okengine 0.9.0 → 0.10.0

package/site/content/docs/providers/index.mdx

@@ -0,0 +1,101 @@
+---
+title: "Providers"
+description: "Managed cloud SQL and Redis providers behind oke's postgres and redis drivers — dashboard click-paths, pooling, and gotchas."
+icon: "Cloud"
+source: "docs/spec/unified-theory.md"
+---
+
+Every provider below speaks a protocol oke already drives — Postgres wire or Redis wire.
+Hand the connection string to that driver; no new driver id, no Flow code changes.
+
+<Callout title="The one rule">
+  Vendor choice lives in a connection URL (`DATABASE_URL` / `REDIS_URL`) — never in
+  `drivers.store.sql` / `drivers.store.kv`, which only ever say `postgres` or `redis`.
+</Callout>
+
+## SQL providers
+
+Managed Postgres-wire databases — set `DATABASE_URL`, driver stays `postgres`.
+
+<Cards>
+  <Card
+    title="Neon"
+    description="Connect widget · pooled vs direct · cold start."
+    href="/docs/providers/neon"
+  />
+  <Card
+    title="Supabase"
+    description="Connect modes · :6543 vs :5432 · free pause."
+    href="/docs/providers/supabase"
+  />
+  <Card
+    title="CockroachDB"
+    description="Connect dialog · verify-full · CA cert."
+    href="/docs/providers/cockroachdb"
+  />
+  <Card
+    title="YugabyteDB"
+    description="YSQL on :5433 · Connect → Application."
+    href="/docs/providers/yugabytedb"
+  />
+</Cards>
+
+## Redis providers
+
+Managed Redis-wire caches — set `REDIS_URL`, driver stays `redis`.
+
+<Cards>
+  <Card
+    title="Redis Cloud"
+    description="Configuration tab · Connect wizard · rediss://"
+    href="/docs/providers/redis-cloud"
+  />
+  <Card
+    title="Amazon ElastiCache"
+    description="Primary Endpoint · Redis OSS ≤7.1."
+    href="/docs/providers/elasticache"
+  />
+  <Card
+    title="Google Memorystore"
+    description="Primary Endpoint IP · TLS on 6378."
+    href="/docs/providers/memorystore"
+  />
+  <Card
+    title="Azure Cache for Redis"
+    description="Access keys · TLS port 6380."
+    href="/docs/providers/azure-redis"
+  />
+  <Card
+    title="Upstash"
+    description="TCP rediss:// — not REST tokens."
+    href="/docs/providers/upstash"
+  />
+  <Card
+    title="Dragonfly Cloud"
+    description="Data store drawer · Connection URI."
+    href="/docs/providers/dragonfly-cloud"
+  />
+  <Card
+    title="DigitalOcean Managed Caching"
+    description="Connection Details · trusted sources."
+    href="/docs/providers/digitalocean-caching"
+  />
+</Cards>
+
+## Learn more
+
+- [Recipes](/docs/recipes) — self-hosted recipes for the same protocols
+- [Store](/docs/elements/store) — `sql` / `kv` facets
+- [Environment variables](/docs/reference/environment-variables) — URL precedence
+
+## Next
+
+<Cards>
+  <Card
+    title="Neon"
+    description="Start with a serverless SQL option."
+    href="/docs/providers/neon"
+  />
+  <Card title="Recipes" description="Run the same protocols yourself." href="/docs/recipes" />
+  <Card title="Store" description="The facets these drivers back." href="/docs/elements/store" />
+</Cards>

