create-oke 0.18.4 → 0.19.0

package/src/transform.ts

@@ -15,14 +15,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { CreateDefaults, CreateProxyId, EnvDriverPins } from "./create-defaults.ts";
-import {
-  DEFAULT_IMAGES,
-  LLAMA_CPP_IMAGE,
-  OLLAMA_IMAGE,
-  PROXY_IMAGES,
-  SGLANG_IMAGE,
-  VLLM_IMAGE,
-} from "./drivers-catalog.ts";
+import { DEFAULT_IMAGES, PROXY_IMAGES } from "./drivers-catalog.ts";
 import { materializeLocalOkengineDependency } from "./local-okengine.ts";
 import { packageRoot } from "./templates.ts";
 
@@ -35,6 +28,12 @@ export type SqlDriverId = (typeof SQL_DRIVERS)[number];
 /** Default when `--sql` / wizard choice is omitted (matches template sources). */
 export const DEFAULT_SQL_DRIVER: SqlDriverId = "postgres";
 
+/**
+ * Manifest extract peer for `oke dev` / boot effects stamping.
+ * Kept in sync with root `okengine` `dependencies["oxc-parser"]`.
+ */
+export const OXC_PARSER_RANGE = "^0.142.0";
+
 /**
  * Whether `value` is a known {@link SqlDriverId}.
  *
@@ -88,6 +87,9 @@ export function transformPackageJson(
   if (dependencies["okengine"] !== undefined) {
     dependencies["okengine"] = okengineDep;
   }
+  // Always pin — published okengine ≤0.18.5 left oxc-parser optional; without it,
+  // Docker-first `oke dev` hard-fails OKE1020 (Manifest extract cannot run).
+  dependencies["oxc-parser"] ??= OXC_PARSER_RANGE;
 
   return {
     ...source,
@@ -503,15 +505,6 @@ function syncImages(source: string, defaults: CreateDefaults): string {
   if (d.store.index?.dev === "meilisearch") {
     pin("store.index", DEFAULT_IMAGES["store.index"]!);
   }
-  if (
-    d.ai &&
-    (d.ai.dev === "ollama" ||
-      d.ai.prod === "ollama" ||
-      d.ai.dev === "openai-compatible" ||
-      d.ai.prod === "openai-compatible")
-  ) {
-    pin("ai", aiImageForDefaults(defaults));
-  }
   if (defaults.proxy !== "none") {
     pin("proxy", PROXY_IMAGES[defaults.proxy]);
   }
@@ -519,24 +512,6 @@ function syncImages(source: string, defaults: CreateDefaults): string {
   return replaceImagesBlock(source, images);
 }
 
-/**
- * Resolve `images.ai` from create-defaults provider / driver pins.
- *
- * @param defaults - Create answers
- */
-function aiImageForDefaults(defaults: CreateDefaults): string {
-  const provider = defaults.ai.provider;
-  if (provider === "ollama" || defaults.drivers.ai?.dev === "ollama") {
-    return OLLAMA_IMAGE;
-  }
-  if (provider === "vllm") return VLLM_IMAGE;
-  if (provider === "sglang") return SGLANG_IMAGE;
-  if (provider === "llama-cpp" || defaults.drivers.ai?.dev === "openai-compatible") {
-    return LLAMA_CPP_IMAGE;
-  }
-  return DEFAULT_IMAGES.ai!;
-}
-
 /**
  * Locate the `images: { … }` block by brace depth (not the first `}`) so
  * nested `store: { … }` / `channel: { … }` sub-blocks don't close the match

