okengine 0.18.5 → 0.19.1

package/site/content/docs/recipes/openrouter.mdx

@@ -0,0 +1,283 @@
+---
+title: "OpenRouter"
+description: "Cloud path for fx.ask — provider openrouter auto-resolves base URL; router aliases pick free, auto, coding, fusion, and latest models."
+icon: "Globe"
+source: "docs/spec/unified-theory.md"
+---
+
+OpenRouter is the simplest way to call a real model from OKE: no Docker, no
+Python, no local weights. Set `provider: "openrouter"` and an API key —
+`baseUrl` resolves from the verified registry.
+
+<Callout title="The one rule">
+  Use a dedicated OpenRouter API key on the binding (`apiKey`), prefer the stable `openrouter/free`
+  router alias for zero-cost smoke tests, and keep other providers on their own `ai.model` +
+  `apiKey` so keys never collide.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Declare the cloud binding
+
+```typescript
+import { ai } from "okengine";
+
+export const smart = ai.model("smart", {
+  provider: "openrouter",
+  model: "openrouter/free",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+
+export const triage = smart.prompt("triage");
+```
+
+`baseUrl` becomes `https://openrouter.ai/api/v1` automatically. Pass an explicit
+`baseUrl` only to point at a proxy or mirror.
+
+</Step>
+
+<Step>
+### Ask from a flow
+
+```typescript title="src/flows/main/ask.ts"
+import { on, flow, http } from "okengine";
+
+export const ask = on(
+  http.post(),
+  flow({ asks: ["triage"] }, async (fx, input) => {
+    return await fx.ask("triage", input);
+  }),
+);
+```
+
+</Step>
+
+<Step>
+### Optional setup via CLI
+
+create-oke **Recommended** / Customize / Reuse and `oke ai setup --provider openrouter`
+pick `openrouter/free`, write `OPENROUTER_API_KEY` to `.env.local` + `vault.secret` (no
+`dev:` stub). Missing key → `oke dev` asks again ([openrouter.ai](https://openrouter.ai)).
+
+</Step>
+
+</Steps>
+
+## Router aliases
+
+OpenRouter **routers** are model slugs that pick (or compose) upstream models for
+you. Pass the slug as `model` on `ai.model` — same as any other OpenRouter id.
+
+| Slug                                                                                           | What it does                                          | Cost                            |
+| ---------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------------------------------- |
+| [`openrouter/free`](https://openrouter.ai/docs/guides/routing/routers/free-router)             | Random free model that supports your request features | Free                            |
+| [`openrouter/auto`](https://openrouter.ai/docs/guides/routing/routers/auto-router)             | Market-based pick by task type + cost tier            | Selected model rate             |
+| [`openrouter/pareto-code`](https://openrouter.ai/docs/guides/routing/routers/pareto-router)    | Strong coding model by `min_coding_score`             | Selected model rate             |
+| [`openrouter/fusion`](https://openrouter.ai/docs/guides/routing/routers/fusion-router)         | Multi-model panel + analyst deliberation              | ~4–5× one completion            |
+| [`openrouter/bodybuilder`](https://openrouter.ai/docs/guides/routing/routers/body-builder)     | NL → parallel request bodies (you run them)           | Builder free; executions billed |
+| [`~author/family-latest`](https://openrouter.ai/docs/guides/routing/routers/latest-resolution) | Newest concrete version in a family                   | Target model rate               |
+
+**Consequence:** the response `model` field is the concrete upstream that answered —
+log it for auditability.
+
+Router plugin knobs (`cost_tier`, `allowed_models`, `min_coding_score`, fusion
+panel) live on OpenRouter’s request `plugins` / account Routing defaults; OKE
+passes the `model` slug through the openai-compatible driver.
+
+### Free Models Router — `openrouter/free`
+
+Ideal for smoke tests, demos, and learning. The router filters free models for
+capabilities your request needs (vision, tools, structured outputs), then picks
+one at random.
+
+```typescript
+export const smoke = ai.model("smoke", {
+  provider: "openrouter",
+  model: "openrouter/free",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+```
+
+| Detail           | Behavior                                         |
+| ---------------- | ------------------------------------------------ |
+| Selection        | Random among eligible free models                |
+| Pin a free model | Use `author/model:free` instead of the router    |
+| Limits           | Lower rate limits; availability and latency vary |
+
+Official guide:
+[Free Models Router](https://openrouter.ai/docs/guides/routing/routers/free-router).
+
+### Auto Router — `openrouter/auto`
+
+Classifies the prompt (~30 task types), ranks by community spend share over a
+trailing 7-day window, then applies your cost band and fallbacks.
+
+```typescript
+export const smart = ai.model("smart", {
+  provider: "openrouter",
+  model: "openrouter/auto",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+```
+
+| Detail       | Behavior                                                      |
+| ------------ | ------------------------------------------------------------- |
+| Early track  | `openrouter/auto-beta` (plugin id `auto-beta-router`)         |
+| Cost bands   | `low` · `medium` · `high` · `xhigh` · `max` (default ≈ `low`) |
+| Allow / deny | Wildcard patterns via `allowed_models` / `excluded_models`    |
