See [Gate](/docs/elements/gate#api-keys).
-
-Add (`+`) creates a contract from Console as well as from source. Those rows
-show `console` until you declare the same name in the Manifest.
-
-Search matches name, description, fingerprint, reader, and winner. Operators
-AND together. `/` focuses the field.
-
-| Token                                                  | Matches                         |
-| ------------------------------------------------------ | ------------------------------- |
-| `is:unset` / `is:set` / `is:healthy`                   | Value present or not            |
-| `is:blast` / `is:shared` / `is:dormant` / `is:overdue` | Posture                         |
-| `kind:secret` / `kind:config`                          | Contract kind                   |
-| `from:.env.local`                                      | Resolution winner               |
-| `reader:payments` / `fp:sha256`                        | Flow id / fingerprint           |
-| `has:readers` / `has:rotate`                           | Declared readers or rotate hint |
-
-The empty pane is a posture board (unset, blast, shared, dormant, overdue).
-Rotate shows **blast radius** — in-flight durable runs that will wake holding
-the new value.
-
-Verify, rotate-master, fingerprint export, and CLI copy live in the security
-sheet.
-
-| Action               | Confirm                      | HTTP                                                                       |
-| -------------------- | ---------------------------- | -------------------------------------------------------------------------- |
-| Add a contract       | review dialog                | `POST /console/vault/create` — lists as `console` until declared in source |
-| Set / rotate a value | reason + review dialog       | `POST /console/vault/set` · `/rotate`                                      |
-| Rotate master key    | `ROTATE_MASTER` + reason ≥ 3 | `POST /console/vault/rotate-master` — one batch; `remaining` is honest     |
-| Verify audit chain   | session only                 | `GET /console/vault/audit/verify` → `{ ok, brokenAt, reason, row }`        |
-
-Master rotation is process-global: any operator in the same Console process may
-continue. Overlapping batches return `VaultRotateBusy`. A generated master key
-is shown once and never logged.
-
-Backup stays on the CLI (`oke vault backup` / `restore`). The Console never
-accepts a master key in the HTTP body — unseal via `OKE_VAULT_MASTER_KEY`.
-
-<Callout title="Builtin concurrency (rotate / audit / backup)">
-  `rotate-master` holds a lease (`FOR UPDATE` + lease TTL) so exactly one batch runs at a time; a
-  busy audit append briefly waits rather than being misread as "lease held". Audit appends serialize
-  under a transactional write lock; backups use temp → fsync → rename with end marker + checksum.
-</Callout>
-
-<Callout title="Builtin master keys and expired rows">
-  Resolve the master key with `--key -` (stdin), `OKE_VAULT_MASTER_KEY`, or a hidden TTY prompt —
-  never put keys on argv in shared shells (history risk). Expired rows stay until `oke vault
-  purge-expired` (use `--dry-run` first, or schedule via cron).
-</Callout>
-
-<Callout title="Secrets never reach logs">
-  `fx.vault.get` returns `Redacted` — `fx.log` shows `[redacted]`. A revealed string that still
-  reaches a log is scrubbed by the boot redactor to `[redacted:secret]`. Traces and the Console get
-  fingerprints, never cleartext.
-</Callout>
-
-## Per-environment drivers
-
-Which backend holds your values depends on the environment — configured once in `oke.config.ts`.
-App boot and the Console share the same chain: **backend first**, then env files:
-
-```typescript title="oke.config.ts"
-drivers: {
-  vault: {
-    dev: "env", // process env / .env.local
-    test: "memory",
-    prod: "vault", // built-in encrypted store (Postgres you already run)
-  },
-},
-```
-
-Defaults are `env` / `memory` / `vault`. create-oke templates pin the built-in store for prod.