package/templates/advanced/.env.example

@@ -1,15 +1,16 @@
 # Environment template — create-oke copies this to `.env.local` when you scaffold.
 #
 # Resolution order (first hit wins):
-#   vault driver → process.env → .env.local → dev fallback
+#   vault driver → process.env → .env.local → dev / fromDocker fallback
 #
-# --- Vault (app secrets) ---
-# Declare secrets in src/vault.ts with `vault.secret(...)`, then uncomment lines here.
+# --- Vault (contracts in src/vault.ts) ---
+# `vault.secret` / `vault.config` names are declared in source so Console Vault
+# lists them. Put values here, in process.env, via `oke vault set`, or Console —
+# same contract either way. Uncomment a line to pin a dotenv value.
 #
 # ── vault — built-in encrypted-at-rest store ────────────────
-# `drivers.vault` is "vault": secrets live encrypted in Postgres, no extra service.
-# Nothing below is required to start — a value already in the vault backend wins
-# over leftover process.env / dotenv pins.
+# `drivers.vault` is "vault": encrypted values live in Postgres, no extra service.
+# A value already in the vault backend wins over leftover process.env / dotenv.
 #
 #   oke vault init                 # creates the store, prints the master key ONCE
 #   export OKE_VAULT_MASTER_KEY=…  # every later command / boot unseals with this
@@ -36,10 +37,11 @@
 # Uncomment to override compose credentials for a host-managed service.
 # Host ports under docker mode are unique per project — do not assume defaults.
 
-# ── App / Console ───────────────────────────────────────────
+# ── App / Console (declared in src/vault.ts) ────────────────
 # PORT=6530
 # OKE_APP_URL=http://127.0.0.1:6530
-# Vite web (`bun run web`): empty = same-origin proxy to oke dev
+# PUBLIC_API_URL=http://127.0.0.1:6530
+# Vite web (`bun run web`): leave VITE_API_URL unset = same-origin proxy to oke dev
 # VITE_API_URL=
 # OKE_CONSOLE_SECRET=
 # MAINTENANCE_MODE=0
@@ -113,10 +115,25 @@
 # PGDATA=/var/lib/postgresql/data/pgdata
 # POSTGRES_INITDB_ARGS=--data-checksums
 
+# ── store.index — Meilisearch (when images.store.index is set) ─
+# MEILI_URL=http://127.0.0.1:7700
+# MEILI_MASTER_KEY=dev-notes-meili
+# OKE_STORE_INDEX_URL=http://127.0.0.1:7700
+# OKE_STORE_INDEX_KEY=dev-notes-meili
+
 # ── AI ──────────────────────────────────────────────────────
-# Default local: llama.cpp → openai-compatible (Ollama remains supported)
+# Prefer `oke ai setup` — writes ai.model() with registry providers.
+# Zero Docker: OpenRouter (baseUrl auto-resolved)
+# OPENROUTER_API_KEY=
+# OKE_AI_CLOUD_MODEL=openrouter/free
+# BYO OpenAI-compatible `/v1` — set OKE_AI_URL yourself (Compose does not manage inference)
 # OKE_AI_DRIVER=openai-compatible
-# OKE_AI_URL=http://127.0.0.1:8080/v1
-# OKE_AI_MODEL=granite3.3:2b
+# OKE_AI_URL=http://127.0.0.1:1234/v1
+# OKE_AI_MODEL=your-model-id
+# Native Anthropic (production Claude)
 # ANTHROPIC_API_KEY=
+# Other registry keys (when selected in setup): GROQ_API_KEY, TOGETHER_API_KEY,
+# DEEPSEEK_API_KEY, MISTRAL_API_KEY, XAI_API_KEY, GEMINI_API_KEY, …
 # OPENAI_API_KEY=
+# Optional proxy override for any registry provider:
+# OPENAI_BASE_URL=

package/templates/advanced/.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2.2.0
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.2"
       - name: Install
         run: bun install
       - name: Typecheck

package/templates/advanced/oke.config.ts

@@ -30,15 +30,14 @@ export default defineConfig({
     store: {
       sql: "postgres:18-alpine",
       kv: "redis:8-alpine",
-      files: "rustfs/rustfs:1.0.0-rc.2",
+      files: "rustfs/rustfs:1.0.0-rc.5",
       // index: "getmeili/meilisearch:v1.53",
     },
     channel: {
-      email: "axllent/mailpit:v1.30.7",
+      email: "axllent/mailpit:v1.31.1",
     },
-    // pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53", // create-oke wizard / --pgdog
+    // pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57", // create-oke wizard / --pgdog
     // proxy: "caddy:2-alpine", // or traefik:v3.7 / nginx:1.31-alpine
-    // ai: "ghcr.io/ggml-org/llama.cpp:server-b10450", // or ollama/ollama:0.32.13
   },
   i18n: { locales: ["en"], default: "en" },
 });