package/site/content/docs/providers/memorystore.mdx

@@ -0,0 +1,89 @@
+---
+title: "Google Cloud Memorystore"
+description: "GCP-managed Redis/Valkey — Instance details Primary Endpoint, AUTH string, TLS on 6378, VPC-only."
+icon: "Zap"
+source: "docs/spec/unified-theory.md"
+---
+
+Memorystore for Redis (and the Valkey offering) is private-IP only inside your VPC.
+`drivers.store.kv` stays `redis`.
+
+<Callout title="The one rule">
+  Open the instance → **Connections** for **Primary Endpoint** + port; **Security** for the AUTH
+  string. There is no public hostname to paste.
+</Callout>
+
+## Find credentials (current console)
+
+1. Google Cloud Console → **Memorystore** → **Redis** (or Valkey) → click **Instance ID**.
+2. **Connections** section → copy **Primary Endpoint** (private IP) and **Port**
+   (usually `6379`).
+3. If AUTH is enabled: **Security** section → **AUTH string** (or
+   `gcloud redis instances get-auth-string INSTANCE --region=REGION`).
+4. If **in-transit encryption** is on: download the **TLS server certificate** from the
+   instance page; clients use port **6378** with that CA (not plain 6379).
+
+```bash title="process env"
+# AUTH on, transit encryption off (common default)
+REDIS_URL=redis://:AUTH_STRING@10.0.0.3:6379
+
+# Transit encryption on → port 6378 + rediss:// + CA configured in the client
+# REDIS_URL=rediss://:AUTH_STRING@10.0.0.3:6378
+```
+
+Cloud Run / Cloud Functions need a **Serverless VPC Access** connector on the same
+network.
+
+## Production guidance
+
+| Topic      | Guidance                                                                         |
+| ---------- | -------------------------------------------------------------------------------- |
+| Networking | Private IP only — never a public endpoint option                                 |
+| AUTH       | Optional but recommended; string is on the instance Security panel               |
+| TLS        | **Not** default — enable in-transit encryption explicitly; port becomes **6378** |
+| Tiers      | Basic vs Standard (replica) — pick before you need HA                            |
+
+## Real gotcha — TLS port flip
+
+Enabling in-transit encryption changes the client port to **6378** and requires the
+server CA. Leaving `REDIS_URL` on `:6379` after enabling TLS looks like a mysterious
+timeout — update port and scheme together.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="Connection refused / timeout from Cloud Run">
+
+Missing Serverless VPC Access connector, or connector on the wrong VPC. Memorystore is
+unreachable from the public internet by design.
+
+</Accordion>
+<Accordion title="NOAUTH Authentication required">
+
+AUTH enabled but password omitted from `REDIS_URL`. Copy the AUTH string from
+**Security** and use `redis://:AUTH@ip:port`.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Redis (image)](/docs/recipes/redis) · [Valkey (image)](/docs/recipes/valkey)
+- [ElastiCache](/docs/providers/elasticache) — AWS equivalent
+- [Store · KV](/docs/elements/store#kv)
+
+## Next
+
+<Cards>
+  <Card title="ElastiCache" description="AWS's equivalent." href="/docs/providers/elasticache" />
+  <Card
+    title="Azure Cache for Redis"
+    description="Azure's equivalent."
+    href="/docs/providers/azure-redis"
+  />
+  <Card
+    title="Dragonfly Cloud"
+    description="Public TLS endpoint option."
+    href="/docs/providers/dragonfly-cloud"
+  />
+</Cards>

package/site/content/docs/providers/meta.json

@@ -0,0 +1,20 @@
+{
+  "title": "Providers",
+  "icon": "Cloud",
+  "pages": [
+    "index",
+    "---SQL providers---",
+    "neon",
+    "supabase",
+    "cockroachdb",
+    "yugabytedb",
+    "---Redis providers---",
+    "redis-cloud",
+    "elasticache",
+    "memorystore",
+    "azure-redis",
+    "upstash",
+    "dragonfly-cloud",
+    "digitalocean-caching"
+  ]
+}

