okengine 0.9.1 → 0.10.0

package/site/content/docs/providers/redis-cloud.mdx

@@ -0,0 +1,93 @@
+---
+title: "Redis Cloud"
+description: "Redis Ltd. managed Redis — Configuration tab endpoints, Connect wizard, rediss://, dynamic vs static endpoints."
+icon: "Zap"
+source: "docs/spec/unified-theory.md"
+---
+
+Redis Cloud is Redis Ltd.'s first-party managed service — RESP over TCP/TLS, no separate
+REST layer. `drivers.store.kv` stays `redis`.
+
+<Callout title="The one rule">
+  Use `rediss://` (double **s**) with the endpoint from **Configuration** or the **Connect** wizard.
+  Prefer **dynamic** endpoints when both are offered.
+</Callout>
+
+## Find credentials (current console)
+
+1. Open Redis Cloud → your **database**.
+2. Open the **Configuration** tab:
+   - **Essentials:** endpoint under **Access**
+   - **Pro:** endpoint under **General** (expand **Dynamic endpoints** if shown)
+3. Credentials:
+   - **Essentials:** **Default user → Configure** → eye icon for password (`default`)
+   - **Pro:** **Security** section on Configuration → eye icon for default user password
+4. Or click **Connect** → connection wizard → copy the ready-made client / `redis-cli`
+   snippet (fills host, port, user, password).
+
+```bash title="process env"
+REDIS_URL=rediss://default:PASSWORD@redis-12345.c1.region.cloud.redislabs.com:12345
+# or dynamic: …@horse-battery-staple-12345.db.redis.io:…
+```
+
+Port is a **per-database high port**, not always `6379` — copy it from the panel.
+
+## Production guidance
+
+| Topic         | Guidance                                                                          |
+| ------------- | --------------------------------------------------------------------------------- |
+| TLS           | Public endpoints expect TLS → `rediss://`                                         |
+| Endpoint type | **Dynamic** (`*.db.redis.io`) can be redirected later; static `redis-….c…` cannot |
+| Private       | Pro private endpoint needs VPC peering / PrivateLink / PSC first                  |
+| Modules       | RediSearch / RedisJSON optional — unused by oke's KV driver                       |
+| Port          | Per-database high port from Configuration — never assume `6379`                   |
+
+Essentials vs Pro panels differ (Access vs General), but **Connect** always opens the
+wizard with a filled client snippet — prefer that when the Configuration layout feels
+unfamiliar after a UI refresh.
+
+## Real gotcha — dynamic vs static
+
+Apps hard-coded to a **static** `redis-….c…` host cannot follow a later “redirect
+dynamic endpoint” migration. Copy the **dynamic** endpoint from Configuration when both
+exist so you can repoint without code changes.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="NOAUTH / WRONGPASS">
+
+Password not in the URL, or default user disabled under RBAC. Format:
+`rediss://default:PASSWORD@host:port`. If default user is off, use a data-access role
+username/password from Access Control.
+
+</Accordion>
+<Accordion title="Connection timeout to public endpoint">
+
+Pro databases can block public endpoints. Use the private endpoint after peering, or
+re-enable public access in security settings.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Redis (image)](/docs/recipes/redis) — self-hosted peer
+- [Store · KV](/docs/elements/store#kv) — TTL physics
+- [Upstash](/docs/providers/upstash) — serverless alternative
+
+## Next
+
+<Cards>
+  <Card
+    title="Upstash"
+    description="Serverless-friendly alternative."
+    href="/docs/providers/upstash"
+  />
+  <Card
+    title="ElastiCache"
+    description="AWS-native alternative."
+    href="/docs/providers/elasticache"
+  />
+  <Card title="Neon" description="Managed SQL-side pair." href="/docs/providers/neon" />
+</Cards>

