okengine 0.10.2 → 0.11.0

package/site/content/docs/plugins/username.mdx

@@ -26,7 +26,7 @@ import { username } from "okengine/plugins";
 
 export const app = oke({
   name: "shop",
-  env: "local",
+  env: "dev",
   gate: { auth: {} },
 }).plug(username());
 ```

package/site/content/docs/recipes/caddy.mdx

@@ -43,7 +43,7 @@ Unset defaults to `localhost` — Caddy issues a **local** TLS cert instead of L
 ### Include the proxy layer
 
 ```bash
-docker compose -f compose.yml -f compose.proxy.yml … up -d
+docker compose -f docker-compose.yml up -d
 ```
 
 Generated `Caddyfile`: `{$OKE_PROXY_HOST:localhost} { reverse_proxy app:6530 }`.

package/site/content/docs/recipes/cockroachdb.mdx

@@ -34,7 +34,7 @@ images: {
 ### Bring the stack up
 
 ```bash
-oke dev --docker
+oke dev
 ```
 
 `oke docker` injects `COCKROACH_USER` / `COCKROACH_PASSWORD` / `COCKROACH_DATABASE`
@@ -94,7 +94,7 @@ not multi-region HA. For managed multi-region, use the
 <Accordions>
 <Accordion title="oke boot: postgres driver needs DATABASE_URL">
 
-Re-run `oke dev --docker` so the stack writes `docker/.env.docker`, or export
+Re-run `oke dev` so the stack writes `docker/.env.docker`, or export
 `DATABASE_URL` yourself when pointing at a remote Cockroach host.
 
 </Accordion>

package/site/content/docs/recipes/dragonfly.mdx

@@ -100,7 +100,7 @@ daemon / systemd limit, or run on a host that allows `memlock: -1`.
 </Accordion>
 <Accordion title="oke boot: redis driver needs REDIS_URL">
 
-Same driver failure as Redis — export `REDIS_URL` or let docker mode write it. Wrong
+Same driver failure as Redis — export `REDIS_URL` or let `oke dev` write it. Wrong
 password yields Redis-protocol `NOAUTH` / `WRONGPASS` from the server.
 
 </Accordion>

package/site/content/docs/recipes/index.mdx

@@ -10,7 +10,7 @@ and get env, healthcheck, and a connection URL for free.
 
 <Callout title="The one rule">
   Vendor choice lives in `images[…]` — never in `drivers.*`, which only ever say protocol ids
-  (`postgres`, `redis`, `s3`, `smtp`, `openbao`, `meilisearch`, `openai-compatible`, `ollama`, …).
+  (`postgres`, `redis`, `s3`, `smtp`, `meilisearch`, `openai-compatible`, `ollama`, …).
 </Callout>
 
 ## SQL
@@ -84,7 +84,6 @@ Opt-in via `images.proxy` — leave unset until you need HTTPS or `--scale app=N
     href="/docs/recipes/rustfs"
   />
   <Card title="Mailpit" description="SMTP catcher — UI on :8025." href="/docs/recipes/mailpit" />
-  <Card title="OpenBao" description="Raft vault — unseal key SPOF." href="/docs/recipes/openbao" />
   <Card
     title="Meilisearch"
     description="Full-text store.index on :7700."

package/site/content/docs/recipes/llama-cpp.mdx

@@ -23,7 +23,7 @@ for single-user / dev. Driver id stays `openai-compatible`.
 
 ```typescript title="oke.config.ts"
 drivers: {
-  ai: { local: "openai-compatible", docker: "openai-compatible", test: "mock" },
+  ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
   ai: "ghcr.io/ggml-org/llama.cpp:server-b10290", // never :latest
@@ -32,7 +32,7 @@ images: {
 
 Or `oke ai setup --provider llama-cpp` (TTY: banner → Ultra Fast / Fast /
 Balanced / Smart → up to 20 curated Docker Hub `ai/` picks per tier) / `--yes`
-for `smollm2`.
+for `granite3.3:2b`.
 
