create-oke 0.11.2 → 0.12.0

package/src/transform.test.ts

@@ -54,6 +54,7 @@ function defaultsWithIndex(indexDev: string) {
     ai: { enabled: false, provider: null, driver: null },
     locales: [],
     pgdog: false,
+    proxy: "none",
   });
 }
 
@@ -71,7 +72,7 @@ describe("applyCreateAnswers images", () => {
 
   test("index meilisearch pins store.index image without comment leakage", () => {
     const next = applyCreateAnswers(templateConfig(), defaultsWithIndex("meilisearch"));
-    expect(next).toMatch(/images:\s*\{\s*store:\s*\{[^}]*\bindex: "getmeili\/meilisearch:v1.37"/s);
+    expect(next).toMatch(/images:\s*\{\s*store:\s*\{[^}]*\bindex: "getmeili\/meilisearch:v1.53"/s);
     expect(next).not.toMatch(/images:\s*\{[^}]*\btest:\s*"memory"/s);
   });
 });
@@ -128,6 +129,7 @@ describe("vault backend defaults", () => {
         ai: { enabled: false, provider: null, driver: null },
         locales: [],
         pgdog: false,
+        proxy: "none",
       }),
     );
     expect(next).toMatch(/vault:\s*\{\s*dev: "managed"/);
@@ -148,7 +150,7 @@ describe("upsertAiDrivers", () => {
     expect(config.drivers?.ai).toEqual(ollamaPins);
     expect(config.drivers?.channel?.ai).toBeUndefined();
     // Sparse templates omit drivers.channel — images.channel stays a string pin.
-    expect(config.images?.channel?.email).toBe("axllent/mailpit:v1.22.3");
+    expect(config.images?.channel?.email).toBe("axllent/mailpit:v1.30.7");
     expect(config.images?.ai).toBeUndefined();
   });
 
@@ -176,6 +178,7 @@ describe("upsertAiDrivers", () => {
           ai: { enabled: true, provider: "llama-cpp", driver: "openai-compatible" },
           locales: [],
           pgdog: false,
+          proxy: "none",
         }),
       );
       const config = evalConfig(next);
@@ -185,7 +188,7 @@ describe("upsertAiDrivers", () => {
         prod: "openai-compatible",
       });
       expect(config.drivers?.channel?.ai, id).toBeUndefined();
-      expect(config.images?.ai, id).toBe("ghcr.io/ggml-org/llama.cpp:server-b10290");
+      expect(config.images?.ai, id).toBe("ghcr.io/ggml-org/llama.cpp:server-b10450");
     }
   });
 });

package/src/transform.ts

@@ -14,11 +14,12 @@
 
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import type { CreateDefaults, EnvDriverPins } from "./create-defaults.ts";
+import type { CreateDefaults, CreateProxyId, EnvDriverPins } from "./create-defaults.ts";
 import {
   DEFAULT_IMAGES,
   LLAMA_CPP_IMAGE,
   OLLAMA_IMAGE,
+  PROXY_IMAGES,
   SGLANG_IMAGE,
   VLLM_IMAGE,
 } from "./drivers-catalog.ts";
@@ -511,6 +512,9 @@ function syncImages(source: string, defaults: CreateDefaults): string {
   ) {
     pin("ai", aiImageForDefaults(defaults));
   }
+  if (defaults.proxy !== "none") {
+    pin("proxy", PROXY_IMAGES[defaults.proxy]);
+  }
 
   return replaceImagesBlock(source, images);
 }
@@ -659,6 +663,25 @@ export function applyPgDogToConfig(source: string, enabled: boolean): string {
   return replaceImagesBlock(source, images);
 }
 