package/site/content/docs/providers/supabase.mdx

@@ -0,0 +1,117 @@
+---
+title: "Supabase"
+description: "Managed Postgres — Connect button modes, transaction :6543 vs direct :5432, IPv6, free-tier pause."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+Supabase wraps Postgres with Auth, Storage, Realtime, and generated APIs. oke only needs
+the Postgres connection underneath — `drivers.store.sql` stays `postgres`.
+
+<Callout title="The one rule">
+  Use the dashboard **Connect** button and pick the mode that matches your runtime — Transaction
+  pooler for serverless, Direct for migrations. Do not guess ports.
+</Callout>
+
+## Find credentials (current dashboard)
+
+1. Open your project in [supabase.com/dashboard](https://supabase.com/dashboard).
+2. Click **Connect** in the project top bar
+   (`?showConnect=true` on the project URL).
+3. Choose a method:
+   - **Transaction pooler** — `aws-[region].pooler.supabase.com:6543` (Supavisor
+     transaction mode)
+   - **Session pooler** — same host, port **5432** (IPv4-friendly persistent clients)
+   - **Direct connection** — `db.[project-ref].supabase.co:5432`
+4. Copy the URI; substitute the database password from **Project Settings → Database**
+   if the string still shows a placeholder.
+
+Alternate path: **Project Settings → Database** → connection string / connection info
+panels (same values as Connect).
+
+```bash title="process env"
+# Serverless / many short-lived clients
+DATABASE_URL=postgres://postgres.[ref]:…@aws-0-[region].pooler.supabase.com:6543/postgres
+
+# Migrations / pg_dump / long session features
+# Direct (IPv6 by default on Free unless IPv4 add-on):
+# DATABASE_URL=postgres://postgres:…@db.[ref].supabase.co:5432/postgres
+```
+
+## Pooled vs direct
+
+| Mode                       | Host:port                   | Best for                                       |
+| -------------------------- | --------------------------- | ---------------------------------------------- |
+| Transaction (Supavisor)    | `…pooler.supabase.com:6543` | Serverless / edge — default app `DATABASE_URL` |
+| Session (Supavisor)        | `…pooler.supabase.com:5432` | Persistent backends on **IPv4-only** networks  |
+| Direct                     | `db.[ref].supabase.co:5432` | Migrations, `pg_dump`, replication             |
+| Dedicated PgBouncer (paid) | `db.[ref].supabase.co:6543` | High-performance pooled traffic on paid tiers  |
+
+**Do not stack** [PgDog](/docs/recipes/pgdog) on top of Supavisor. Transaction mode does
+not support prepared statements — turn them off in the client if you see related errors.
+
+**IPv6 gotcha:** Direct (and dedicated pooler) are IPv6 unless you buy the IPv4 add-on.
+IPv4-only app hosts must use the shared pooler hostnames.
+
+## pgvector
+
+Available on every plan. Enable from the dashboard **Database → Extensions** (or
+`CREATE EXTENSION vector;`). Same `store.index` + `pgvector` driver path as self-hosted
+Postgres.
+
+## Free tier — breaks real production
+
+| Limit                      | Free                                                   |
+| -------------------------- | ------------------------------------------------------ |
+| Inactivity pause           | **7 days** without enough DB activity → project paused |
+| Active projects            | **2**                                                  |
+| DB size                    | **500 MB**                                             |
+| Restore window after pause | Finite (platform retention)                            |
+
+Paused projects wake slowly and will fail uptime checks. Paid plans do not auto-pause.
+Do not run user-facing production on Free.
+
+## Real gotcha — Connect port mix-ups
+
+Since Feb 2025, **6543 is transaction-only** on the shared pooler; session mode is
+**5432** on the pooler host. An old snippet that assumed “6543 = session” will break
+session features or auth in subtle ways — re-copy from **Connect** today.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="Connection refused / timeout to db.[ref].supabase.co">
+
+Often IPv4 client → IPv6-only direct endpoint. Switch `DATABASE_URL` to the **Session**
+or **Transaction** pooler host (`pooler.supabase.com`), or enable the IPv4 add-on.
+
+</Accordion>
+<Accordion title="Project paused after a quiet week">
+
+Free-tier inactivity pause. Restore from the dashboard, then upgrade or keep real DB
+traffic above the pause threshold. Dashboard page views alone may not count.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Supabase recipe](/docs/recipes/supabase-docker) — Postgres image only, no platform
+- [Store · Index](/docs/elements/store#index) — `pgvector`
+- [Environment variables](/docs/reference/environment-variables) — `DATABASE_URL`
+
+## Next
+
+<Cards>
+  <Card
+    title="Supabase (image)"
+    description="Run just the Postgres image."
+    href="/docs/recipes/supabase-docker"
+  />
+  <Card title="Neon" description="Serverless alternative." href="/docs/providers/neon" />
+  <Card
+    title="YugabyteDB"
+    description="Distributed Apache-2.0 option."
+    href="/docs/providers/yugabytedb"
+  />
+</Cards>

