okengine 0.9.1 → 0.10.0

package/site/content/docs/recipes/postgres.mdx

@@ -0,0 +1,136 @@
+---
+title: "Postgres"
+description: "Default store.sql image — POSTGRES_* env, PGDATA path, and when DATABASE_URL points at PgDog instead."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+Postgres is the default `store.sql` image in docker and prod. `oke docker` matches
+any image whose reference contains `postgres` or `pgvector` (after more specific
+recipes), then derives env, healthcheck, and connection URL.
+
+<Callout title="The one rule">
+  The driver id stays `postgres` no matter which Postgres-wire image you pin — vendor choice lives
+  in `images["store.sql"]`, not in `drivers.store.sql`.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin the image
+
+```typescript title="oke.config.ts"
+images: {
+  "store.sql": "postgres:18-alpine", // any Postgres / pgvector image
+},
+```
+
+</Step>
+
+<Step>
+### Bring the stack up
+
+```bash
+oke dev --docker
+```
+
+`oke docker` writes `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` into
+`docker/.env.docker` as `${OKE_STORE_SQL_USER}` / `${OKE_STORE_SQL_PASSWORD}` /
+`${OKE_STORE_SQL_DB}` refs — never literal secrets in compose YAML.
+
+</Step>
+
+<Step>
+### Connect
+
+```bash
+# App reads this (also accepts OKE_STORE_SQL_URL)
+echo "$DATABASE_URL"
+# postgres://oke:…@127.0.0.1:5432/oke
+```
+
+When PgDog is pinned, `DATABASE_URL` points at `:6432` instead — see
+[PgDog](/docs/recipes/pgdog).
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable                 | Who sets it            | Meaning                              |
+| ------------------------ | ---------------------- | ------------------------------------ |
+| `OKE_STORE_SQL_USER`     | `oke docker` → compose | Injected as `POSTGRES_USER`          |
+| `OKE_STORE_SQL_PASSWORD` | `oke docker` → compose | Injected as `POSTGRES_PASSWORD`      |
+| `OKE_STORE_SQL_DB`       | `oke docker` → compose | Injected as `POSTGRES_DB`            |
+| `DATABASE_URL`           | stack env for the app  | What Bun.SQL / Drizzle actually open |
+| `PGDATA`                 | stack default          | `/var/lib/postgresql/data/pgdata`    |
+| `POSTGRES_INITDB_ARGS`   | stack default          | `--data-checksums`                   |
+
+## Data and backup
+
+| Path                                          | What lives there                                     |
+| --------------------------------------------- | ---------------------------------------------------- |
+| `$PGDATA` (`/var/lib/postgresql/data/pgdata`) | Cluster data directory                               |
+| Image `VOLUME` `/var/lib/postgresql/data`     | Official image mount — Docker attaches a volume here |
+
+The recipe does **not** declare a named compose volume. Persistence rides the image's
+`VOLUME` (anonymous unless you add a named mount in `compose.override.yml`).
+
+**Backup means:** `pg_dump` / `pg_dumpall`, or a Docker volume backup of
+`/var/lib/postgresql/data`. Losing that volume loses the cluster.
+
+## Production note
+
+For multi-replica apps, keep SQL on a shared Postgres — Clock CronStore and durable
+journal need one backend. See [Clock](/docs/elements/clock#what-the-runtime-guarantees) ·
+[Docker](/docs/deployment/docker#share-backing-services).
+
+Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exhaust
+`max_connections`. Do not also stack a managed provider's pooler on the same URL.
+
+## What the recipe configures
+
+| Field          | Value                                                |
+| -------------- | ---------------------------------------------------- |
+| Container port | `5432`                                               |
+| Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries |
+| Connection URL | `postgres://user:pass@host:5432/db`                  |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="oke boot: postgres driver needs DATABASE_URL">
+
+The `postgres` driver fails boot when neither `DATABASE_URL` nor `OKE_STORE_SQL_URL` is
+set. Re-run `oke dev --docker` so the stack writes `docker/.env.docker`, or export
+`DATABASE_URL` yourself when pointing at a managed host.
