create-oke 0.18.4 → 0.19.0

package/templates/advanced/src/vault.ts

@@ -0,0 +1,138 @@
+/**
+ * Notes vault contracts — secrets and cleartext config.
+ *
+ * Values resolve through the driver chain (built-in store → process.env →
+ * `.env.local` → `dev:` / `vault.fromDocker`). Declare every stack / app name
+ * here so Console Vault lists it; put values in `.env.local`, `oke vault set`,
+ * or leave the local fallback for Docker-first `oke dev`.
+ */
+
+import { vault } from "okengine";
+
+// --- Secrets (fingerprinted) -------------------------------------------------
+
+/** HMAC secret for outbound note webhooks (`fx.vault.get` on create). */
+export const webhookSecret = vault.secret("APP_WEBHOOK_SECRET", {
+  description: "HMAC secret for outbound note webhooks",
+  rotate: "never",
+  dev: "dev-webhook-secret-change-me",
+});
+
+/** Console operator secret. */
+export const okeConsoleSecret = vault.secret("OKE_CONSOLE_SECRET", {
+  description: "Console operator secret",
+  rotate: "90d",
+  dev: "oke-dev-notes-console",
+});
+
+/** Mailpit SMTP URL. */
+export const channelEmailUrl = vault.secret("OKE_CHANNEL_EMAIL_URL", {
+  description: "Mailpit SMTP URL",
+  rotate: "never",
+  dev: vault.fromDocker("channel.email"),
+});
+
+/** SMTP alias. */
+export const smtpUrl = vault.secret("SMTP_URL", {
+  description: "SMTP URL",
+  rotate: "never",
+  dev: vault.fromDocker("channel.email"),
+});
+
+/** Object storage URL. */
+export const storeFilesUrl = vault.secret("OKE_STORE_FILES_URL", {
+  description: "Object storage URL",
+  rotate: "never",
+  dev: vault.fromDocker("store.files"),
+});
+
+/** Redis URL. */
+export const storeKvUrl = vault.secret("OKE_STORE_KV_URL", {
+  description: "Redis URL",
+  rotate: "never",
+  dev: vault.fromDocker("store.kv"),
+});
+
+/** Redis alias. */
+export const redisUrl = vault.secret("REDIS_URL", {
+  description: "Redis URL",
+  rotate: "never",
+  dev: vault.fromDocker("store.kv"),
+});
+
+/** Direct Postgres URL. */
+export const storeSqlUrl = vault.secret("OKE_STORE_SQL_URL", {
+  description: "Direct Postgres URL",
+  rotate: "never",
+  dev: vault.fromDocker("store.sql"),
+});
+
+/** Postgres URL (compose / PgDog may rewrite this). */
+export const databaseUrl = vault.secret("DATABASE_URL", {
+  description: "Postgres URL",
+  rotate: "never",
+  dev: vault.fromDocker("store.sql"),
+});
+
+/** Meilisearch master key (when `store.index` is meilisearch). */
+export const meiliMasterKey = vault.secret("MEILI_MASTER_KEY", {
+  description: "Meilisearch master key",
+  rotate: "90d",
+  dev: "dev-notes-meili",
+});
+
+// --- Config (shown in the clear) ---------------------------------------------
+
+/** App listen origin. */
+export const okeAppUrl = vault.config("OKE_APP_URL", {
+  description: "App listen origin",
+  dev: "http://127.0.0.1:6530",
+});
+
+/** Public API origin (Vite web keeps `VITE_API_URL` empty for same-origin proxy). */
+export const publicApiUrl = vault.config("PUBLIC_API_URL", {
+  description: "Public API origin",
+  dev: "http://127.0.0.1:6530",
+});
+
+/** Mailpit UI origin. */
+export const mailpitUiUrl = vault.config("MAILPIT_UI_URL", {
+  description: "Mailpit UI origin",
+  dev: "http://127.0.0.1:8025",
+});
+
+/** Meilisearch origin. */
+export const meiliUrl = vault.config("MEILI_URL", {
+  description: "Meilisearch origin",
+  dev: "http://127.0.0.1:7700",
+});
+
+/** Maintenance flag (`1` / `0`). */
+export const maintenanceMode = vault.config("MAINTENANCE_MODE", {
+  description: "Maintenance mode flag",
+  dev: "0",
+});
+
+/**
+ * Full contract list for `oke({ secrets })`.
+ *
+ * `vault.secret` auto-registers; `vault.config` does not — pass this array so
+ * configs resolve in boot / Console the same way secrets do.
+ */
+export const NOTES_VAULT = [
+  webhookSecret,
+  okeConsoleSecret,
+  channelEmailUrl,
+  smtpUrl,
+  storeFilesUrl,
+  storeKvUrl,
+  redisUrl,
+  storeSqlUrl,
+  databaseUrl,
+  meiliMasterKey,
+  okeAppUrl,
+  publicApiUrl,
+  mailpitUiUrl,
+  meiliUrl,
+  maintenanceMode,
+] as const;

