okengine 0.18.4 → 0.19.0

package/site/content/docs/recipes/ollama.mdx

@@ -1,142 +0,0 @@
----
-title: "Ollama"
-description: "Fully supported local AI alternative — OKE_AI_URL, pinned ≥ 0.17.1, loopback-only publish, library models only."
-icon: "Bot"
-source: "docs/spec/unified-theory.md"
----
-
-Ollama remains a **fully supported** local model server (not deprecated). The
-default local pin is [llama.cpp](/docs/recipes/llama-cpp); choose Ollama when you
-want its library pull UX. Pin `images.ai` and set `drivers.ai` to `ollama`.
-
-<Callout title="The one rule">
-  Pin ≥ `0.17.1` (never `latest`), publish only on loopback, and load models only from Ollama’s
-  library — never arbitrary untrusted GGUF via `/api/create`.
-</Callout>
-
-## Quick start
-
-<Steps>
-
-<Step>
-### Pin driver + image
-
-```typescript title="oke.config.ts"
-drivers: {
-  ai: { dev: "ollama", test: "mock", prod: "ollama" }, // or set prod deliberately
-},
-images: {
-  ai: "ollama/ollama:0.32.13", // never :latest — floor 0.17.1 (CVE-2026-7482)
-},
-```
-
-Or run `oke ai setup --provider ollama --yes`.
-
-</Step>
-
-<Step>
-### Env written by the stack
-
-```bash title=".env.local"
-OKE_AI_URL=http://127.0.0.1:11434
-OKE_AI_MODEL=qwen3.5:9b
-```
-
-Host publish is `127.0.0.1:11434:11434`. Inside the container
-`OLLAMA_HOST=0.0.0.0:11434` so Docker networking works.
-
-</Step>
-
-<Step>
-### Boot pulls against the container API
-
-After compose is healthy, `oke dev -d` shows `OKE_AI_MODEL` in the hero / Docker
-summary, POSTs `/api/pull` to **this container’s**
-loopback URL when the recipe is Ollama — never a host `ollama` CLI.
-
-</Step>
-
-</Steps>
-
-## Security (hard requirements)
-
-| Control        | Requirement                                                                |
-| -------------- | -------------------------------------------------------------------------- |
-| Host publish   | `127.0.0.1:11434:11434` only — never `0.0.0.0`                             |
-| Image pin      | Explicit tag ≥ **0.17.1** (CVE-2026-7482); never `latest`                  |
-| Model source   | [Ollama library](https://ollama.com/library) only                          |
-| Untrusted GGUF | **Forbidden** — `/api/create` with crafted files is the CVE-2026-7482 path |
-
-Ollama and llama.cpp share GGUF-parser risk; Ollama also has its own Go loader
-CVE. Network exposure of `:11434` turns that into a remote attack.
-
-<Callout type="warn" title="Host `ollama` CLI is unrelated">
-  A host `ollama pull` often talks to a separately installed daemon. Trust boot ensure against
-  `OKE_AI_URL`.
-</Callout>
-
-## Required env
-
-| Variable                                     | Required?         | Meaning                                                            |
-| -------------------------------------------- | ----------------- | ------------------------------------------------------------------ |
-| `OKE_AI_URL`                                 | **Yes** in docker | Base URL — `oke boot: ollama driver needs OKE_AI_URL` when missing |
-| `OKE_AI_MODEL`                               | Recommended       | Model tag to pull/serve (default `qwen3.5:9b`)                     |
-| `OLLAMA_HOST`                                | Set by recipe     | `0.0.0.0:11434` inside the container                               |
-| `OKE_AI_VISION_MODEL` / `OKE_AI_EMBED_MODEL` | Optional          | Written by `oke ai setup` for logical models                       |
-
-## Data and backup
-
-| Volume    | Path            | What it stores                         |
-| --------- | --------------- | -------------------------------------- |
-| `ai-data` | `/root/.ollama` | Pulled model weights + Ollama metadata |
-
-## Production note
-
-Local Ollama is for docker/dev (and air-gapped prod you deliberately choose).