+
+</Accordion>
+<Accordion title="pg_isready fails / store-sql unhealthy">
+
+Wrong `POSTGRES_USER` or the container is still initializing. Check
+`docker compose … logs store-sql` for `database system is ready to accept connections`.
+
+Credential refs must resolve in `.env.docker` — empty `${OKE_STORE_SQL_PASSWORD}` leaves
+Postgres refusing auth.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [PgDog](/docs/recipes/pgdog) — transaction pooling in front of this recipe
+- [Store · SQL](/docs/elements/store#sql) — schema push / generate / migrate
+- [Environment variables](/docs/reference/environment-variables) — `DATABASE_URL` precedence
+- [Neon](/docs/providers/neon) · [Supabase](/docs/providers/supabase) — managed alternatives
+
+## Next
+
+<Cards>
+  <Card title="PgDog" description="Add pooling in front of Postgres." href="/docs/recipes/pgdog" />
+  <Card title="Neon" description="A managed alternative." href="/docs/providers/neon" />
+  <Card title="Redis" description="The default store.kv image." href="/docs/recipes/redis" />
+</Cards>

package/site/content/docs/recipes/redis.mdx

@@ -0,0 +1,130 @@
+---
+title: "Redis"
+description: "Default store.kv image — OKE_STORE_KV_PASSWORD, maxmemory policy, ephemeral data, REDIS_URL."
+icon: "Zap"
+source: "docs/spec/unified-theory.md"
+---
+
+Redis is the default `store.kv` image in docker and prod. `oke docker` matches image
+references containing `redis` or `keydb` and derives a password-required server — no
+unauthenticated instance.
+
+<Callout title="The one rule">
+  The driver id stays `redis` for every Redis-wire image — Redis, Valkey, Dragonfly, or a managed
+  provider. Vendor choice lives in `images["store.kv"]`, never in `drivers.store.kv`.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin the image
+
+```typescript title="oke.config.ts"
+images: {
+  "store.kv": "redis:8-alpine",
+},
+```
+
+</Step>
+
+<Step>
+### Required password
+
+```bash title="docker/.env.docker (written by oke docker)"
+OKE_STORE_KV_PASSWORD=…
+REDIS_URL=redis://:…@127.0.0.1:6379
+```
+
+The recipe runs:
+
+`redis-server --requirepass "$OKE_STORE_KV_PASSWORD" --maxmemory … --maxmemory-policy …`
+
+</Step>
+
+<Step>
+### Optional memory caps
+
+| Variable                        | Default in recipe                                       | Meaning  |
+| ------------------------------- | ------------------------------------------------------- | -------- |
+| `OKE_STORE_KV_MAXMEMORY`        | `0` (unlimited) in command; stack often sets `256mb`    | Max RSS  |
+| `OKE_STORE_KV_MAXMEMORY_POLICY` | `noeviction` in command; stack often sets `allkeys-lru` | Eviction |
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable                        | Required?     | Meaning                                                            |
+| ------------------------------- | ------------- | ------------------------------------------------------------------ |
+| `OKE_STORE_KV_PASSWORD`         | **Yes**       | `--requirepass` — empty password is not a valid production posture |
+| `REDIS_URL`                     | **Yes** (app) | What the `redis` driver opens (`OKE_STORE_KV_URL` also works)      |
+| `OKE_STORE_KV_MAXMEMORY`        | Optional      | Cap memory                                                         |
+| `OKE_STORE_KV_MAXMEMORY_POLICY` | Optional      | Eviction when at cap                                               |
+
+## Data and backup
+
+The Redis recipe declares **no named volume**. Process memory is the source of truth;
+a container recreate loses keys unless you add persistence yourself
+(`compose.override.yml` + Redis AOF/RDB).
+
+**Backup means (default recipe):** treat KV as a cache — rebuild from SQL / files, or
+add an explicit volume + `SAVE`/`BGSAVE` policy before you rely on durability.