 </Step>
 
@@ -41,19 +41,16 @@ for `smollm2`.
 
 ```bash title="docker/.env.docker"
 OKE_AI_URL=http://127.0.0.1:8080/v1
-OKE_AI_MODEL=smollm2
+OKE_AI_MODEL=granite3.3:2b
 ```
 
 `OKE_AI_MODEL` is a Docker Hub `ai/<id>` model. The recipe writes
-`docker/llama-entrypoint.py`, which Hub-pulls into the cache volume (native
-`llama download -dr`, then a CNCF `model.weight` fallback for newer tags like
-gemma4), then starts `llama-server -m <gguf> --alias <id>` (single-model — not
-router `--models-preset` / bare `--docker-repo`, which hang on b10290+). Never
-set `LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` in the container env.
+`docker/llama-entrypoint.py`, which Hub-pulls into the cache volume, then starts
+`llama-server -m <gguf> --alias <id>` (single-model).
 
-`oke dev -d` shows the model id in the hero / Docker summary and polls
-`/v1/models` in the background until status is `ready` (first boot may take
-minutes while the Hub image downloads).
+Never set `LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` — those hang on
+b10290+. `oke dev` shows the model id and polls `/v1/models` until `ready`
+(first boot may take minutes).
 
 </Step>
 
@@ -65,7 +62,7 @@ import { ai } from "okengine";
 