-For multi-user GPU self-hosting see [vLLM](/docs/recipes/vllm) /
-[SGLang](/docs/recipes/sglang). Cloud drivers stay separate.
-
-PII egress rules treat `ollama` as local — see [AI · PII](/docs/elements/ai).
-
-## What the recipe configures
-
-| Field          | Value                                          |
-| -------------- | ---------------------------------------------- |
-| Container port | `11434`                                        |
-| Host publish   | `127.0.0.1:11434:11434`                        |
-| Entrypoint     | Image default (`ollama serve`)                 |
-| Healthcheck    | `ollama list`, every 5s, 24 retries, 10s start |
-| Connection URL | `http://host:11434`                            |
-| Model pull     | Host-side `POST /api/pull` after healthy       |
-
-## Troubleshooting
-
-<Accordions>
-<Accordion title="oke boot: ollama driver needs OKE_AI_URL">
-
-Docker mode expects `OKE_AI_URL` from `.env.local` when `images.ai` is pinned.
-Locally the default is `http://127.0.0.1:11434`. Prefer `oke ai setup` to wire everything
-in one pass.
-
-</Accordion>
-<Accordion title="Model missing / I already ran ollama pull on the host">
-
-The host CLI likely filled a **different** Ollama. Check `GET $OKE_AI_URL/api/tags`,
-then recreate with `oke dev -d`.
-
-</Accordion>
-</Accordions>
-
-## Learn more
-
-- [llama.cpp](/docs/recipes/llama-cpp) — default local AI
-- [AI](/docs/elements/ai) — `fx.ask`, prompts, evals
-- [CLI · oke ai setup](/docs/reference/cli) — non-interactive provider wiring
-
-## Next
-
-<Cards>
-  <Card title="llama.cpp" description="Default local AI." href="/docs/recipes/llama-cpp" />
-  <Card title="Meilisearch" description="Full-text index peer." href="/docs/recipes/meilisearch" />
-  <Card title="AI" description="Prompts, models, guardrails." href="/docs/elements/ai" />
-</Cards>

package/site/content/docs/recipes/sglang.mdx

@@ -1,105 +0,0 @@
----
-title: "SGLang"
-description: "Production-tier self-hosted inference for structured and agent workloads on GPU."
-icon: "Cpu"
-source: "docs/spec/unified-theory.md"
----
-
-SGLang is for **structured generation and agent-heavy workloads on real GPU
-hardware** when you self-host inference. Prefer a managed provider for most
-production apps. For general multi-user serving, prefer [vLLM](/docs/recipes/vllm).
-
-<Callout title="The one rule">
-  Pin an explicit runtime tag (never `latest`), publish only on loopback, and pick SGLang only when
-  structured / agent throughput is the reason you self-host.
-</Callout>
-
-## Quick start
-
-<Steps>
-
-<Step>
-### Pin driver + image
-
-```typescript title="oke.config.ts"
-drivers: {
-  ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
-},
-images: {
-  ai: "lmsysorg/sglang:v0.5.17-runtime", // never :latest
-},
-```
-
-Or `oke ai setup --provider sglang --yes`.
-
-</Step>
-
-<Step>
-### Env + GPU
-
-```bash title=".env.local"
-OKE_AI_URL=http://127.0.0.1:30000/v1
-OKE_AI_MODEL=Qwen/Qwen3-0.6B
-```
-
-Same NVIDIA reservation pattern as vLLM (`ipc: host` + device reservation).
