okengine 0.3.6 → 0.5.0

package/src/plugins/two-factor.ts

@@ -0,0 +1,249 @@
+/**
+ * TOTP two-factor Gate auth method plugin (RFC 6238, HMAC-SHA1).
+ *
+ * v1 verify accepts `{ userId, code }` after password sign-in when 2FA is enabled.
+ */
+
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  bindSessionAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+/** Per-user TOTP + recovery state. */
+export interface TwoFactorRow {
+  userId: string;
+  secret: string;
+  enabled: boolean;
+  /** SHA-256 hex of recovery codes (unused codes only). */
+  recoveryHashes: Set<string>;
+  createdAt: number;
+}
+
+/** In-memory two-factor store. */
+export interface TwoFactorStore {
+  readonly byUserId: Map<string, TwoFactorRow>;
+}
+
+/**
+ * Create an empty two-factor store.
+ */
+export function createTwoFactorStore(): TwoFactorStore {
+  return { byUserId: new Map() };
+}
+
+/** Options for {@link twoFactor}. */
+export interface TwoFactorOptions extends AuthMethodOptions {
+  readonly factors?: TwoFactorStore;
+  /** Issuer label for otpauth URLs (default `oke`). */
+  readonly issuer?: string;
+}
+
+/**
+ * Enable / verify / disable TOTP two-factor (`oke_two_factor`).
+ *
+ * @param opts - Secret / session / factor store
+ */
+export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const factors = opts.factors ?? createTwoFactorStore();
+  const issuer = opts.issuer ?? "oke";
+
+  const enable = flow({
+    name: "auth.twoFactorEnable",
+    unit: "auth",
+    plane: "user",
+    out: z.object({
+      secret: z.string(),
+      otpauthUrl: z.string(),
+      recoveryCodes: z.array(z.string()),
+    }),
+    errors: { AuthFailed },
+    do: async (_input, fx) => {
+      const userId = fx.auth.userId;
+      if (!userId) return fail("AuthFailed", { reason: "unauthenticated" });
+      const secret = generateBase32Secret(20);
+      const recoveryCodes = Array.from({ length: 8 }, () => randomRecoveryCode());
+      const recoveryHashes = new Set<string>();
+      for (const code of recoveryCodes) {
+        recoveryHashes.add(await sha256Hex(code));
+      }
+      factors.byUserId.set(userId, {
+        userId,
+        secret,
+        enabled: true,
+        recoveryHashes,
+        createdAt: runtime.now(),
+      });
+      const label = encodeURIComponent(userId);
+      const otpauthUrl = `otpauth://totp/${encodeURIComponent(issuer)}:${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`;
+      return { secret, otpauthUrl, recoveryCodes };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.twoFactorVerify",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      userId: z.string().min(1),
+      code: z.string().min(6).max(16),
+    }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const row = factors.byUserId.get(input.userId);
+      if (!row?.enabled) return fail("AuthFailed", { reason: "invalid_credentials" });
+      const code = input.code.trim().replace(/\s+/g, "");
+      const totpOk = await verifyTotp(row.secret, code);
+      if (!totpOk) {
+        const hash = await sha256Hex(code);
+        if (!row.recoveryHashes.has(hash)) {
+          return fail("AuthFailed", { reason: "invalid_credentials" });
+        }
+        row.recoveryHashes.delete(hash);
+      }
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: input.userId,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: input.userId,
+      };
+    },
+  });
+
+  const disable = flow({
