okengine 0.6.0 → 0.7.0

package/site/content/docs/elements/vault.mdx

@@ -83,6 +83,14 @@ still reaches `fx.log` is scrubbed by the boot redactor as before.
 
 That's the whole loop: declare → set → read. Everything below is what OKE guarantees on top of it.
 
+## Redacted until you reveal
+
+<VaultRedacted />
+
+Pass the wrapper freely — `fx.log`, `String()`, and `JSON.stringify` all yield
+`[redacted]`. Call `.reveal()` once at the provider boundary that needs the
+credential.
+
 ## Two kinds of contracts
 
 | Declaration                         | Sensitive? | Console shows    | Use for                     |
@@ -143,17 +151,19 @@ In docker mode, `oke vault set` writes straight to the running OpenBao — no gi
 The **Console** (`:6533`) can also set and rotate values, but it is **write-only**: it shows a salted fingerprint (`sha256:…`) per secret, never the cleartext. When you rotate a key there, the panel shows the **blast radius** — which in-flight durable runs will wake up with the new value.
 
 <Callout title="Secrets never reach logs">
-  Every loaded secret is registered with the redactor at boot. Even if you accidentally pass one to
-  `fx.log`, the log line shows `***` — the value, never. Traces and the Console get fingerprints.
+  `fx.vault` returns `Redacted` — `fx.log` shows `[redacted]`. A revealed string that still reaches
+  a log is scrubbed by the boot redactor to `[redacted:secret]`. Traces and the Console get
+  fingerprints, never cleartext.
 </Callout>
 
 ## Per-environment drivers
 
-Which backend holds your values depends on the mode — configured once in `oke.config.ts`:
+Which backend holds your values depends on the mode — configured once in `oke.config.ts`.
+App boot and the Console share the same resolution-chain builder (`env` layers → backend):
 
 ```typescript title="oke.config.ts"
 vault: {
-  local: "dotenv",   // .env.local — zero ceremony
+  local: "env",      // .env.local — zero ceremony
   docker: "openbao", // real vault in the compose stack
   test: "memory",    // seeded map — deterministic tests
   prod: "openbao",   // real vault in production
@@ -162,7 +172,7 @@ vault: {
 
 | Driver    | Backend         | Best for                                   |
 | --------- | --------------- | ------------------------------------------ |
-| `dotenv`  | `.env.local`    | Local loop — no infra at all               |
+| `env`     | `.env.local`    | Local loop — no infra at all               |
 | `openbao` | OpenBao (KV v2) | Docker + prod — durable, access-controlled |
 | `memory`  | in-process map  | Tests                                      |
 

package/site/content/docs/get-started/basic-usage.mdx

@@ -1,12 +1,12 @@
 ---
 title: Basic Usage
-description: Scaffold the standard starter, call the health Flow, and inspect it in the Console.
-source: packages/create-oke/template
+description: Scaffold the standard Notes starter, call health and notes Flows, and inspect them in the Console.
+source: packages/create-oke/templates/standard
 icon: SquareTerminal
 ---
 
 Write your first Flow, call it from a typed client, and prove it with
-`bun:test` — using the same standard starter `create-oke` scaffolds.
+`bun:test` — using the same standard Notes starter `create-oke` scaffolds.
 
 <Callout title="The one rule">
   All reads, writes, emits, sends, and external calls belong behind `fx`. That is what makes effects
@@ -26,6 +26,9 @@ cd my-app
 oke dev
 ```
 
+Use `--template advanced` for the same Notes domain with files attach, a daily
+digest Clock, and an AI summarize stub.
+
 <Surfaces />
 
 </Step>
@@ -33,7 +36,7 @@ oke dev
 <Step>
 ### Read the health Flow
 
-The standard starter already exports a health Flow:
+The standard starter already exports a named health Flow:
 
 ```typescript title="flows/main"
 import { on, flow, http, gate } from "okengine";
@@ -42,13 +45,16 @@ import { z } from "zod";
 export const health = on(
   http.get("/health").gate(gate.public),
   flow({
+    name: "main.health",
+    unit: "main",
     out: z.object({ ok: z.literal(true) }),
     do: () => ({ ok: true as const }),
   }),
 );
 ```
 
-Change the route or output and save. App and Console update together from the
+Named flows show up as `main.health` (not `flow_1`) in `oke dev` logs.
+Change the route or output and save — App and Console update together from the
 same Manifest.
 
