okengine 0.6.1 → 0.8.0

package/site/content/docs/elements/vault.mdx

@@ -83,6 +83,14 @@ still reaches `fx.log` is scrubbed by the boot redactor as before.
 
 That's the whole loop: declare → set → read. Everything below is what OKE guarantees on top of it.
 
+## Redacted until you reveal
+
+<VaultRedacted />
+
+Pass the wrapper freely — `fx.log`, `String()`, and `JSON.stringify` all yield
+`[redacted]`. Call `.reveal()` once at the provider boundary that needs the
+credential.
+
 ## Two kinds of contracts
 
 | Declaration                         | Sensitive? | Console shows    | Use for                     |
@@ -143,17 +151,19 @@ In docker mode, `oke vault set` writes straight to the running OpenBao — no gi
 The **Console** (`:6533`) can also set and rotate values, but it is **write-only**: it shows a salted fingerprint (`sha256:…`) per secret, never the cleartext. When you rotate a key there, the panel shows the **blast radius** — which in-flight durable runs will wake up with the new value.
 
 <Callout title="Secrets never reach logs">
-  Every loaded secret is registered with the redactor at boot. Even if you accidentally pass one to
-  `fx.log`, the log line shows `***` — the value, never. Traces and the Console get fingerprints.
+  `fx.vault` returns `Redacted` — `fx.log` shows `[redacted]`. A revealed string that still reaches
+  a log is scrubbed by the boot redactor to `[redacted:secret]`. Traces and the Console get
+  fingerprints, never cleartext.
 </Callout>
 
 ## Per-environment drivers
 
-Which backend holds your values depends on the mode — configured once in `oke.config.ts`:
+Which backend holds your values depends on the mode — configured once in `oke.config.ts`.
+App boot and the Console share the same resolution-chain builder (`env` layers → backend):
 
 ```typescript title="oke.config.ts"
 vault: {
-  local: "dotenv",   // .env.local — zero ceremony
+  local: "env",      // .env.local — zero ceremony
   docker: "openbao", // real vault in the compose stack
   test: "memory",    // seeded map — deterministic tests
   prod: "openbao",   // real vault in production
@@ -162,7 +172,7 @@ vault: {
 
 | Driver    | Backend         | Best for                                   |
 | --------- | --------------- | ------------------------------------------ |
-| `dotenv`  | `.env.local`    | Local loop — no infra at all               |
+| `env`     | `.env.local`    | Local loop — no infra at all               |
 | `openbao` | OpenBao (KV v2) | Docker + prod — durable, access-controlled |
 | `memory`  | in-process map  | Tests                                      |
 

package/site/content/docs/get-started/basic-usage.mdx

@@ -1,12 +1,12 @@
 ---
 title: Basic Usage
-description: Scaffold the standard starter, call the health Flow, and inspect it in the Console.
-source: packages/create-oke/template
+description: Scaffold the standard Notes starter, call health and notes Flows, and inspect them in the Console.
+source: packages/create-oke/templates/standard
 icon: SquareTerminal
 ---
 
 Write your first Flow, call it from a typed client, and prove it with
-`bun:test` — using the same standard starter `create-oke` scaffolds.
+`bun:test` — using the same standard Notes starter `create-oke` scaffolds.
 
 <Callout title="The one rule">
   All reads, writes, emits, sends, and external calls belong behind `fx`. That is what makes effects
@@ -26,6 +26,9 @@ cd my-app
 oke dev
 ```
 
+Use `--template advanced` for the same Notes domain with files attach, a daily
+digest Clock, and an AI summarize stub.
+
 <Surfaces />
 
 </Step>
@@ -33,7 +36,7 @@ oke dev
 <Step>
 ### Read the health Flow
 
-The standard starter already exports a health Flow:
+The standard starter already exports a named health Flow:
 
 ```typescript title="flows/main"
 import { on, flow, http, gate } from "okengine";
@@ -42,13 +45,16 @@ import { z } from "zod";
 export const health = on(
   http.get("/health").gate(gate.public),
   flow({
+    name: "main.health",
+    unit: "main",
     out: z.object({ ok: z.literal(true) }),
     do: () => ({ ok: true as const }),
   }),
 );
 ```
 
-Change the route or output and save. App and Console update together from the
+Named flows show up as `main.health` (not `flow_1`) in `oke dev` logs.
+Change the route or output and save — App and Console update together from the
 same Manifest.
 