package/site/content/docs/providers/upstash.mdx

@@ -0,0 +1,91 @@
+---
+title: "Upstash"
+description: "Serverless Redis — Details tab TCP endpoint vs REST URL/token; oke needs rediss:// only."
+icon: "Zap"
+source: "docs/spec/unified-theory.md"
+---
+
+Upstash exposes the **same database** two ways: Redis protocol over TLS (TCP) and a
+separate HTTP REST API. oke's `redis` driver speaks **TCP only**.
+
+<Callout title="The one rule">
+  From the database **Details** / **Connect** panel, copy the **Redis** / TCP connection
+  (`rediss://…`), never `UPSTASH_REDIS_REST_URL` / `UPSTASH_REDIS_REST_TOKEN`.
+</Callout>
+
+## Find credentials (current console)
+
+1. Open [console.upstash.com](https://console.upstash.com) → **Redis** → your database.
+2. On the database page (**Details**):
+   - **Endpoint**, **Port**, **Password** (token) for TCP clients
+   - Ready-made `redis-cli` / `rediss://` snippets under **Connect** / **Redis**
+3. Ignore the **REST** tab values (`UPSTASH_REDIS_REST_URL`,
+   `UPSTASH_REDIS_REST_TOKEN`) for oke — those are for `@upstash/redis` / HTTP only.
+
+```bash title="process env"
+REDIS_URL=rediss://default:PASSWORD@usw1-example-12345.upstash.io:6379
+```
+
+TLS is mandatory — `redis://` without TLS fails.
+
+## Production guidance
+
+| Topic       | Guidance                                                                    |
+| ----------- | --------------------------------------------------------------------------- |
+| Transport   | TCP `rediss://` for Bun / long-running servers                              |
+| REST        | Edge/serverless SDKs only — **not** wired to `fx.store`                     |
+| Pricing     | Per-request — watch command fan-out in hot KV paths                         |
+| Eviction    | Plan max size / eviction; serverless still has quotas                       |
+| Consistency | Global replication options are product-specific — confirm region in Details |
+
+Do not put [PgDog](/docs/recipes/pgdog)-style thinking on Redis: there is no separate
+“pooled hostname” toggle. Connection count pressure shows up as Upstash plan limits /
+timeouts, not a Neon-style `-pooler` suffix.
+
+When debugging, open **Details** and confirm you are reading the **Redis** column, not
+the REST env var block that sits beside it on the same page.
+
+## Real gotcha — REST token ≠ Redis password
+
+Using `UPSTASH_REDIS_REST_TOKEN` inside a `rediss://` URL (or the reverse) yields
+`WRONGPASS` / `NOAUTH`. REST token and TCP password are different credentials on the
+same console page — copy from the **Redis/TCP** section.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="WRONGPASS invalid or missing auth token">
+
+Often a REST token pasted into a TCP client. Re-copy **Password** from Details for
+Redis protocol, build `rediss://:PASSWORD@ENDPOINT:PORT`.
+
+</Accordion>
+<Accordion title="NOAUTH Authentication required">
+
+Password missing from the URL. ioredis-style URLs need the colon before the password:
+`rediss://:PASSWORD@host:port`.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Redis (image)](/docs/recipes/redis)
+- [Redis Cloud](/docs/providers/redis-cloud) — fixed-instance alternative
+- [Store · KV](/docs/elements/store#kv)
+
+## Next
+
+<Cards>
+  <Card
+    title="Redis Cloud"
+    description="Fixed-instance alternative."
+    href="/docs/providers/redis-cloud"
+  />
+  <Card
+    title="Dragonfly Cloud"
+    description="Another managed option."
+    href="/docs/providers/dragonfly-cloud"
+  />
+  <Card title="Neon" description="Managed SQL-side pair." href="/docs/providers/neon" />
+</Cards>