 export const smart = ai.model("smart", {
   provider: "openai-compatible",
-  model: process.env.OKE_AI_MODEL ?? "smollm2",
+  model: process.env.OKE_AI_MODEL ?? "granite3.3:2b",
 });
 ```
 
@@ -89,10 +86,10 @@ Postgres/Redis, stricter on the published interface because of GGUF CVE risk.
 
 ## Required env
 
-| Variable       | Required?         | Meaning                                 |
-| -------------- | ----------------- | --------------------------------------- |
-| `OKE_AI_URL`   | **Yes** in docker | Base URL including `/v1`                |
-| `OKE_AI_MODEL` | Recommended       | Docker Hub `ai/` id (default `smollm2`) |
+| Variable       | Required?         | Meaning                                       |
+| -------------- | ----------------- | --------------------------------------------- |
+| `OKE_AI_URL`   | **Yes** in docker | Base URL including `/v1`                      |
+| `OKE_AI_MODEL` | Recommended       | Docker Hub `ai/` id (default `granite3.3:2b`) |
 
 ## What the recipe configures
 
@@ -127,13 +124,14 @@ interfaces). `OKE_AI_URL` must include `/v1`.
 
 First start Hub-pulls the curated `ai/` model into the named cache volume
 (see logs: `oke ai: ensuring…` / download %). Prefer `oke ai setup` tiers
-(Ultra Fast → `smollm2`) for smoke tests. Confirm `OKE_AI_MODEL` is active in
-`.env.local` / `docker/.env.docker`. Watch `oke dev` (`AI … — waiting…` →
-`ready`). If status stays `loading` forever on an old stack that still uses
-`--models-preset`, regenerate `docker/` and recreate AI. Newer Hub tags use
-CNCF weight layers — the entrypoint falls back when native `llama download`
-cannot find `vnd.docker.ai.gguf.v3`. Do not mount random GGUF files. Never put
-`LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` in the container env.
+(Ultra Fast → `granite3.3:2b`) for smoke tests.
+
+Confirm `OKE_AI_MODEL` in `docker/.env.docker` (keep the `.env.local` hint commented so it does not shadow compose). Watch `oke
+dev` until AI status is `ready`.
+
+If status stays `loading` on Compose that still uses `--models-preset`,
+regenerate `docker/` and recreate AI. Never mount random GGUF or set
+`LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO`.
 
 </Accordion>
 </Accordions>

package/site/content/docs/recipes/mailpit.mdx

@@ -5,13 +5,13 @@ icon: "Mail"
 source: "docs/spec/unified-theory.md"
 ---
 
-Mailpit is the docker-mode email catcher — every message the `smtp` channel driver sends
-lands in a web UI instead of a real inbox. Pin it as `images["channel.email"]` when
-`drivers.channel.email.docker` is `smtp`.
+Mailpit is the `oke dev` email catcher — every message the `smtp` channel driver sends
+lands in a web UI instead of a real inbox. Pin it as `images.channel.email` when
+`drivers.channel.email.dev` is `smtp`.
 
 <Callout title="The one rule">
-  Docker ≈ prod for the **SMTP protocol** — same `SMTP_URL` shape. Mailpit is not a production MTA;
-  swap the image / URL for a real relay when you leave local docker.
+  `dev` ≈ `prod` for the **SMTP protocol** — same `SMTP_URL` shape. Mailpit is not a production MTA;
+  swap the image / URL for a real relay in production.
 </Callout>
 
 ## Quick start
@@ -24,11 +24,11 @@ lands in a web UI instead of a real inbox. Pin it as `images["channel.email"]` w
 ```typescript title="oke.config.ts"
 drivers: {
   channel: {
-    email: { local: "console", docker: "smtp", test: "console", prod: "smtp" },
+    email: { dev: "smtp", test: "console", prod: "smtp" },
   },
 },
 images: {
-  "channel.email": "axllent/mailpit:v1.22.3",
+  channel: { email: "axllent/mailpit:v1.22.3" },
 },
 ```
 
@@ -100,7 +100,7 @@ if SMTP still accepts mail.
 <Accordion title="oke boot: smtp driver needs SMTP_URL">
 
 The smtp binder refuses to start without `SMTP_URL` (or `OKE_CHANNEL_EMAIL_URL`). In
-docker mode the error asks whether `oke dev -d` wrote `docker/.env.docker`. Also rejects
+under `oke dev` the error asks whether Compose wrote `docker/.env.docker`. Also rejects
 non-`smtp://` schemes: `oke boot: SMTP_URL must use smtp://`.
 
 </Accordion>
@@ -128,9 +128,9 @@ shift the host port).
     href="/docs/recipes/rustfs"
   />
   <Card
-    title="OpenBao"
-    description="Vault recipe for docker/prod secrets."
-    href="/docs/recipes/openbao"
+    title="Vault"
+    description="Secrets and built-in encrypted store."
+    href="/docs/elements/vault"
   />
   <Card title="Channel" description="How fx.email reaches humans." href="/docs/elements/channel" />
 </Cards>

package/site/content/docs/recipes/meilisearch.mdx

@@ -6,12 +6,12 @@ source: "docs/spec/unified-theory.md"
 ---
 
 Meilisearch backs the `meilisearch` index driver — typo-tolerant full-text search over
-HTTP. Pin `images["store.index"]` and set `drivers.store.index` to `meilisearch` where
-you need it (index does **not** auto-promote in docker).
+HTTP. Pin `images.store.index` and set `drivers.store.index` to `meilisearch` where
+you need it (index does **not** auto-promote under Compose).
 
 <Callout title="The one rule">
   Index stays `memory` in every environment until you set the driver map explicitly — there is no
-  silent docker fallback to Meilisearch or pgvector.
+  silent fallback to Meilisearch or pgvector.
 </Callout>
 
 ## Quick start
@@ -24,11 +24,11 @@ you need it (index does **not** auto-promote in docker).
 ```typescript title="oke.config.ts"
 drivers: {
   store: {
-    index: { local: "memory", docker: "meilisearch", prod: "meilisearch" },
+    index: { dev: "meilisearch", test: "memory", prod: "meilisearch" },
   },
 },
 images: {
-  "store.index": "getmeili/meilisearch:v1.14",
+  store: { index: "getmeili/meilisearch:v1.14" },
 },
 ```
 
@@ -53,8 +53,8 @@ Recipe injects into the container:
 <Step>
 ### Search from a flow
 
-Use `store.index(…)` without `{ dims }` for full-text (vector dims select pgvector /
-libsql). Writes wait on Meilisearch tasks before returning.
+Use `store.index(…)` without `{ dims }` for full-text (vector dims select pgvector).
+Writes wait on Meilisearch tasks before returning.
 
 </Step>
 
@@ -87,8 +87,8 @@ Always set a non-empty `OKE_STORE_INDEX_KEY` when `MEILI_ENV=production` — Mei
 refuses insecure production mode without a master key. Prefer network isolation (compose
 network only) plus the key; do not publish `:7700` on the public internet without auth.
 
-Vector `ai.embed` into a meilisearch index fails loud — embeddings need `pgvector` /
-`libsql`, not FTS. See [Store · Index](/docs/elements/store#index).
+Vector `ai.embed` into a meilisearch index fails loud — embeddings need `pgvector`,
+not FTS. See [Store · Index](/docs/elements/store#index).
 
 ## What the recipe configures
 
@@ -103,7 +103,7 @@ Vector `ai.embed` into a meilisearch index fails loud — embeddings need `pgvec
 <Accordions>
 <Accordion title="oke boot: meilisearch index needs OKE_STORE_INDEX_URL">
 
-No silent memory fallback. Re-run `oke dev --docker` or export `OKE_STORE_INDEX_URL`.
+No silent memory fallback. Re-run `oke dev` or export `OKE_STORE_INDEX_URL`.
 Docker-mode wording asks whether `docker/.env.docker` was written.
 
 </Accordion>

package/site/content/docs/recipes/meta.json

@@ -20,7 +20,6 @@
     "pgdog",
     "rustfs",
     "mailpit",
-    "openbao",
     "meilisearch",
     "---AI---",
     "llama-cpp",

package/site/content/docs/recipes/ollama.mdx

@@ -23,7 +23,7 @@ want its library pull UX. Pin `images.ai` and set `drivers.ai` to `ollama`.
 