-
-| Driver    | Backend                                                     | Best for                           |
-| --------- | ----------------------------------------------------------- | ---------------------------------- |
-| `env`     | process env                                                 | Local pins — no encryption at rest |
-| `vault`   | Postgres/PGlite envelope (AES-256-GCM)                      | Default prod — no extra container  |
-| `managed` | Official SM (`OKE_VAULT_PROVIDER`) or platform-injected env | Cloud SM / Fly / Railway / K8s     |
-| `memory`  | in-process map                                              | Tests                              |
-
-### Threat model (honest)
-
-Built-in Vault protects a **database dump** (ciphertext + wrapped DEKs). It does **not** equal a separate process-isolated vault:
-
-| Threat                                        | Built-in `vault`                   | Managed remote vault        |
-| --------------------------------------------- | ---------------------------------- | --------------------------- |
-| Postgres dump / backup leak                   | Protected (need master/KEK)        | Protected                   |
-| App RCE / memory dump                         | Game over (same process)           | Better if vault is isolated |
-| Master key only in `.env` next to app secrets | Weak — use KMS auto-unseal in prod | Prefer non-exportable KEK   |
-| JS `Buffer.fill(0)` vs remote `mlock`         | Hygiene only — not claimed         | Stronger outside the app    |
-
-For production built-in stores, set `vault.encryption.masterKey` to a KMS source (optional peer
-`@aws-sdk/client-kms`) or use `managed` with a provider below. `oke doctor` warns when prod would
-take the master key from the environment.
-
-## Tenant isolation (built-in store)
-
-When `gate.auth.tenant` is on, `perTenant` contracts resolve at request time under
-`{tenantId}/{contract}`. Boot skips those contracts.
-
-The built-in Postgres table `oke_vault_secrets` carries `tenant_id` and the same
-`oke.tenant()` helper as domain tables — not a second GUC.
-
-<Callout title="RLS on ciphertext rows">
-  `tenant_id = oke.tenant() OR tenant_id IS NULL`. ENABLE without FORCE: the adapter (owner) still
-  sees every row; Console / `oke_app` cannot list another tenant's ciphertext. Global `NULL` rows
-  stay visible to every stamped tenant.
-</Callout>
-
-## Managed providers (official)
-
-Set `drivers.vault` to `"managed"` and `OKE_VAULT_PROVIDER` to an id below. Omit the provider when
-the platform already injects secrets as env vars (Fly, Railway, Kubernetes).
-
-| Provider            | `OKE_VAULT_PROVIDER`  | Connection                                                                        | Optional peer                                 |
-| ------------------- | --------------------- | --------------------------------------------------------------------------------- | --------------------------------------------- |
-| AWS Secrets Manager | `aws-secrets-manager` | `OKE_VAULT_REGION`, `OKE_VAULT_MOUNT` (name prefix)                               | `@aws-sdk/client-secrets-manager`             |
-| Azure Key Vault     | `azure-key-vault`     | `OKE_VAULT_URL` (vault URI), `OKE_VAULT_MOUNT` (prefix)                           | `@azure/keyvault-secrets` + `@azure/identity` |
-| GCP Secret Manager  | `gcp-secret-manager`  | `OKE_VAULT_MOUNT` (`project` or `project/prefix`)                                 | `@google-cloud/secret-manager`                |
-| Doppler             | `doppler`             | `OKE_VAULT_TOKEN`; `OKE_VAULT_MOUNT` as `project/config` for personal tokens      | —                                             |
-| 1Password Connect   | `1password`           | `OKE_VAULT_URL` (Connect host), `OKE_VAULT_TOKEN`, `OKE_VAULT_MOUNT` (vault name) | —                                             |
-
-AWS, Azure, and GCP use that cloud's default credential chain. Azure names allow only letters,
-numbers, and hyphens — OKE maps `_` in the contract name to `-` on the wire.
-
-## Community / plugin
-
-OpenBao and HashiCorp Vault are not shipped in core. Implement a community adapter for the
-`managed` driver surface, or keep using built-in `vault` / `env`.
-
-## Troubleshooting
-
-<Accordions>
-<Accordion title="Boot fails with VaultBootError listing missing secrets">
-
-A contract has no value in any layer of the chain. Fix by providing it in exactly one place:
-
-- locally: add `NAME=value` to `.env.local` (or run `oke vault set NAME value`)
-- built-in store: `oke vault init` then unseal, or set via Console (write-only)
-- CI / hosting: set a real environment variable (or the managed provider when `managed`)
-
-</Accordion>
-<Accordion title="Does the keel example put secrets in Vault?">
-
-Yes — this example only (prod posture). `oke db seed` (dev) writes the keel
-stubs and copies minted stack URLs into the built-in store. `.env.local` keeps
-`OKE_VAULT_MASTER_KEY` and `PORT`; other apps leave Vault empty.