+    name: "auth.twoFactorDisable",
+    unit: "auth",
+    plane: "user",
+    out: z.object({ ok: z.literal(true) }),
+    errors: { AuthFailed },
+    do: (_input, fx) => {
+      const userId = fx.auth.userId;
+      if (!userId) return fail("AuthFailed", { reason: "unauthenticated" });
+      factors.byUserId.delete(userId);
+      return { ok: true as const };
+    },
+  });
+
+  return plugin("twoFactor", { version: "0.0.1", config: { method: "two-factor" } })
+    .needs("auth")
+    .table("oke_two_factor", undefined, { plane: "user", description: "TOTP secrets + recovery" })
+    .binding(bindSessionAuth("/two-factor/enable", enable))
+    .binding(bindPublicAuth("/two-factor/verify", verify, "otp"))
+    .binding(bindSessionAuth("/two-factor/disable", disable));
+}
+
+/**
+ * Verify a 6-digit TOTP against a base32 secret (RFC 6238, 30s step, ±1 window).
+ *
+ * @param secretBase32 - Shared secret
+ * @param code - Submitted code
+ * @param nowSec - Epoch seconds (test injection)
+ */
+export async function verifyTotp(
+  secretBase32: string,
+  code: string,
+  nowSec: number = Math.floor(Date.now() / 1000),
+): Promise<boolean> {
+  if (!/^\d{6}$/.test(code)) return false;
+  const key = base32Decode(secretBase32);
+  const counter = Math.floor(nowSec / 30);
+  for (let w = -1; w <= 1; w++) {
+    const otp = await hotp(key, counter + w);
+    if (otp === code) return true;
+  }
+  return false;
+}
+
+async function hotp(key: Uint8Array, counter: number): Promise<string> {
+  const msg = new Uint8Array(8);
+  let c = counter;
+  for (let i = 7; i >= 0; i--) {
+    msg[i] = c & 0xff;
+    c = Math.floor(c / 256);
+  }
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength) as ArrayBuffer,
+    { name: "HMAC", hash: "SHA-1" },
+    false,
+    ["sign"],
+  );
+  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", cryptoKey, msg));
+  const offset = sig[sig.length - 1]! & 0x0f;
+  const bin =
+    ((sig[offset]! & 0x7f) << 24) |
+    ((sig[offset + 1]! & 0xff) << 16) |
+    ((sig[offset + 2]! & 0xff) << 8) |
+    (sig[offset + 3]! & 0xff);
+  return (bin % 1_000_000).toString().padStart(6, "0");
+}
+
+function generateBase32Secret(byteLen: number): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(byteLen));
+  return base32Encode(bytes);
+}
+
+function randomRecoveryCode(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(5));
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+async function sha256Hex(raw: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+const B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+
+function base32Encode(bytes: Uint8Array): string {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const b of bytes) {
+    value = (value << 8) | b;
+    bits += 8;
+    while (bits >= 5) {
+      out += B32[(value >>> (bits - 5)) & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += B32[(value << (5 - bits)) & 31];
+  return out;
+}
+
+function base32Decode(input: string): Uint8Array {
+  const cleaned = input
+    .replace(/=+$/, "")
+    .toUpperCase()
+    .replace(/[^A-Z2-7]/g, "");
+  let bits = 0;
+  let value = 0;
+  const out: number[] = [];
+  for (const ch of cleaned) {
+    const idx = B32.indexOf(ch);
+    if (idx < 0) continue;
+    value = (value << 5) | idx;
+    bits += 5;
+    if (bits >= 8) {
+      out.push((value >>> (bits - 8)) & 0xff);
+      bits -= 8;
+    }
+  }
+  return new Uint8Array(out);
+}