+/**
+ * Add or remove the `images.proxy` pin (Caddy / Traefik / nginx).
+ *
+ * @param source - `oke.config.ts` source
+ * @param proxy - Wizard / CLI proxy id (`none` clears the pin)
+ */
+export function applyProxyToConfig(source: string, proxy: CreateProxyId): string {
+  const images = extractImages(source);
+  if (proxy === "none") {
+    if (!images.proxy) return source;
+    delete images.proxy;
+  } else {
+    const image = PROXY_IMAGES[proxy];
+    if (images.proxy === image) return source;
+    images.proxy = image;
+  }
+  return replaceImagesBlock(source, images);
+}
+
 /**
  * Sanitize a directory / package name for npm.
  *

package/templates/advanced/.env.example

@@ -1,14 +1,15 @@
 # Environment template — create-oke copies this to `.env.local` when you scaffold.
 #
 # Resolution order (first hit wins):
-#   process.env → .env.local → docker/.env.docker → vault driver → dev fallback
+#   vault driver → process.env → .env.local → dev fallback
 #
 # --- Vault (app secrets) ---
 # Declare secrets in src/vault.ts with `vault.secret(...)`, then uncomment lines here.
 #
 # ── vault — built-in encrypted-at-rest store ────────────────
 # `drivers.vault` is "vault": secrets live encrypted in Postgres, no extra service.
-# Nothing below is required to start — the dotenv layers above resolve first.
+# Nothing below is required to start — a value already in the vault backend wins
+# over leftover process.env / dotenv pins.
 #
 #   oke vault init                 # creates the store, prints the master key ONCE
 #   export OKE_VAULT_MASTER_KEY=…  # every later command / boot unseals with this
@@ -19,20 +20,27 @@
 # secret manager at boot. Committing it defeats encryption at rest.
 # OKE_VAULT_MASTER_KEY=
 #
-# For `drivers.vault: "managed"` instead, point at your provider secret store:
+# For `drivers.vault: "managed"` instead, point at an official provider:
+#   aws-secrets-manager · azure-key-vault · gcp-secret-manager · doppler · 1password
 # OKE_VAULT_PROVIDER=aws-secrets-manager
 # OKE_VAULT_REGION=us-east-1
-# Optional prefix for secret names (defaults to oke/<env>/):
+# Scope: AWS/Azure prefix, GCP project[/prefix], Doppler project/config, 1Password vault
 # OKE_VAULT_MOUNT=oke/prod/
+# Azure Key Vault URI / 1Password Connect host / optional Doppler origin:
+# OKE_VAULT_URL=
+# Doppler token / 1Password Connect token:
+# OKE_VAULT_TOKEN=
 #
 # --- Infrastructure ---
-# Same keys as `docker/.env.docker` after `oke dev --docker`.
+# Same keys `oke dev --docker` merges into `.env.local`.
 # Uncomment to override compose credentials for a host-managed service.
 # Host ports under docker mode are unique per project — do not assume defaults.
 
 # ── App / Console ───────────────────────────────────────────
 # PORT=6530
 # OKE_APP_URL=http://127.0.0.1:6530
+# Vite web (`bun run web`): empty = same-origin proxy to oke dev
+# VITE_API_URL=
 # OKE_CONSOLE_SECRET=
 # MAINTENANCE_MODE=0
 # APP_WEBHOOK_SECRET=dev-webhook-secret-change-me