package/templates/advanced/tests/advanced.test.ts

@@ -5,7 +5,15 @@ import { app, type App } from "@/app";
 let t: TestApp<App>;
 
 beforeAll(async () => {
-  t = await createTestApp(app);
+  t = await createTestApp(app, {
+    boot: {
+      config: {
+        drivers: {
+          store: { sql: { test: "pglite" } },
+        },
+      },
+    },
+  });
 });
 
 afterAll(async () => {
@@ -18,7 +26,7 @@ test("boots — health flow is named main.health", async () => {
   expect(data).toEqual({ ok: true });
 });
 
-test("notes create → attach → summarize → archive", async () => {
+test("notes create → attach → archive", async () => {
   const created = await t.api.notes!.create!({
     title: "Advanced",
     body: "Body long enough to exercise attach and summarize paths in the advanced starter.",
@@ -32,12 +40,7 @@ test("notes create → attach → summarize → archive", async () => {
   expect(attached.error).toBeNull();
   expect((attached.data as { key: string }).key).toBe(`notes/${id}/attachment.txt`);
 
-  t.ai.mock("summarize-note", { summary: "Advanced starter summary." });
-  const summary = await t.api.notes!.summarize!({ id });
-  expect(summary.error).toBeNull();
-  const out = summary.data as { via: string; summary: string };
-  expect(out.via.length).toBeGreaterThan(0);
-  expect(out.summary.length).toBeGreaterThan(0);
+  // `notes.summarize` needs `oke ai setup` (summarize-note prompt) — exercised there.
 
   const archived = await t.api.notes!.archive!({ id });
   expect(archived.error).toBeNull();

package/templates/advanced/web/src/App.css

@@ -57,6 +57,13 @@
   color: #b91c1c;
 }
 
+.hint,
+.session {
+  margin: 0.5rem 0;
+  font-size: 0.875rem;
+  color: #64748b;
+}
+
 .list {
   list-style: none;
   padding: 0;

package/templates/advanced/web/src/App.tsx

@@ -1,10 +1,12 @@
 import { useCallback, useEffect, useState, type FormEvent, type JSX } from "react";
 import { isOk } from "okengine/client";
+import { Can } from "okengine/client-react";
 import { api, type Note } from "./client.ts";
 import "./App.css";
 
 /**
  * Notes SPA — health + list + create + archive against the oke app.
+ * Auth chrome uses Can (UI-only); Gate on Flows remains real authz.
  */
 export function App(): JSX.Element {
   const [health, setHealth] = useState<"unknown" | "ok" | "down">("unknown");
@@ -12,6 +14,18 @@ export function App(): JSX.Element {
   const [title, setTitle] = useState("");
   const [body, setBody] = useState("");
   const [message, setMessage] = useState<string | null>(null);
+  const [email, setEmail] = useState("demo@localhost");
+  const [password, setPassword] = useState("password-demo-1");
+  const [sessionLabel, setSessionLabel] = useState<string>("…");
+
+  const refreshSession = useCallback(async () => {
+    if (!api.auth) {
+      setSessionLabel("no auth");
+      return;
+    }
+    const user = await api.auth.getSession();
+    setSessionLabel(user ? `${user.email ?? user.userId}` : "signed out");
+  }, []);
 
   const refresh = useCallback(async () => {
     const live = await api.main.health({});
@@ -27,7 +41,48 @@ export function App(): JSX.Element {
 
   useEffect(() => {
     void refresh();
-  }, [refresh]);
+    void refreshSession();
+  }, [refresh, refreshSession]);
+
+  async function onSignIn(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    if (!api.auth) return;
+    const result = await api.auth.signIn.email({ email, password });
+    if (!result.ok) {
+      setMessage("sign-in failed — try sign-up first");
+      return;
+    }
+    setMessage(null);
+    await refreshSession();
+  }
+
+  async function onSignUp(): Promise<void> {
+    if (!api.auth) return;
+    const result = await api.auth.signUp.email({ email, password, name: "Demo" });
+    if (!result.ok) {
+      setMessage("sign-up failed");
+      return;
+    }
+    setMessage(null);
+    await refreshSession();
+  }
+
+  async function onPasskey(): Promise<void> {
+    if (!api.auth) return;
+    const result = await api.auth.signIn.passkey({ email });
+    if (!result.ok) {
+      setMessage("passkey failed — register a passkey while signed in");
+      return;
+    }
+    setMessage(null);
+    await refreshSession();
+  }
+
+  async function onSignOut(): Promise<void> {
+    if (!api.auth) return;
+    await api.auth.signOut();
+    await refreshSession();
+  }
 