package/src/plugins/username.ts

@@ -0,0 +1,148 @@
+/**
+ * Username + password Gate auth method plugin.
+ */
+
+import { createBunCrypto } from "../runtime/primitives.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+/** In-memory username credential row. */
+export interface UsernameRow {
+  readonly userId: string;
+  readonly username: string;
+  passwordHash: string;
+  createdAt: number;
+}
+
+/** Username → credential map. */
+export interface UsernameStore {
+  readonly byUsername: Map<string, UsernameRow>;
+  readonly byUserId: Map<string, UsernameRow>;
+}
+
+/**
+ * Create an empty username store.
+ */
+export function createUsernameStore(): UsernameStore {
+  return { byUsername: new Map(), byUserId: new Map() };
+}
+
+/** Options for {@link username}. */
+export interface UsernamePluginOptions extends AuthMethodOptions {
+  /** Shared username credential store. */
+  readonly usernames?: UsernameStore;
+}
+
+const UsernameIn = z.object({
+  username: z.string().min(3).max(64),
+  password: z.string().min(1),
+});
+
+function normalizeUsername(raw: string): string {
+  return raw.trim().toLowerCase();
+}
+
+/**
+ * Username + password sign-up / sign-in (`oke_usernames`).
+ *
+ * @param opts - Secret / session / store overrides
+ */
+export function username(opts: UsernamePluginOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const usernames = opts.usernames ?? createUsernameStore();
+  const crypto = createBunCrypto();
+
+  const signUp = flow({
+    name: "auth.signUpUsername",
+    unit: "auth",
+    plane: "user",
+    in: UsernameIn,
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const key = normalizeUsername(input.username);
+      if (!/^[a-z0-9._-]{3,64}$/.test(key)) {
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      if (usernames.byUsername.has(key)) {
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      const userId = crypto.randomUUID();
+      const passwordHash = await crypto.hashPassword(input.password, {
+        algorithm: "argon2id",
+      });
+      const row: UsernameRow = {
+        userId,
+        username: key,
+        passwordHash,
+        createdAt: runtime.now(),
+      };
+      usernames.byUsername.set(key, row);
+      usernames.byUserId.set(userId, row);
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: userId,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId,
+      };
+    },
+  });
+
+  const signIn = flow({
+    name: "auth.signInUsername",
+    unit: "auth",
+    plane: "user",
+    in: UsernameIn,
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const key = normalizeUsername(input.username);
+      const row = usernames.byUsername.get(key);
+      const hash = row?.passwordHash ?? (await dummyHash(crypto));
+      const ok = await crypto.verifyPassword(input.password, hash);
+      if (!ok || !row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: row.userId,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: row.userId,
+      };
+    },
+  });
+
+  return plugin("username", { version: "0.0.1", config: { method: "username" } })
+    .needs("auth")
+    .table("oke_usernames", undefined, { plane: "user", description: "Username credentials" })
+    .binding(bindPublicAuth("/sign-up/username", signUp, "signUp"))
+    .binding(bindPublicAuth("/sign-in/username", signIn, "signIn"));
+}
+
+let dummyPasswordHash: string | null = null;
+
+async function dummyHash(crypto: ReturnType<typeof createBunCrypto>): Promise<string> {
+  if (dummyPasswordHash === null) {
+    dummyPasswordHash = await crypto.hashPassword("oke-username-timing-dummy", "argon2id");
+  }
+  return dummyPasswordHash;
+}

package/src/runs/runs.test.ts

@@ -14,6 +14,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { fsDriver, memoryFilesDriver } from "../drivers/index.ts";
+import { gate } from "../elements/gate.ts";
 import { oke } from "../kernel/app.ts";
 import { flow } from "../kernel/flow.ts";
 import { on, resetBindings } from "../kernel/on.ts";
@@ -54,8 +55,10 @@ describe("zero-instrumentation dimensions", () => {
     });
     await runs.open();
 
+    const member = gate.policy("member", ({ auth }) => !!auth.verified);
+
     on(
-      http.get("/book").gate("member"),
+      http.get("/book").gate(member),
       flow({
         name: "book.create",
         unit: "bookings",
@@ -74,8 +77,9 @@ describe("zero-instrumentation dimensions", () => {
     const app = oke({
       name: "runs-dims",
       runs,
+      gate: { policies: [member] },
       fx: {
-        auth: { userId: "user_42", scopes: new Set(["book:write"]) },
+        auth: { userId: "user_42", scopes: new Set(["book:write"]), verified: true },
         tenant: { id: "org_a41" },
       },
     });

package/src/runtime/primitives.ts

@@ -6,11 +6,13 @@
 
 import type {
   PasswordAlgorithm,
+  PasswordHashOptions,
   RuntimeCrypto,
   RuntimeEnv,
   RuntimeFiles,
   RuntimeTimers,
 } from "./types.ts";
+import { ARGON2ID_MEMORY_COST_FLOOR, ARGON2ID_TIME_COST_FLOOR } from "./types.ts";
 