+| Sessions     | Prefers the prior model while it stays a top candidate        |
+| Pricing      | No router fee — pay the selected model                        |
+
+Official guide:
+[Auto Router](https://openrouter.ai/docs/guides/routing/routers/auto-router).
+
+### Pareto Router — `openrouter/pareto-code`
+
+Coding-only. You set a minimum coding score (`0`–`1`); the router maps it to a
+tier and picks the cheapest (or fastest with `:nitro`) eligible model.
+
+```typescript
+export const coder = ai.model("coder", {
+  provider: "openrouter",
+  model: "openrouter/pareto-code",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+```
+
+| `min_coding_score`             | Tier                          |
+| ------------------------------ | ----------------------------- |
+| `>= 0.66` (default if omitted) | high — top of AA coding field |
+| `>= 0.33`, `< 0.66`            | medium                        |
+| `< 0.33`                       | low                           |
+
+Within the tier: cheapest available (+ same-tier fallbacks on provider errors).
+Use `session_id` for multi-turn stickiness. Official guide:
+[Pareto Router](https://openrouter.ai/docs/guides/routing/routers/pareto-router).
+
+### Fusion Router — `openrouter/fusion`
+
+A panel of models answers in parallel; an analyst returns structured consensus /
+contradictions / gaps; your outer model writes the final answer.
+
+```typescript
+export const deliberate = ai.model("deliberate", {
+  provider: "openrouter",
+  model: "openrouter/fusion",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+```
+
+| Detail        | Behavior                                                        |
+| ------------- | --------------------------------------------------------------- |
+| Fast preset   | `openrouter/fusion-flash` (`general-fast` panel)                |
+| Default panel | Quality: Claude Opus / GPT / Gemini latest aliases              |
+| Cost          | N panel + 1 analyst + outer — expect ~4–5× with 3 models        |
+| Force fusion  | OpenRouter `tool_choice: "required"` (model decides by default) |
+
+Official guide:
+[Fusion Router](https://openrouter.ai/docs/guides/routing/routers/fusion-router).
+
+### Body Builder — `openrouter/bodybuilder`
+
+Describe a multi-model job in natural language. The response is JSON
+`{ requests: [...] }` — generate is free; you execute each body yourself.
+Useful for A/B checks, not a single `fx.ask` answer.
+
+```typescript
+export const builder = ai.model("builder", {
+  provider: "openrouter",
+  model: "openrouter/bodybuilder",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+```
+
+Official guide:
+[Body Builder](https://openrouter.ai/docs/guides/routing/routers/body-builder).
+
+### Latest resolution — `~author/family-latest`
+
+Stable family alias that always retargets to the newest visible model in that
+family. Response `model` reports the concrete slug.
+
+```typescript
+export const opus = ai.model("opus", {
+  provider: "openrouter",
+  model: "~anthropic/claude-opus-latest",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+```
+
+| Detail           | Behavior                                                  |
+| ---------------- | --------------------------------------------------------- |
+| Reproducibility  | Pin a concrete slug (e.g. `anthropic/claude-opus-4.8`)    |
+| Reasoning params | Unsupported `none` / disabled may remap on `~latest` only |
+| Pricing          | Listed as the current target’s rates                      |
+
+Official guide:
+[Latest Model Resolution](https://openrouter.ai/docs/guides/routing/routers/latest-resolution).
+
+## Multi-provider projects
+
+```typescript
+export const viaOr = ai.model("via-or", {
+  provider: "openrouter",
+  model: "openrouter/free",
+  apiKey: process.env.OPENROUTER_API_KEY,
+});
+
+export const viaGroq = ai.model("via-groq", {
+  provider: "groq",
+  model: "llama-3.1-8b-instant",
+  apiKey: process.env.GROQ_API_KEY,
+});
+```
+
+Each binding keeps its own `apiKey` and auto-resolved `baseUrl`. No shared
+process-wide token.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="401 / invalid API key">
+
+Pass `apiKey` on the binding (or the env your setup wrote). OpenRouter does not
+accept an OpenAI key against its base URL.
+
+</Accordion>
+<Accordion title="Unknown provider error">
+
+Typos fail loud: unknown names require an explicit `baseUrl`. Known names are
+listed on [Models](/docs/elements/ai/models).
+
+</Accordion>
+<Accordion title="Free router feels flaky or rate-limited">
+
+`openrouter/free` picks randomly among eligible free models — availability and
+limits change. Pin `author/model:free` or move to `openrouter/auto` / a paid id
+for stable prod paths.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Models](/docs/elements/ai/models) — verified providers, limited compatibility, BYO `/v1`
+- [AI](/docs/elements/ai) — prompts and `fx.ask`
+- [OpenRouter routers](https://openrouter.ai/docs/guides/routing/routers/auto-router) — Auto, Free, Pareto, Fusion, Body Builder, Latest
+
+Any OpenAI-compatible `/v1` endpoint works via custom `baseUrl` / `OKE_AI_URL`
+on an `openai-compatible` binding — see Models.
+
+## Next
+
+<Cards>
+  <Card
+    title="Models"
+    description="Provider registry + custom URL."
+    href="/docs/elements/ai/models"
+  />
+  <Card title="AI" description="Prompts and guardrails." href="/docs/elements/ai" />
+</Cards>