package/site/content/docs/providers/neon.mdx

@@ -0,0 +1,115 @@
+---
+title: "Neon"
+description: "Serverless Postgres — Connect widget, pooled vs direct, scale-to-zero cold start, neon_superuser for pgvector."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+Neon separates storage from compute: branches are cheap copy-on-write metadata, and idle
+compute scales to zero. Wire protocol is plain Postgres — `drivers.store.sql` stays
+`postgres`.
+
+<Callout title="The one rule">
+  Copy the connection string from Neon's **Connect** widget. Prefer the pooled hostname for app
+  traffic and the direct hostname for migrations — never invent the `-pooler` suffix by hand.
+</Callout>
+
+## Find credentials (current console)
+
+1. Open [console.neon.tech](https://console.neon.tech) → your **project**.
+2. On the **Project Dashboard**, click **Connect**.
+3. In **Connect to your database**, pick **Branch**, **Compute**, **Database**, and
+   **Role**.
+4. Toggle **Connection pooling** **on** for the pooled string (hostname gains `-pooler`),
+   or **off** for the direct string.
+5. Copy the connection string into `DATABASE_URL` (add `?sslmode=require` if missing).
+
+```bash title="process env"
+# Runtime (pooled) — ep-….…-pooler.…neon.tech
+DATABASE_URL=postgresql://neondb_owner:…@ep-xxxx-pooler.region.aws.neon.tech/neondb?sslmode=require
+
+# Migrations / pg_dump / LISTEN — same host without -pooler
+# OKE_STORE_SQL_URL=postgresql://neondb_owner:…@ep-xxxx.region.aws.neon.tech/neondb?sslmode=require
+```
+
+No `images["store.sql"]` pin — Neon runs the server.
+
+## Pooled vs direct
+
+| Use                                                           | Which string              | Why                                                      |
+| ------------------------------------------------------------- | ------------------------- | -------------------------------------------------------- |
+| App / serverless / Drizzle runtime                            | **Pooled** (`-pooler`)    | PgBouncer transaction mode; up to 10k client connections |
+| `oke db migrate` / `pg_dump` / logical replication / `LISTEN` | **Direct** (no `-pooler`) | Session features break under transaction pooling         |
+
+Do **not** also put [PgDog](/docs/recipes/pgdog) in front of Neon — one pooler only.
+
+**Consequence:** seeding or migrations through the pooled URL often fail with prepared-statement
+errors; switch those jobs to the direct URL.
+
+## pgvector and roles
+
+`CREATE EXTENSION vector;` works on every plan — no add-on. Roles created in the Neon
+Console / CLI / API get `neon_superuser` membership and can install supported extensions.
+
+Roles you create only with raw SQL (`CREATE ROLE`) do **not** get `neon_superuser` — they
+hit permission errors on extension install. Create app roles in the Console (or grant
+deliberately) when you need `pgvector` setup from that role.
+
+## Free tier / production limits
+
+| Limit         | Free plan                                 |
+| ------------- | ----------------------------------------- |
+| Scale to zero | After **5 min** idle — **cannot disable** |
+| Compute       | **100 CU-hours** / project / month        |
+| Storage       | **0.5 GB** / project                      |
+| Autoscaling   | Up to 2 CU                                |
+
+Hitting CU-hours or storage **suspends compute** until the next billing period or an
+upgrade. Always-on production needs Launch/Scale with scale-to-zero disabled.
+
+## Real gotcha — cold start
+
+After scale-to-zero, the first query pays a wake-up (hundreds of ms to a few seconds).
+Health checks that expect sub-100ms on an idle Free project will flap. Paid plans can
+disable scale-to-zero; Free cannot.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="remaining connection slots are reserved / pooler wait timeout">
+
+Too many **direct** connections, or pooler server pool exhausted for your compute size.
+Move runtime traffic to the `-pooler` hostname; keep a small number of direct admin
+sessions. Neon reserves connections for the superuser account on each compute size.
+
+</Accordion>
+<Accordion title='permission denied to create extension "vector"'>
+
+The role is not a Console-created / `neon_superuser` member. Re-run as `neondb_owner` (or
+another Console role), or grant appropriately — raw SQL roles start with public-schema
+privileges only.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Postgres (image)](/docs/recipes/postgres) — self-hosted peer
+- [Store · Index](/docs/elements/store#index) — `pgvector` usage
+- [PgDog](/docs/recipes/pgdog) — when you self-host pooling instead
+
+## Next
+
+<Cards>
+  <Card
+    title="Supabase"
+    description="Another managed Postgres option."
+    href="/docs/providers/supabase"
+  />
+  <Card
+    title="CockroachDB"
+    description="Distributed SQL alternative."
+    href="/docs/providers/cockroachdb"
+  />
+  <Card title="PgDog" description="Self-hosted pooler comparison." href="/docs/recipes/pgdog" />
+</Cards>