 ```typescript title="oke.config.ts"
 drivers: {
-  ai: { local: "ollama", docker: "ollama", test: "mock" }, // prod: set deliberately
+  ai: { dev: "ollama", test: "mock", prod: "ollama" }, // or set prod deliberately
 },
 images: {
   ai: "ollama/ollama:0.32.6", // never :latest — floor 0.17.1 (CVE-2026-7482)

package/site/content/docs/recipes/pgdog.mdx

@@ -1,6 +1,6 @@
 ---
 title: "PgDog"
-description: "Postgres wire-protocol pooler — transaction mode on :6432, generated pgdog.toml / users.toml, DATABASE_URL rewrite."
+description: "Postgres wire-protocol pooler — transaction mode on :6432, generated pgdog/ configs, DATABASE_URL rewrite."
 icon: "Package"
 source: "docs/spec/unified-theory.md"
 ---
@@ -21,6 +21,8 @@ transaction-pooling proxy — same wire protocol, no app code changes.
 <Step>
 ### Pin both images
 
+create-oke asks **Add PgDog connection pooling…?** (or pass `--pgdog`). Manually:
+
 ```typescript title="oke.config.ts"
 images: {
   "store.sql": "postgres:18-alpine",
@@ -37,8 +39,9 @@ images: {
 oke docker
 ```
 
-Writes `./pgdog.toml` (listen + one primary database) and `./users.toml` (same
-user/password/database as Postgres). The pooler waits on `store-sql` health before start.
+Writes `./pgdog/pgdog.toml` (listen + one primary database) and
+`./pgdog/users.toml` (same user/password/database as Postgres). The pooler
+waits on `store-sql` health before start.
 
 </Step>
 
@@ -59,7 +62,7 @@ echo "$OKE_STORE_SQL_URL"   # still the direct Postgres URL when you need it
 
 | Variable                                 | Role                                                             |
 | ---------------------------------------- | ---------------------------------------------------------------- |
-| `OKE_STORE_SQL_USER` / `PASSWORD` / `DB` | Copied into `users.toml` for client + server auth                |
+| `OKE_STORE_SQL_USER` / `PASSWORD` / `DB` | Copied into `pgdog/users.toml` for client + server auth          |
 | `DATABASE_URL`                           | Rewritten to the pooler URL (`:6432`) when PgDog is in the stack |
 | `OKE_PGDOG_URL`                          | Same value as pooled `DATABASE_URL` when both are present        |
 | `OKE_STORE_SQL_URL`                      | Direct Postgres host — bypass the pooler for admin / migrations  |
@@ -68,10 +71,10 @@ PgDog itself has no separate credential env — it mounts the generated TOML fil
 
 ## Data and backup
 
-| Mount                               | What it is                                                         |
-| ----------------------------------- | ------------------------------------------------------------------ |
-| `./pgdog.toml:/pgdog/pgdog.toml:ro` | Generated listen + `[[databases]]` (host `store-sql`, port `5432`) |
-| `./users.toml:/pgdog/users.toml:ro` | Generated `[[users]]` credentials                                  |
+| Mount                                     | What it is                                                         |
+| ----------------------------------------- | ------------------------------------------------------------------ |
+| `./pgdog/pgdog.toml:/pgdog/pgdog.toml:ro` | Generated listen + `[[databases]]` (host `store-sql`, port `5432`) |
+| `./pgdog/users.toml:/pgdog/users.toml:ro` | Generated `[[users]]` credentials                                  |
 