 /** HTML / WinterTC timers on `globalThis`. */
 export function createTimers(): RuntimeTimers {
@@ -124,7 +126,11 @@ export function createWebCrypto(): RuntimeCrypto {
     getRandomValues(array) {
       return web.getRandomValues(array);
     },
-    async hashPassword(password, algorithm = "pbkdf2") {
+    async hashPassword(password, algorithmOrOptions = "pbkdf2") {
+      const algorithm =
+        typeof algorithmOrOptions === "string"
+          ? algorithmOrOptions
+          : (algorithmOrOptions.algorithm ?? "pbkdf2");
       if (algorithm !== "pbkdf2") {
         throw new Error(
           `web-standard runtime supports only pbkdf2 passwords (got ${algorithm}); use the Bun adapter for argon2id/bcrypt`,
@@ -156,10 +162,37 @@ export function createBunCrypto(): RuntimeCrypto {
     getRandomValues(array) {
       return web.getRandomValues(array);
     },
-    async hashPassword(password, algorithm = "argon2id") {
+    async hashPassword(password, algorithmOrOptions = "argon2id") {
+      const opts: PasswordHashOptions =
+        typeof algorithmOrOptions === "string"
+          ? { algorithm: algorithmOrOptions }
+          : algorithmOrOptions;
+      const algorithm: PasswordAlgorithm = opts.algorithm ?? "argon2id";
       if (algorithm === "pbkdf2") return hashPbkdf2(password);
-      const algo = algorithm === "bcrypt" ? "bcrypt" : "argon2id";
-      return Bun.password.hash(password, algo);
+      if (algorithm === "bcrypt") {
+        if (opts.cost !== undefined) {
+          return Bun.password.hash(password, { algorithm: "bcrypt", cost: opts.cost });
+        }
+        return Bun.password.hash(password, "bcrypt");
+      }
+      // argon2id — never weaker than Bun's defaults (m=65536, t=2).
+      const memoryCost = opts.memoryCost ?? ARGON2ID_MEMORY_COST_FLOOR;
+      const timeCost = opts.timeCost ?? ARGON2ID_TIME_COST_FLOOR;
+      if (memoryCost < ARGON2ID_MEMORY_COST_FLOOR) {
+        throw new TypeError(
+          `argon2id memoryCost must be >= ${ARGON2ID_MEMORY_COST_FLOOR} (Bun default floor)`,
+        );
+      }
+      if (timeCost < ARGON2ID_TIME_COST_FLOOR) {
+        throw new TypeError(
+          `argon2id timeCost must be >= ${ARGON2ID_TIME_COST_FLOOR} (Bun default floor)`,
+        );
+      }
+      return Bun.password.hash(password, {
+        algorithm: "argon2id",
+        memoryCost,
+        timeCost,
+      });
     },
     async verifyPassword(password, hash) {
       if (hash.startsWith("pbkdf2$")) return verifyPbkdf2(password, hash);

package/src/runtime/serve.test.ts

@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { gate } from "../elements/gate.ts";
 import { oke } from "../kernel/app.ts";
 import { flow, resetFlowSeq } from "../kernel/flow.ts";
 import { on, resetBindings } from "../kernel/on.ts";
@@ -55,14 +56,14 @@ function rawHttp(port: number, payload: string): Promise<string> {
 
 function buildApp() {
   on(
-    http.get("/ping"),
+    http.get("/ping").gate(gate.public),
     flow({
       name: "ping",
       do: () => ({ ok: true as const, n: 1 }),
     }),
   );
   on(
-    http.get("/notes/:id"),
+    http.get("/notes/:id").gate(gate.public),
     flow({
       name: "notes.get",
       do: ({ id }: { id: string }) => ({ id }),

package/src/runtime/types.ts

@@ -130,6 +130,26 @@ export interface RuntimeTimers {
 /** Password algorithm accepted by {@link RuntimeCrypto.hashPassword}. */
 export type PasswordAlgorithm = "argon2id" | "bcrypt" | "pbkdf2";
 
