create-oke 0.11.1 → 0.12.0

package/src/cli.ts

@@ -25,10 +25,13 @@ import { existsSync, rmSync } from "node:fs";
 import { agentsMdContent } from "./agents-md.ts";
 import {
   createDefaultsPath,
+  isCreateProxyId,
   readCreateDefaults,
   writeCreateDefaults,
   type CreateDefaults,
+  type CreateProxyId,
   type EnvDriverPins,
+  CREATE_PROXY_IDS,
 } from "./create-defaults.ts";
 import { docsUrl } from "./docs-origin.ts";
 import { applyAiSetup, type AiSetupApplyInput } from "./ai-setup/apply.ts";
@@ -39,6 +42,7 @@ import {
 } from "./ai-setup/from-pref.ts";
 import { askAiSetup } from "./ai-setup/prompts.ts";
 import { askCustomizeFlow } from "./customize-flow.ts";
+import { recommendedDefaults } from "./drivers-catalog.ts";
 import { parseExtraLocales } from "./locales.ts";
 import {
   scaffold,
@@ -89,6 +93,11 @@ export type CliArgs = {
    * `undefined` = ask (interactive) / off (`--yes`).
    */
   readonly pgdog: boolean | undefined;
+  /**
+   * Proxy pin from CLI.
+   * `undefined` = ask (interactive) / none (`--yes`).
+   */
+  readonly proxy: CreateProxyId | undefined;
   readonly targetDir: string | undefined;
 };
 
@@ -152,6 +161,8 @@ export type InteractiveAnswers = {
   readonly locales: readonly string[];
   /** Pin PgDog in front of Postgres. */
   readonly pgdog: boolean;
+  /** Pin `images.proxy` (`none` = unset). */
+  readonly proxy: CreateProxyId;
 };
 
 /**
@@ -170,6 +181,8 @@ export type ScaffoldCallArgs = {
   readonly locales?: readonly string[];
   /** Pin PgDog in front of Postgres. */
   readonly pgdog?: boolean;
+  /** Pin `images.proxy`. */
+  readonly proxy?: CreateProxyId;
 };
 
 /**
@@ -190,6 +203,7 @@ export function parseArgs(argv: readonly string[]): CliArgs {
   let ai: AiCliMode = "prompt";
   let locales: readonly string[] = [];
   let pgdog: boolean | undefined;
+  let proxy: CreateProxyId | undefined;
   let targetDir: string | undefined;
 
   for (let i = 0; i < argv.length; i++) {
@@ -301,6 +315,26 @@ export function parseArgs(argv: readonly string[]): CliArgs {
       pgdog = false;
       continue;
     }
+    if (a === "--proxy") {
+      const next = argv[++i];
+      if (!next || !isCreateProxyId(next)) {
+        throw new Error(`create-oke: --proxy must be one of ${CREATE_PROXY_IDS.join("|")}`);
+      }
+      proxy = next;
+      continue;
+    }
+    if (a.startsWith("--proxy=")) {
+      const value = a.slice("--proxy=".length);
+      if (!isCreateProxyId(value)) {
+        throw new Error(`create-oke: --proxy must be one of ${CREATE_PROXY_IDS.join("|")}`);
+      }
+      proxy = value;
+      continue;
+    }
+    if (a === "--no-proxy") {
+      proxy = "none";
+      continue;
+    }
     if (a.startsWith("-")) {
       throw new Error(`create-oke: unknown option ${a}`);
     }
@@ -317,6 +351,11 @@ export function parseArgs(argv: readonly string[]): CliArgs {
   if (argv.includes("--pgdog") && argv.includes("--no-pgdog")) {
     throw new Error("create-oke: use either --pgdog or --no-pgdog, not both");
   }
+  if (argv.includes("--proxy") || argv.some((x) => x.startsWith("--proxy="))) {
+    if (argv.includes("--no-proxy")) {
+      throw new Error("create-oke: use either --proxy or --no-proxy, not both");
+    }
+  }
 
   if (name !== undefined) {
     targetDir = resolve(name);
@@ -335,6 +374,7 @@ export function parseArgs(argv: readonly string[]): CliArgs {
     ai,
     locales,
     pgdog,
+    proxy,
     targetDir,
   };
 }
@@ -353,9 +393,9 @@ export function formatCdPath(targetDir: string): string {
 /**
  * Post-scaffold next-steps block — shared by interactive and flag-driven paths.
  *
- * @param result - Successful scaffold result
+ * @param result - Successful scaffold result (only `label` + `targetDir` are read)
  */
-export function nextStepsText(result: ScaffoldResult): string {
+export function nextStepsText(result: Pick<ScaffoldResult, "label" | "targetDir">): string {
   return `
 Scaffolded ${result.label} → ${result.targetDir}
 