 **No database state lives in the PgDog container.** Backing up PgDog means keeping those
 two config files (they are regenerated by `oke docker`). Durable data stays on the
@@ -104,7 +107,7 @@ not wired into the generated stack yet.
 <Accordions>
 <Accordion title="pgdog unhealthy — pg_isready on :6432 fails">
 
-Usually the backend is not ready, or `users.toml` credentials do not match Postgres.
+Usually the backend is not ready, or `pgdog/users.toml` credentials do not match Postgres.
 Confirm `store-sql` is healthy first, then re-run `oke docker` so TOML matches
 `OKE_STORE_SQL_*`. Logs often show auth failures against `store-sql:5432`.
 

package/site/content/docs/recipes/postgres.mdx

@@ -5,7 +5,7 @@ icon: "Database"
 source: "docs/spec/unified-theory.md"
 ---
 
-Postgres is the default `store.sql` image in docker and prod. `oke docker` matches
+Postgres is the default `store.sql` image in `dev` and `prod`. `oke docker` matches
 any image whose reference contains `postgres` or `pgvector` (after more specific
 recipes), then derives env, healthcheck, and connection URL.
 
@@ -33,7 +33,7 @@ images: {
 ### Bring the stack up
 
 ```bash
-oke dev --docker
+oke dev
 ```
 
 `oke docker` writes `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` into
@@ -105,7 +105,7 @@ Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exha
 <Accordion title="oke boot: postgres driver needs DATABASE_URL">
 
 The `postgres` driver fails boot when neither `DATABASE_URL` nor `OKE_STORE_SQL_URL` is
-set. Re-run `oke dev --docker` so the stack writes `docker/.env.docker`, or export
+set. Re-run `oke dev` so the stack writes `docker/.env.docker`, or export
 `DATABASE_URL` yourself when pointing at a managed host.
 
 </Accordion>

package/site/content/docs/recipes/redis.mdx

@@ -5,7 +5,7 @@ icon: "Zap"
 source: "docs/spec/unified-theory.md"
 ---
 
-Redis is the default `store.kv` image in docker and prod. `oke docker` matches image
+Redis is the default `store.kv` image in `dev` and `prod`. `oke docker` matches image
 references containing `redis` or `keydb` and derives a password-required server — no
 unauthenticated instance.
 
@@ -99,7 +99,7 @@ Multi-replica Gate rate counters and Signal need a **shared** Redis URL — an i
 <Accordion title="oke boot: redis driver needs REDIS_URL">
 
 Missing `REDIS_URL` fails boot loudly — never a silent fallback to `memory`. Re-run
-`oke dev --docker` or export `REDIS_URL` when using a managed host. In docker mode the
+`oke dev` or export `REDIS_URL` when using a managed host. Under Compose the
 message asks whether `oke dev -d` wrote `docker/.env.docker`.
 
 </Accordion>

package/site/content/docs/recipes/rustfs.mdx

@@ -5,9 +5,8 @@ icon: "HardDrive"
 source: "docs/spec/unified-theory.md"
 ---
 
-RustFS is the default docker `store.files` image — an Apache-2.0 S3-compatible object
-store (MinIO alternative). Driver id stays `s3`; Bun binds `Bun.S3Client` against the
-endpoint.
+RustFS is the default `oke dev` / prod `store.files` image — an Apache-2.0 S3-compatible
+object store. Driver id stays `s3`; Bun binds `Bun.S3Client` against the endpoint.
 
 <Callout title="The one rule">
   Protocol name is `s3` — vendor choice is the image pin (`rustfs/rustfs:…`) plus `S3_ENDPOINT`.
@@ -24,11 +23,11 @@ endpoint.
 ```typescript title="oke.config.ts"
 drivers: {
   store: {
-    files: { local: "fs", docker: "s3", test: "memory", prod: "s3" },
+    files: { dev: "s3", test: "memory", prod: "s3" },
   },
 },
 images: {
-  "store.files": "rustfs/rustfs:1.0.0-beta.11",
+  store: { files: "rustfs/rustfs:1.0.0-beta.11" },
 },
 ```
 
@@ -116,7 +115,7 @@ the recipe enables the console for local ops.
 <Accordion title="oke boot: redis / meilisearch / S3 URL missing — S3_BUCKET">
 
 Files on the `s3` driver need `S3_BUCKET` (or `OKE_STORE_FILES_DB`). Without it the
-facet cannot open. Re-run `oke dev --docker` so stack env fills `S3_*`, or export them
+facet cannot open. Re-run `oke dev` so stack env fills `S3_*`, or export them
 for a managed bucket.
 