package/site/content/docs/providers/yugabytedb.mdx

@@ -0,0 +1,95 @@
+---
+title: "YugabyteDB"
+description: "Distributed SQL (YSQL) — Connect → Application, port 5433, CA cert, YSQL vs YCQL."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+YugabyteDB Aeon exposes a Postgres-compatible query layer (**YSQL**). That is the only
+API oke's `postgres` driver targets — not YCQL.
+
+<Callout title="The one rule">
+  In **Connect → Connect to your Application**, choose **YSQL** and download the CA cert. Port
+  **5433** is the YSQL default — not Postgres's 5432.
+</Callout>
+
+## Find credentials (current console)
+
+1. YugabyteDB Aeon → **Clusters** → select the cluster.
+2. Click **Connect**.
+3. Click **Connect to your Application**.
+4. Click **Download CA Cert** and install it where the app can read it.
+5. Select API **YSQL** (not YCQL).
+6. Pick address mode: **Private Address** / **Private Service Endpoint** if VPC-peered;
+   **Public Address** only if **Settings → Network Access → Public Access** is enabled
+   (not recommended for production).
+7. Copy **Connection String** (or Parameters) into `DATABASE_URL`.
+
+```bash title="process env"
+DATABASE_URL=postgresql://admin:…@….aws.yugabyte.cloud:5433/yugabyte?ssl=true&sslmode=verify-full&sslrootcert=/path/to/root.crt
+```
+
+Also add your app's IPs (or peered VPC) to the cluster **IP allow list** before
+connecting.
+
+## Production guidance
+
+| Topic   | Guidance                                                                      |
+| ------- | ----------------------------------------------------------------------------- |
+| API     | **YSQL only** — YCQL is Cassandra-wire, useless to `postgres`                 |
+| TLS     | `sslmode=verify-full` + downloaded CA                                         |
+| Network | Prefer private / PSE; public access is an explicit opt-in                     |
+| License | Core is **Apache 2.0** (including once-enterprise features in the core build) |
+
+No Neon-style pooled hostname toggle — connection limits and load balancing are
+cluster/VPC topology concerns. Smart drivers want a peered VPC; otherwise they probe
+unreachable nodes first and add latency.
+
+## Real gotcha — wrong API tab
+
+Copying **YCQL** parameters (port **9042**) into `DATABASE_URL` fails immediately —
+different protocol. Always confirm the Connect dialog shows **YSQL** and port **5433**.
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="Connection timed out / could not connect to server">
+
+IP allow list or Public Access. Add the client IP under network settings, or use the
+private address from a peered VPC. Public hostname stays dark until Public Access is on.
+
+</Accordion>
+<Accordion title="SSL error with verify-full">
+
+CA not downloaded or `sslrootcert` path wrong. Re-run **Download CA Cert** from the
+Connect dialog and point the URI at that file.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [CockroachDB](/docs/providers/cockroachdb) — license / feature comparison
+- [YugabyteDB (self-hosted)](/docs/recipes/yugabytedb) — single-node Docker recipe
+- [Postgres (image)](/docs/recipes/postgres) — driver this backs
+- [Store · SQL](/docs/elements/store#sql) — schema workflows
+
+## Next
+
+<Cards>
+  <Card
+    title="CockroachDB"
+    description="Compare licensing and features."
+    href="/docs/providers/cockroachdb"
+  />
+  <Card
+    title="Supabase"
+    description="Managed single-node option."
+    href="/docs/providers/supabase"
+  />
+  <Card
+    title="Redis Cloud"
+    description="Managed Redis-side pair."
+    href="/docs/providers/redis-cloud"
+  />
+</Cards>