package/site/content/docs/providers/redis-cloud.mdx

@@ -0,0 +1,93 @@
+---
+title: "Redis Cloud"
+description: "Redis Ltd. managed Redis — Configuration tab endpoints, Connect wizard, rediss://, dynamic vs static endpoints."
+icon: "Zap"
+source: "docs/spec/unified-theory.md"
+---
+
+Redis Cloud is Redis Ltd.'s first-party managed service — RESP over TCP/TLS, no separate
+REST layer. `drivers.store.kv` stays `redis`.
+
+<Callout title="The one rule">
+  Use `rediss://` (double **s**) with the endpoint from **Configuration** or the **Connect** wizard.
+  Prefer **dynamic** endpoints when both are offered.
+</Callout>
+
+## Find credentials (current console)
+
+1. Open Redis Cloud → your **database**.
+2. Open the **Configuration** tab:
+   - **Essentials:** endpoint under **Access**
+   - **Pro:** endpoint under **General** (expand **Dynamic endpoints** if shown)
+3. Credentials:
+   - **Essentials:** **Default user → Configure** → eye icon for password (`default`)
+   - **Pro:** **Security** section on Configuration → eye icon for default user password
+4. Or click **Connect** → connection wizard → copy the ready-made client / `redis-cli`
+   snippet (fills host, port, user, password).
+
+```bash title="process env"
+REDIS_URL=rediss://default:PASSWORD@redis-12345.c1.region.cloud.redislabs.com:12345
+# or dynamic: …@horse-battery-staple-12345.db.redis.io:…
+```
+
+Port is a **per-database high port**, not always `6379` — copy it from the panel.
+
+## Production guidance
+
+| Topic         | Guidance                                                                          |
+| ------------- | --------------------------------------------------------------------------------- |
+| TLS           | Public endpoints expect TLS → `rediss://`                                         |
+| Endpoint type | **Dynamic** (`*.db.redis.io`) can be redirected later; static `redis-….c…` cannot |
+| Private       | Pro private endpoint needs VPC peering / PrivateLink / PSC first                  |
+| Modules       | RediSearch / RedisJSON optional — unused by oke's KV driver                       |
+| Port          | Per-database high port from Configuration — never assume `6379`                   |
+
+Essentials vs Pro panels differ (Access vs General), but **Connect** always opens the
+wizard with a filled client snippet — prefer that when the Configuration layout feels
+unfamiliar after a UI refresh.
+
+## Real gotcha — dynamic vs static
+
+Apps hard-coded to a **static** `redis-….c…` host cannot follow a later “redirect
+dynamic endpoint” migration. Copy the **dynamic** endpoint from Configuration when both
+exist so you can repoint without code changes.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="NOAUTH / WRONGPASS">
+
+Password not in the URL, or default user disabled under RBAC. Format:
+`rediss://default:PASSWORD@host:port`. If default user is off, use a data-access role
+username/password from Access Control.
+
+</Accordion>
+<Accordion title="Connection timeout to public endpoint">
+
+Pro databases can block public endpoints. Use the private endpoint after peering, or
+re-enable public access in security settings.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Redis (image)](/docs/recipes/redis) — self-hosted peer
+- [Store · KV](/docs/elements/store#kv) — TTL physics
+- [Upstash](/docs/providers/upstash) — serverless alternative
+
+## Next
+
+<Cards>
+  <Card
+    title="Upstash"
+    description="Serverless-friendly alternative."
+    href="/docs/providers/upstash"
+  />
+  <Card
+    title="ElastiCache"
+    description="AWS-native alternative."
+    href="/docs/providers/elasticache"
+  />
+  <Card title="Neon" description="Managed SQL-side pair." href="/docs/providers/neon" />
+</Cards>