   async function onCreate(event: FormEvent<HTMLFormElement>): Promise<void> {
     event.preventDefault();
@@ -57,8 +112,38 @@ export function App(): JSX.Element {
         <p className={health === "ok" ? "ok" : "down"}>
           {health === "unknown" ? "checking…" : health === "ok" ? "app up" : "app down — start oke dev"}
         </p>
+        <p className="session">{sessionLabel}</p>
       </header>
 
+      <form className="compose" onSubmit={(event) => void onSignIn(event)}>
+        <input
+          name="email"
+          type="email"
+          placeholder="Email"
+          value={email}
+          onChange={(event) => setEmail(event.target.value)}
+          required
+        />
+        <input
+          name="password"
+          type="password"
+          placeholder="Password"
+          value={password}
+          onChange={(event) => setPassword(event.target.value)}
+          required
+        />
+        <button type="submit">Sign in</button>
+        <button type="button" onClick={() => void onSignUp()}>
+          Sign up
+        </button>
+        <button type="button" onClick={() => void onPasskey()}>
+          Passkey
+        </button>
+        <button type="button" onClick={() => void onSignOut()}>
+          Sign out
+        </button>
+      </form>
+
       <form className="compose" onSubmit={(event) => void onCreate(event)}>
         <input
           name="title"
@@ -80,6 +165,21 @@ export function App(): JSX.Element {
         <button type="submit">Create</button>
       </form>
 
+      {api.auth ? (
+        <Can
+          auth={api.auth}
+          all={["notes:write"]}
+          fallback={
+            <p className="hint">
+              UI chrome: missing notes:write (authorize is UI-only — Gate on Flows is real authz).
+            </p>
+          }
+          loading={<p className="hint">Checking session…</p>}
+        >
+          <p className="hint">UI chrome: notes:write — editor affordances can show here.</p>
+        </Can>
+      ) : null}
+
       {message ? <p className="err">{message}</p> : null}
 
       <ul className="list">

package/templates/advanced/web/src/client.ts

@@ -12,8 +12,8 @@ export type Note = {
   readonly id: string;
   readonly title: string;
   readonly body: string;
-  readonly archivedAt: number | null;
-  readonly createdAt: number;
+  readonly archivedAt: string | null;
+  readonly createdAt: string;
 };
 
 const $routes = {
@@ -26,13 +26,26 @@ const $routes = {
     get: { method: "GET", path: "/notes/:id" },
     archive: { method: "POST", path: "/notes/:id/archive" },
   },
+  auth: {
+    me: { method: "GET", path: "/auth/me" },
+    signInEmail: { method: "POST", path: "/auth/sign-in/email" },
+    signUpEmail: { method: "POST", path: "/auth/sign-up/email" },
+    revoke: { method: "POST", path: "/auth/revoke" },
+    passkeyAuthenticateOptions: {
+      method: "POST",
+      path: "/auth/passkey/authenticate/options",
+    },
+    passkeyAuthenticate: { method: "POST", path: "/auth/passkey/authenticate" },
+  },
 } as const;
 
 type AppRoutes = { readonly $routes: typeof $routes };
 
 /**
- * Typed caller for starter Flows. `VITE_API_URL` is empty in dev (proxy).
+ * Typed caller for starter Flows. Cookie session + `api.auth` helpers.
+ * `VITE_API_URL` is empty in dev (proxy).
  */
 export const api = createClient<AppRoutes>(import.meta.env.VITE_API_URL ?? "", {
   $routes,
+  auth: { mode: "cookie", csrfConfigured: true },
 });

package/templates/advanced/web/vite.config.ts

@@ -20,6 +20,7 @@ const APP_ORIGIN = "http://127.0.0.1:6530";
 const proxy: Record<string, ProxyOptions> = {
   "/health": { target: APP_ORIGIN, changeOrigin: true },
   "/notes": { target: APP_ORIGIN, changeOrigin: true },
+  "/auth": { target: APP_ORIGIN, changeOrigin: true },
   "/_oke": { target: APP_ORIGIN, changeOrigin: true },
 };
 