package/site/content/docs/recipes/caddy.mdx

@@ -0,0 +1,128 @@
+---
+title: "Caddy"
+description: "Automatic-HTTPS reverse proxy — OKE_PROXY_HOST, Caddyfile, /data certificate volume, single-instance compose."
+icon: "Lock"
+source: "docs/spec/unified-theory.md"
+---
+
+Caddy is the simplest TLS path — automatic HTTPS from a generated `Caddyfile`, no
+certificate management by hand. Right choice for a single app instance without `--scale`.
+
+<Callout title="The one rule">
+  Leave `images.proxy` unset until you need HTTPS at the edge or `--scale app=N`. Once set, `app`
+  stops publishing its host port directly — Caddy (or Traefik) does.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin the proxy
+
+```typescript title="oke.config.ts"
+images: {
+  proxy: "caddy:2-alpine",
+},
+```
+
+</Step>
+
+<Step>
+### Set the public hostname
+
+```bash title="docker/.env.docker"
+OKE_PROXY_HOST=app.example.com
+```
+
+Unset defaults to `localhost` — Caddy issues a **local** TLS cert instead of Let's Encrypt.
+
+</Step>
+
+<Step>
+### Include the proxy layer
+
+```bash
+docker compose -f compose.yml -f compose.proxy.yml … up -d
+```
+
+Generated `Caddyfile`: `{$OKE_PROXY_HOST:localhost} { reverse_proxy app:6530 }`.
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable                | Required?   | Meaning                                                                     |
+| ----------------------- | ----------- | --------------------------------------------------------------------------- |
+| `OKE_PROXY_HOST`        | Recommended | Public hostname for ACME; default `localhost` → local TLS only              |
+| `allowedHosts` (config) | Production  | Must include the public hostname — see [Security](/docs/reference/security) |
+
+Caddy has no separate ACME email env in this recipe (unlike Traefik's
+`OKE_PROXY_ACME_EMAIL`).
+
+## Data and backup
+
+| Volume         | Path                                      | What it stores                  |
+| -------------- | ----------------------------------------- | ------------------------------- |
+| `proxy-data`   | `/data`                                   | ACME certificates, account keys |
+| `proxy-config` | `/config`                                 | Caddy runtime config            |
+| Bind mount     | `./Caddyfile` → `/etc/caddy/Caddyfile:ro` | Generated site block            |
+
+**Backup means:** preserve the `proxy-data` named volume (and ideally `proxy-config`) so
+Let's Encrypt rate limits and cert renewals survive recreates. Losing `/data` forces
+re-issuance. The `Caddyfile` is regenerated by `oke docker`.
+
+## Production note
+
+Caddy has **no** service-discovery story for multiple `app` replicas. Once you run
+`docker compose up --scale app=N`, switch to [Traefik](/docs/recipes/traefik) — it
+discovers replicas from Docker labels instead of a static `reverse_proxy` target.
+
+Also set `allowedHosts` to your public hostname before exposing the edge — see
+[Reverse proxy](/docs/deployment/reverse-proxy).
+
+## What the recipe configures
+
+| Field          | Value                                        |
+| -------------- | -------------------------------------------- |
+| Ports          | `80` + `443` published; `app` stays internal |
+| Healthcheck    | `caddy version`, every 10s, 5 retries        |
+| Connection URL | `https://<host>`                             |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="ACME fails — connection refused / challenge timeout">
+
+`OKE_PROXY_HOST` must be a DNS name that resolves to this host on ports 80/443. Localhost
+never gets a public Let's Encrypt cert — that path uses Caddy's local CA. Check firewall
+and that nothing else binds `:80`.
+
+</Accordion>
+<Accordion title="Browser trust errors on localhost">
+
+Expected with the local CA. Install Caddy's local root for that machine, or set a real
+`OKE_PROXY_HOST` with public DNS when you need a public cert.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Reverse proxy](/docs/deployment/reverse-proxy) — Caddy vs Traefik rationale
+- [Docker · Reverse proxy](/docs/deployment/docker#reverse-proxy) — compose layer order
+- [Security](/docs/reference/security) — `allowedHosts`
+
+## Next
+
+<Cards>
+  <Card title="Traefik" description="Multi-replica alternative." href="/docs/recipes/traefik" />
+  <Card
+    title="PgDog"
+    description="Pool Postgres behind the same stack."
+    href="/docs/recipes/pgdog"
+  />
+  <Card title="Redis" description="The default store.kv image." href="/docs/recipes/redis" />
+</Cards>