-
-</Step>
-
-<Step>
-### Decision matrix
-
-| Workload                         | Recipe                                                                           |
-| -------------------------------- | -------------------------------------------------------------------------------- |
-| Single-user / dev                | [llama.cpp](/docs/recipes/llama-cpp) (default) or [Ollama](/docs/recipes/ollama) |
-| Multi-user GPU serving           | [vLLM](/docs/recipes/vllm)                                                       |
-| Structured / agent GPU workloads | **SGLang** (this recipe)                                                         |
-| Managed cloud                    | Anthropic / OpenAI / …                                                           |
-
-</Step>
-
-</Steps>
-
-## Security
-
-| Control      | Requirement                                    |
-| ------------ | ---------------------------------------------- |
-| Host publish | `127.0.0.1:30000:30000` only — never `0.0.0.0` |
-| Image pin    | Explicit version tag — never `latest`          |
-| Model source | Trusted Hugging Face repos / your own weights  |
-
-## What the recipe configures
-
-| Field          | Value                                                 |
-| -------------- | ----------------------------------------------------- |
-| Container port | `30000`                                               |
-| Host publish   | `127.0.0.1:30000:30000`                               |
-| `ipc`          | `host`                                                |
-| GPU            | `deploy.resources.reservations.devices` (nvidia, all) |
-| Healthcheck    | `GET /health`, long start period for model load       |
-| Connection URL | `http://host:30000/v1`                                |
-
-## Troubleshooting
-
-<Accordions>
-<Accordion title="GPU not visible / container exits">
-
-Install the NVIDIA Container Toolkit. Without a GPU, use
-[llama.cpp](/docs/recipes/llama-cpp) for local smoke tests.
-
-</Accordion>
-</Accordions>
-
-## Learn more
-
-- [vLLM](/docs/recipes/vllm) — general production GPU serving
-- [llama.cpp](/docs/recipes/llama-cpp) — default local AI
-- [AI](/docs/elements/ai) — drivers and `fx.ask`
-
-## Next
-
-<Cards>
-  <Card title="vLLM" description="General multi-user GPU serving." href="/docs/recipes/vllm" />
-  <Card title="llama.cpp" description="Default local AI." href="/docs/recipes/llama-cpp" />
-  <Card title="AI" description="Prompts and guardrails." href="/docs/elements/ai" />
-</Cards>

package/site/content/docs/recipes/vllm.mdx

@@ -1,106 +0,0 @@
----
-title: "vLLM"
-description: "Production-tier self-hosted inference — OpenAI-compatible GPU serving when you run inference yourself."
-icon: "Cpu"
-source: "docs/spec/unified-theory.md"
----
-
-vLLM is for **multi-user / production concurrency on real GPU hardware** when
-you choose to self-host inference instead of a managed provider. Driver id stays
-`openai-compatible`. Most apps should prefer Anthropic / OpenAI / … in prod.
-
-<Callout title="The one rule">
-  Pin an explicit image tag (never `latest`), publish only on loopback, and treat this as “I run
-  production inference myself” — not the default create path.
-</Callout>
-
-## Quick start
-
-<Steps>
-
-<Step>
-### Pin driver + image
-
-```typescript title="oke.config.ts"
-drivers: {
-  ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
-},
-images: {
-  ai: "vllm/vllm-openai:v0.27.1", // never :latest
-},
-```
-
-Or `oke ai setup --provider vllm --yes`.
-
-</Step>
-
-<Step>
-### Env + GPU
-
-```bash title=".env.local"
-OKE_AI_URL=http://127.0.0.1:8000/v1
-OKE_AI_MODEL=Qwen/Qwen3-0.6B
-```
-
-The recipe sets `ipc: host` and an NVIDIA device reservation. Host needs the
-NVIDIA Container Toolkit.