 </Step>
@@ -61,8 +67,9 @@ Adopted modules become namespaces on the client:
 ```typescript title="app"
 import { oke } from "okengine";
 import * as main from "./flows/main";
+import * as notes from "./flows/notes";
 
-export const app = oke({ name: "standard" }).adopt({ main });
+export const app = oke({ name: "notes" }).adopt({ main, notes });
 export type App = typeof app;
 ```
 

package/site/content/docs/get-started/installation.mdx

@@ -6,11 +6,11 @@ icon: Download
 ---
 
 This page gets you from zero to a running app on Bun. The engine targets
-**Bun ≥ 1.3** — prefer it for install, scaffold, and `oke dev`.
+**Bun ≥ 1.3.14** — prefer it for install, scaffold, and `oke dev`.
 
 <Callout title="The one rule">
-  Prefer `bun add okengine` when you want the `oke` CLI on your PATH. JSR (`@omqkhafi/okengine`) is
-  the library API only.
+  The npm package is `okengine`; the CLI binary is `oke`. Use `bun add` in a project or `bun install
+  -g okengine` for a global `oke` on PATH. JSR is the library API only.
 </Callout>
 
 ## Quick start
@@ -20,7 +20,7 @@ This page gets you from zero to a running app on Bun. The engine targets
 <Step>
 ### Prerequisites
 
-- [Bun](https://bun.sh) ≥ 1.3 (`bun --version`)
+- [Bun](https://bun.sh) ≥ 1.3.14 (`bun --version`)
 - A terminal and a code editor
 
 </Step>
@@ -28,10 +28,18 @@ This page gets you from zero to a running app on Bun. The engine targets
 <Step>
 ### Install the package
 
+Project dependency (framework + local `oke`):
+
 ```bash title="Terminal"
 bun add okengine
 ```
 
+Global CLI (`oke` on PATH):
+
+```bash title="Terminal"
+bun install -g okengine
+```
+
 Library-only via JSR:
 
 ```bash title="Terminal"
@@ -46,12 +54,24 @@ bunx jsr add @omqkhafi/okengine
 ```bash title="Terminal"
 bunx create-oke@latest my-app
 bunx create-oke@latest my-app --template standard
+bunx create-oke@latest my-app --template advanced
 bunx create-oke@latest my-app --sql postgres
+bunx create-oke@latest my-app --yes
 ```
 
-`standard` is the only starter. Default: local SQLite, Docker/production
-Postgres. `--sql postgres` pins `store.sql` for **local, Docker, and
-production** — schema stays dialect-agnostic (`store.schema.table`).
+Two Notes starters: **standard** (local-first) and **advanced** (docker-ready +
+files/digest/AI).
+
+On a TTY: pick a template, then **recommended defaults**, **customize** (local
+or docker first; saved to `~/.oke/create-defaults.json`), or **reuse** matching
+saved settings. Project name rejects a non-empty existing path.
+
+Non-TTY / `--yes` stay scriptable. Defaults: local SQLite · Docker/prod Postgres.
+`--sql postgres` pins SQL; `--ai` runs the model wizard before install.
+
+Scaffold writes `.oke/mode` (standard → `local`, advanced → `docker`) so the
+first `oke dev` skips the mode prompt unless you delete it or pass `--local` /
+`--docker`.
 
 </Step>
 
@@ -63,12 +83,16 @@ cd my-app
 oke dev
 ```
 
-Three ports come up together (mnemonic: **O·K·E = 6·5·3**):
+Four ports come up together (mnemonic: **O·K·E = 6·5·3**):
 
 <Surfaces />
 
-Open `http://localhost:6533`. If the Console lists your flows, the install
-worked — **derived, not configured.**
+Open `http://localhost:6533`. Claim the Console with the **claim code** printed
+once in the `oke dev` log, then create the first operator.
+
+Password policy matches Gate auth: **≥ 12 characters, with a letter and a
+number.** If the Console lists your flows, the install worked — **derived, not
+configured.**
 
 </Step>
 
@@ -103,8 +127,9 @@ Uses the `docker` driver profile in `oke.config.ts` (filled from `prod` when
 omitted). Compose and credentials land under `docker/` (`.env.docker` beside
 compose); host ports are unique per project.
 