package/site/content/docs/providers/supabase.mdx

@@ -0,0 +1,117 @@
+---
+title: "Supabase"
+description: "Managed Postgres — Connect button modes, transaction :6543 vs direct :5432, IPv6, free-tier pause."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+Supabase wraps Postgres with Auth, Storage, Realtime, and generated APIs. oke only needs
+the Postgres connection underneath — `drivers.store.sql` stays `postgres`.
+
+<Callout title="The one rule">
+  Use the dashboard **Connect** button and pick the mode that matches your runtime — Transaction
+  pooler for serverless, Direct for migrations. Do not guess ports.
+</Callout>
+
+## Find credentials (current dashboard)
+
+1. Open your project in [supabase.com/dashboard](https://supabase.com/dashboard).
+2. Click **Connect** in the project top bar
+   (`?showConnect=true` on the project URL).
+3. Choose a method:
+   - **Transaction pooler** — `aws-[region].pooler.supabase.com:6543` (Supavisor
+     transaction mode)
+   - **Session pooler** — same host, port **5432** (IPv4-friendly persistent clients)
+   - **Direct connection** — `db.[project-ref].supabase.co:5432`
+4. Copy the URI; substitute the database password from **Project Settings → Database**
+   if the string still shows a placeholder.
+
+Alternate path: **Project Settings → Database** → connection string / connection info
+panels (same values as Connect).
+
+```bash title="process env"
+# Serverless / many short-lived clients
+DATABASE_URL=postgres://postgres.[ref]:…@aws-0-[region].pooler.supabase.com:6543/postgres
+
+# Migrations / pg_dump / long session features
+# Direct (IPv6 by default on Free unless IPv4 add-on):
+# DATABASE_URL=postgres://postgres:…@db.[ref].supabase.co:5432/postgres
+```
+
+## Pooled vs direct
+
+| Mode                       | Host:port                   | Best for                                       |
+| -------------------------- | --------------------------- | ---------------------------------------------- |
+| Transaction (Supavisor)    | `…pooler.supabase.com:6543` | Serverless / edge — default app `DATABASE_URL` |
+| Session (Supavisor)        | `…pooler.supabase.com:5432` | Persistent backends on **IPv4-only** networks  |
+| Direct                     | `db.[ref].supabase.co:5432` | Migrations, `pg_dump`, replication             |
+| Dedicated PgBouncer (paid) | `db.[ref].supabase.co:6543` | High-performance pooled traffic on paid tiers  |
+
+**Do not stack** [PgDog](/docs/recipes/pgdog) on top of Supavisor. Transaction mode does
+not support prepared statements — turn them off in the client if you see related errors.
+
+**IPv6 gotcha:** Direct (and dedicated pooler) are IPv6 unless you buy the IPv4 add-on.
+IPv4-only app hosts must use the shared pooler hostnames.
+
+## pgvector
+
+Available on every plan. Enable from the dashboard **Database → Extensions** (or
+`CREATE EXTENSION vector;`). Same `store.index` + `pgvector` driver path as self-hosted
+Postgres.
+
+## Free tier — breaks real production
+
+| Limit                      | Free                                                   |
+| -------------------------- | ------------------------------------------------------ |
+| Inactivity pause           | **7 days** without enough DB activity → project paused |
+| Active projects            | **2**                                                  |
+| DB size                    | **500 MB**                                             |
+| Restore window after pause | Finite (platform retention)                            |
+
+Paused projects wake slowly and will fail uptime checks. Paid plans do not auto-pause.
+Do not run user-facing production on Free.
+
+## Real gotcha — Connect port mix-ups
+
+Since Feb 2025, **6543 is transaction-only** on the shared pooler; session mode is
+**5432** on the pooler host. An old snippet that assumed “6543 = session” will break
+session features or auth in subtle ways — re-copy from **Connect** today.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="Connection refused / timeout to db.[ref].supabase.co">
+
+Often IPv4 client → IPv6-only direct endpoint. Switch `DATABASE_URL` to the **Session**
+or **Transaction** pooler host (`pooler.supabase.com`), or enable the IPv4 add-on.
+
+</Accordion>
+<Accordion title="Project paused after a quiet week">
+
+Free-tier inactivity pause. Restore from the dashboard, then upgrade or keep real DB
+traffic above the pause threshold. Dashboard page views alone may not count.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Supabase recipe](/docs/recipes/supabase-docker) — Postgres image only, no platform
+- [Store · Index](/docs/elements/store#index) — `pgvector`
+- [Environment variables](/docs/reference/environment-variables) — `DATABASE_URL`
+
+## Next
+
+<Cards>
+  <Card
+    title="Supabase (image)"
+    description="Run just the Postgres image."
+    href="/docs/recipes/supabase-docker"
+  />
+  <Card title="Neon" description="Serverless alternative." href="/docs/providers/neon" />
+  <Card
+    title="YugabyteDB"
+    description="Distributed Apache-2.0 option."
+    href="/docs/providers/yugabytedb"
+  />
+</Cards>