 </Step>
@@ -61,8 +67,9 @@ Adopted modules become namespaces on the client:
 ```typescript title="app"
 import { oke } from "okengine";
 import * as main from "./flows/main";
+import * as notes from "./flows/notes";
 
-export const app = oke({ name: "standard" }).adopt({ main });
+export const app = oke({ name: "notes" }).adopt({ main, notes });
 export type App = typeof app;
 ```
 

package/site/content/docs/get-started/installation.mdx

@@ -6,11 +6,11 @@ icon: Download
 ---
 
 This page gets you from zero to a running app on Bun. The engine targets
-**Bun ≥ 1.3** — prefer it for install, scaffold, and `oke dev`.
+**Bun ≥ 1.3.14** — prefer it for install, scaffold, and `oke dev`.
 
 <Callout title="The one rule">
-  Prefer `bun add okengine` when you want the `oke` CLI on your PATH. JSR (`@omqkhafi/okengine`) is
-  the library API only.
+  The npm package is `okengine`; the CLI binary is `oke`. Use `bun add` in a project or `bun install
+  -g okengine` for a global `oke` on PATH. JSR is the library API only.
 </Callout>
 
 ## Quick start
@@ -20,7 +20,7 @@ This page gets you from zero to a running app on Bun. The engine targets
 <Step>
 ### Prerequisites
 
-- [Bun](https://bun.sh) ≥ 1.3 (`bun --version`)
+- [Bun](https://bun.sh) ≥ 1.3.14 (`bun --version`)
 - A terminal and a code editor
 
 </Step>
@@ -28,10 +28,18 @@ This page gets you from zero to a running app on Bun. The engine targets
 <Step>
 ### Install the package
 
+Project dependency (framework + local `oke`):
+
 ```bash title="Terminal"
 bun add okengine
 ```
 
+Global CLI (`oke` on PATH):
+
+```bash title="Terminal"
+bun install -g okengine
+```
+
 Library-only via JSR:
 
 ```bash title="Terminal"
@@ -46,12 +54,23 @@ bunx jsr add @omqkhafi/okengine
 ```bash title="Terminal"
 bunx create-oke@latest my-app
 bunx create-oke@latest my-app --template standard
+bunx create-oke@latest my-app --template advanced
 bunx create-oke@latest my-app --sql postgres
+bunx create-oke@latest my-app --yes
 ```
 
-`standard` is the only starter. Default: local SQLite, Docker/production
-Postgres. `--sql postgres` pins `store.sql` for **local, Docker, and
-production** — schema stays dialect-agnostic (`store.schema.table`).
+Two Notes starters: **standard** (local-first) and **advanced** (docker-ready +
+files/digest/AI). On a TTY: pick a template, then **recommended defaults**,
+**customize** (choose **local** or **docker** first, walk that side’s facets,
+optionally customize the other; saved to `~/.oke/create-defaults.json`), or
+**reuse** when saved settings match that template. The project-name step rejects
+a path that already exists and is not empty.
+
+Non-TTY / `--yes` stay scriptable. Default pins: local SQLite · Docker/prod
+Postgres. `--sql postgres` pins SQL envs; `--ai` runs the AI model wizard
+**before** install. Scaffold writes `.oke/mode` from the primary side
+(recommended: standard → `local`, advanced → `docker`) so the first `oke dev`
+skips the mode prompt unless you delete that file or pass `--local` / `--docker`.
 
 </Step>
 
@@ -63,11 +82,14 @@ cd my-app
 oke dev
 ```
 
-Three ports come up together (mnemonic: **O·K·E = 6·5·3**):
+Four ports come up together (mnemonic: **O·K·E = 6·5·3**):
 
 <Surfaces />
 
-Open `http://localhost:6533`. If the Console lists your flows, the install
+Open `http://localhost:6533`. On first boot, claim the Console with the
+**claim code** printed once in the `oke dev` log, then create the first
+operator. Password policy matches Gate auth: **≥ 12 characters, with a letter
+and a number.** After that, if the Console lists your flows, the install
 worked — **derived, not configured.**
 
 </Step>
@@ -103,8 +125,9 @@ Uses the `docker` driver profile in `oke.config.ts` (filled from `prod` when
 omitted). Compose and credentials land under `docker/` (`.env.docker` beside
 compose); host ports are unique per project.
 