-
-</Step>
-
-<Step>
-### Decide deliberately
-
-| Path                                 | When                                         |
-| ------------------------------------ | -------------------------------------------- |
-| Managed provider                     | Default for most production apps             |
-| **vLLM** (this recipe)               | Self-hosted multi-user GPU serving           |
-| [SGLang](/docs/recipes/sglang)       | Self-hosted structured / agent GPU workloads |
-| [llama.cpp](/docs/recipes/llama-cpp) | Single-user / dev (default local)            |
-
-</Step>
-
-</Steps>
-
-## Security
-
-| Control      | Requirement                                   |
-| ------------ | --------------------------------------------- |
-| Host publish | `127.0.0.1:8000:8000` only — never `0.0.0.0`  |
-| Image pin    | Explicit version tag — never `latest`         |
-| Model source | Trusted Hugging Face repos / your own weights |
-
-## What the recipe configures
-
-| Field          | Value                                                 |
-| -------------- | ----------------------------------------------------- |
-| Container port | `8000`                                                |
-| Host publish   | `127.0.0.1:8000:8000`                                 |
-| `ipc`          | `host`                                                |
-| GPU            | `deploy.resources.reservations.devices` (nvidia, all) |
-| Healthcheck    | `GET /health`, long start period for model load       |
-| Connection URL | `http://host:8000/v1`                                 |
-
-## Troubleshooting
-
-<Accordions>
-<Accordion title="GPU not visible / container exits">
-
-Install the NVIDIA Container Toolkit on the host. CPU-only hosts should use
-[llama.cpp](/docs/recipes/llama-cpp) or [Ollama](/docs/recipes/ollama) instead.
-
-</Accordion>
-</Accordions>
-
-## Learn more
-
-- [llama.cpp](/docs/recipes/llama-cpp) — default local AI
-- [SGLang](/docs/recipes/sglang) — structured / agent GPU path
-- [AI](/docs/elements/ai) — drivers and `fx.ask`
-
-## Next
-
-<Cards>
-  <Card title="SGLang" description="Agent / structured GPU serving." href="/docs/recipes/sglang" />
-  <Card title="llama.cpp" description="Default local AI." href="/docs/recipes/llama-cpp" />
-  <Card title="AI" description="Prompts and guardrails." href="/docs/elements/ai" />
-</Cards>

package/site/content/docs/reference/cli.md

@@ -1,232 +0,0 @@
----
-title: "CLI Reference"
-description: "oke and create-oke — everyday commands and flags."
-icon: "Terminal"
-source: "docs/cli.md"
----
-
-### Commands
-
-```bash
-bun add okengine                 # ONE package (project)
-bun install -g okengine          # global `oke` on PATH
-
-oke                              # interactive TUI (TTY) — Dashboard · Dev · Database · Docker · Navigator
-oke --tui                        # force TUI even when other args were passed
-oke --help                       # command list (also what bare `oke` prints when non-TTY / CI)
-
-oke dev                          # watch · hot reload · Console :6533 · app :6530 · MCP :6535 · docs MCP :6536
-                                 #   → always Docker Compose under docker/ + host Bun
-                                 #   → regenerates flows/generated.ts when the flows tree changes
-                                 #   → client types + domain schema push on save
-                                 #   → Console UI hot-reloads from source (okengine checkout; no bun run build)
-oke dev --no-db-push             #     opt out of auto oke db push on schema input save
-oke dev -d store.sql,signal      #     optional role filter (still Compose; requires Docker)
-oke test                         # bun test with PGLite posture (NODE_ENV=test, OKE_PGLITE_URL=memory://)
-                                 #   → does not start Docker Compose
-oke mode                         # removed — prints error; use oke dev (Compose) / oke test (PGLite)
-
-oke start                        # runs exactly what production runs (this is the Docker CMD)
-oke doctor                       # verify secrets, ports, drivers, tenancy, schema drift, FD headroom,
-                                 #   CDC outbox backlog/retention, live fan-out pressure
-oke console claim-code           # print setup claim code from .oke/claim-code (after Console boot)
-                                 #   → `bun run dev:console` boots kernel + Vite with a fixed
-                                 #     operator (`dev@oke.dev` / `Okengine123!`) — Sign in (prefilled)