package/templates/standard/.env.example

@@ -1,15 +1,16 @@
 # Environment template — create-oke copies this to `.env.local` when you scaffold.
 #
 # Resolution order (first hit wins):
-#   vault driver → process.env → .env.local → dev fallback
+#   vault driver → process.env → .env.local → dev / fromDocker fallback
 #
-# --- Vault (app secrets) ---
-# Declare secrets in src/vault.ts with `vault.secret(...)`, then uncomment lines here.
+# --- Vault (contracts in src/vault.ts) ---
+# `vault.secret` / `vault.config` names are declared in source so Console Vault
+# lists them. Put values here, in process.env, via `oke vault set`, or Console —
+# same contract either way. Uncomment a line to pin a dotenv value.
 #
 # ── vault — built-in encrypted-at-rest store ────────────────
-# `drivers.vault` is "vault": secrets live encrypted in Postgres, no extra service.
-# Nothing below is required to start — a value already in the vault backend wins
-# over leftover process.env / dotenv pins.
+# `drivers.vault` is "vault": encrypted values live in Postgres, no extra service.
+# A value already in the vault backend wins over leftover process.env / dotenv.
 #
 #   oke vault init                 # creates the store, prints the master key ONCE
 #   export OKE_VAULT_MASTER_KEY=…  # every later command / boot unseals with this
@@ -36,10 +37,11 @@
 # Uncomment to override compose credentials for a host-managed service.
 # Host ports under docker mode are unique per project — do not assume defaults.
 
-# ── App / Console ───────────────────────────────────────────
+# ── App / Console (declared in src/vault.ts) ────────────────
 # PORT=6530
 # OKE_APP_URL=http://127.0.0.1:6530
-# Vite web (`bun run web`): empty = same-origin proxy to oke dev
+# PUBLIC_API_URL=http://127.0.0.1:6530
+# Vite web (`bun run web`): leave VITE_API_URL unset = same-origin proxy to oke dev
 # VITE_API_URL=
 # OKE_CONSOLE_SECRET=
 # MAINTENANCE_MODE=0
@@ -114,9 +116,18 @@
 # POSTGRES_INITDB_ARGS=--data-checksums
 
 # ── AI ──────────────────────────────────────────────────────
-# Default local: llama.cpp → openai-compatible (Ollama remains supported)
+# Prefer `oke ai setup` — writes ai.model() with registry providers.
+# Zero Docker: OpenRouter (baseUrl auto-resolved)
+# OPENROUTER_API_KEY=
+# OKE_AI_CLOUD_MODEL=openrouter/free
+# BYO OpenAI-compatible `/v1` — set OKE_AI_URL yourself (Compose does not manage inference)
 # OKE_AI_DRIVER=openai-compatible
-# OKE_AI_URL=http://127.0.0.1:8080/v1
-# OKE_AI_MODEL=granite3.3:2b
+# OKE_AI_URL=http://127.0.0.1:1234/v1
+# OKE_AI_MODEL=your-model-id
+# Native Anthropic (production Claude)
 # ANTHROPIC_API_KEY=
+# Other registry keys (when selected in setup): GROQ_API_KEY, TOGETHER_API_KEY,
+# DEEPSEEK_API_KEY, MISTRAL_API_KEY, XAI_API_KEY, GEMINI_API_KEY, …
 # OPENAI_API_KEY=
+# Optional proxy override for any registry provider:
+# OPENAI_BASE_URL=

package/templates/standard/.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2.2.0
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.2"
       - name: Install
         run: bun install
       - name: Typecheck

package/templates/standard/oke.config.ts

@@ -22,12 +22,12 @@ export default defineConfig({
     store: {
       sql: "postgres:18-alpine",
       kv: "redis:8-alpine",
-      files: "rustfs/rustfs:1.0.0-rc.2",
+      files: "rustfs/rustfs:1.0.0-rc.5",
     },
     channel: {
-      email: "axllent/mailpit:v1.30.7",
+      email: "axllent/mailpit:v1.31.1",
     },
-    // pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53", // create-oke wizard / --pgdog
+    // pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57", // create-oke wizard / --pgdog
     // proxy: "caddy:2-alpine", // or traefik:v3.7 / nginx:1.31-alpine
   },
   i18n: { locales: ["en"], default: "en" },