-Bare `oke dev` prompts once on a TTY (saved in `.oke/mode`); non-TTY defaults
-to `local`.
+Bare `oke dev` uses `.oke/mode` when present (seeded by create-oke). On a TTY
+with no saved mode it prompts once and writes the file; non-TTY defaults to
+`local`.
 
 | Protocol            | Env shape (generated)                                                                                           |
 | ------------------- | --------------------------------------------------------------------------------------------------------------- |
@@ -122,8 +145,9 @@ controls are preserved when `oke dev --docker` regenerates the file.
 <Accordions>
 
 <Accordion title="oke: command not found after install">
-  Use `bun add okengine` (npm package), not JSR alone — the CLI ships with the npm distribution. Or
-  invoke via `bunx oke dev` from the project.
+  Install the npm package `okengine` (not JSR alone): `bun add okengine` in the project, or `bun
+  install -g okengine` for a global binary. Or invoke via `bunx oke dev`. There is no separate `oke`
+  package name — only `okengine`.
 </Accordion>
 
 <Accordion title="Console is empty / no flows listed">
@@ -131,11 +155,23 @@ controls are preserved when `oke dev --docker` regenerates the file.
   boots and the Manifest is extracted — fix TypeScript errors in the terminal first.
 </Accordion>
 
+<Accordion title="Create first operator fails (password / claim code)">
+  Use a password with at least 12 characters, including a letter and a number. Copy the claim code
+  from the current `oke dev` boot log (it expires in 30 minutes; restart mint a new one). The form
+  and the request log now show the reason — not a bare `TransportError` / `500`.
+</Accordion>
+
 <Accordion title="Database out of sync after editing schema">
   Local `oke dev` auto-pushes by default. If you passed `--no-db-push` or set `db.autoPush: false`,
   run `oke db push` yourself, or re-enable auto-push.
 </Accordion>
 
+<Accordion title="Docker containers left after deleting a project">
+  Each project gets its own `oke-dev-<id>` compose stack; `oke dev` stop keeps volumes. Run
+  `oke docker clean` (TTY picker) or `oke docker clean --all --yes` from anywhere to remove
+  leftover containers, networks, and volumes.
+</Accordion>
+
 </Accordions>
 
 ## Learn more

package/site/content/docs/get-started/introduction.mdx

@@ -60,7 +60,7 @@ on(db.table(users).changed("email"), reverify);
 <Step>
 ### See what was derived
 
-Run `oke dev`. Three surfaces come up together — nothing configured by hand in
+Run `oke dev`. Four surfaces come up together — nothing configured by hand in
 a separate dashboard.
 