@@ -365,6 +405,7 @@ Next steps:
   bun install
   oke schema generate   # system stubs → .oke/schema/oke.ts (also runs on db push)
   oke dev               # app :6530 · Console :6533 · MCP :6535
+  bun run web           # Vite SPA — proxies /notes · /health to the app
 
 Docs: ${docsUrl("/docs")}
 `;
@@ -399,6 +440,8 @@ Options:
   --locales <tags>      Extra languages beyond English (e.g. ar or ar,fr)
   --pgdog               Pin PgDog pooling in front of Postgres
   --no-pgdog            Skip PgDog (default for --yes)
+  --proxy <id>          Pin reverse proxy: ${CREATE_PROXY_IDS.join("|")}
+  --no-proxy            Skip proxy (default for --yes)
   -h, --help            Show this help
 
 Template:
@@ -406,9 +449,10 @@ ${templateLines}
 
 On a TTY: pick standard|advanced, then recommended defaults, customize
 (Docker-first facets; store.index with none; AI setup Recommended /
-Customize / Off; saved to ~/.oke/create-defaults.json),
-optional extra locales + PgDog pooling, or reuse when saved for that template.
-Non-TTY / --yes stay English-only / no PgDog unless --locales / --pgdog.
+Customize / Off), optional locales + PgDog + proxy, or reuse when
+saved for that template. Reuse applies saved locales / PgDog / proxy
+without re-asking. Answers write to ~/.oke/create-defaults.json.
+Non-TTY / --yes stay English-only / no PgDog / no proxy unless flagged.
 `;
 }
 
@@ -453,6 +497,7 @@ export function scaffoldArgsFromCli(args: CliArgs): ScaffoldCallArgs {
     aiApply: args.ai === "force" ? nonInteractiveAiApply("llama-cpp") : null,
     locales: args.locales,
     pgdog: args.pgdog ?? false,
+    proxy: args.proxy ?? "none",
   };
 }
 
@@ -503,6 +548,7 @@ export function scaffoldArgsFromAnswers(
     aiApply: answers.aiApply,
     locales: answers.locales,
     pgdog: answers.pgdog,
+    proxy: answers.proxy,
   };
 }
 
@@ -519,6 +565,7 @@ export type AskInteractiveFn = (partial: {
   readonly template?: TemplateId;
   readonly locales?: readonly string[];
   readonly pgdog?: boolean;
+  readonly proxy?: CreateProxyId;
 }) => Promise<InteractiveAnswers | null>;
 
 /** Injectable persistence seams for tests. */
@@ -528,6 +575,52 @@ export type CreateDefaultsIo = {
   readonly write: (defaults: CreateDefaults) => void;
 };
 
+/**
+ * Merge wizard locales / PgDog / proxy into a create-defaults document to persist.
+ *
+ * Prefer the in-session answers (customize / reuse), else same-template
+ * previous settings, else recommended pins for the template.
+ *
+ * @param input - Template, locales, pgdog, proxy, and optional session / previous docs
+ */
+export function withWizardExtras(input: {
+  readonly template: TemplateId;
+  readonly locales: readonly string[];
+  readonly pgdog: boolean;
+  readonly proxy: CreateProxyId;
+  readonly session: CreateDefaults | undefined;
+  readonly previous: CreateDefaults | null;
+}): CreateDefaults {
+  const { template, locales, pgdog, proxy, session, previous } = input;
+  const base =
+    session ??
+    (previous?.template === template ? previous : null) ??
+    recommendedDefaults("docker-ready", template);
+  return {
+    ...base,
+    template,
+    locales,
+    pgdog,
+    proxy,
+    updatedAt: new Date().toISOString(),
+  };
+}
+
+/** @deprecated Prefer {@link withWizardExtras}. */
+export function withLocalesPgDog(input: {
+  readonly template: TemplateId;
+  readonly locales: readonly string[];
+  readonly pgdog: boolean;
+  readonly proxy?: CreateProxyId;
+  readonly session: CreateDefaults | undefined;
+  readonly previous: CreateDefaults | null;
+}): CreateDefaults {
+  return withWizardExtras({
+    ...input,
+    proxy: input.proxy ?? input.session?.proxy ?? input.previous?.proxy ?? "none",
+  });
+}
+
 /**
  * Collect interactive answers via `@clack/prompts`.
  *
@@ -544,6 +637,7 @@ export async function askInteractiveAnswers(
     readonly template?: TemplateId;
     readonly locales?: readonly string[];
     readonly pgdog?: boolean;
+    readonly proxy?: CreateProxyId;
   } = {},
   io: CreateDefaultsIo = {
     path: createDefaultsPath(),
@@ -582,6 +676,7 @@ export async function askInteractiveAnswers(
   let createDefaults: CreateDefaults | undefined;
   let aiApply: AiSetupApplyInput | null = null;
   let persistDefaults = false;
+  let reused = false;
 