-Bare `oke dev` prompts once on a TTY (saved in `.oke/mode`); non-TTY defaults
-to `local`.
+Bare `oke dev` uses `.oke/mode` when present (seeded by create-oke). On a TTY
+with no saved mode it prompts once and writes the file; non-TTY defaults to
+`local`.
 
 | Protocol            | Env shape (generated)                                                                                           |
 | ------------------- | --------------------------------------------------------------------------------------------------------------- |
@@ -122,8 +147,9 @@ controls are preserved when `oke dev --docker` regenerates the file.
 <Accordions>
 
 <Accordion title="oke: command not found after install">
-  Use `bun add okengine` (npm package), not JSR alone — the CLI ships with the npm distribution. Or
-  invoke via `bunx oke dev` from the project.
+  Install the npm package `okengine` (not JSR alone): `bun add okengine` in the project, or `bun
+  install -g okengine` for a global binary. Or invoke via `bunx oke dev`. There is no separate `oke`
+  package name — only `okengine`.
 </Accordion>
 
 <Accordion title="Console is empty / no flows listed">
@@ -131,11 +157,23 @@ controls are preserved when `oke dev --docker` regenerates the file.
   boots and the Manifest is extracted — fix TypeScript errors in the terminal first.
 </Accordion>
 
+<Accordion title="Create first operator fails (password / claim code)">
+  Use a password with at least 12 characters, including a letter and a number. Copy the claim code
+  from the current `oke dev` boot log (it expires in 30 minutes; restart mint a new one). The form
+  and the request log now show the reason — not a bare `TransportError` / `500`.
+</Accordion>
+
 <Accordion title="Database out of sync after editing schema">
   Local `oke dev` auto-pushes by default. If you passed `--no-db-push` or set `db.autoPush: false`,
   run `oke db push` yourself, or re-enable auto-push.
 </Accordion>
 
+<Accordion title="Docker containers left after deleting a project">
+  Each project gets its own `oke-dev-<id>` compose stack; `oke dev` stop keeps volumes. Run
+  `oke docker clean` (TTY picker) or `oke docker clean --all --yes` from anywhere to remove
+  leftover containers, networks, and volumes.
+</Accordion>
+
 </Accordions>
 
 ## Learn more

package/site/content/docs/get-started/introduction.mdx

@@ -60,7 +60,7 @@ on(db.table(users).changed("email"), reverify);
 <Step>
 ### See what was derived
 
-Run `oke dev`. Three surfaces come up together — nothing configured by hand in
+Run `oke dev`. Four surfaces come up together — nothing configured by hand in
 a separate dashboard.
 
 <Surfaces />

package/site/content/docs/plugins/magic-link.mdx

@@ -86,6 +86,48 @@ const { data } = await api.auth.verifyMagicLink({ token });
 **Consequence:** the plugin contributes the `auth-magic-link` Channel template and EN/AR
 catalog bodies (`{{link}}`, `{{token}}`). Override copy by merging your own catalog at boot.
 
+## Delivery drivers
+
+| `drivers.channel.email` | Delivery                                                          |
+| ----------------------- | ----------------------------------------------------------------- |
+| `console`               | Dev inbox (local/test default)                                    |
+| `smtp`                  | Any SMTP host — Mailpit under `oke dev --docker` (docker default) |
+| `resend` / `sndr`       | Hosted email APIs                                                 |
+| `taqnyat-mail`          | Taqnyat Mail API (additive option)                                |
+
+### Taqnyat Mail
+
+```typescript title="oke.config.ts"
+export default {
+  drivers: {
+    channel: {
+      email: { local: "console", docker: "smtp", test: "console", prod: "taqnyat-mail" },
+    },
+  },
+};
+```
+
+| Env                  | Meaning                                          |
+| -------------------- | ------------------------------------------------ |
+| `TAQNYAT_MAIL_TOKEN` | Taqnyat bearer token enabled for Email           |
+| `TAQNYAT_CAMPAIGN`   | Campaign name required by Taqnyat `mailSend.php` |
+
+The plugin needs no change — delivery stays Channel-mediated via `fx.send`. SMTP/Mailpit
+remains the default docker path; `taqnyat-mail` is strictly additive.
+
+## Live tests (opt-in)
+
+The Taqnyat live suite sends real email and burns real quota, so it is double-gated: it runs
+only when `OKE_EMAIL_LIVE=1` **and** the real credentials (`TAQNYAT_MAIL_TOKEN`,
+`TAQNYAT_CAMPAIGN`, plus `OKE_TEST_TAQNYAT_MAIL`) are all present.
+
+Credentials alone never send; without the flag the suite skips visibly — never a silent pass.
+
+```bash
+OKE_EMAIL_LIVE=1 TAQNYAT_MAIL_TOKEN=… TAQNYAT_CAMPAIGN=auth \
+  OKE_TEST_TAQNYAT_MAIL=you@example.com bun test src/plugins
+```
+
 ## Troubleshooting
 