 <Surfaces />

package/site/content/docs/reference/cli.md

@@ -8,13 +8,15 @@ source: "docs/cli.md"
 ### Commands
 
 ```bash
-bun add okengine                 # ONE package
+bun add okengine                 # ONE package (project)
+bun install -g okengine          # global `oke` on PATH
 
 oke dev                          # watch · hot reload · Console :6533 · app :6530 · MCP :6535 · docs MCP :6536
                                  #   → client types + domain schema push on save (local)
 oke dev --local                  # -l  session-only local (in-memory; never writes .oke/mode)
-oke dev --no-db-push             #     opt out of auto oke db push on schema change
+oke dev --no-db-push             #     opt out of auto oke db push on schema input save
 oke dev --docker                 # -d  infra compose under docker/ (no app container; host Bun)
+                                 #     Ctrl-C / close terminal → docker compose stop (volumes kept)
 oke dev -d store.sql,signal      #     partial: only these roles get real backends
 oke mode local|docker            # get/set default oke dev mode (saved in .oke/mode)
 
@@ -31,10 +33,14 @@ oke client add <url>             # types for a separate frontend repo
 
 oke docker                       # docker/Dockerfile + docker/compose.<role>.yml · …
 oke docker --prod                # healthchecks, volumes, limits, secret refs, deploy.replicas
+oke docker clean                 # TTY: pick oke-dev-* stacks → down -v (containers, networks, volumes)
+oke docker clean --yes           # non-TTY: current project stack only
+oke docker clean --all --yes     # non-TTY: every oke-dev-* stack on this machine
 oke images pin                   # tags → digests in oke.images.lock
 
 oke build --target edge          # < 15 kB kernel profile
 oke eval                         # run prompt eval sets; fails CI on regression
+oke ai setup                     # configure AI driver + models (TTY wizard or flags)
 oke branch prod --at "yesterday" # fork journaled state into a sandbox
 oke privacy erase --subject <id> # crypto-shredding: deletes the key, not the terabytes
 oke upgrade                      # run codemods for a breaking change, print the diff
@@ -44,6 +50,24 @@ In development, app, Console, MCP, and docs MCP prefer the canonical ports and m
 when occupied. Docker infrastructure uses stable per-project offsets in disjoint ranges for
 each built-in service, preventing one service's offset port from overlapping another's.
 
+### create-oke
+
+```bash
+bunx create-oke@latest my-app                    # TTY: template → recommended / reuse / customize
+bunx create-oke@latest my-app --template advanced
+bunx create-oke@latest my-app --yes              # non-interactive recommended defaults
+bunx create-oke@latest my-app --sql postgres
+bunx create-oke@latest my-app --ai               # AI model wizard before install
+bunx create-oke@latest my-app --no-ai
+```
+
+On a TTY: pick **standard** or **advanced**, then recommended defaults or
+customize. Customize asks **local** or **docker** first, walks facets for that
+side only, then whether to customize the other (defaults if no). Writes
+user-global `~/.oke/create-defaults.json` (reuse only when `template` matches).
+Scaffold writes `.oke/mode` from the primary side. Non-TTY / `--yes` / explicit
+`--template` never prompt.
+
 ### Additional commands
 