   for (;;) {
     const previous = io.read();
@@ -608,6 +703,7 @@ export async function askInteractiveAnswers(
         continue;
       }
       createDefaults = prev;
+      reused = true;
       if (prev.ai.enabled && partial.ai !== "skip") {
         aiApply = applyInputFromAiPref(prev.ai);
         if (!aiApply?.chatModel && prev.ai.provider && prev.ai.provider !== "mock") {
@@ -644,36 +740,66 @@ export async function askInteractiveAnswers(
     aiApply = picked;
   }
 
-  const locales = await askExtraLocales(partial.locales ?? createDefaults?.locales ?? []);
-  if (locales === null) return null;
-
-  const usesPostgres = createDefaults
-    ? createDefaults.drivers.store.sql.dev === "postgres" ||
-      createDefaults.drivers.store.sql.prod === "postgres" ||
-      createDefaults.drivers.store.sql.dev === "pgvector" ||
-      createDefaults.drivers.store.sql.prod === "pgvector"
-    : true;
-  let pgdog = false;
-  if (usesPostgres) {
-    if (partial.pgdog !== undefined) {
-      pgdog = partial.pgdog;
+  // Reuse applies saved locales / PgDog / proxy without re-asking (CLI flags still win).
+  let locales: readonly string[];
+  let pgdog: boolean;
+  let proxy: CreateProxyId;
+
+  if (reused && createDefaults) {
+    locales =
+      partial.locales !== undefined && partial.locales.length > 0
+        ? partial.locales
+        : createDefaults.locales;
+    pgdog = partial.pgdog !== undefined ? partial.pgdog : createDefaults.pgdog;
+    proxy = partial.proxy !== undefined ? partial.proxy : createDefaults.proxy;
+  } else {
+    if (partial.locales !== undefined && partial.locales.length > 0) {
+      locales = partial.locales;
+    } else {
+      const pickedLocales = await askExtraLocales(createDefaults?.locales ?? []);
+      if (pickedLocales === null) return null;
+      locales = pickedLocales;
+    }
+
+    const usesPostgres = createDefaults
+      ? createDefaults.drivers.store.sql.dev === "postgres" ||
+        createDefaults.drivers.store.sql.prod === "postgres" ||
+        createDefaults.drivers.store.sql.dev === "pgvector" ||
+        createDefaults.drivers.store.sql.prod === "pgvector"
+      : true;
+    pgdog = false;
+    if (usesPostgres) {
+      if (partial.pgdog !== undefined) {
+        pgdog = partial.pgdog;
+      } else {
+        const picked = await askPgDog(createDefaults?.pgdog ?? false);
+        if (picked === null) return null;
+        pgdog = picked;
+      }
+    }
+
+    if (partial.proxy !== undefined) {
+      proxy = partial.proxy;
     } else {
-      const picked = await askPgDog(createDefaults?.pgdog ?? false);
+      const picked = await askProxy(createDefaults?.proxy ?? "none");
       if (picked === null) return null;
-      pgdog = picked;
+      proxy = picked;
     }
   }
 
+  const persisted = withWizardExtras({
+    template,
+    locales,
+    pgdog,
+    proxy,
+    session: createDefaults,
+    previous: io.read(),
+  });
   if (createDefaults) {
-    createDefaults = {
-      ...createDefaults,
-      locales,
-      pgdog,
-      updatedAt: new Date().toISOString(),
-    };
+    createDefaults = persisted;
   }
-  if (persistDefaults && createDefaults) {
-    io.write(createDefaults);
+  io.write(persisted);
+  if (persistDefaults) {
     note(`Saved globally for next projects → ${io.path}`, "Defaults");
   }
 