package/templates/advanced/package.json

@@ -5,22 +5,23 @@
   "type": "module",
   "dependencies": {
     "okengine": "file:../../../..",
-    "@duckdb/node-api": "^1.5.5-r.2",
+    "@duckdb/node-api": "^1.5.5-r.4",
     "drizzle-orm": "1.0.0-rc.5-169397b",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
-    "zod": "^4.4.3"
+    "oxc-parser": "^0.149.0",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "zod": "^4.6.1"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.5.4",
-    "@electric-sql/pglite-pgvector": "^0.0.5",
+    "@electric-sql/pglite": "^0.5.8",
+    "@electric-sql/pglite-pgvector": "^0.0.9",
     "@types/bun": "latest",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.0.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.1",
     "drizzle-kit": "1.0.0-rc.5-ab785fc",
     "typescript": "^7.0.2",
-    "vite": "^8.2.0"
+    "vite": "^8.3.0"
   },
   "trustedDependencies": ["@duckdb/node-api"],
   "scripts": {

package/templates/advanced/src/app.ts

@@ -2,7 +2,42 @@ import "@/core";
 import "@/flows/generated";
 
 import { oke } from "okengine/http";
+import { cors, csrf, passkey } from "okengine/plugins";
+import { NOTES_VAULT } from "@/vault";
 
-export const app = oke({ name: "notes" });
+const viteOrigins = ["http://127.0.0.1:5173", "http://localhost:5173"] as const;
+
+/**
+ * Notes app — cookie auth + CSRF + passkey demo (additive to Notes Flows).
+ * `vault.config` is not auto-registered (only `vault.secret` is), so pass
+ * {@link NOTES_VAULT} for configs + secrets to resolve together.
+ */
+export const app = oke({
+  name: "notes",
+  secrets: NOTES_VAULT,
+  gate: {
+    auth: {
+      cookies: { enabled: true },
+      emailAndPassword: { enabled: true },
+    },
+  },
+})
+  .plug(
+    csrf({
+      allowNoHeader: false,
+      allowOrigins: [...viteOrigins],
+    }),
+  )
+  .plug(
+    cors({
+      origin: [...viteOrigins],
+      credentials: true,
+    }),
+  )
+  .plug(
+    passkey({
+      origins: [...viteOrigins, "http://127.0.0.1:6530", "http://localhost:6530"],
+    }),
+  );
 
 export type App = typeof app;

package/templates/advanced/src/core.ts

@@ -3,15 +3,17 @@
  *
  * Order matches how you usually extend the starter:
  * locales → store → gate → vault → channel → (AI via `oke ai setup`).
- * Keep this file until a section outgrows it, then split by element.
+ * Vault contracts live in `src/vault.ts` (re-exported below).
  */
 
 import "@/locales";
 
-import { channel, gate, store, vault } from "okengine";
+import { channel, gate, store } from "okengine";
 import { z } from "zod";
 import * as schema from "@/db/schema.decl";
 
+export * from "@/vault";
+
 // --- Store -------------------------------------------------------------------
 