 ```bash
@@ -52,6 +76,8 @@ oke doctor --json                # -j  JSON on stdout; hints on stderr (agents /
 oke stack --json                 # -j
 oke images list                  # recipe · image · tag · digest · size (--json|-j)
 oke gates list                   # Module:Action catalogue (--json|-j)
+oke ai setup --provider ollama --yes   # non-interactive AI config
+# TTY Ollama: needs quiz → RAM-tier panel → recommend / installed / manual (+ ← Back)
 ```
 
 ### Shell completion
@@ -74,6 +100,8 @@ Long form is canonical in docs; short form is convenience only. Shared letters f
 | `--docker`           | `-d`  | `dev`                                          |
 | `--no-db-push`       |       | `dev`                                          |
 | `--prod`             | `-p`  | `docker`                                       |
+| `--yes`              | `-y`  | `docker clean`                                 |
+| `--all`              |       | `docker clean`                                 |
 | `--port`             | `-p`  | `start`                                        |
 | `--check`            | `-c`  | `schema generate`                              |
 | `--config`           | `-c`  | `stack`, `docker`, `images`, `db *` (drizzle)  |

package/site/content/docs/reference/configuration.mdx

@@ -25,11 +25,12 @@ drivers: {
     kv: { local: "memory", docker: "redis", test: "memory", prod: "redis" },
     files: { local: "fs", docker: "s3", test: "memory", prod: "s3" },
   },
-  signal: { local: "memory", docker: "postgres", test: "memory", prod: "postgres" },
-  clock: { local: "memory", docker: "postgres", test: "frozen", prod: "postgres" },
-  vault: { local: "dotenv", docker: "openbao", test: "memory", prod: "openbao" },
+  signal: { local: "memory", docker: "redis", test: "memory", prod: "redis" },
+  clock: { local: "memory", docker: "file", test: "frozen", prod: "file" },
+  vault: { local: "env", docker: "openbao", test: "memory", prod: "openbao" },
   channel: {
     email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
+    sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
   },
 },
 ```
@@ -40,13 +41,13 @@ drivers: {
 | `store.kv`         | env driver map | `memory` · `redis`                                                           |
 | `store.files`      | env driver map | `memory` · `fs` · `s3`                                                       |
 | `store.index`      | env driver map | `memory` · `pgvector` · `libsql` · `meilisearch`                             |
-| `signal`           | env driver map | `memory` · `postgres` · `redis` · `nats`                                     |
-| `clock`            | env driver map | `memory` · `postgres` · `frozen`                                             |
-| `vault`            | env driver map | `dotenv` · `openbao` · `memory`                                              |
-| `channel.email`    | env driver map | `console` · `smtp` · `resend`                                                |
-| `channel.sms`      | env driver map | `console` · `unifonic`                                                       |
-| `channel.whatsapp` | env driver map | medium declared; drivers added per provider                                  |
-| `channel.push`     | env driver map | medium declared; drivers added per provider                                  |
+| `signal`           | env driver map | `memory` · `redis` (boot); `postgres` · `nats` fail loud until clients bind  |
+| `clock`            | env driver map | `memory` · `file` · `frozen`                                                 |
+| `vault`            | env driver map | `env` · `openbao` · `memory` · `managed`                                     |
+| `channel.email`    | env driver map | `console` · `smtp` · `resend` · `sndr`                                       |
+| `channel.sms`      | env driver map | `console` · `taqnyat` · `msegat` · `unifonic`                                |
+| `channel.whatsapp` | env driver map | `console` · `wa-cloud`                                                       |
+| `channel.push`     | env driver map | `console` · `webpush` · `fcm`                                                |
 | `ai`               | env driver map | `mock` · `anthropic` · `openai-compatible` · `bedrock` · `vertex` · `ollama` |
 | `runs`             | env driver map | runs-store driver (distinct from top-level `runs`)                           |
 | `prod`             | `string[]`     | flat protocol list for the Manifest — nested maps are preferred              |
@@ -127,13 +128,13 @@ Runs retention and redaction at the config surface — **not** the same key as `
 
 Domain schema sync for `oke db push | generate | migrate` (Drizzle). Unrelated to `oke schema generate`.
 
-| Option      | Default                     | Meaning                                                                     |
-| ----------- | --------------------------- | --------------------------------------------------------------------------- |
-| `autoPush`  | `true` (local only)         | Auto-run `db push` on schema change in `oke dev`; forced off in docker/prod |
-| `config`    | `"drizzle.config.ts"`       | Path to the drizzle-kit config                                              |
-| `declare`   | `"src/schema.decl.ts"`      | Abstract schema module (`store.schema.table` exports)                       |
-| `generated` | `"src/schema.generated.ts"` | Where `oke db` emits dialect Drizzle                                        |
-| `entry`     | `src/app.ts`                | App entry for collecting plugin table contributions                         |
+| Option      | Default                     | Meaning                                                                                                           |
+| ----------- | --------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `autoPush`  | `true` (local only)         | Auto-run `db push` when schema inputs change in `oke dev` (not on emit of `generated`); forced off in docker/prod |
+| `config`    | `"drizzle.config.ts"`       | Path to the drizzle-kit config                                                                                    |
+| `declare`   | `"src/schema.decl.ts"`      | Abstract schema module (`store.schema.table` exports)                                                             |
+| `generated` | `"src/schema.generated.ts"` | Where `oke db` emits dialect Drizzle                                                                              |
+| `entry`     | `src/app.ts`                | App entry for collecting plugin table contributions                                                               |
 
 ## topology
 

package/site/content/docs/reference/environment-variables.mdx

@@ -61,27 +61,53 @@ Written by the first-boot bootstrap; you normally only set these when pointing a
 | `OKE_VAULT_TOKEN` | App token (least-privilege) | —                  |
 | `OKE_VAULT_MOUNT` | KV v2 mount path            | `"secret"`         |
 