 <Accordions>

package/site/content/docs/plugins/phone-number.mdx

@@ -1,16 +1,18 @@
 ---
 title: "Phone number"
-description: "Official plugin — E.164 phone OTP request and verify under /auth."
+description: "Official plugin — E.164 phone OTP request and verify under /auth, with provider-managed delivery via Taqnyat Verify."
 icon: "Smartphone"
 source: "docs/spec/unified-theory.md"
 ---
 
-`phoneNumber()` signs people in with a phone number in E.164 form (`+15551234567`). Codes are
-6 digits, hashed, 10 minutes, 5 attempts — same security shape as email OTP.
+`phoneNumber()` signs people in with a phone number in E.164 form (`+15551234567`). Delivery
+has two shapes: provider-managed OTP through Taqnyat Verify when an SMS driver is bound, or a
+local hashed code (10 minutes, 5 attempts) you deliver yourself.
 
 <Callout title="The one rule">
-  Enable `gate.auth`, then `.plug(phoneNumber())`. Reject non-E.164 numbers. SMS Channel delivery is
-  not wired yet — use `exposeDevOtp` locally. Prefer stronger methods when phone is the only factor.
+  Enable `gate.auth`, then `.plug(phoneNumber())`. For real SMS set `drivers.channel.sms` to
+  `taqnyat` — the plugin uses Taqnyat's Verify API, never a self-generated code. Use `exposeDevOtp`
+  only when no SMS driver is bound.
 </Callout>
 