 /** SQL store for Notes (`schema.decl`). Drivers: pglite locally · postgres in docker. */
@@ -31,6 +33,8 @@ export const files = store.files("uploads");
  * );
  * export const notesMutate = gate.all(notesWrite, notesWriteRate);
  * ```
+ *
+ * Cookie auth + passkey are wired in `app.ts`; client `Can` / `authorize` are UI-only.
  */
 export const notesWrite = gate.policy("notes:write", () => true);
 
@@ -45,14 +49,6 @@ export const notesWriteRate = gate.rate({
 /** Reuse on every notes mutate route. */
 export const notesMutate = gate.all(notesWrite, notesWriteRate);
 
-// --- Vault -------------------------------------------------------------------
-
-/** HMAC secret for outbound note webhooks (`fx.vault.get` on create). */
-export const webhookSecret = vault.secret("APP_WEBHOOK_SECRET", {
-  description: "HMAC secret for outbound note webhooks",
-  dev: "dev-webhook-secret-change-me",
-});
-
 // --- Channel -----------------------------------------------------------------
 
 const mail = channel.email({ from: "Notes <notes@localhost>" });
@@ -67,4 +63,9 @@ export const noteCreatedMail = mail.template("note-created", {
 });
 
 // --- AI ----------------------------------------------------------------------
-// `oke ai setup` / create-oke --ai appends models here.
+// Appended by `oke ai setup` / `create-oke --ai`.
+// When an embed model is chosen, setup also wires Notes hybrid search:
+//   oke({ store: { search: { embed: { model: embedModel, dims: 768 } } } })
+//   body: field.text().searchable().embed()
+// Registry cloud: provider "openrouter" + OPENROUTER_API_KEY (no baseUrl).
+// Local self-host still needs an explicit baseUrl (or OKE_AI_URL on the binding).

package/templates/advanced/src/db/schema.decl.ts

@@ -3,11 +3,15 @@ import { store, field } from "okengine";
 /**
  * Notes domain — abstract declarations, emitted to
  * `src/db/schema.drizzle.ts` for the active dialect by `oke db` / `oke dev`.
+ *
+ * `.searchable()` is free BM25. With `oke ai setup` (embed model chosen),
+ * body also gets bare `.embed()` and `oke({ store: { search: { embed } } })`
+ * stamps the project default (model + dims).
  */
 export const notes = store.schema.table("notes", {
   id: field.id().primaryKey(),
-  title: field.text().notNull(),
-  body: field.text().notNull(),
+  title: field.text().searchable({ weight: 2 }).notNull(),
+  body: field.text().searchable().notNull(),
   archivedAt: field.timestamp(),
   createdAt: field.timestamp().notNull().now(),
 });

package/templates/advanced/src/db/seed/index.ts

@@ -19,7 +19,7 @@ async function welcomeNote(fx: Fx) {
       title: "Welcome",
       body: "Advanced Notes starter — attach files, summarize with AI, daily digest clock.",
       archivedAt: null,
-      createdAt: 1,
+      createdAt: new Date("2026-01-15T10:00:00.000Z"),
     },
   );
 }
@@ -33,7 +33,7 @@ async function sampleNotes(fx: Fx) {
       title: "Shipping checklist",
       body: "Confirm schema with oke db push (or migrate in docker), then oke db seed.",
       archivedAt: null,
-      createdAt: 2,
+      createdAt: new Date("2026-01-15T10:01:00.000Z"),
     },
   );
   await fx.store(db).upsert(
@@ -44,7 +44,7 @@ async function sampleNotes(fx: Fx) {
       title: "Try attach",
       body: "POST /notes/:id/attach stores a text blob on files:uploads.",
       archivedAt: null,
-      createdAt: 3,
+      createdAt: new Date("2026-01-15T10:02:00.000Z"),
     },
   );
   await fx.store(db).upsert(
@@ -55,7 +55,7 @@ async function sampleNotes(fx: Fx) {
       title: "Try summarize",
       body: "POST /notes/:id/summarize uses fx.ask with the prompt's via recovery chain.",
       archivedAt: null,
-      createdAt: 4,
+      createdAt: new Date("2026-01-15T10:03:00.000Z"),
     },
   );
 }

package/templates/advanced/src/flows/main/route.ts

@@ -3,14 +3,15 @@ import { z } from "zod";
 
 /** First-run welcome — visit :6530/ after `oke dev` (browser code block; curl stays JSON). */
 export const root = on(
-  http.get().public(),
-  flow({
+  http.get({
     out: z.object({
       ok: z.literal(true),
       app: z.string(),
       try: z.array(z.string()),
       console: z.string(),
     }),
+  }).public(),
+  flow({
     do: () => ({