package/site/content/docs/providers/upstash.mdx

@@ -0,0 +1,91 @@
+---
+title: "Upstash"
+description: "Serverless Redis — Details tab TCP endpoint vs REST URL/token; oke needs rediss:// only."
+icon: "Zap"
+source: "docs/spec/unified-theory.md"
+---
+
+Upstash exposes the **same database** two ways: Redis protocol over TLS (TCP) and a
+separate HTTP REST API. oke's `redis` driver speaks **TCP only**.
+
+<Callout title="The one rule">
+  From the database **Details** / **Connect** panel, copy the **Redis** / TCP connection
+  (`rediss://…`), never `UPSTASH_REDIS_REST_URL` / `UPSTASH_REDIS_REST_TOKEN`.
+</Callout>
+
+## Find credentials (current console)
+
+1. Open [console.upstash.com](https://console.upstash.com) → **Redis** → your database.
+2. On the database page (**Details**):
+   - **Endpoint**, **Port**, **Password** (token) for TCP clients
+   - Ready-made `redis-cli` / `rediss://` snippets under **Connect** / **Redis**
+3. Ignore the **REST** tab values (`UPSTASH_REDIS_REST_URL`,
+   `UPSTASH_REDIS_REST_TOKEN`) for oke — those are for `@upstash/redis` / HTTP only.
+
+```bash title="process env"
+REDIS_URL=rediss://default:PASSWORD@usw1-example-12345.upstash.io:6379
+```
+
+TLS is mandatory — `redis://` without TLS fails.
+
+## Production guidance
+
+| Topic       | Guidance                                                                    |
+| ----------- | --------------------------------------------------------------------------- |
+| Transport   | TCP `rediss://` for Bun / long-running servers                              |
+| REST        | Edge/serverless SDKs only — **not** wired to `fx.store`                     |
+| Pricing     | Per-request — watch command fan-out in hot KV paths                         |
+| Eviction    | Plan max size / eviction; serverless still has quotas                       |
+| Consistency | Global replication options are product-specific — confirm region in Details |
+
+Do not put [PgDog](/docs/recipes/pgdog)-style thinking on Redis: there is no separate
+“pooled hostname” toggle. Connection count pressure shows up as Upstash plan limits /
+timeouts, not a Neon-style `-pooler` suffix.
+
+When debugging, open **Details** and confirm you are reading the **Redis** column, not
+the REST env var block that sits beside it on the same page.
+
+## Real gotcha — REST token ≠ Redis password
+
+Using `UPSTASH_REDIS_REST_TOKEN` inside a `rediss://` URL (or the reverse) yields
+`WRONGPASS` / `NOAUTH`. REST token and TCP password are different credentials on the
+same console page — copy from the **Redis/TCP** section.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="WRONGPASS invalid or missing auth token">
+
+Often a REST token pasted into a TCP client. Re-copy **Password** from Details for
+Redis protocol, build `rediss://:PASSWORD@ENDPOINT:PORT`.
+
+</Accordion>
+<Accordion title="NOAUTH Authentication required">
+
+Password missing from the URL. ioredis-style URLs need the colon before the password:
+`rediss://:PASSWORD@host:port`.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Redis (image)](/docs/recipes/redis)
+- [Redis Cloud](/docs/providers/redis-cloud) — fixed-instance alternative
+- [Store · KV](/docs/elements/store#kv)
+
+## Next
+
+<Cards>
+  <Card
+    title="Redis Cloud"
+    description="Fixed-instance alternative."
+    href="/docs/providers/redis-cloud"
+  />
+  <Card
+    title="Dragonfly Cloud"
+    description="Another managed option."
+    href="/docs/providers/dragonfly-cloud"
+  />
+  <Card title="Neon" description="Managed SQL-side pair." href="/docs/providers/neon" />
+</Cards>