-
-</Accordion>
-<Accordion title="How do I rotate a key safely?">
-
-Set the new value (`oke vault set` or the Console). The Console shows blast
-radius before you rotate, and `is:overdue` when a secret is past its
-`rotate: "90d"` hint. `rotate: "never"` (or omit `rotate`) shows `no rotate`.
-
-</Accordion>
-<Accordion title="How do I pass the builtin master key without shell history?">
-
-Prefer `oke vault unseal --key -` and pipe the key on stdin, or omit `--key` on a
-TTY and type it at the hidden prompt. Avoid `--key <base64>` on shared hosts.
-
-</Accordion>
-<Accordion title="Console SQL lists another tenant's vault rows">
-
-User-plane SQL is stamped `oke.tenant()`. The policy hides other tenants' ciphertext
-and keeps global `NULL` rows. The Vault adapter is table owner, so ENABLE (not FORCE)
-does not hide rows from itself.
-
-</Accordion>
-<Accordion title="Expired secrets still take space in Postgres">
-
-`expires_at` fails closed on read, but rows stay until you hard-delete them:
-
-```bash
-oke vault purge-expired --dry-run
-oke vault purge-expired
-```
-
-Schedule the live command with cron when you want automatic cleanup.
-
-</Accordion>
-</Accordions>
-
-## Learn more
-
-- [Project structure](/docs/get-started/project-structure) — `flow({…})` names as `unit.export`; `flow("billing.charge")` still wins
-- [Flow](/docs/elements/flow) — how `fx.vault.get` reads secrets inside `do`
-- [Gate](/docs/elements/gate) — `perTenant` contracts when `gate.auth.tenant` is on
-- [CLI Reference](/docs/reference/cli) — `oke vault set` · `list` · `import`
-
-## Next
-
-<Cards>
-  <Card title="Channel" description="Continue to Channel." href="/docs/elements/channel" />
-  <Card
-    title="Introduction"
-    description="Eight elements overview."
-    href="/docs/get-started/introduction"
-  />
-</Cards>

package/site/content/docs/get-started/basic-usage.mdx

@@ -1,173 +0,0 @@
----
-title: Basic Usage
-description: Scaffold the standard Notes starter, call health and notes Flows, and inspect them in the Console.
-source: packages/create-oke/templates/standard
-icon: SquareTerminal
----
-
-Write your first Flow, call it from a typed client, and prove it with
-`bun:test` — using the same standard Notes starter `create-oke` scaffolds.
-
-<Callout title="The one rule">
-  All reads, writes, emits, sends, and external calls belong behind `fx`. That is what makes effects
-  inspectable and tests deterministic.
-</Callout>
-
-## Quick start
-
-<Steps>
-
-<Step>
-### Scaffold and run
-
-```bash title="Terminal"
-bunx create-oke@latest my-app
-cd my-app
-oke dev
-bun run web
-```
-
-Use `--template advanced` for the same Notes domain with files attach, a daily
-digest Clock, and an AI summarize stub.
-
-To exercise Docker with a larger domain, run `examples/keel` from the okengine
-repo (`bun run dev:keel`) — not a create-oke template.
-
-Open **6530** in a browser to read the envelope in a code block. The right rail
-lists HTTP routes — static GET paths are links. `curl` still gets `{ data, error }`.
-
-<Surfaces />
-
-</Step>
-
-<Step>
-### Read the health Flow
-
-The standard starter already exports a named health Flow:
-
-```typescript title="flows/main/health.ts"
-import { on, flow, http } from "okengine/http";
-
-export const health = on(http.get().public(), flow({ do: () => ({ ok: true }) }));
-```
-
-`main` omits the URL prefix, so this file is `GET /health` named `main.health`. See [Project structure](/docs/get-started/project-structure).
-
-Named flows show up as `main.health` (not `flow_1`) in `oke dev` logs, with the run id after the timestamp.
-Change the route or output and save — App and Console update together from the
-same Manifest.
-
-</Step>
-
-<Step>
-### Call it from a typed client
-
-Generated units become namespaces on the client:
-
-```typescript title="app"
-import "@/core";
-import "@/flows/generated";
-import { oke } from "okengine/http";
-
-export const app = oke({ name: "notes" });
-export type App = typeof app;
-```
-
-`import "@/core"` loads stores, secrets, gates, clocks, channels, and
-message catalogs (via `locales/index.ts`) so they auto-register before `oke()`.