@@ -694,6 +820,7 @@ export async function askInteractiveAnswers(
     aiApply,
     locales,
     pgdog,
+    proxy,
   };
 }
 
@@ -744,6 +871,27 @@ async function askPgDog(initial: boolean = false): Promise<boolean | null> {
   return Boolean(value);
 }
 
+/**
+ * Ask which reverse proxy to pin (or none).
+ *
+ * @param initial - Prefill from reused create-defaults
+ * @returns Proxy id, or `null` on cancel
+ */
+async function askProxy(initial: CreateProxyId = "none"): Promise<CreateProxyId | null> {
+  const value = await select({
+    message: "Add a reverse proxy in front of the app?",
+    options: [
+      { value: "none", label: "No", hint: "app publishes :6530" },
+      { value: "caddy", label: "Caddy", hint: "automatic HTTPS · Caddyfile" },
+      { value: "traefik", label: "Traefik", hint: "Docker labels · --scale app=N" },
+      { value: "nginx", label: "nginx", hint: "static nginx.conf reverse proxy" },
+    ],
+    initialValue: initial,
+  });
+  if (isCancel(value)) return null;
+  return value as CreateProxyId;
+}
+
 /**
  * Provider passed to `oke ai setup` — prefer native Ollama when either env uses it.
  *
@@ -871,8 +1019,9 @@ async function runInteractive(
     agentsMd: args.agentsMd,
     sqlDriver: args.sqlDriverExplicit ? args.sqlDriver : undefined,
     ai: args.ai,
-    locales: args.locales,
+    ...(args.locales.length > 0 ? { locales: args.locales } : {}),
     ...(args.pgdog !== undefined ? { pgdog: args.pgdog } : {}),
+    ...(args.proxy !== undefined ? { proxy: args.proxy } : {}),
   });
   if (answers === null) {
     cancel("Cancelled.");
@@ -911,6 +1060,7 @@ async function runScaffold(
     aiApply,
     locales,
     pgdog,
+    proxy,
     interactive,
     install,
     startDev,
@@ -947,6 +1097,7 @@ async function runScaffold(
       ...(createDefaults !== undefined ? { createDefaults } : {}),
       ...(locales !== undefined ? { locales } : {}),
       ...(pgdog !== undefined ? { pgdog } : {}),
+      ...(proxy !== undefined ? { proxy } : {}),
     });
     if (spun) spun.stop("Scaffolded.");
 

package/src/create-defaults.test.ts

@@ -45,6 +45,13 @@ describe("parseCreateDefaults", () => {
     const parsed = parseCreateDefaults(rest);
     expect(parsed?.template).toBe("standard");
   });
+
+  test("older files without proxy default to none", () => {
+    const d = recommendedDefaults("docker-ready", "standard");
+    const { proxy: _p, ...rest } = d;
+    const parsed = parseCreateDefaults(rest);
+    expect(parsed?.proxy).toBe("none");
+  });
 });
 
 describe("read/write round-trip", () => {
@@ -71,6 +78,7 @@ describe("read/write round-trip", () => {
         ai: { enabled: true, provider: "ollama", driver: "ollama" },
         locales: ["ar"],
         pgdog: true,
+        proxy: "caddy",
       });
       writeCreateDefaults(original, path);
       const loaded = readCreateDefaults(path);
@@ -82,6 +90,7 @@ describe("read/write round-trip", () => {
       expect(loaded!.profile).toBe("docker-ready");
       expect(loaded!.locales).toEqual(["ar"]);
       expect(loaded!.pgdog).toBe(true);
+      expect(loaded!.proxy).toBe("caddy");
     } finally {
       rmSync(home, { recursive: true, force: true });
     }

package/src/create-defaults.ts

@@ -13,6 +13,9 @@ import { isTemplateId, type TemplateId } from "./templates.ts";
 /** Create profile — Docker Compose is always the `dev` runtime. */
 export type CreateProfile = "docker-ready";
 
+/** Opt-in reverse proxy pinned into `images.proxy`. */
+export type CreateProxyId = "none" | "caddy" | "traefik" | "nginx";
+
 /** Env columns written into `oke.config.ts` driver maps. */
 export type EnvDriverPins = {
   readonly dev: string;
@@ -71,12 +74,20 @@ export type CreateDefaults = {
    * Default false — opt in via the wizard or `--pgdog`.
    */
   readonly pgdog: boolean;
+  /**
+   * Pin `images.proxy` (Caddy / Traefik / nginx). `none` leaves the role unset.
+   * Default `none` — opt in via the wizard or `--proxy`.
+   */
+  readonly proxy: CreateProxyId;
   readonly updatedAt: string;
 };
 