package/site/content/docs/recipes/cockroachdb.mdx

@@ -0,0 +1,127 @@
+---
+title: "CockroachDB"
+description: "Self-hosted single-node Cockroach — COCKROACH_* env, port 26257, DB Console on :8080, driver stays postgres."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+CockroachDB speaks Postgres wire closely enough that `drivers.store.sql` stays
+`postgres`. Pin `cockroachdb/cockroach` as `store.sql` and `oke docker` derives a
+single-node compose service — credentials, healthcheck, and `DATABASE_URL`.
+
+<Callout title="The one rule">
+  The driver id stays `postgres` — vendor choice lives in `images["store.sql"]`, not in
+  `drivers.store.sql`. Host maps `:5432` → container `:26257` so local apps keep the usual Postgres
+  port.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin the image
+
+```typescript title="oke.config.ts"
+images: {
+  "store.sql": "cockroachdb/cockroach:v25.2.0", // pin a real tag
+},
+```
+
+</Step>
+
+<Step>
+### Bring the stack up
+
+```bash
+oke dev --docker
+```
+
+`oke docker` injects `COCKROACH_USER` / `COCKROACH_PASSWORD` / `COCKROACH_DATABASE`
+from `OKE_STORE_SQL_*`, starts `start-single-node --accept-sql-without-tls`, and
+publishes SQL on host `:5432` plus the DB Console on `:8080`.
+
+</Step>
+
+<Step>
+### Connect
+
+```bash
+echo "$DATABASE_URL"
+# postgres://oke:…@127.0.0.1:5432/oke?sslmode=require
+```
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable                 | Who sets it            | Meaning                              |
+| ------------------------ | ---------------------- | ------------------------------------ |
+| `OKE_STORE_SQL_USER`     | `oke docker` → compose | → `COCKROACH_USER` (first boot only) |
+| `OKE_STORE_SQL_PASSWORD` | `oke docker` → compose | → `COCKROACH_PASSWORD`               |
+| `OKE_STORE_SQL_DB`       | `oke docker` → compose | → `COCKROACH_DATABASE`               |
+| `DATABASE_URL`           | stack env for the app  | Includes `sslmode=require`           |
+
+## Data and backup
+
+| Path                        | What lives there                              |
+| --------------------------- | --------------------------------------------- |
+| `/cockroach/cockroach-data` | Named volume `store-sql-data` — cluster store |
+
+**Backup means:** volume backup of `store-sql-data`, or Cockroach's backup tooling
+against a running node. Losing that volume loses the cluster.
+
+## Production note
+
+This recipe is a **single-node** cluster — fine for local and small self-hosted apps,
+not multi-region HA. For managed multi-region, use the
+[CockroachDB provider](/docs/providers/cockroachdb). Prefer a pinned tag, not `latest`.
+
+## What the recipe configures
+
+| Field          | Value                                        |
+| -------------- | -------------------------------------------- |
+| Container port | `26257` (host publishes `5432`)              |
+| Extra port     | `8080` — DB Console                          |
+| Command        | `start-single-node --accept-sql-without-tls` |
+| Healthcheck    | `GET /health?ready=1` on `:8080`             |
+| Connection URL | `postgres://…?sslmode=require`               |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="oke boot: postgres driver needs DATABASE_URL">
+
+Re-run `oke dev --docker` so the stack writes `docker/.env.docker`, or export
+`DATABASE_URL` yourself when pointing at a remote Cockroach host.
+
+</Accordion>
+<Accordion title="store-sql unhealthy / healthcheck never ready">
+
+First boot can take longer than Postgres. Check
+`docker compose … logs store-sql` for SQL ready. Empty `${OKE_STORE_SQL_PASSWORD}`
+in `.env.docker` leaves the init user broken — regenerate the stack env.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [CockroachDB (provider)](/docs/providers/cockroachdb) — managed Cloud Connect flow
+- [YugabyteDB](/docs/recipes/yugabytedb) — Apache-2.0 self-hosted alternative
+- [Postgres](/docs/recipes/postgres) — default SQL recipe
+- [Store · SQL](/docs/elements/store#sql) — schema push / generate / migrate
+
+## Next
+
+<Cards>
+  <Card
+    title="CockroachDB Cloud"
+    description="Managed multi-region alternative."
+    href="/docs/providers/cockroachdb"
+  />
+  <Card title="YugabyteDB" description="Self-hosted YSQL peer." href="/docs/recipes/yugabytedb" />
+  <Card title="Postgres" description="The default store.sql image." href="/docs/recipes/postgres" />
+</Cards>