package/templates/advanced/README.md

@@ -8,6 +8,7 @@ Scaffold, not a finished product: keep the Flows you want, replace the rest.
 bun install
 oke mode docker   # seeded by create-oke recommended path
 oke dev           # auto db push; asks once whether to seed
+bun run web       # Vite SPA — proxies /notes · /health to the app
 ```
 
 | Surface | URL |
@@ -15,6 +16,7 @@ oke dev           # auto db push; asks once whether to seed
 | App | http://127.0.0.1:6530 |
 | Console | http://127.0.0.1:6533 |
 | MCP | http://127.0.0.1:6535 |
+| Web | `bun run web` (Vite; API via proxy) |
 
 ## Extra routes (vs standard)
 
@@ -43,6 +45,7 @@ Without AI, summarize returns a local excerpt (`via: "fallback"`).
 | `src/core/` | `store` (db + files) · gates · vault · channels |
 | `src/db/` | schema · seed · migrations |
 | `.github/workflows/ci.yml` | `bun run typecheck` + `bun test` on push/PR |
+| `web/` | Vite 8 SPA — same as standard |
 
 ## Drivers
 

package/templates/advanced/oke.config.ts

@@ -30,14 +30,15 @@ export default defineConfig({
     store: {
       sql: "postgres:18-alpine",
       kv: "redis:8-alpine",
-      files: "rustfs/rustfs:1.0.0-beta.11",
-      // index: "getmeili/meilisearch:v1.37",
+      files: "rustfs/rustfs:1.0.0-rc.2",
+      // index: "getmeili/meilisearch:v1.53",
     },
     channel: {
-      email: "axllent/mailpit:v1.22.3",
+      email: "axllent/mailpit:v1.30.7",
     },
-    // pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51", // create-oke wizard / --pgdog
-    // ai: "ghcr.io/ggml-org/llama.cpp:server-b10290", // or ollama/ollama:0.32.6
+    // pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53", // create-oke wizard / --pgdog
+    // proxy: "caddy:2-alpine", // or traefik:v3.7 / nginx:1.31-alpine
+    // ai: "ghcr.io/ggml-org/llama.cpp:server-b10450", // or ollama/ollama:0.32.13
   },
   i18n: { locales: ["en"], default: "en" },
 });

package/templates/advanced/package.json

@@ -5,19 +5,30 @@
   "type": "module",
   "dependencies": {
     "okengine": "file:../../../..",
+    "@duckdb/node-api": "^1.5.5-r.2",
     "drizzle-orm": "1.0.0-rc.4",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.4",
     "@electric-sql/pglite-pgvector": "^0.0.5",
     "@types/bun": "latest",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^6.0.5",
     "drizzle-kit": "1.0.0-rc.4",
-    "typescript": "^7.0.2"
+    "typescript": "^7.0.2",
+    "vite": "^8.2.0"
   },
+  "trustedDependencies": ["@duckdb/node-api"],
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc -b -p web/tsconfig.json",
     "test": "oke test",
-    "dev": "oke dev"
+    "dev": "oke dev",
+    "web": "bunx --bun vite --config web/vite.config.ts",
+    "web:build": "tsc -b -p web/tsconfig.json && bunx --bun vite build --config web/vite.config.ts",
+    "web:preview": "bunx --bun vite preview --config web/vite.config.ts"
   }
 }

package/templates/advanced/src/app.ts

@@ -1,8 +1,9 @@
 import "@/core";
+import { notesMutate } from "@/core";
 
 import { oke } from "okengine/http";
 import * as routes from "@/flows/generated";
 
-export const app = oke({ name: "notes" }).adopt(routes);
+export const app = oke({ name: "notes", gate: { policies: [notesMutate] } }).adopt(routes);
 
 export type App = typeof app;

package/templates/advanced/src/core.ts

@@ -29,10 +29,22 @@ export const files = store.files("uploads");
  * export const notesWrite = gate.policy("notes:write", ({ auth }) =>
  *   auth.scopes.has("notes:write"),
  * );
+ * export const notesMutate = gate.all(notesWrite, notesWriteRate);
  * ```
  */
 export const notesWrite = gate.policy("notes:write", () => true);
 
+/** Note write throttle. */
+export const notesWriteRate = gate.rate({
+  max: 60,
+  per: "1m",
+  keyBy: "ip",
+  description: "Note write throttle",
+});
+
+/** Reuse on every notes mutate route. */
+export const notesMutate = gate.all(notesWrite, notesWriteRate);
+
 // --- Vault -------------------------------------------------------------------
 