package/site/content/docs/recipes/pgdog.mdx

@@ -26,7 +26,7 @@ create-oke asks **Add PgDog connection pooling…?** (or pass `--pgdog`). Manual
 ```typescript title="oke.config.ts"
 images: {
   "store.sql": "postgres:18-alpine",
-  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
+  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
 },
 ```
 
@@ -99,7 +99,7 @@ not wired into the generated stack yet.
 | -------------- | ------------------------------------------------------- |
 | Container port | `6432`                                                  |
 | `dependsOn`    | `store-sql` healthy                                     |
-| Healthcheck    | `pg_isready -h 127.0.0.1 -p 6432`, every 5s, 12 retries |
+| Healthcheck    | `pg_isready -h 127.0.0.1 -p 6432`, every 2s, 20 retries |
 | Connection URL | `postgres://user:pass@host:6432/db`                     |
 
 ## Troubleshooting
@@ -123,9 +123,9 @@ Postgres), keep `DATABASE_URL` on the pooler for app traffic.
 
 ## Learn more
 
-- [Docker · PgDog pooling](/docs/deployment/docker#pgdog-pooling) — compose `-f` layer order
 - [Postgres](/docs/recipes/postgres) — the backend PgDog fronts
 - [Store · SQL](/docs/elements/store#sql) — “Connection pooling is infrastructure”
+- [Configuration](/docs/reference/configuration) — `images.pgdog` and compose layers
 
 ## Next
 

package/site/content/docs/recipes/postgres.mdx

@@ -85,8 +85,7 @@ The recipe does **not** declare a named compose volume. Persistence rides the im
 ## Production note
 
 For multi-replica apps, keep SQL on a shared Postgres — Clock CronStore and durable
-journal need one backend. See [Clock](/docs/elements/clock#what-the-runtime-guarantees) ·
-[Docker](/docs/deployment/docker#share-backing-services).
+journal need one backend. See [Clock](/docs/elements/clock#what-the-runtime-guarantees).
 
 Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exhaust
 `max_connections`. Do not also stack a managed provider's pooler on the same URL.

package/site/content/docs/recipes/rustfs.mdx

@@ -27,7 +27,7 @@ drivers: {
   },
 },
 images: {
-  store: { files: "rustfs/rustfs:1.0.0-rc.2" },
+  store: { files: "rustfs/rustfs:1.0.0-rc.5" },
 },
 ```
 
@@ -132,7 +132,7 @@ running service; confirm health at `/health` before debugging client signatures.
 
 - [Store · Files](/docs/elements/store#files) — facet API and drivers
 - [Environment variables](/docs/reference/environment-variables) — full `S3_*` map
-- [Installation](/docs/get-started/installation) — docker env cheat sheet
+- [Recipes](/docs/recipes) — docker env cheat sheet
 
 ## Next
 

package/site/content/docs/recipes/traefik.mdx

@@ -78,7 +78,7 @@ durable state.
 
 Security posture is intentional: Traefik talks to `tcp://socket-proxy:2375` with a
 filtered API (`CONTAINERS`, `EVENTS`, `PING`, `VERSION`, `NETWORKS` only). Never mount
-raw `docker.sock` on Traefik — see [Reverse proxy](/docs/deployment/reverse-proxy).
+raw `docker.sock` on Traefik — keep the socket-proxy companion in front.
 
 HTTP entrypoint redirects to `websecure`. For a single instance with no scale plans,
 [Caddy](/docs/recipes/caddy) is simpler (no labels, no companion).
@@ -122,8 +122,8 @@ re-issuing repeatedly.
 
 ## Learn more
 
-- [Reverse proxy](/docs/deployment/reverse-proxy) — Docker-socket-proxy security rationale
-- [Docker · Reverse proxy](/docs/deployment/docker#reverse-proxy) — compose layer order
+- [Caddy](/docs/recipes/caddy) — simpler single-instance HTTPS edge
+- [nginx](/docs/recipes/nginx) — static HTTP reverse proxy
 - [Security](/docs/reference/security) — `allowedHosts`
 
 ## Next

package/site/content/docs/reference/cli.mdx

@@ -0,0 +1,231 @@
+---
+title: "CLI"
+description: "oke and create-oke commands — scaffold, develop, ship, and operate an okengine app."
+icon: "Terminal"
+source: "docs/spec/unified-theory.md"
+---
+
+The CLI is how you scaffold, run, and operate an app. `create-oke` writes the project;
+`oke` is the day-to-day binary (dev loop, schema, vault, docker, doctor).
+
+For developers who already know the model — look up a command, its flags, and what it
+writes.
+
+<Callout title="The one rule">
+  Prefer the CLI for environment wiring (`oke dev`, `oke db`, `oke docker`). Put behavior in Flows
+  and `oke.config.ts` — never invent a ninth element or hand-edit the Manifest.
+</Callout>
+
+## Smallest Example
+
+<Steps>
+
+<Step>
+### Scaffold an app
+
+```bash
+bunx create-oke@latest notes --yes
+cd notes
+```
+
+</Step>
+
+<Step>
+### Run the dev loop
+
+```bash
+oke dev
+```
+
+Compose comes up (pull / create / start progress streams into the boot status
+lines), the backend listens on **6530**, Console on **6533**, app MCP on **6535**,
+docs MCP on **6536**. Open `http://localhost:6533`. Quit with **Ctrl+C**.
+
+On a TTY, after schema push, `oke dev` also:
+
+1. Prompts one-by-one for any Vault boot gaps (writes `.env.local`) — e.g.
+   `OPENROUTER_API_KEY` when create-oke / `oke ai setup` / Keel declared the
+   OpenRouter contract without a value.
+2. Asks to run `oke db seed` when a seed module exists and `.oke/state.json` has
+   not recorded that seed identity yet. Run `oke db seed` anytime later.
+
+</Step>
+
+</Steps>
+
+## Progressive Patterns
+
+<Tabs items={["Daily", "Schema", "Ship", "Scaffold"]}>
+
+<Tab value="Daily">
+
+```bash
+oke dev                 # watch · Console · client types · Docker Compose
+oke test                # bun test with PGLite posture
+oke doctor              # secrets · ports · schema drift
+oke doctor --diff       # CI gate: undeclared contract breaks
+```
+
+</Tab>
+
+<Tab value="Schema">
+
+```bash
+oke db push             # sync domain schema (dev; auto under oke dev)
+oke db generate         # versioned SQL under drizzle/
+oke db migrate          # apply migrations (prod)
+oke schema generate     # core + plugin stub → .oke/schema/oke.ts
+```
+
+**Consequence:** `oke schema generate` is not `oke db generate`. The first writes the
+framework stub; the second emits your app's Drizzle migrations.
+
+</Tab>
+
+<Tab value="Ship">
+
+```bash
+oke docker --prod       # derive production Compose
+oke build --target bun  # tree-shaken bundle
+oke start               # production entry (Docker CMD)
+```
+
+</Tab>
+
+<Tab value="Scaffold">
+
+```bash
+bunx create-oke@latest my-app --yes
+bunx create-oke@latest my-app -t advanced --locales ar --proxy caddy
+bunx create-oke@latest          # interactive (TTY only)
+```
+
+</Tab>
+
+</Tabs>
+
+## Port Map
+
+| Port     | Surface              | Who starts it           |
+| -------- | -------------------- | ----------------------- |
+| **6530** | Backend API          | `oke dev` / `oke start` |