+/**
+ * Bun.password cost knobs. Defaults match Bun's argon2id floor
+ * (`memoryCost: 65536`, `timeCost: 2`) — never weaker.
+ */
+export interface PasswordHashOptions {
+  /** Algorithm (Bun default `argon2id`). */
+  readonly algorithm?: PasswordAlgorithm;
+  /** Argon2 memory cost in KiB (floor 65536). */
+  readonly memoryCost?: number;
+  /** Argon2 time cost / iterations (floor 2). */
+  readonly timeCost?: number;
+  /** bcrypt cost (only when `algorithm: "bcrypt"`). */
+  readonly cost?: number;
+}
+
+/** Bun argon2id defaults — also the configuration floor. */
+export const ARGON2ID_MEMORY_COST_FLOOR = 65_536;
+/** Bun argon2id timeCost floor. */
+export const ARGON2ID_TIME_COST_FLOOR = 2;
+
 /**
  * Crypto surface — Web Crypto plus password hash/verify.
  * Bun binds `Bun.password`; web-standard uses PBKDF2 via SubtleCrypto.
@@ -149,9 +169,12 @@ export interface RuntimeCrypto {
    * Hash a password.
    *
    * @param password - Plaintext
-   * @param algorithm - Hash algorithm (Bun default `argon2id`)
+   * @param algorithmOrOptions - Algorithm string or Bun cost options
    */
-  hashPassword(password: string, algorithm?: PasswordAlgorithm): Promise<string>;
+  hashPassword(
+    password: string,
+    algorithmOrOptions?: PasswordAlgorithm | PasswordHashOptions,
+  ): Promise<string>;
   /**
    * Verify a password against a hash from {@link RuntimeCrypto.hashPassword}.
    *

package/src/test/create-test-app.test.ts

@@ -77,7 +77,7 @@ describe("createTestApp — four-applications surface", () => {
 
     const app = oke({
       name: "harness",
-      gates: [member],
+      gate: { policies: [member] },
       signals: [orderPlaced],
       clocks: [clock("expire-stale", { every: "1h" })],
       channel: { templates: [orderConfirmed] },

package/src/test/create-test-app.ts

@@ -215,8 +215,11 @@ export async function createTestApp<App extends OkeApp>(
   await app.boot({
     ...(options.boot ?? {}),
     env: "test",
+    // Test-only opt-out (honoured because env is "test" below). Production
+    // boots never skip posture via this flag.
+    unguardedHttp: options.boot?.unguardedHttp ?? appOpts.gate?.unguardedHttp ?? "allow",
     startScheduler: options.startScheduler ?? options.boot?.startScheduler ?? false,
-    gates: options.gates ?? options.boot?.gates ?? appOpts.gates,
+    gates: options.gates ?? options.boot?.gates ?? appOpts.gate?.policies,
     secrets: options.secrets ?? options.boot?.secrets ?? appOpts.secrets,
     signals: options.signals ?? options.boot?.signals ?? appOpts.signals,
     stores: options.boot?.stores ?? appOpts.stores,

package/src/test/provisions.integration.test.ts

@@ -56,7 +56,7 @@ describe("Provisions integration", () => {
       effects: { secrets: ["STRIPE_KEY"], emits: ["order-news"] },
       do: async ({ orderId }, fx) => {
         const key = fx.vault(stripeKey);
-        expect(key.startsWith("sk_")).toBe(true);
+        expect(key.reveal().startsWith("sk_")).toBe(true);
 
         await fx.step("create-intent", async () => ({ id: `pi_${orderId}` }));
         await fx.clock.sleep("verify-window", "2m");
@@ -111,7 +111,7 @@ describe("Provisions integration", () => {
 
     const app = oke({
       name: "provisions",
-      gates: [member, canOrder],
+      gate: { policies: [member, canOrder] },
       secrets: [stripeKey],
       signals: [orderPlaced, orderNews],
       channel: { templates: [orderConfirmed] },