+
+## Production note
+
+<Callout title="License note" type="warn">
+  Redis ≥8 is dual-licensed RSALv2 / SSPLv1 / AGPLv3. Those terms restrict offering Redis itself as
+  a managed service to third parties — running it for your own app is unaffected. Prefer
+  [Valkey](/docs/recipes/valkey) when the managed-service restriction matters.
+</Callout>
+
+Multi-replica Gate rate counters and Signal need a **shared** Redis URL — an in-process
+`memory` driver is per instance. Same shared-store idea as
+[Clock](/docs/elements/clock#what-the-runtime-guarantees) for cron exclusivity.
+
+## What the recipe configures
+
+| Field          | Value                                                |
+| -------------- | ---------------------------------------------------- |
+| Container port | `6379`                                               |
+| Healthcheck    | `redis-cli -a <password> ping`, every 5s, 10 retries |
+| Connection URL | `redis://:pass@host:6379`                            |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="oke boot: redis driver needs REDIS_URL">
+
+Missing `REDIS_URL` fails boot loudly — never a silent fallback to `memory`. Re-run
+`oke dev --docker` or export `REDIS_URL` when using a managed host. In docker mode the
+message asks whether `oke dev -d` wrote `docker/.env.docker`.
+
+</Accordion>
+<Accordion title="NOAUTH Authentication required">
+
+`REDIS_URL` is missing the password, or it does not match `OKE_STORE_KV_PASSWORD`.
+Format must be `redis://:PASSWORD@host:6379` (colon before the password, empty username).
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Store · KV](/docs/elements/store#kv) — TTL physics, per-driver behavior, license table
+- [Valkey](/docs/recipes/valkey) · [Dragonfly](/docs/recipes/dragonfly) — Redis-wire peers
+- [Environment variables](/docs/reference/environment-variables) — `REDIS_URL` precedence
+
+## Next
+
+<Cards>
+  <Card title="Valkey" description="Permissive-licensed alternative." href="/docs/recipes/valkey" />
+  <Card title="Redis Cloud" description="Managed Redis." href="/docs/providers/redis-cloud" />
+  <Card
+    title="Upstash"
+    description="Serverless Redis-protocol option."
+    href="/docs/providers/upstash"
+  />
+</Cards>

package/site/content/docs/recipes/rustfs.mdx

@@ -0,0 +1,148 @@
+---
+title: "RustFS"
+description: "S3-compatible object store — S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY, /data volume, console on :9001."
+icon: "HardDrive"
+source: "docs/spec/unified-theory.md"
+---
+
+RustFS is the default docker `store.files` image — an Apache-2.0 S3-compatible object
+store (MinIO alternative). Driver id stays `s3`; Bun binds `Bun.S3Client` against the
+endpoint.
+
+<Callout title="The one rule">
+  Protocol name is `s3` — vendor choice is the image pin (`rustfs/rustfs:…`) plus `S3_ENDPOINT`.
+  Never invent a `rustfs` driver id.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin driver + image (templates already do)
+
+```typescript title="oke.config.ts"
+drivers: {
+  store: {
+    files: { local: "fs", docker: "s3", test: "memory", prod: "s3" },
+  },
+},
+images: {
+  "store.files": "rustfs/rustfs:1.0.0-beta.11",
+},
+```
+
+</Step>
+
+<Step>
+### Credentials and endpoint
+
+```bash title="docker/.env.docker (written by oke docker)"
+S3_ACCESS_KEY_ID=…
+S3_SECRET_ACCESS_KEY=…
+S3_BUCKET=oke
+S3_ENDPOINT=http://127.0.0.1:9000
+S3_URL=http://…@127.0.0.1:9000/oke
+S3_REGION=us-east-1
+S3_CONSOLE_URL=http://127.0.0.1:9001
+```
+
+Recipe maps:
+
+- `RUSTFS_ACCESS_KEY=${S3_ACCESS_KEY_ID}`
+- `RUSTFS_SECRET_KEY=${S3_SECRET_ACCESS_KEY}`
+- `RUSTFS_CONSOLE_ENABLE=true`
+- `RUSTFS_ADDRESS=:9000`
+- command: `/data`
+
+</Step>
+
+<Step>
+### Put an object
+
+Any flow using `fx.store` files (`put` / `get`) against the `s3` driver talks to this
+endpoint. Open `S3_CONSOLE_URL` for a browser console on port **9001**.