 /** HMAC secret for outbound note webhooks (`fx.vault.get` on create). */

package/templates/advanced/src/db/seed/index.ts

@@ -61,6 +61,8 @@ async function sampleNotes(fx: Fx) {
 }
 
 export default defineSeed({
+  name: "notes",
+  description: "Welcome + sample notes",
   essential: welcomeNote,
   dev: sampleNotes,
   // prod: async (fx) => { /* real production-only data, e.g. register a webhook */ },

package/templates/advanced/src/flows/main/index.ts

@@ -1,9 +1,9 @@
-import { on, flow, http, gate } from "okengine";
+import { on, flow, http } from "okengine";
 import { z } from "zod";
 
-/** First-run welcome — visit :6530/ after `oke dev`. */
+/** First-run welcome — visit :6530/ after `oke dev` (browser code block; curl stays JSON). */
 export const root = on(
-  http.get("/").gate(gate.public),
+  http.get("/").gate.public,
   flow("main.root", {
     out: z.object({
       ok: z.literal(true),
@@ -22,7 +22,7 @@ export const root = on(
 
 /** Liveness for probes and `bun test`. */
 export const health = on(
-  http.get("/health").gate(gate.public),
+  http.get("/health").gate.public,
   flow("main.health", {
     out: z.object({ ok: z.literal(true) }),
     do: () => ({ ok: true as const }),

package/templates/advanced/src/flows/notes/index.ts

@@ -1,7 +1,7 @@
-import { on, flow, http, every, gate, fail } from "okengine";
+import { on, flow, http, every, fail } from "okengine";
 import { eq, isNull } from "drizzle-orm";
 
-import { db, files, noteCreatedMail, webhookSecret } from "@/core";
+import { db, files, noteCreatedMail, notesMutate, webhookSecret } from "@/core";
 import { notes } from "@/db/schema.decl";
 import {
   NoteAttachIn,
@@ -64,28 +64,28 @@ function unwrapSummaryText(text: string): string {
 
 /** List active (non-archived) notes, newest first. */
 export const list = on(
-  http.get("/notes").gate(gate.public),
+  http.get("/notes").gate.public,
   flow("notes.list", {
     out: NoteListOut,
-    do: async (_input, fx) => {
+    do: async (input, fx) => {
       const rows = await fx.store(db).select().from(notes).where(isNull(notes.archivedAt));
-      const sorted = [...rows].sort((a, b) => Number(b.createdAt) - Number(a.createdAt));
-      return {
-        notes: sorted.map((r) => ({
+      const data = [...rows]
+        .sort((a, b) => Number(b.createdAt) - Number(a.createdAt))
+        .map((r) => ({
           id: String(r.id),
           title: String(r.title),
           body: String(r.body),
           archivedAt: r.archivedAt == null ? null : Number(r.archivedAt),
           createdAt: Number(r.createdAt),
-        })),
-      };
+        }));
+      return fx.json.withQuery(data, input);
     },
   }),
 );
 
 /** Create a note, emit `note-created`, touch vault. */
 export const create = on(
-  http.post("/notes").gate(gate.public),
+  http.post("/notes").gate(notesMutate),
   flow("notes.create", {
     in: NoteCreateIn,
     out: NoteOut,
@@ -115,7 +115,7 @@ export const create = on(
 
 /** Fetch one note by id. */
 export const get = on(
-  http.get("/notes/:id").gate(gate.public),
+  http.get("/notes/:id").gate.public,
   flow("notes.get", {
     in: NoteIdIn,
     out: NoteOut,
@@ -136,7 +136,7 @@ export const get = on(
 
 /** Soft-archive a note. */
 export const archive = on(
-  http.post("/notes/:id/archive").gate(gate.public),
+  http.post("/notes/:id/archive").gate(notesMutate),
   flow("notes.archive", {
     in: NoteIdIn,
     out: NoteOut,
@@ -176,7 +176,7 @@ export const onCreated = on(
 