-                                 #   → `bun run dev:console:seed` same + keel PM (all 8 elements) + ~80 traces
-                                 #     + 500+ tasks + full CRUD / custom HTTP (GET·POST·PUT·PATCH·DELETE·HEAD·QUERY)
-                                 #     + app Gate auth / oke_* system tables
-                                 #     (form/github→tasks.create→notify chain, work-management
-                                 #     SQL/KV/files/index; `oke_console` is Console operators);
-                                 #     click Traces row → highlight chain on the radial hub;
-                                 #     click a unit / element disc → 1-hop neighborhood + filter runs;
-                                 #     Replay → waterfall playhead + chain pulse on the graph)
-                                 #   → `bun run dev:console:fresh` / `:fresh:seed` — claim from scratch
-                                 #     (no fixed operator; claim code printed in the boot log)
-                                 #   → after `bun run test:console:setup`, open the HTML report:
-                                 #     `bun run test:console:setup:report` (trace + screenshots + video)
-oke stack                        # preview resolved images/tags/ports — writes nothing
-
-oke schema generate              # core + plugin stubs → .oke/schema/oke.ts (--check in CI)
-oke db push                      # domain schema.ts → live DB (dev; drizzle-kit)
-oke db generate                  # versioned SQL under drizzle/ (review)
-oke db migrate                   # apply migrations (explicit; never auto in prod)
-oke db seed                      # this app's defineSeed (name + essential + env) — standard CLI path
-oke db seed --env prod --force   # CI: skip prod confirmation prompt
-oke db studio                    # drizzle-kit Studio (long-running)
-oke vault set STRIPE_KEY         # also: list · import .env · key rotate
-oke client add <url>             # types for a separate frontend repo
-
-oke docker                       # docker/Dockerfile + docker-compose.yml (prod-grade; 4 CPU / 8 GiB budget)
-oke docker --split               # layered compose.yml + compose.<role>.yml + compose.prod.yml
-oke docker --stack               # docker-stack.yml for docker stack deploy
-oke docker --cpus 8 --memory 16  # override host budget used for deploy.resources
-oke docker --no-prod             # skip readiness / deploy / resource budget
-oke docker clean                 # TTY: pick oke-dev-* projects → down -v (containers, networks, volumes)
-oke docker clean --yes           # non-TTY: current project only
-oke docker clean --all --yes     # non-TTY: every oke-dev-* project on this machine
-oke images pin                   # tags → digests in oke.images.lock
-
-oke build --target edge          # < 16 kB kernel profile
-oke eval                         # run prompt eval sets; fails CI on regression
-oke ai setup                     # configure AI driver + models (TTY wizard or flags)
-oke branch prod --at "yesterday" # fork journaled state into a sandbox
-oke replay --request-id <id>     # re-invoke a past Flow from a Runs WideEvent (dry-run if send/ask)
-oke privacy erase --subject <id> # crypto-shredding: deletes the key, not the terabytes
-oke upgrade                      # run codemods for a breaking change, print the diff
-```
-
-`oke replay` loads a Runs WideEvent by id and re-enters the Flow with stored
-input. Defaults to dry-run when the ledger has `send` / `ask` (pass `--live`
-to override). Needs a build that persisted `WideEvent.input`. Console Traces
-Replay (`POST /console/traces/replay`) uses the same `runReplay` path.
-
-`oke dev` request lines print the WideEvent / run id after the timestamp.
-Paste it into Traces or `oke replay --request-id`.
-
-`oke dev` bridges host-app WideEvents into Console Traces: the CLI starts
-Console first, mints a loopback ingest secret, and sets `OKE_RUNS_INGEST_URL` /
-`OKE_RUNS_INGEST_SECRET` on the host child so every recorded run POSTs to
-`POST /console/runs/ingest`. Console appends into its own runs store (live
-`feedRun` → PII-masked `projectRun` for `GET /console/runs` and
-`/console/live`). `listRuns` also reads host Parquet at `.oke/runs`, so
-Traces survive a Console restart. Production recording stays opt-in —
-`oke start` does not enable the bridge; set `oke({ runs })` or
-`drivers.runs` explicitly. `oke replay` reads the same `.oke/runs` tree.