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable               | Required?         | Meaning                                    |
+| ---------------------- | ----------------- | ------------------------------------------ |
+| `S3_ACCESS_KEY_ID`     | **Yes**           | Access key → `RUSTFS_ACCESS_KEY`           |
+| `S3_SECRET_ACCESS_KEY` | **Yes**           | Secret key → `RUSTFS_SECRET_KEY`           |
+| `S3_BUCKET`            | **Yes** (app)     | Bucket name the driver opens               |
+| `S3_ENDPOINT`          | **Yes** (non-AWS) | Origin `http://host:9000`                  |
+| `S3_REGION`            | Optional          | Default `us-east-1` in stack env           |
+| `S3_SESSION_TOKEN`     | Optional          | Temporary creds                            |
+| `S3_CONSOLE_URL`       | Written by stack  | UI on `:9001` — not required by the driver |
+| `S3_URL`               | Written by stack  | Credentialed URL form                      |
+
+## Data and backup
+
+| Volume             | Path    | What it stores                 |
+| ------------------ | ------- | ------------------------------ |
+| `store-files-data` | `/data` | Object bytes + RustFS metadata |
+
+**Backup means:** snapshot that named volume (or `aws s3 sync` against the API).
+Deleting the volume deletes every object.
+
+Credentials live in `.env.docker`, not in `/data` — rotate keys without wiping objects.
+Losing both volume and keys means full restore from backup only.
+
+## Production note
+
+For cloud prod, point the same `s3` driver at real S3 / R2 / GCS interop by changing
+`S3_ENDPOINT` + keys — keep the driver id. Self-hosted RustFS on a single node is a
+durability SPOF: put the `/data` volume on reliable disks and back it up.
+
+Do not publish `:9000` / `:9001` on the public internet without TLS and network policy —
+the recipe enables the console for local ops.
+
+## What the recipe configures
+
+| Field          | Value                                                                   |
+| -------------- | ----------------------------------------------------------------------- |
+| API port       | `9000`                                                                  |
+| Extra port     | `9001` → console                                                        |
+| Healthcheck    | `curl -f http://127.0.0.1:9000/health`, every 5s, 12 retries, 10s start |
+| Connection URL | `http://user:pass@host:9000/bucket`                                     |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="oke boot: redis / meilisearch / S3 URL missing — S3_BUCKET">
+
+Files on the `s3` driver need `S3_BUCKET` (or `OKE_STORE_FILES_DB`). Without it the
+facet cannot open. Re-run `oke dev --docker` so stack env fills `S3_*`, or export them
+for a managed bucket.
+
+</Accordion>
+<Accordion title="Access Denied / signature errors against :9000">
+
+`S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY` do not match `RUSTFS_*` inside the
+container, or `S3_ENDPOINT` points at the wrong host/port. Align `.env.docker` with the
+running service; confirm health at `/health` before debugging client signatures.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Store · Files](/docs/elements/store#files) — facet API and drivers
+- [Environment variables](/docs/reference/environment-variables) — full `S3_*` map
+- [Installation](/docs/get-started/installation) — docker env cheat sheet
+
+## Next
+
+<Cards>
+  <Card
+    title="Mailpit"
+    description="SMTP catcher for the same stack."
+    href="/docs/recipes/mailpit"
+  />
+  <Card title="OpenBao" description="Vault for secrets." href="/docs/recipes/openbao" />
+  <Card title="Store" description="Files facet details." href="/docs/elements/store" />
+</Cards>

package/site/content/docs/recipes/sglang.mdx

@@ -0,0 +1,105 @@
+---
+title: "SGLang"
+description: "Production-tier self-hosted inference for structured and agent workloads on GPU."
+icon: "Cpu"
+source: "docs/spec/unified-theory.md"
+---
+
+SGLang is for **structured generation and agent-heavy workloads on real GPU
+hardware** when you self-host inference. Prefer a managed provider for most
+production apps. For general multi-user serving, prefer [vLLM](/docs/recipes/vllm).