 /** Store a text attachment next to a note (`files:uploads`). */
 export const attach = on(
-  http.post("/notes/:id/attach").gate(gate.public),
+  http.post("/notes/:id/attach").gate(notesMutate),
   flow("notes.attach", {
     in: NoteAttachIn,
     out: NoteAttachOut,
@@ -208,7 +208,7 @@ export const digest = on(
  * Exhausted / failed asks surface as Unavailable — never a body excerpt.
  */
 export const summarize = on(
-  http.post("/notes/:id/summarize").gate(gate.public),
+  http.post("/notes/:id/summarize").gate(notesMutate),
   flow("notes.summarize", {
     in: NoteSummarizeIn,
     out: NoteSummarizeOut,

package/templates/advanced/src/flows/notes/shapes.ts

@@ -13,9 +13,8 @@ export const NoteOut = z.object({
   createdAt: z.number(),
 });
 
-export const NoteListOut = z.object({
-  notes: z.array(NoteOut),
-});
+/** List `data` is the item array. Pagination lives in HTTP `meta`. */
+export const NoteListOut = z.array(NoteOut);
 
 export const NoteIdIn = z.object({
   id: z.string().min(1),

package/templates/advanced/web/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Notes</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/templates/advanced/web/src/App.css

@@ -0,0 +1,78 @@
+.page {
+  max-width: 40rem;
+  margin: 0 auto;
+  padding: 2rem 1.25rem 4rem;
+}
+
+.head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 1rem;
+}
+
+.head h1 {
+  margin: 0;
+  font-size: 1.5rem;
+}
+
+.ok,
+.down {
+  margin: 0;
+  font-size: 0.875rem;
+}
+
+.ok {
+  color: #047857;
+}
+
+.down {
+  color: #b45309;
+}
+
+.compose {
+  display: grid;
+  gap: 0.5rem;
+  margin: 1.5rem 0;
+}
+
+.compose input,
+.compose textarea,
+.compose button,
+.list button {
+  font: inherit;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid #cbd5e1;
+  border-radius: 0.375rem;
+  background: #fff;
+}
+
+.compose button,
+.list button {
+  cursor: pointer;
+  width: fit-content;
+}
+
+.err {
+  color: #b91c1c;
+}
+
+.list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+  display: grid;
+  gap: 0.75rem;
+}
+
+.list li {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 0.75rem 0;
+  border-top: 1px solid #e2e8f0;
+}
+
+.list p {
+  margin: 0.25rem 0 0;
+}