+| **6533** | Developer Console    | `oke dev`               |
+| **6535** | App MCP              | `oke dev`               |
+| **6536** | Docs MCP (read-only) | `oke dev`               |
+
+Override app / console / mcp listen ports in `oke.config.ts` `ports` — see
+[Configuration](/docs/reference/configuration#ports).
+
+## `oke` Commands
+
+| Command      | Purpose                                                      | Key flags / subs                                                                                                                                          |
+| ------------ | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `dev`        | Watch · hot reload · Console · client types (Docker Compose) | `--docker\|-d [roles]`, `--no-db-push`, `--entry\|-e`                                                                                                     |
+| `test`       | Run bun test with PGLite test posture                        |                                                                                                                                                           |
+| `start`      | Production entry (Docker CMD)                                | `--entry\|-e`, `--port\|-p`                                                                                                                               |
+| `doctor`     | Secrets · ports · stub/domain schema drift                   | `--manifest`, `--diff`, `--before`, `--after`, `--base`, `--json`                                                                                         |
+| `stack`      | Preview images / tags / ports (writes nothing)               | `--config`, `--json`                                                                                                                                      |
+| `schema`     | Core + plugin tables → `.oke/schema/oke.ts`                  | `generate` (`--check`, `--manifest`, `--out`)                                                                                                             |
+| `db`         | Domain schema                                                | `push` · `generate` · `migrate` · `seed` · `studio` · `search-backfill`                                                                                   |
+| `client`     | Ambient types for a separate frontend repo                   | `add <url>` (`--out`)                                                                                                                                     |
+| `vault`      | Secrets                                                      | `set` · `list` · `import` · `key` · `init` · `status` · `seal` · `unseal` · `rotate` · `rotate-master` · `audit` · `purge-expired` · `backup` · `restore` |
+| `docker`     | Derive compose · clean leftover stacks                       | `--prod\|-p`, `--out`, `--config`, `--manifest`; sub `clean`                                                                                              |
+| `images`     | List / pin digests                                           | `list` · `pin`                                                                                                                                            |
+| `build`      | Tree-shaken bundle                                           | `--target\|-t bun\|node\|edge`, `--entry`, `--outdir`                                                                                                     |
+| `eval`       | Prompt eval sets (CI gate)                                   | `--manifest`                                                                                                                                              |
+| `ai`         | Configure AI driver + models                                 | `setup` (`--provider`, `--chat`, `--vision`, `--embed`, `--yes`)                                                                                          |
+| `branch`     | Fork journaled state                                         | `<name>`, `--at\|-a`                                                                                                                                      |
+| `replay`     | Re-invoke a past Flow from Runs                              | `--request-id\|-r`, `--entry`, `--dry-run`, `--live`                                                                                                      |
+| `privacy`    | Crypto-shred subject data                                    | `erase` (`--subject\|-s`)                                                                                                                                 |
+| `upgrade`    | Breaking-change codemods + diff                              | `--apply\|-a`                                                                                                                                             |