-## Channel (email)
-
-| Variable                | Used for                                  |
-| ----------------------- | ----------------------------------------- |
-| `SMTP_URL`              | Full SMTP connection string (`smtp://…`)  |
-| `SMTP_USER`             | Overrides the user embedded in `SMTP_URL` |
-| `SMTP_PASSWORD`         | Overrides the password in `SMTP_URL`      |
-| `OKE_CHANNEL_EMAIL_URL` | OKE-specific alternative to `SMTP_URL`    |
+## Channel (email) — boot binder
+
+Read when `drivers.channel.email` resolves to that driver id.
+
+| Variable                | Used for                                         |
+| ----------------------- | ------------------------------------------------ |
+| `SMTP_URL`              | `smtp` — full SMTP URL (`smtp://…`)              |
+| `SMTP_USER`             | Overrides the user embedded in `SMTP_URL`        |
+| `SMTP_PASSWORD`         | Overrides the password in `SMTP_URL`             |
+| `OKE_CHANNEL_EMAIL_URL` | Alternative to `SMTP_URL`                        |
+| `RESEND_API_KEY`        | `resend` API key                                 |
+| `SNDR_API_KEY`          | `sndr` API key                                   |
+| `SNDR_BASE_URL`         | Optional SNDR API origin (default `api.sndr.sh`) |
+
+## Channel (SMS) — boot binder
+
+Read when `drivers.channel.sms` resolves to that driver id (`console` opens nothing).
+
+| Variable               | Used for                         |
+| ---------------------- | -------------------------------- |
+| `TAQNYAT_BEARER_TOKEN` | `taqnyat` bearer token           |
+| `TAQNYAT_TOKEN`        | Alias for `TAQNYAT_BEARER_TOKEN` |
+| `TAQNYAT_SENDER`       | Taqnyat pre-approved sender id   |
+| `MSEGAT_USERNAME`      | `msegat` account username        |
+| `MSEGAT_API_KEY`       | `msegat` API key                 |
+| `MSEGAT_SENDER`        | Msegat pre-approved sender id    |
+| `UNIFONIC_APPSID`      | `unifonic` AppSid                |
+| `UNIFONIC_APP_SID`     | Alias for `UNIFONIC_APPSID`      |
+| `UNIFONIC_SENDER`      | Unifonic SenderID (optional)     |
+
+WhatsApp (`wa-cloud`) and push (`webpush` / `fcm`) are not opened from env at
+boot — pass them on `BootOptions.channel.drivers` with their open options.
 
 ## AI providers
 
-| Variable            | Used for                                                                                                                                  | Default when unset                |
-| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
-| `ANTHROPIC_API_KEY` | `anthropic` driver credential                                                                                                             | —                                 |
-| `ANTHROPIC_MODEL`   | Model override for the anthropic driver                                                                                                   | —                                 |
-| `OPENAI_API_KEY`    | `openai-compatible` driver credential                                                                                                     | —                                 |
-| `OPENAI_BASE_URL`   | `openai-compatible` base URL                                                                                                              | OpenAI cloud                      |
-| `OKE_AI_DRIVER`     | Force the AI driver id (honoured in docker mode)                                                                                          | config map                        |
-| `OKE_AI_URL`        | Ollama (or openai-compatible) base URL                                                                                                    | `http://127.0.0.1:11434` (ollama) |
-| `OKE_AI_MODEL`      | Default model for `ollama` (any pulled model; `qwen3.5:9b` is a balanced local-dev starting point; on Apple Silicon try `qwen3.5:9b-mlx`) | `qwen3.5:9b`                      |
-| `OLLAMA_HOST`       | Alternate Ollama host (`host:port` or URL) when `OKE_AI_URL` is unset                                                                     | —                                 |
+| Variable              | Used for                                                                                                                                  | Default when unset                |
+| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
+| `ANTHROPIC_API_KEY`   | `anthropic` driver credential                                                                                                             | —                                 |
+| `ANTHROPIC_MODEL`     | Model override for the anthropic driver                                                                                                   | —                                 |
+| `OPENAI_API_KEY`      | `openai-compatible` driver credential                                                                                                     | —                                 |
+| `OPENAI_BASE_URL`     | `openai-compatible` base URL                                                                                                              | OpenAI cloud                      |
+| `OKE_AI_DRIVER`       | Force the AI driver id (honoured in docker mode)                                                                                          | config map                        |
+| `OKE_AI_URL`          | Ollama (or openai-compatible) base URL                                                                                                    | `http://127.0.0.1:11434` (ollama) |
+| `OKE_AI_MODEL`        | Default model for `ollama` (any pulled model; `qwen3.5:9b` is a balanced local-dev starting point; on Apple Silicon try `qwen3.5:9b-mlx`) | `qwen3.5:9b`                      |
+| `OKE_AI_VISION_MODEL` | Vision model id written by `oke ai setup` (logical `ai.model("vision")`)                                                                  | —                                 |
+| `OKE_AI_EMBED_MODEL`  | Embedding model id written by `oke ai setup`                                                                                              | —                                 |
+| `OLLAMA_HOST`         | Alternate Ollama host (`host:port` or URL) when `OKE_AI_URL` is unset                                                                     | —                                 |
 