package/templates/advanced/web/src/App.tsx

@@ -0,0 +1,100 @@
+import { useCallback, useEffect, useState, type FormEvent, type JSX } from "react";
+import { isOk } from "okengine/client";
+import { api, type Note } from "./client.ts";
+import "./App.css";
+
+/**
+ * Notes SPA — health + list + create + archive against the oke app.
+ */
+export function App(): JSX.Element {
+  const [health, setHealth] = useState<"unknown" | "ok" | "down">("unknown");
+  const [notes, setNotes] = useState<readonly Note[]>([]);
+  const [title, setTitle] = useState("");
+  const [body, setBody] = useState("");
+  const [message, setMessage] = useState<string | null>(null);
+
+  const refresh = useCallback(async () => {
+    const live = await api.main.health({});
+    setHealth(isOk(live) && live.data.ok ? "ok" : "down");
+    const listed = await api.notes.list({});
+    if (isOk(listed) && Array.isArray(listed.data)) {
+      setNotes(listed.data as readonly Note[]);
+      setMessage(null);
+      return;
+    }
+    setMessage(listed.error?.code ?? "notes.list failed");
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  async function onCreate(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    const created = await api.notes.create({ title, body });
+    if (!isOk(created)) {
+      setMessage(created.error.code);
+      return;
+    }
+    setTitle("");
+    setBody("");
+    await refresh();
+  }
+
+  async function onArchive(id: string): Promise<void> {
+    const archived = await api.notes.archive({ id });
+    if (!isOk(archived)) {
+      setMessage(archived.error.code);
+      return;
+    }
+    await refresh();
+  }
+
+  return (
+    <main className="page">
+      <header className="head">
+        <h1>Notes</h1>
+        <p className={health === "ok" ? "ok" : "down"}>
+          {health === "unknown" ? "checking…" : health === "ok" ? "app up" : "app down — start oke dev"}
+        </p>
+      </header>
+
+      <form className="compose" onSubmit={(event) => void onCreate(event)}>
+        <input
+          name="title"
+          placeholder="Title"
+          value={title}
+          onChange={(event) => setTitle(event.target.value)}
+          required
+          maxLength={200}
+        />
+        <textarea
+          name="body"
+          placeholder="Body"
+          value={body}
+          onChange={(event) => setBody(event.target.value)}
+          required
+          maxLength={10_000}
+          rows={4}
+        />
+        <button type="submit">Create</button>
+      </form>
+
+      {message ? <p className="err">{message}</p> : null}
+
+      <ul className="list">
+        {notes.map((note) => (
+          <li key={note.id}>
+            <div>
+              <strong>{note.title}</strong>
+              <p>{note.body}</p>
+            </div>
+            <button type="button" onClick={() => void onArchive(note.id)}>
+              Archive
+            </button>
+          </li>
+        ))}
+      </ul>
+    </main>
+  );
+}

package/templates/advanced/web/src/client.ts

@@ -0,0 +1,38 @@
+/**
+ * Browser client — Vite proxies these paths to `oke dev` (:6530).
+ *
+ * `$routes` is passed at runtime so HTTP triggers use REST, not `/_oke` RPC.
+ * Do not import `src/app.ts` here — that graph is Bun/server-only.
+ */
+
+import { createClient } from "okengine/client";
+
+/** One note from `notes.list` / `notes.create`. */
+export type Note = {
+  readonly id: string;
+  readonly title: string;
+  readonly body: string;
+  readonly archivedAt: number | null;
+  readonly createdAt: number;
+};
+
+const $routes = {
+  main: {
+    health: { method: "GET", path: "/health" },
+  },
+  notes: {
+    list: { method: "GET", path: "/notes" },
+    create: { method: "POST", path: "/notes" },
+    get: { method: "GET", path: "/notes/:id" },
+    archive: { method: "POST", path: "/notes/:id/archive" },
+  },
+} as const;
+
+type AppRoutes = { readonly $routes: typeof $routes };
+
+/**
+ * Typed caller for starter Flows. `VITE_API_URL` is empty in dev (proxy).
+ */
+export const api = createClient<AppRoutes>(import.meta.env.VITE_API_URL ?? "", {
+  $routes,
+});

package/templates/advanced/web/src/index.css

@@ -0,0 +1,18 @@
+:root {
+  color: #0f172a;
+  background: #f8fafc;
+  font-family: ui-sans-serif, system-ui, sans-serif;
+  line-height: 1.5;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+}
+
+#root {
+  min-height: 100vh;
+}

package/templates/advanced/web/src/main.tsx

@@ -0,0 +1,13 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./App.tsx";
+import "./index.css";
+
+const root = document.getElementById("root");
+if (!root) throw new Error("web: #root missing");
+
+createRoot(root).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

package/templates/advanced/web/src/vite-env.d.ts

@@ -0,0 +1,17 @@
+interface ViteTypeOptions {
+  // By adding this line, you can make the type of ImportMetaEnv strict
+  // to disallow unknown keys.
+  // strictImportMetaEnv: unknown
+}
+
+interface ImportMetaEnv {
+  /**
+   * App origin for `createClient`. Unset / empty = same origin so Vite's
+   * `server.proxy` forwards `/notes` · `/health` · `/_oke` to `oke dev`.
+   */
+  readonly VITE_API_URL?: string;
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv;
+}