       ok: true as const,
       app: "notes",

package/templates/advanced/src/flows/notes/[id]/archive.ts

@@ -3,26 +3,23 @@ import { eq } from "drizzle-orm";
 
 import { db, notesMutate } from "@/core";
 import { notes } from "@/db/schema.decl";
-import { NoteIdIn, NoteOut, NotFound } from "../shapes";
+import { NoteIdIn, NoteOut, NotFound, toIsoInstant } from "../shapes";
 
 /** Soft-archive a note. */
 export const archive = on(
-  http.post().gate(notesMutate),
+  http.post({ in: NoteIdIn, out: NoteOut, errors: { NotFound } }).gate(notesMutate),
   flow({
-    in: NoteIdIn,
-    out: NoteOut,
-    errors: { NotFound },
     do: async (input, fx) => {
       const row = await fx.store(db).findById(notes, input.id);
       if (!row) return fail("NotFound", { id: input.id });
-      const archivedAt = fx.clock.now();
+      const archivedAt = new Date(fx.clock.now());
       await fx.store(db).update(notes).set({ archivedAt }).where(eq(notes.id, input.id));
       return {
         id: String(row.id),
         title: String(row.title),
         body: String(row.body),
-        archivedAt,
-        createdAt: Number(row.createdAt),
+        archivedAt: toIsoInstant(archivedAt),
+        createdAt: toIsoInstant(row.createdAt),
       };
     },
   }),

package/templates/advanced/src/flows/notes/[id]/attach.ts

@@ -6,11 +6,8 @@ import { NoteAttachIn, NoteAttachOut, NotFound } from "../shapes";
 
 /** Store a text attachment next to a note (`files:uploads`). */
 export const attach = on(
-  http.post().gate(notesMutate),
+  http.post({ in: NoteAttachIn, out: NoteAttachOut, errors: { NotFound } }).gate(notesMutate),
   flow({
-    in: NoteAttachIn,
-    out: NoteAttachOut,
-    errors: { NotFound },
     do: async (input, fx) => {
       const row = await fx.store(db).findById(notes, input.id);
       if (!row) return fail("NotFound", { id: input.id });

package/templates/advanced/src/flows/notes/[id]/get.ts

@@ -2,15 +2,12 @@ import { on, flow, http, fail } from "okengine/http";
 
 import { db } from "@/core";
 import { notes } from "@/db/schema.decl";
-import { NoteIdIn, NoteOut, NotFound } from "../shapes";
+import { NoteIdIn, NoteOut, NotFound, toIsoInstant } from "../shapes";
 
 /** Fetch one note by id. */
 export const get = on(
-  http.get().public(),
+  http.get({ in: NoteIdIn, out: NoteOut, errors: { NotFound } }).public(),
   flow({
-    in: NoteIdIn,
-    out: NoteOut,
-    errors: { NotFound },
     do: async (input, fx) => {
       const row = await fx.store(db).findById(notes, input.id);
       if (!row) return fail("NotFound", { id: input.id });
@@ -18,8 +15,8 @@ export const get = on(
         id: String(row.id),
         title: String(row.title),
         body: String(row.body),
-        archivedAt: row.archivedAt == null ? null : Number(row.archivedAt),
-        createdAt: Number(row.createdAt),
+        archivedAt: row.archivedAt == null ? null : toIsoInstant(row.archivedAt),
+        createdAt: toIsoInstant(row.createdAt),
       };
     },
   }),

package/templates/advanced/src/flows/notes/[id]/summarize.ts

@@ -50,11 +50,10 @@ function unwrapSummaryText(text: string): string {
  * Exhausted / failed asks surface as Unavailable — never a body excerpt.
  */
 export const summarize = on(
-  http.post().gate(notesMutate),
+  http.post({ in: NoteSummarizeIn, out: NoteSummarizeOut, errors: { NotFound, Unavailable } }).gate(
+    notesMutate,
+  ),
   flow({
-    in: NoteSummarizeIn,
-    out: NoteSummarizeOut,
-    errors: { NotFound, Unavailable },
     do: async (input, fx) => {
       const row = await fx.store(db).findById(notes, input.id);
       if (!row) return fail("NotFound", { id: input.id });

package/templates/advanced/src/flows/notes/create.ts

@@ -2,19 +2,17 @@ import { on, flow, http } from "okengine/http";
 
 import { db, notesMutate, webhookSecret } from "@/core";
 import { notes } from "@/db/schema.decl";
-import { NoteCreateIn, NoteOut } from "./shapes";
+import { NoteCreateIn, NoteOut, toIsoInstant } from "./shapes";
 import { noteCreated } from "./signals";
 
 /** Create a note, emit `note-created`, touch vault. */
 export const create = on(
-  http.post().gate(notesMutate),
+  http.post({ in: NoteCreateIn, out: NoteOut }).gate(notesMutate),