package/site/content/docs/get-started/comparison.mdx

@@ -1,65 +0,0 @@
----
-title: Comparison
-description: How OKE compares to Hono, Elysia, Encore.ts, and iii — and when to pick it.
-source: docs/spec/unified-theory.md
-icon: Scale
----
-
-> **OKE is the batteries-included TypeScript backend for the Bun era:** contract-first APIs with end-to-end type safety, declarative infrastructure primitives, an OpenTelemetry-native Console, secure-by-default auth and ABAC — pure TypeScript, Web-Standards portable, MIT-licensed, self-hostable with zero cloud lock-in.
-
-_"Encore's batteries and dashboard, Elysia's speed and DX, Hono's portability — without the Rust lock-in, the cloud gravity, or the source-available license."_
-
-## When to pick OKE
-
-Choose OKE if you want:
-
-- **One mental model** for HTTP, jobs, consumers, and durable work (`on(Trigger) → Effects`)
-- **Batteries included** — store, signals, clock, gates, vault, channels, and AI as first-class elements
-- **A local Console** derived from your code (not a separate SaaS product you must adopt)
-- **MIT + self-host** with drivers named after protocols (`postgres`, `redis`, `s3`), not vendors
-- Effects that power cache invalidation, live queries, and least privilege **without hand annotations**
-
-Prefer a thinner router (Hono / Elysia alone) if you only need HTTP and will assemble queues, cron, and auth yourself.
-
-## Matrix
-
-|                                                 | Hono            | Elysia      | Encore.ts           | iii                   | **OKE**                           |
-| ----------------------------------------------- | --------------- | ----------- | ------------------- | --------------------- | --------------------------------- |
-| Primary runtime                                 | Multi (Web Std) | Bun-first   | Node + Rust core    | Rust engine, polyglot | **Bun-first, Web-Std portable**   |
-| License                                         | MIT             | MIT         | MPL-2.0             | ELv2 engine           | **MIT**                           |
-| Typed client                                    | hc RPC          | Eden Treaty | generated           | SDK                   | **contract-first + live queries** |
-| DB · queue · cron · storage                     | ❌              | ❌          | ✅                  | ✅                    | **✅ (7 elements)**               |
-| Durable workflows                               | ❌              | ❌          | ❌                  | partial               | **✅ (a flag)**                   |
-| Local Console                                   | ❌              | ❌          | ✅                  | ✅                    | **✅ (dev + prod)**               |
-| Auto cache invalidation                         | ❌              | ❌          | ❌                  | ❌                    | **✅ (from effects)**             |
-| Least-privilege by compiler                     | ❌              | ❌          | ❌                  | ❌                    | **✅**                            |
-| Human channels (email/SMS/WA)                   | ❌              | ❌          | ❌                  | ❌                    | **✅ (7th element)**              |
-| AI in the application (models, prompts, agents) | ❌              | ❌          | ❌                  | ❌                    | **✅ (8th element)**              |
-| Self-host, no lock-in                           | ✅              | ✅          | ✅ (Cloud optional) | ⚠️                    | **✅ first-class**                |
-
-## vs Collections of libraries
-
-Frameworks that ship a router plus a queue library plus a cron library plus websockets share one flaw: the concepts do not derive from one another. Documentation sprawls; each new fashion adds a concept that never gets removed.
-
-OKE starts from one law so docs, traces, hooks, and agent surfaces stay **one shape**.
-
-## vs Cloud-gravity platforms
-
-OKE is MIT, self-hostable, and names drivers after **protocols** — not vendors. Vendor choice lives in images keyed by role. There is no separate “deploy to our cloud” product you must adopt to get the Console.
-
-## vs Rolling your own effect system
-
-Effects are inferred from what a Flow touches through `fx`. Cache invalidation, live queries, least privilege, deterministic tests, and Manifest Diff fall out of that one decision — without hand-written annotations for each capability.
-
-<Cards>
-  <Card
-    title="Installation"
-    description="Install and scaffold in minutes."
-    href="/docs/get-started/installation"
-  />
-  <Card
-    title="Introduction"
-    description="The one law, eight elements, ten exports."
-    href="/docs/get-started/introduction"
-  />
-</Cards>