-
-In development, app, Console, MCP, and docs MCP prefer the canonical ports and move upward
-when occupied. Docker infrastructure uses stable per-project offsets in disjoint ranges for
-each built-in service, preventing one service's offset port from overlapping another's.
-
-Bare `oke` on a TTY opens an Ink interactive shell (optional deps `ink` +
-`react`). The viewport is cleared before render so boot logs never sit above the
-frame. Chrome matches `oke dev`: green OKE wordmark on Dashboard, green active
-tabs, cyan focus rows. Panels cover live ports (App / Console / MCP / Docs MCP),
-Dev start/stop/attach with live logs, Database action cards (including Studio),
-Docker compose status, and a Manifest navigator. **Tab** / **←→** (on the tab
-strip) switch panels; **↑↓** navigate inside a panel; **Esc** returns to the tab
-strip, then confirms quit when a managed `oke dev` is running; **1–5** jump
-panels from any focus. Press `/` for the **command palette** (Tab autofill,
-Enter runs `oke …`; status shows in the global footer). If `oke dev` is already
-running, the TUI shows **Connected** via `.oke/dev.json` + port probes and will
-not spawn a second stack. Non-TTY / CI keeps the classic help listing
-(`EXIT_USAGE`).
-
-`oke dev` always starts Compose (requires a running Docker daemon). Boot chrome
-prints immediately (wordmark + Starting + profile), then streams background work
-(compose up, vault, per-service health, AI probe). Status ● is green ready ·
-yellow pending/loading · red error · dim idle. After bind, Backend · Console ·
-MCP · Docs MCP each get a box (URL + one-line purpose). Compose health keeps polling
-(`docker compose ps -a`); AI ● tracks model phase while the AI container is up.
-Boot does not wait for the model to become ready. A successful session writes
-`.oke/dev.json` (pid · ports · startedAt) and clears it on stop. Durable local
-markers live in `.oke/state.json` — not in the session lock. Console session signing uses
-`.oke/console.secret` (or `OKE_CONSOLE_SECRET`); that is not a Vault secret.
-
-On a TTY, Ink keyboard controls stay active after boot (`useInput` — same
-shortcuts as before). Press `r` to clear the log pane and reprint the latest
-board.
-
-| Key | Action                              |
-| --- | ----------------------------------- |
-| `?` | help                                |
-| `r` | refresh — clear logs, show latest ● |
-| `s` | `oke db seed`                       |
-| `q` | quit `oke dev`                      |
-| `u` | compose up (whole stack)            |
-| `x` | compose stop (whole stack)          |
-
-Compose stays quiet unless it fails. Process-local boot notices print once under
-the hero (not once per process).
-
-`oke test` sets `NODE_ENV=test` and `OKE_PGLITE_URL=memory://` when unset, checks
-that `@electric-sql/pglite` resolves, then forwards argv to `bun test`.
-
-`oke mode` and `oke dev --local` / `-l` are removed — they exit with an error.
-Rename the env keys in `oke.config.ts` to `dev` / `test` / `prod`.
-
-### create-oke
-
-```bash
-bunx create-oke@latest my-app                    # TTY: template → recommended / reuse / customize
-bunx create-oke@latest my-app --template advanced
-bunx create-oke@latest my-app --yes              # non-interactive recommended defaults
-bunx create-oke@latest my-app --sql postgres
-bunx create-oke@latest my-app --ai               # AI model wizard before install
-bunx create-oke@latest my-app --no-ai
-```
-
-On a TTY: pick **standard** or **advanced**, then recommended defaults or
-customize. Customize walks **Docker-first** facets once (including `store.index`
-with a `none` opt-out), then **AI setup**: Recommended (llama.cpp) · Customize ·
-Off. Writes user-global `~/.oke/create-defaults.json` (reuse only when `template`
-matches). Recommended / customize also ask locales, PgDog, and reverse proxy
-(Caddy / Traefik / nginx / No); **reuse** applies the saved answers without
-re-asking. Flags: `--locales`, `--pgdog` / `--no-pgdog`, `--proxy` /
-`--no-proxy`. Non-TTY / `--yes` / explicit `--template` never prompt.