+
+<Callout title="The one rule">
+  Pin an explicit runtime tag (never `latest`), publish only on loopback, and pick SGLang only when
+  structured / agent throughput is the reason you self-host.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin driver + image
+
+```typescript title="oke.config.ts"
+drivers: {
+  ai: { docker: "openai-compatible", prod: "openai-compatible", test: "mock" },
+},
+images: {
+  ai: "lmsysorg/sglang:v0.5.16-runtime", // never :latest
+},
+```
+
+Or `oke ai setup --provider sglang --yes`.
+
+</Step>
+
+<Step>
+### Env + GPU
+
+```bash title="docker/.env.docker"
+OKE_AI_URL=http://127.0.0.1:30000/v1
+OKE_AI_MODEL=Qwen/Qwen3-0.6B
+```
+
+Same NVIDIA reservation pattern as vLLM (`ipc: host` + device reservation).
+
+</Step>
+
+<Step>
+### Decision matrix
+
+| Workload                         | Recipe                                                                           |
+| -------------------------------- | -------------------------------------------------------------------------------- |
+| Single-user / dev                | [llama.cpp](/docs/recipes/llama-cpp) (default) or [Ollama](/docs/recipes/ollama) |
+| Multi-user GPU serving           | [vLLM](/docs/recipes/vllm)                                                       |
+| Structured / agent GPU workloads | **SGLang** (this recipe)                                                         |
+| Managed cloud                    | Anthropic / OpenAI / …                                                           |
+
+</Step>
+
+</Steps>
+
+## Security
+
+| Control      | Requirement                                    |
+| ------------ | ---------------------------------------------- |
+| Host publish | `127.0.0.1:30000:30000` only — never `0.0.0.0` |
+| Image pin    | Explicit version tag — never `latest`          |
+| Model source | Trusted Hugging Face repos / your own weights  |
+
+## What the recipe configures
+
+| Field          | Value                                                 |
+| -------------- | ----------------------------------------------------- |
+| Container port | `30000`                                               |
+| Host publish   | `127.0.0.1:30000:30000`                               |
+| `ipc`          | `host`                                                |
+| GPU            | `deploy.resources.reservations.devices` (nvidia, all) |
+| Healthcheck    | `GET /health`, long start period for model load       |
+| Connection URL | `http://host:30000/v1`                                |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="GPU not visible / container exits">
+
+Install the NVIDIA Container Toolkit. Without a GPU, use
+[llama.cpp](/docs/recipes/llama-cpp) for local smoke tests.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [vLLM](/docs/recipes/vllm) — general production GPU serving
+- [llama.cpp](/docs/recipes/llama-cpp) — default local AI
+- [AI](/docs/elements/ai) — drivers and `fx.ask`
+
+## Next
+
+<Cards>
+  <Card title="vLLM" description="General multi-user GPU serving." href="/docs/recipes/vllm" />
+  <Card title="llama.cpp" description="Default local AI." href="/docs/recipes/llama-cpp" />
+  <Card title="AI" description="Prompts and guardrails." href="/docs/elements/ai" />
+</Cards>

package/site/content/docs/recipes/supabase-docker.mdx

@@ -0,0 +1,145 @@
+---
+title: "Supabase"
+description: "Pin supabase/postgres as store.sql — extension bundle (pgvector, …) without Auth, Storage, Realtime, or Studio."
+icon: "Database"
+source: "docs/spec/unified-theory.md"
+---
+
+Supabase publishes `supabase/postgres` — plain Postgres with a bundled extension set
+(`pgvector`, `pg_graphql`, `pg_cron`, `wrappers`, and more). `oke docker` matches that
+image ahead of the generic Postgres recipe.
+
+<Callout title="Not the full Supabase platform">
+  This recipe does **not** start GoTrue, PostgREST, Kong, Realtime, Storage, or Studio. Auth, files,
+  and realtime delivery are already covered by [Vault](/docs/elements/vault), [Store ·
+  files](/docs/elements/store#files), and [Signal](/docs/elements/signal).