 ## Framework behavior
 

package/site/content/docs/reference/errors.mdx

@@ -29,17 +29,18 @@ string. Custom app codes stay message-less until registered.
 
 ## OKE numeric codes
 
-| Code   | Name              | Cause                                            | Fix                                             |
-| ------ | ----------------- | ------------------------------------------------ | ----------------------------------------------- |
-| `1001` | undeclared read   | Flow reads a resource not in `effects.reads`     | Add it to the flow's `effects.reads`            |
-| `1002` | undeclared write  | Flow writes a resource not in `effects.writes`   | Add it to the flow's `effects.writes`           |
-| `1003` | undeclared emit   | Flow emits a signal not in `effects.emits`       | Add it to the flow's `effects.emits`            |
-| `1004` | undeclared send   | Flow sends a template not in `effects.sends`     | Add it to the flow's `effects.sends`            |
-| `1005` | undeclared ask    | Flow asks a prompt not in `effects.asks`         | Add it to the flow's `effects.asks`             |
-| `1006` | undeclared secret | Flow reads a secret not in `effects.secrets`     | Add it to the flow's `effects.secrets`          |
-| `1007` | undeclared call   | Flow calls a flow not in `effects.calls`         | Add it to the flow's `effects.calls`            |
-| `1042` | orphan emit       | Emitted signal has no subscriber                 | Add `on(signal, …)` or declare `optional: true` |
-| `1101` | schema missing    | Domain table absent in docker/prod — no auto-DDL | Run `oke db migrate` against this environment   |
+| Code   | Name              | Cause                                            | Fix                                                |
+| ------ | ----------------- | ------------------------------------------------ | -------------------------------------------------- |
+| `1001` | undeclared read   | Flow reads a resource not in `effects.reads`     | Add it to the flow's `effects.reads`               |
+| `1002` | undeclared write  | Flow writes a resource not in `effects.writes`   | Add it to the flow's `effects.writes`              |
+| `1003` | undeclared emit   | Flow emits a signal not in `effects.emits`       | Add it to the flow's `effects.emits`               |
+| `1004` | undeclared send   | Flow sends a template not in `effects.sends`     | Add it to the flow's `effects.sends`               |
+| `1005` | undeclared ask    | Flow asks a prompt not in `effects.asks`         | Add it to the flow's `effects.asks`                |
+| `1006` | undeclared secret | Flow reads a secret not in `effects.secrets`     | Add it to the flow's `effects.secrets`             |
+| `1007` | undeclared call   | Flow calls a flow not in `effects.calls`         | Add it to the flow's `effects.calls`               |
+| `1042` | orphan emit       | Emit with zero subscribers and `optional` false  | Add `on(signal, …)` or declare `optional: true`    |
+| `1043` | signal schema     | Emit payload failed the signal's `schema`        | Pass a payload that matches `schema`, or remove it |
+| `1101` | schema missing    | Domain table absent in docker/prod — no auto-DDL | Run `oke db migrate` against this environment      |
 