 /** Relative path under the user home directory. */
 export const CREATE_DEFAULTS_RELATIVE = ".oke/create-defaults.json";
 
+/** Valid proxy wizard / CLI values. */
+export const CREATE_PROXY_IDS = ["none", "caddy", "traefik", "nginx"] as const;
+
 /**
  * Absolute path to the create-defaults file.
  *
@@ -130,6 +141,15 @@ export function toCreateDefaults(
   };
 }
 
+/**
+ * Whether `value` is a known {@link CreateProxyId}.
+ *
+ * @param value - Candidate
+ */
+export function isCreateProxyId(value: string): value is CreateProxyId {
+  return (CREATE_PROXY_IDS as readonly string[]).includes(value);
+}
+
 /**
  * Validate a parsed JSON value as {@link CreateDefaults}.
  *
@@ -213,6 +233,12 @@ export function parseCreateDefaults(raw: unknown): CreateDefaults | null {
     if (typeof o.pgdog !== "boolean") return null;
     pgdog = o.pgdog;
   }
+  // Older files omit proxy — treat as none (opt-in).
+  let proxy: CreateProxyId = "none";
+  if (o.proxy !== undefined && o.proxy !== null) {
+    if (typeof o.proxy !== "string" || !isCreateProxyId(o.proxy)) return null;
+    proxy = o.proxy;
+  }
   return {
     version: 1,
     template,
@@ -237,6 +263,7 @@ export function parseCreateDefaults(raw: unknown): CreateDefaults | null {
     },
     locales,
     pgdog,
+    proxy,
     updatedAt: o.updatedAt,
   };
 }

package/src/customize-flow.test.ts

@@ -48,13 +48,20 @@ describe("catalog labels", () => {
 
 describe("recommendedAiApply", () => {
   test("returns llama.cpp (openai-compatible) with curated ai/ model", () => {
-    const apply = recommendedAiApply();
-    expect(apply.driver).toBe("openai-compatible");
-    expect(apply.chatModel).toBe("granite3.3:2b");
-    expect(apply.baseUrl).toContain("8080");
-    expect(apply.image).toContain("llama.cpp");
-    expect(apply.image).not.toContain("latest");
-    expect(apply.visionModel).toBeNull();
+    const prev = process.env.OKE_AI_URL;
+    delete process.env.OKE_AI_URL;
+    try {
+      const apply = recommendedAiApply();
+      expect(apply.driver).toBe("openai-compatible");
+      expect(apply.chatModel).toBe("granite3.3:2b");
+      expect(apply.baseUrl).toContain("8080");
+      expect(apply.image).toContain("llama.cpp");
+      expect(apply.image).not.toContain("latest");
+      expect(apply.visionModel).toBeNull();
+    } finally {
+      if (prev !== undefined) process.env.OKE_AI_URL = prev;
+      else delete process.env.OKE_AI_URL;
+    }
   });
 });
 

package/src/customize-flow.ts

@@ -240,9 +240,10 @@ export async function askCustomizeFlow(
     profile: "docker-ready",
     drivers: { ...drivers, ai: aiPins },
     ai: aiPref,
-    // Locales / PgDog are asked once in the main wizard (not per customize pass).
+    // Locales / PgDog / proxy are asked once in the main wizard (not per customize pass).
     locales: [],
     pgdog: false,
+    proxy: "none",
   });
 }
 