   flow({
-    in: NoteCreateIn,
-    out: NoteOut,
     do: async (input, fx) => {
       await fx.vault.get(webhookSecret);
       const id = fx.id();
-      const createdAt = fx.clock.now();
+      const createdAt = new Date(fx.clock.now());
       await fx.store(db).insert(notes).values({
         id,
         title: input.title,
@@ -28,7 +26,7 @@ export const create = on(
         title: input.title,
         body: input.body,
         archivedAt: null,
-        createdAt,
+        createdAt: toIsoInstant(createdAt),
       };
     },
   }),

package/templates/advanced/src/flows/notes/digest.ts

@@ -1,18 +1,19 @@
-import { on, flow, every } from "okengine/http";
+import { on, flow, clock } from "okengine/http";
 import { isNull } from "drizzle-orm";
 
 import { db } from "@/core";
 import { notes } from "@/db/schema.decl";
-import { NoteDigestOut } from "./shapes";
+import { toIsoInstant } from "./shapes";
+
+export const digestClock = clock("notes.digest", { every: "1d" });
 
 /** Daily count of active notes (frozen under test drivers). */
 export const digest = on(
-  every("1d"),
+  digestClock,
   flow({
-    out: NoteDigestOut,
     do: async (_input, fx) => {
       const rows = await fx.store(db).select().from(notes).where(isNull(notes.archivedAt));
-      return { active: rows.length, at: fx.clock.now() };
+      return { active: rows.length, at: toIsoInstant(new Date(fx.clock.now())) };
     },
   }),
 );

package/templates/advanced/src/flows/notes/list.ts

@@ -3,13 +3,12 @@ import { isNull } from "drizzle-orm";
 
 import { db } from "@/core";
 import { notes } from "@/db/schema.decl";
-import { NoteListOut } from "./shapes";
+import { NoteListOut, toIsoInstant } from "./shapes";
 
 /** List active (non-archived) notes, newest first. */
 export const list = on(
-  http.get().public(),
+  http.get({ out: NoteListOut }).public(),
   flow({
-    out: NoteListOut,
     do: async (input, fx) => {
       const rows = await fx.store(db).select().from(notes).where(isNull(notes.archivedAt));
       const data = [...rows]
@@ -18,8 +17,8 @@ export const list = on(
           id: String(r.id),
           title: String(r.title),
           body: String(r.body),
-          archivedAt: r.archivedAt == null ? null : Number(r.archivedAt),
-          createdAt: Number(r.createdAt),
+          archivedAt: r.archivedAt == null ? null : toIsoInstant(r.archivedAt),
+          createdAt: toIsoInstant(r.createdAt),
         }));
       return fx.json.withQuery(data, input);
     },

package/templates/advanced/src/flows/notes/shapes.ts

@@ -1,5 +1,8 @@
 import { z } from "zod";
 
+/** Instant on the HTTP wire — ISO-8601 UTC. */
+export const IsoInstant = z.iso.datetime();
+
 export const NoteCreateIn = z.object({
   title: z.string().min(1).max(200),
   body: z.string().min(1).max(10_000),
@@ -9,8 +12,8 @@ export const NoteOut = z.object({
   id: z.string(),
   title: z.string(),
   body: z.string(),
-  archivedAt: z.number().nullable(),
-  createdAt: z.number(),
+  archivedAt: IsoInstant.nullable(),
+  createdAt: IsoInstant,
 });
 
 /** List `data` is the item array. Pagination lives in HTTP `meta`. */
@@ -37,7 +40,7 @@ export const NoteAttachOut = z.object({
 
 export const NoteDigestOut = z.object({
   active: z.number().int().nonnegative(),
-  at: z.number(),
+  at: IsoInstant,
 });
 
 export const NoteSummarizeIn = z.object({
@@ -55,3 +58,10 @@ export const NoteSummarizeOut = z.object({
 export const Unavailable = z.object({
   message: z.string(),
 });
+
+/** Map a store temporal (`Date` / ISO / epoch-ms) to an ISO wire string. */
+export function toIsoInstant(value: unknown): string {
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "string") return new Date(value).toISOString();
+  return new Date(Number(value)).toISOString();
+}

package/templates/advanced/src/flows/notes/signals.ts

@@ -2,8 +2,7 @@ import { signal } from "okengine";
 import { z } from "zod";
 
 /** Fired after a note is persisted — subscriber sends email. */
-export const noteCreated = signal("note-created", {
-  delivery: "once",
+export const noteCreated = signal.once("note-created", {
   retries: 3,
   deadLetter: true,
   schema: z.object({