+| `console`    | Console helpers                                              | `claim-code` (`--json`)                                                                                                                                   |
+| `gates`      | Gate catalogue from Manifest                                 | `list` (`--manifest`, `--json`)                                                                                                                           |
+| `completion` | Shell completion script                                      | `bash` · `zsh` · `fish`                                                                                                                                   |
+| `mode`       | **Deprecated** — `oke dev` always uses Docker Compose        | `--help`                                                                                                                                                  |
+
+Bare `oke` (TTY) opens the interactive board; `oke --help` prints the catalogue.
+
+### `oke db` detail
+
+Shared flags on push / generate / migrate / studio: `--config\|-c`, `--env name`
+(`dev` · `test` · `prod`). Seed adds `--force`, `--entry`. Search-backfill adds
+`--batch n` and a `<table>` positional.
+
+```bash
+oke db push --env dev
+oke db migrate --env prod
+oke db seed --force
+oke db search-backfill notes --batch 500
+```
+
+## `create-oke`
+
+| Flag                             | Meaning                                                   |
+| -------------------------------- | --------------------------------------------------------- |
+| `-t, --template <id>`            | `standard` (default) or `advanced`                        |
+| `--sql <id>`                     | Store SQL dialect — only `postgres` (test stays `pglite`) |
+| `-y, --yes`                      | No prompts; defaults + bun install (no `oke dev`)         |
+| `--install` / `--no-install`     | Run or skip `bun install` after scaffold                  |
+| `--agents-md` / `--no-agents-md` | Write `AGENTS.md` (default on)                            |
+| `--ai` / `--no-ai` / `--ai skip` | Configure or skip AI setup                                |
+| `--locales <tags>`               | Extra languages beyond English (e.g. `ar` or `ar,fr`)     |
+| `--pgdog` / `--no-pgdog`         | Pin PgDog in front of Postgres                            |
+| `--proxy <id>` / `--no-proxy`    | `none` · `caddy` · `traefik` · `nginx`                    |
+| `-h, --help`                     | Show help                                                 |
+
+## Troubleshooting
+
+<Accordions>
+
+<Accordion title="oke start: no entry found">
+  Set `package.json` `okengine.entry` or `main`, pass `--entry`, or keep a conventional
+  `src/app.ts`. Production imports that module; the app must call `createBunRuntime().serve` itself.
+</Accordion>
+
+<Accordion title="Confusion: oke schema generate vs oke db generate">
+  `oke schema generate` emits framework / plugin stub tables under `.oke/schema/`. `oke db generate`
+  emits versioned domain SQL via Drizzle. Use `db` for your app tables; use `schema` when the stub
+  drifted after a plugin change.
+</Accordion>
+
+<Accordion title="oke mode still in muscle memory">
+  `oke mode` is deprecated. `oke dev` always starts Docker Compose. There is no soft-compat for old
+  `local` / `docker` env map keys — rename to `dev` / `test` / `prod` in
+  [Configuration](/docs/reference/configuration).
+</Accordion>
+
+<Accordion title="OKE1110 after deploy">
+  Domain tables are missing in prod (no auto-DDL). Run `oke db migrate` against that environment —
+  see [Errors](/docs/reference/errors).
+</Accordion>
+
+<Accordion title="Claim code missing for first Console operator">
+  The setup claim code prints on the `oke dev` TTY board and is mirrored to gitignored
+  `.oke/claim-code`. Run `oke console claim-code` while setup is open.
+</Accordion>
+
+</Accordions>
+
+## Learn more
+
+- [Configuration](/docs/reference/configuration) — `oke.config.ts` drivers and ports
+- [Environment Variables](/docs/reference/environment-variables) — what Compose writes
+- [Security](/docs/reference/security) — Host / Origin / `allowedHosts`
+- [The Architecture](/docs/understand/the-architecture) — one contract; `oke doctor --diff` reviews it
+- [Vault](/docs/elements/vault) — `oke vault` rotate / unseal
+
+## Next
+
+<Cards>
+  <Card
+    title="Configuration"
+    description="Every option in oke.config.ts."
+    href="/docs/reference/configuration"
+  />
+  <Card
+    title="Security"
+    description="Host, Origin, planes, and MCP posture."
+    href="/docs/reference/security"
+  />
+  <Card title="Client" description="Typed createClient for your flows." href="/docs/client" />
+</Cards>