 ## Quick start
@@ -40,7 +42,8 @@ export const app = oke({
 const { data, error } = await api.auth.requestPhoneOtp({ phone: "+15551234567" });
 ```
 
-`POST /auth/phone/request`. Invalid E.164 → `AuthFailed` / `invalid_phone`.
+`POST /auth/phone/request`. Invalid E.164 → `AuthFailed` / `invalid_phone`. Optional `lang:
+"en" | "ar"` picks the OTP message language on the Taqnyat path.
 
 </Step>
 
@@ -60,16 +63,51 @@ const { data } = await api.auth.verifyPhoneOtp({
 
 </Steps>
 
+## Delivery
+
+| Bound SMS driver     | Request behavior                                           | Verify behavior                |
+| -------------------- | ---------------------------------------------------------- | ------------------------------ |
+| `taqnyat`            | Taqnyat Verify `sendOtp` (provider generates the code)     | Taqnyat Verify `verifyOtp`     |
+| none                 | Local 6-digit code, hashed at rest (`exposeDevOtp` for DX) | Local hash compare, 5 attempts |
+| any other SMS driver | Fails loudly — provider-managed OTP unsupported            | —                              |
+
+**Consequence:** the request response never contains `devOtp` on the Taqnyat path — the code
+exists only inside the SMS Taqnyat sends.
+
+### Taqnyat Verify
+
+```typescript title="oke.config.ts"
+export default {
+  drivers: {
+    channel: {
+      sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
+    },
+  },
+};
+```
+
+| Env                    | Meaning                                      |
+| ---------------------- | -------------------------------------------- |
+| `TAQNYAT_BEARER_TOKEN` | Taqnyat bearer token (`TAQNYAT_TOKEN` alias) |
+| `TAQNYAT_SENDER`       | Pre-approved sender id                       |
+
+Request stores a provider challenge (`taqnyat:<requestId>`, 10m TTL, 5 attempts) and calls
+`fx.sendOtp`; verify replays the same `requestId` with the code through `fx.verifyOtp`. Both
+are capability-gated `send` effects — dry-run records them without contacting Taqnyat.
+
+An SMS driver without Verify support (for example a generic SMS sender) makes the request fail
+with a clear error: use `exposeDevOtp` locally or switch `drivers.channel.sms` to `taqnyat`.
+
 ## Options
 
-| Option          | Type                | Default  | Meaning                                 |
-| --------------- | ------------------- | -------- | --------------------------------------- |
-| `secret`        | `string`            | active\* | HMAC secret (\*from `gate.auth`)        |
-| `sessions`      | `SessionStore`      | active\* | Session store                           |
-| `ttlMs`         | `number`            | 10m      | Challenge lifetime                      |
-| `exposeDevOtp`  | `boolean`           | `false`  | Include raw OTP in the request response |
-| `phones`        | `PhoneStore`        | new      | Phone → userId map                      |
-| `verifications` | `VerificationStore` | new      | Challenge store                         |
+| Option          | Type                | Default  | Meaning                                                   |
+| --------------- | ------------------- | -------- | --------------------------------------------------------- |
+| `secret`        | `string`            | active\* | HMAC secret (\*from `gate.auth`)                          |
+| `sessions`      | `SessionStore`      | active\* | Session store                                             |
+| `ttlMs`         | `number`            | 10m      | Challenge lifetime                                        |
+| `exposeDevOtp`  | `boolean`           | `false`  | Include raw OTP in the request response (local path only) |
+| `phones`        | `PhoneStore`        | new      | Phone → userId map                                        |
+| `verifications` | `VerificationStore` | new      | Challenge store                                           |
 
 ## Surfaces
 
@@ -80,6 +118,21 @@ const { data } = await api.auth.verifyPhoneOtp({
 
 E.164 pattern: `^\+[1-9]\d{7,14}$`.
 
+## Live tests (opt-in)
+
+The Taqnyat live suite sends real SMS and burns real quota, so it is double-gated: it runs only when
+`OKE_SMS_LIVE=1` **and** the real credentials (`TAQNYAT_TOKEN`, `TAQNYAT_SENDER`, plus
+`OKE_TEST_TAQNYAT_PHONE` — `TAQNYAT_TO` also accepted) are all present. Credentials alone never send.
+
+The suite sends exactly one SMS and never asks for the code.
+
+```bash
+OKE_SMS_LIVE=1 TAQNYAT_TOKEN=… TAQNYAT_SENDER=YourBrand \
+  OKE_TEST_TAQNYAT_PHONE=+9665xxxxxxxx bun test src/plugins
+```
+
+Without the flag the suite skips visibly — never a silent pass.
+
 ## Troubleshooting
 
 <Accordions>
@@ -88,10 +141,18 @@ E.164 pattern: `^\+[1-9]\d{7,14}$`.
 Number must start with `+` and a non-zero country digit, then 7–14 more digits. No spaces or
 dashes.
 
+</Accordion>
+<Accordion title="SMS driver does not support provider-managed OTP">
+
+The configured `drivers.channel.sms` driver has no Verify API. Either switch to `taqnyat` or
+remove the SMS driver so the local hashed path (`exposeDevOtp`) is used.
+
 </Accordion>
 <Accordion title="No SMS arrived">
 
-v1 does not send SMS. Use `exposeDevOtp` in local/test, or deliver via your own Channel Flow.
+On the local path no SMS is sent by design — use `exposeDevOtp`, or bind `taqnyat` with valid
+`TAQNYAT_*` credentials. On the Taqnyat path check the sender id is pre-approved and the
+number is E.164.
 
 </Accordion>
 </Accordions>
@@ -99,8 +160,8 @@ v1 does not send SMS. Use `exposeDevOtp` in local/test, or deliver via your own
 ## Learn more
 
 - [Email OTP](/docs/plugins/email-otp) — email variant of the same OTP rules
-- [Gate](/docs/elements/gate) — `gate.auth`
-- [Channel](/docs/elements/channel) — when you wire SMS yourself
+- [Magic link](/docs/plugins/magic-link) — one-time email link sign-in
+- [Channel](/docs/elements/channel) — SMS / email drivers and delivery
 
 ## Next
 

package/site/content/docs/plugins/two-factor.mdx

@@ -107,6 +107,7 @@ enable. A recovery code works once, then is consumed.
 - [Passkey](/docs/plugins/passkey) — WebAuthn register / authenticate
 - [Gate](/docs/elements/gate) — session + policies
 - [Username](/docs/plugins/username) — first factor to enroll against
+- OTP over SMS or email instead of TOTP? See [Phone number](/docs/plugins/phone-number) / [Magic link](/docs/plugins/magic-link)
 
 ## Next
 

package/site/content/docs/reference/cli.md

@@ -8,13 +8,15 @@ source: "docs/cli.md"
 ### Commands
 