-
-### Additional commands
-
-```bash
-oke doctor --diff                # CI gate: undeclared Manifest contract breaks
-oke doctor --json                # -j  JSON on stdout; hints on stderr (agents / MCP)
-oke stack --json                 # -j
-oke images list                  # recipe · image · tag · digest · size (--json|-j)
-oke gates list                   # Module:Action catalogue (--json|-j)
-oke console claim-code           # first-admin claim from .oke/claim-code (--json|-j)
-oke ai setup --provider llama-cpp --yes  # default local AI
-oke ai setup --provider ollama --yes     # fully supported alternative
-# TTY: llama.cpp / Ollama → banner · tiers · manual; vLLM / SGLang / cloud → model
-```
-
-### Shell completion
-
-Generated from the command registry — not a hand-maintained script:
-
-```bash
-eval "$(oke completion bash)"
-eval "$(oke completion zsh)"
-oke completion fish | source
-```
-
-### Short flags
-
-Long form is canonical in docs; short form is convenience only. Shared letters follow git’s pattern (different meanings on different subcommands — e.g. `-c` is `--check` on `schema generate`, `--config` on `stack` / `docker` / `images`).
-
-| Long                 | Short | Where                                                                |
-| -------------------- | ----- | -------------------------------------------------------------------- |
-| `--docker`           | `-d`  | `dev` (optional Compose **role filter**)                             |
-| `--no-db-push`       |       | `dev`                                                                |
-| `--prod`             | `-p`  | `docker`                                                             |
-| `--yes`              | `-y`  | `docker clean`                                                       |
-| `--all`              |       | `docker clean`                                                       |
-| `--port`             | `-p`  | `start`                                                              |
-| `--check`            | `-c`  | `schema generate`                                                    |
-| `--config`           | `-c`  | `stack`, `docker`, `images`, `db *` (drizzle)                        |
-| `--apply`            | `-a`  | `upgrade`                                                            |
-| `--at`               | `-a`  | `branch`                                                             |
-| `--after`            | `-a`  | `doctor --diff`                                                      |
-| `--target`           | `-t`  | `build`                                                              |
-| `--diff`             |       | `doctor`                                                             |
-| `--json`             | `-j`  | `doctor`, `stack`, `images list`, `gates list`, `console claim-code` |
-| `--manifest`         | `-m`  | most Manifest readers                                                |
-| `--entry`            | `-e`  | `dev`, `start`, `build`, `replay`                                    |
-| `--request-id`       | `-r`  | `replay`                                                             |
-| `--dry-run`          |       | `replay`                                                             |
-| `--live`             |       | `replay`                                                             |
-| `--out` / `--outdir` | `-o`  | writers                                                              |
-| `--subject`          | `-s`  | `privacy erase`                                                      |
-| `--before`           | `-b`  | `doctor --diff`                                                      |
-| `--base`             | `-B`  | `doctor --diff`                                                      |
-| `--env`              |       | `db *` (`dev` \| `test` \| `prod`)                                   |
-| `--force`            |       | `db seed`                                                            |
-| `--local` / `-l`     |       | **removed** on `dev` (use `oke test`)                                |
-
-### Exit codes
-
-| Exit  | Meaning                               |
-| ----- | ------------------------------------- |
-| **0** | success                               |
-| **1** | usage / validation                    |
-| **2** | runtime / environment / check failure |
-
-`oke help` prints the same flag and exit-code tables.