 <Callout title="Effects are usually inferred">
   The 1001–1007 family exists for flows that declare effects explicitly. Most apps never write an

package/site/content/docs/reference/fx.mdx

@@ -16,24 +16,26 @@ flow({
 
 ## Stores
 
-| Signature                                                           | Records      | Returns                                                   |
-| ------------------------------------------------------------------- | ------------ | --------------------------------------------------------- |
-| `fx.store(sqlDecl).select().from(t)…`                               | `read`       | rows (`where` · `orderBy` · `limit` · `offset` chainable) |
-| `fx.store(sqlDecl).insert(t).values(v)`                             | `write`      | `Promise<void>`                                           |
-| `fx.store(sqlDecl).update(t).set(v).where(…)`                       | `write`      | `Promise<void>`                                           |
-| `fx.store(sqlDecl).delete(t).where(…)`                              | `write`      | `Promise<void>`                                           |
-| `fx.store(sqlDecl).findById(t, id)`                                 | `read`       | row \| undefined                                          |
-| `fx.store(kv).get / set(key, value, ttl?) / delete / list(prefix?)` | read / write | per op                                                    |
-| `fx.store(files).put / get / delete / list(prefix?)`                | read / write | per op                                                    |
-| `fx.store(index).upsert / search(vector, topK?) / delete`           | read / write | per op                                                    |
+| Signature                                                           | Records      | Returns                                                                                     |
+| ------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------- |
+| `fx.store(sqlDecl).select().from(t)…`                               | `read`       | rows (`where` · `orderBy` · `limit` · `offset` chainable)                                   |
+| `fx.store(sqlDecl).insert(t).values(v)`                             | `write`      | `Promise<void>`                                                                             |
+| `fx.store(sqlDecl).update(t).set(v).where(…)`                       | `write`      | `Promise<void>`                                                                             |
+| `fx.store(sqlDecl).delete(t).where(…)`                              | `write`      | `Promise<void>`                                                                             |
+| `fx.store(sqlDecl).findById(t, id)`                                 | `read`       | row \| undefined                                                                            |
+| `fx.store(kv).get / set(key, value, ttl?) / delete / list(prefix?)` | read / write | per op                                                                                      |
+| `fx.store(files).put / get / delete / list(prefix?)`                | read / write | per op                                                                                      |
+| `fx.store(files).image(key\|bytes).…`                               | read / write | Bun.Image chain; terminals gate (see [Store](/docs/elements/store#images--image--putimage)) |
+| `fx.store(files).putImage(key, data, opts?)`                        | `write`      | original + variants (+ optional LQIP)                                                       |
+| `fx.store(index).upsert / search(vector, topK?) / delete`           | read / write | per op                                                                                      |
 
 See [Store](/docs/elements/store) for the query-builder surface.
 
 ## Signals
 
-| Signature                   | Records | Notes                                            |
-| --------------------------- | ------- | ------------------------------------------------ |
-| `fx.emit(signal, payload?)` | `emit`  | With the postgres driver, joins your transaction |
+| Signature                             | Records | Notes                                                                                                                                           |
+| ------------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| `fx.emit(signal, payload?, { key? })` | `emit`  | Commits the signal outbox when the call resolves; optional `key` serializes `once` per key; throws **OKE1042** (orphan) or **OKE1043** (schema) |
 
 ## Flows
 

package/site/content/docs/reference/security.md

@@ -45,7 +45,9 @@ Our path is concrete: a booking name containing "ignore previous instructions an
 - **Plugin panels** run in a sandboxed iframe without `allow-same-origin`, communicating only over a `postMessage` bridge with their own CSP, no access to the operator session token, and exposure limited to that plugin's declared flows.
 - **Session and framing:** `frame-ancestors 'none'`, `SameSite=Strict`, step-up authentication before destructive actions.
 - **Secret write path:** TLS required, no autocomplete, never echoed, never logged, not retained in browser memory after submission.
-- **The setup claim code** is rate-limited and compared in constant time.
+- **The setup claim code** is rate-limited and compared in constant time. The first-operator password
+  uses the same policy as Gate auth (minLength 12, letter + number); weak passwords return
+  `ClaimFailed` / `password_policy`, not an opaque 500.
 
 #### 10.5 Reversibility governs the confirmation pattern