 ```bash
-bun add okengine                 # ONE package
+bun add okengine                 # ONE package (project)
+bun install -g okengine          # global `oke` on PATH
 
 oke dev                          # watch · hot reload · Console :6533 · app :6530 · MCP :6535 · docs MCP :6536
                                  #   → client types + domain schema push on save (local)
 oke dev --local                  # -l  session-only local (in-memory; never writes .oke/mode)
-oke dev --no-db-push             #     opt out of auto oke db push on schema change
+oke dev --no-db-push             #     opt out of auto oke db push on schema input save
 oke dev --docker                 # -d  infra compose under docker/ (no app container; host Bun)
+                                 #     Ctrl-C / close terminal → docker compose stop (volumes kept)
 oke dev -d store.sql,signal      #     partial: only these roles get real backends
 oke mode local|docker            # get/set default oke dev mode (saved in .oke/mode)
 
@@ -26,15 +28,21 @@ oke schema generate              # core + plugin stubs → schema/oke.ts   (--ch
 oke db push                      # domain schema.ts → live local DB (dev; drizzle-kit)
 oke db generate                  # versioned SQL under drizzle/ (review)
 oke db migrate                   # apply migrations (explicit; never auto in prod)
+oke db seed                      # defineSeed (essential + env category); never at boot
+oke db seed --env prod --force   # CI: skip docker/prod confirmation prompt
 oke vault set STRIPE_KEY         # also: list · import .env · key rotate
 oke client add <url>             # types for a separate frontend repo
 
 oke docker                       # docker/Dockerfile + docker/compose.<role>.yml · …
 oke docker --prod                # healthchecks, volumes, limits, secret refs, deploy.replicas
+oke docker clean                 # TTY: pick oke-dev-* stacks → down -v (containers, networks, volumes)
+oke docker clean --yes           # non-TTY: current project stack only
+oke docker clean --all --yes     # non-TTY: every oke-dev-* stack on this machine
 oke images pin                   # tags → digests in oke.images.lock
 
 oke build --target edge          # < 15 kB kernel profile
 oke eval                         # run prompt eval sets; fails CI on regression
+oke ai setup                     # configure AI driver + models (TTY wizard or flags)
 oke branch prod --at "yesterday" # fork journaled state into a sandbox
 oke privacy erase --subject <id> # crypto-shredding: deletes the key, not the terabytes
 oke upgrade                      # run codemods for a breaking change, print the diff
@@ -44,6 +52,24 @@ In development, app, Console, MCP, and docs MCP prefer the canonical ports and m
 when occupied. Docker infrastructure uses stable per-project offsets in disjoint ranges for
 each built-in service, preventing one service's offset port from overlapping another's.
 
+### create-oke
+
+```bash
+bunx create-oke@latest my-app                    # TTY: template → recommended / reuse / customize
+bunx create-oke@latest my-app --template advanced
+bunx create-oke@latest my-app --yes              # non-interactive recommended defaults
+bunx create-oke@latest my-app --sql postgres
+bunx create-oke@latest my-app --ai               # AI model wizard before install
+bunx create-oke@latest my-app --no-ai
+```
+
+On a TTY: pick **standard** or **advanced**, then recommended defaults or
+customize. Customize asks **local** or **docker** first, walks facets for that
+side only, then whether to customize the other (defaults if no). Writes
+user-global `~/.oke/create-defaults.json` (reuse only when `template` matches).
+Scaffold writes `.oke/mode` from the primary side. Non-TTY / `--yes` / explicit
+`--template` never prompt.
+
 ### Additional commands
 
 ```bash
@@ -52,6 +78,8 @@ oke doctor --json                # -j  JSON on stdout; hints on stderr (agents /
 oke stack --json                 # -j
 oke images list                  # recipe · image · tag · digest · size (--json|-j)
 oke gates list                   # Module:Action catalogue (--json|-j)
+oke ai setup --provider ollama --yes   # non-interactive AI config
+# TTY Ollama: needs quiz → RAM-tier panel → recommend / installed / manual (+ ← Back)
 ```
 