-
-```typescript title="client"
-import { createClient } from "okengine/client";
-import type { App } from "./app";
-
-const api = createClient<App>("http://localhost:6530");
-const { data, error } = await api.main.health({});
-```
-
-`data` and `error` are inferred from the Flow contracts.
-
-The starter `web/` app uses `createClient("")` so Vite proxies `/notes` and
-`/health` to the app. Bearer: `auth: { getToken, refresh }`. See [Client](/docs/reference/client).
-
-</Step>
-
-</Steps>
-
-## Mental model
-
-Every backend behavior has one shape:
-
-<FlowShape />
-
-## From Flow to client
-
-Export → generated barrel → call or test. Same App type — no separate codegen project.
-
-<ClientLoop />
-
-## Test
-
-Boot the same app with test drivers:
-
-```typescript title="tests/standard.test.ts"
-import { expect, test } from "bun:test";
-import { createTestApp } from "okengine/test";
-import { app } from "../src/app";
-
-test("boots — health flow", async () => {
-  const t = await createTestApp(app);
-  const { data, error } = await t.api.main.health({});
-  expect(error).toBeNull();
-  expect(data).toEqual({ ok: true });
-});
-```
-
-```bash title="Terminal"
-bun test
-```
-
-## Troubleshooting
-
-<Accordions>
-
-<Accordion title="api.main.health is not a function / type error">
-  Confirm the Flow is `export`ed from a generated unit (`import "@/flows/generated"` then `oke({ name })`), or from a module you still `.adopt({ main })`.
-
-Type `createClient` with your `App` type. Restart `oke dev` after renaming exports so the Manifest refreshes.
-
-</Accordion>
-
-<Accordion title="createTestApp fails to boot">
-  The starter patches test env and stores on the app options. Keep the template's side-imports
-  (vault, gates, channels, core db) — removing them can leave Vault or Store unresolved under test
-  drivers.
-</Accordion>
-
-</Accordions>
-
-## Learn more
-
-- [Project structure](/docs/get-started/project-structure) — folders are the URL
-- [Flow](/docs/elements/flow) — triggers, contracts, effects, and composition
-- [Store](/docs/elements/store) — SQL, KV, files, index, and the preferred list envelope
-- [fx](/docs/reference/fx) — the full effect surface
-
-## Next
-
-<Cards>
-  <Card
-    title="Project structure"
-    description="Folders are the URL; unit plus export is the name."
-    href="/docs/get-started/project-structure"
-  />
-  <Card
-    title="Flow"
-    description="Triggers, contracts, effects, and composition."
-    href="/docs/elements/flow"
-  />
-  <Card
-    title="Store"
-    description="SQL, KV, files, index, and declarative resources."
-    href="/docs/elements/store"
-  />
-</Cards>

package/site/content/docs/get-started/index.mdx

@@ -1,43 +0,0 @@
----
-title: "Get Started"
-description: "From the one law to a running app — introduction, why OKE, install, and first flows."
-icon: "Rocket"
-source: "docs/spec/unified-theory.md"
----
-
-Learn the shape once, install on Bun, then write your first Flow from the standard starter.
-
-## Pages
-
-<Cards>
-  <Card
-    title="Introduction"
-    description="One law, eight elements, one contract."
-    href="/docs/get-started/introduction"
-  />
-  <Card
-    title="Why OKE"
-    description="Six seams every backend maintains by hand."
-    href="/docs/get-started/why"
-  />
-  <Card
-    title="Installation"
-    description="Scaffold with create-oke and open the Console."
-    href="/docs/get-started/installation"
-  />
-  <Card
-    title="Basic Usage"
-    description="Health Flow, typed client, Console proof."
-    href="/docs/get-started/basic-usage"
-  />
-  <Card
-    title="Project structure"
-    description="Folder and file conventions — URL, name, and the generated barrel."
-    href="/docs/get-started/project-structure"
-  />
-  <Card
-    title="Deployment"
-    description="Compose, Swarm, Kubernetes, and reverse proxy."
-    href="/docs/deployment"
-  />
-</Cards>