 </Accordion>
@@ -143,6 +142,10 @@ running service; confirm health at `/health` before debugging client signatures.
     description="SMTP catcher for the same stack."
     href="/docs/recipes/mailpit"
   />
-  <Card title="OpenBao" description="Vault for secrets." href="/docs/recipes/openbao" />
+  <Card
+    title="Vault"
+    description="Secrets and built-in encrypted store."
+    href="/docs/elements/vault"
+  />
   <Card title="Store" description="Files facet details." href="/docs/elements/store" />
 </Cards>

package/site/content/docs/recipes/sglang.mdx

@@ -23,7 +23,7 @@ production apps. For general multi-user serving, prefer [vLLM](/docs/recipes/vll
 
 ```typescript title="oke.config.ts"
 drivers: {
-  ai: { docker: "openai-compatible", prod: "openai-compatible", test: "mock" },
+  ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
   ai: "lmsysorg/sglang:v0.5.16-runtime", // never :latest

package/site/content/docs/recipes/supabase-docker.mdx

@@ -44,7 +44,7 @@ refs from `OKE_STORE_SQL_*`. Driver id stays `postgres`.
 ```typescript
 drivers: {
   store: {
-    index: { local: "memory", docker: "pgvector", prod: "pgvector" },
+    index: { test: "memory", prod: "pgvector" },
   },
 },
 ```

package/site/content/docs/recipes/timescale.mdx

@@ -33,7 +33,7 @@ images: {
 ### Bring the stack up
 
 ```bash
-oke dev --docker
+oke dev
 ```
 
 Same credential contract as [Postgres](/docs/recipes/postgres):
@@ -104,7 +104,7 @@ re-derive, then `CREATE EXTENSION timescaledb`.
 </Accordion>
 <Accordion title="oke boot: postgres driver needs DATABASE_URL">
 
-Same as Postgres — re-run `oke dev --docker` or export `DATABASE_URL` for a remote
+Same as Postgres — re-run `oke dev` or export `DATABASE_URL` for a remote
 host.
 
 </Accordion>

package/site/content/docs/recipes/valkey.mdx

@@ -90,7 +90,7 @@ see [DigitalOcean Managed Caching](/docs/providers/digitalocean-caching).
 <Accordion title="oke boot: redis driver needs REDIS_URL">
 
 Same loud failure as Redis — the driver id is still `redis`. Export `REDIS_URL` or let
-`oke dev --docker` write it.
+`oke dev` write it.
 
 </Accordion>
 <Accordion title="Healthcheck uses redis-cli and fails">

package/site/content/docs/recipes/vllm.mdx

@@ -23,7 +23,7 @@ you choose to self-host inference instead of a managed provider. Driver id stays
 
 ```typescript title="oke.config.ts"
 drivers: {
-  ai: { docker: "openai-compatible", prod: "openai-compatible", test: "mock" },
+  ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
   ai: "vllm/vllm-openai:v0.26.0", // never :latest

package/site/content/docs/recipes/yugabytedb.mdx

@@ -33,7 +33,7 @@ images: {
 ### Bring the stack up
 
 ```bash
-oke dev --docker
+oke dev
 ```
 
 `oke docker` injects `YSQL_USER` / `YSQL_PASSWORD` / `YSQL_DB` from `OKE_STORE_SQL_*`
@@ -105,7 +105,7 @@ Receiver or remap that port in `compose.override.yml` if you need the UI.
 <Accordion title="password authentication failed">
 
 `YSQL_PASSWORD` must match `DATABASE_URL`. Regenerate `docker/.env.docker` with
-`oke dev --docker`. Auth is off only when `YSQL_PASSWORD` is unset — this recipe
+`oke dev`. Auth is off only when `YSQL_PASSWORD` is unset — this recipe
 always sets it.
 
 </Accordion>