 ### Shell completion
@@ -74,6 +102,8 @@ Long form is canonical in docs; short form is convenience only. Shared letters f
 | `--docker`           | `-d`  | `dev`                                          |
 | `--no-db-push`       |       | `dev`                                          |
 | `--prod`             | `-p`  | `docker`                                       |
+| `--yes`              | `-y`  | `docker clean`                                 |
+| `--all`              |       | `docker clean`                                 |
 | `--port`             | `-p`  | `start`                                        |
 | `--check`            | `-c`  | `schema generate`                              |
 | `--config`           | `-c`  | `stack`, `docker`, `images`, `db *` (drizzle)  |

package/site/content/docs/reference/configuration.mdx

@@ -25,9 +25,10 @@ drivers: {
     kv: { local: "memory", docker: "redis", test: "memory", prod: "redis" },
     files: { local: "fs", docker: "s3", test: "memory", prod: "s3" },
   },
-  signal: { local: "memory", docker: "postgres", test: "memory", prod: "postgres" },
+  signal: { local: "memory", docker: "redis", test: "memory", prod: "redis" },
   clock: { local: "memory", docker: "postgres", test: "frozen", prod: "postgres" },
-  vault: { local: "dotenv", docker: "openbao", test: "memory", prod: "openbao" },
+  journal: { local: "memory", docker: "postgres", test: "memory", prod: "postgres" },
+  vault: { local: "env", docker: "openbao", test: "memory", prod: "openbao" },
   channel: {
     email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
     sms: { local: "console", docker: "taqnyat", test: "console", prod: "taqnyat" },
@@ -41,10 +42,11 @@ drivers: {
 | `store.kv`         | env driver map | `memory` · `redis`                                                           |
 | `store.files`      | env driver map | `memory` · `fs` · `s3`                                                       |
 | `store.index`      | env driver map | `memory` · `pgvector` · `libsql` · `meilisearch`                             |
-| `signal`           | env driver map | `memory` · `postgres` · `redis` · `nats`                                     |
-| `clock`            | env driver map | `memory` · `postgres` · `frozen`                                             |
-| `vault`            | env driver map | `dotenv` · `openbao` · `memory`                                              |
-| `channel.email`    | env driver map | `console` · `smtp` · `resend` · `sndr`                                       |
+| `signal`           | env driver map | `memory` · `redis` (boot); `postgres` · `nats` fail loud until clients bind  |
+| `clock`            | env driver map | `memory` · `postgres` · `file` · `frozen`                                    |
+| `journal`          | env driver map | `memory` · `file` · `postgres`                                               |
+| `vault`            | env driver map | `env` · `openbao` · `memory` · `managed`                                     |
+| `channel.email`    | env driver map | `console` · `smtp` · `resend` · `sndr` · `taqnyat-mail`                      |
 | `channel.sms`      | env driver map | `console` · `taqnyat` · `msegat` · `unifonic`                                |
 | `channel.whatsapp` | env driver map | `console` · `wa-cloud`                                                       |
 | `channel.push`     | env driver map | `console` · `webpush` · `fcm`                                                |
@@ -128,13 +130,13 @@ Runs retention and redaction at the config surface — **not** the same key as `
 
 Domain schema sync for `oke db push | generate | migrate` (Drizzle). Unrelated to `oke schema generate`.
 
-| Option      | Default                     | Meaning                                                                     |
-| ----------- | --------------------------- | --------------------------------------------------------------------------- |
-| `autoPush`  | `true` (local only)         | Auto-run `db push` on schema change in `oke dev`; forced off in docker/prod |
-| `config`    | `"drizzle.config.ts"`       | Path to the drizzle-kit config                                              |
-| `declare`   | `"src/schema.decl.ts"`      | Abstract schema module (`store.schema.table` exports)                       |
-| `generated` | `"src/schema.generated.ts"` | Where `oke db` emits dialect Drizzle                                        |
-| `entry`     | `src/app.ts`                | App entry for collecting plugin table contributions                         |
+| Option      | Default                     | Meaning                                                                                                           |
+| ----------- | --------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `autoPush`  | `true` (local only)         | Auto-run `db push` when schema inputs change in `oke dev` (not on emit of `generated`); forced off in docker/prod |
+| `config`    | `"drizzle.config.ts"`       | Path to the drizzle-kit config                                                                                    |
+| `declare`   | `"src/schema.decl.ts"`      | Abstract schema module (`store.schema.table` exports)                                                             |
+| `generated` | `"src/schema.generated.ts"` | Where `oke db` emits dialect Drizzle                                                                              |
+| `entry`     | `src/app.ts`                | App entry for collecting plugin table contributions                                                               |
 
 ## topology