package/src/drivers-catalog.ts

@@ -89,7 +89,7 @@ export const JOURNAL_CHOICES: readonly DriverChoice[] = [
  * Vault backends. `vault` is okengine's own encrypted-at-rest store: it lives
  * in the app's Postgres, so it needs no extra container, and it is the only
  * backend with `oke vault init` / `seal` / `audit`. `managed` reads from a
- * provider secret store (e.g. AWS Secrets Manager).
+ * provider secret store (AWS, Azure, GCP, Doppler, 1Password).
  */
 export const VAULT_CHOICES: readonly DriverChoice[] = [
   { value: "env", label: "env (dotenv layers only)" },
@@ -112,13 +112,13 @@ export const EMAIL_CHOICES: readonly DriverChoice[] = [
  * Pinned local-inference images — must match `src/docker/recipes/*` pins.
  * Never `latest` (GGUF-parser CVE floors: llama.cpp ≥ b8146, Ollama ≥ 0.17.1).
  */
-export const LLAMA_CPP_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b10290";
+export const LLAMA_CPP_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b10450";
 /** @see LLAMA_CPP_IMAGE */
-export const OLLAMA_IMAGE = "ollama/ollama:0.32.6";
+export const OLLAMA_IMAGE = "ollama/ollama:0.32.13";
 /** @see LLAMA_CPP_IMAGE */
-export const VLLM_IMAGE = "vllm/vllm-openai:v0.26.0";
+export const VLLM_IMAGE = "vllm/vllm-openai:v0.27.1";
 /** @see LLAMA_CPP_IMAGE */
-export const SGLANG_IMAGE = "lmsysorg/sglang:v0.5.16-runtime";
+export const SGLANG_IMAGE = "lmsysorg/sglang:v0.5.17-runtime";
 
 /** AI menu providers → protocol driver. */
 export const AI_PROVIDERS = [
@@ -191,6 +191,7 @@ export function recommendedDefaults(
     ai: { enabled: false, provider: null, driver: null },
     locales: [],
     pgdog: false,
+    proxy: "none",
     updatedAt: new Date().toISOString(),
   };
 }
@@ -229,10 +230,18 @@ export function aiDriverForProvider(provider: string): string {
 /** Default image pins keyed by role (standard template). */
 export const DEFAULT_IMAGES: Readonly<Record<string, string>> = {
   "store.sql": "postgres:18-alpine",
-  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
   "store.kv": "redis:8-alpine",
-  "store.files": "rustfs/rustfs:1.0.0-beta.11",
-  "channel.email": "axllent/mailpit:v1.22.3",
-  "store.index": "getmeili/meilisearch:v1.37",
+  "store.files": "rustfs/rustfs:1.0.0-rc.2",
+  "channel.email": "axllent/mailpit:v1.30.7",
+  "store.index": "getmeili/meilisearch:v1.53",
   ai: LLAMA_CPP_IMAGE,
+  proxy: "caddy:2-alpine",
+};
+
+/** Default `images.proxy` pins by wizard id (excluding `none`). */
+export const PROXY_IMAGES: Readonly<Record<"caddy" | "traefik" | "nginx", string>> = {
+  caddy: "caddy:2-alpine",
+  traefik: "traefik:v3.7",
+  nginx: "nginx:1.31-alpine",
 };

package/src/local-okengine.test.ts

@@ -29,6 +29,7 @@ describe("materializeLocalOkengineDependency", () => {
         workspaces?: unknown;
         peerDependencies?: Record<string, string>;
         exports?: Record<string, string>;
+        trustedDependencies?: readonly string[];
       };
       expect(pkg.name).toBe("okengine");
       expect(pkg.devDependencies).toBeUndefined();
@@ -40,6 +41,7 @@ describe("materializeLocalOkengineDependency", () => {
       expect(pkg.dependencies?.["drizzle-kit"]).toBe("1.0.0-rc.4");
       expect(pkg.dependencies?.["zod"]).toBeDefined();
       expect(pkg.exports?.["./config"]).toBe("./src/config/index.ts");
+      expect(pkg.trustedDependencies).toContain("@duckdb/node-api");
 
       // Real copies — Bun file: install drops directory symlinks.
       const src = join(stage, "src");

package/src/local-okengine.ts

@@ -33,6 +33,7 @@ type ConsumerOkenginePackageJson = {
   readonly peerDependencies?: Record<string, string>;
   readonly peerDependenciesMeta?: Record<string, unknown>;
   readonly engines?: unknown;
+  readonly trustedDependencies?: readonly string[];
 };
 
 /**
@@ -92,6 +93,8 @@ export function materializeLocalOkengineDependency(localOkengineRoot: string): s
     ...(raw["exports"] !== undefined ? { exports: raw["exports"] } : {}),
     ...(Object.keys(stageDependencies).length > 0 ? { dependencies: stageDependencies } : {}),
     ...(raw["engines"] !== undefined ? { engines: raw["engines"] } : {}),
+    // Bun blocks native postinstalls unless listed — DuckDB runs queries need it.
+    trustedDependencies: ["@duckdb/node-api"],
   };
 
   const stage = localOkengineStageDir();