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin the image
+
+```typescript title="oke.config.ts"
+images: {
+  "store.sql": "supabase/postgres:15.8.1.049", // pin a real tag from Supabase's registry
+},
+```
+
+</Step>
+
+<Step>
+### Same env shape as Postgres
+
+`oke docker` injects the same `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB`
+refs from `OKE_STORE_SQL_*`. Driver id stays `postgres`.
+
+</Step>
+
+<Step>
+### Use pgvector when you need it
+
+```typescript
+drivers: {
+  store: {
+    index: { local: "memory", docker: "pgvector", prod: "pgvector" },
+  },
+},
+```
+
+`CREATE EXTENSION IF NOT EXISTS vector` runs when the `pgvector` index driver opens —
+the extension ships in this image.
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable                 | Meaning                                   |
+| ------------------------ | ----------------------------------------- |
+| `OKE_STORE_SQL_USER`     | → `POSTGRES_USER`                         |
+| `OKE_STORE_SQL_PASSWORD` | → `POSTGRES_PASSWORD`                     |
+| `OKE_STORE_SQL_DB`       | → `POSTGRES_DB`                           |
+| `DATABASE_URL`           | App connection (`postgres://…:5432/…`)    |
+| `PGDATA`                 | Default `/var/lib/postgresql/data/pgdata` |
+
+Identical credential contract to [Postgres](/docs/recipes/postgres) — only the image
+(and its extension bundle) differs.
+
+## Data and backup
+
+| Path                                      | What lives there                           |
+| ----------------------------------------- | ------------------------------------------ |
+| `$PGDATA`                                 | Cluster data, including extension catalogs |
+| Image `VOLUME` `/var/lib/postgresql/data` | Persistence mount                          |
+
+Same backup story as plain Postgres: `pg_dump` or volume backup of
+`/var/lib/postgresql/data`. Losing that volume loses tables **and** which extensions
+were created.
+
+## Production note
+
+Want managed Supabase (Auth / Storage / Realtime included)? Use the
+[Supabase provider](/docs/providers/supabase) and set `DATABASE_URL` — do not run this
+image and the cloud project as if they were the same deployment.
+
+For self-hosted production, prefer a pinned tag (not `latest`) and the same
+shared-store guidance as [Postgres](/docs/recipes/postgres#production-note). Free-tier
+cloud pausing does not apply to this Docker image — you own uptime.
+
+## What the recipe configures
+
+| Field          | Value                                                |
+| -------------- | ---------------------------------------------------- |
+| Match          | `supabase/postgres` before generic `postgres`        |
+| Container port | `5432`                                               |
+| Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries |
+| Connection URL | `postgres://user:pass@host:5432/db`                  |
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title='Extension "vector" is not available'>
+
+You pinned a plain `postgres:` image, not `supabase/postgres`, or the tag predates the
+bundle. Confirm the image reference contains `supabase/postgres`, then re-derive.
+With the right image, `CREATE EXTENSION vector` succeeds without a separate install.
+
+</Accordion>
+<Accordion title="Looking for Studio / the REST API">
+
+Those services are not part of this recipe. Use the
+[managed Supabase provider](/docs/providers/supabase) for the full platform, or oke's
+own Vault / Store · files / Signal for those concerns.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Supabase (provider)](/docs/providers/supabase) — managed cloud alternative
+- [Postgres](/docs/recipes/postgres) — generic recipe this one takes precedence over
+- [Store · Index](/docs/elements/store#index) — `pgvector`-backed vector search
+
+## Next
+
+<Cards>
+  <Card
+    title="Supabase"
+    description="Managed cloud, same wire protocol."
+    href="/docs/providers/supabase"
+  />
+  <Card
+    title="PgDog"
+    description="Add pooling in front of this recipe too."
+    href="/docs/recipes/pgdog"
+  />
+  <Card
+    title="Postgres"
+    description="The plain image this specializes."
+    href="/docs/recipes/postgres"
+  />
+</Cards>