package/templates/standard/package.json

@@ -5,22 +5,23 @@
   "type": "module",
   "dependencies": {
     "okengine": "file:../../../..",
-    "@duckdb/node-api": "^1.5.5-r.2",
+    "@duckdb/node-api": "^1.5.5-r.4",
     "drizzle-orm": "1.0.0-rc.5-169397b",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
-    "zod": "^4.4.3"
+    "oxc-parser": "^0.149.0",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "zod": "^4.6.1"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.5.4",
-    "@electric-sql/pglite-pgvector": "^0.0.5",
+    "@electric-sql/pglite": "^0.5.8",
+    "@electric-sql/pglite-pgvector": "^0.0.9",
     "@types/bun": "latest",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.0.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.1",
     "drizzle-kit": "1.0.0-rc.5-ab785fc",
     "typescript": "^7.0.2",
-    "vite": "^8.2.0"
+    "vite": "^8.3.0"
   },
   "trustedDependencies": ["@duckdb/node-api"],
   "scripts": {

package/templates/standard/src/app.ts

@@ -2,7 +2,12 @@ import "@/core";
 import "@/flows/generated";
 
 import { oke } from "okengine/http";
+import { NOTES_VAULT } from "@/vault";
 
-export const app = oke({ name: "notes" });
+/**
+ * Notes app — `vault.config` is not auto-registered (only `vault.secret` is),
+ * so pass {@link NOTES_VAULT} for configs + secrets to resolve together.
+ */
+export const app = oke({ name: "notes", secrets: NOTES_VAULT });
 
 export type App = typeof app;

package/templates/standard/src/core.ts

@@ -3,15 +3,17 @@
  *
  * Order matches how you usually extend the starter:
  * locales → store → gate → vault → channel → (AI via `oke ai setup`).
- * Keep this file until a section outgrows it, then split by element.
+ * Vault contracts live in `src/vault.ts` (re-exported below).
  */
 
 import "@/locales";
 
-import { channel, gate, store, vault } from "okengine";
+import { channel, gate, store } from "okengine";
 import { z } from "zod";
 import * as schema from "@/db/schema.decl";
 
+export * from "@/vault";
+
 // --- Store -------------------------------------------------------------------
 
 /** SQL store for Notes (`schema.decl`). Drivers: pglite locally · postgres in docker. */
@@ -42,14 +44,6 @@ export const notesWriteRate = gate.rate({
 /** Reuse on every notes mutate route. */
 export const notesMutate = gate.all(notesWrite, notesWriteRate);
 
-// --- Vault -------------------------------------------------------------------
-
-/** HMAC secret for outbound note webhooks (`fx.vault.get` on create). */
-export const webhookSecret = vault.secret("APP_WEBHOOK_SECRET", {
-  description: "HMAC secret for outbound note webhooks",
-  dev: "dev-webhook-secret-change-me",
-});
-
 // --- Channel -----------------------------------------------------------------
 
 const mail = channel.email({ from: "Notes <notes@localhost>" });
@@ -64,4 +58,9 @@ export const noteCreatedMail = mail.template("note-created", {
 });
 
 // --- AI ----------------------------------------------------------------------
-// `oke ai setup` / create-oke --ai appends models here.
+// Appended by `oke ai setup` / `create-oke --ai`.
+// When an embed model is chosen, setup also wires Notes hybrid search:
+//   oke({ store: { search: { embed: { model: embedModel, dims: 768 } } } })
+//   body: field.text().searchable().embed()
+// Registry cloud: provider "openrouter" + OPENROUTER_API_KEY (no baseUrl).
+// Local self-host still needs an explicit baseUrl (or OKE_AI_URL on the binding).

package/templates/standard/src/db/schema.decl.ts

@@ -3,11 +3,15 @@ import { store, field } from "okengine";
 /**
  * Notes domain — abstract declarations, emitted to
  * `src/db/schema.drizzle.ts` for the active dialect by `oke db` / `oke dev`.
+ *
+ * `.searchable()` is free BM25. With `oke ai setup` (embed model chosen),
+ * body also gets bare `.embed()` and `oke({ store: { search: { embed } } })`
+ * stamps the project default (model + dims).
  */
 export const notes = store.schema.table("notes", {
   id: field.id().primaryKey(),
-  title: field.text().notNull(),
-  body: field.text().notNull(),
+  title: field.text().searchable({ weight: 2 }).notNull(),
+  body: field.text().searchable().notNull(),
   archivedAt: field.timestamp(),
   createdAt: field.timestamp().notNull().now(),
 });

package/templates/standard/src/db/seed/index.ts

@@ -19,7 +19,7 @@ async function welcomeNote(fx: Fx) {
       title: "Welcome",
       body: "Your Notes API is ready. Create, list, and archive notes over HTTP.",
       archivedAt: null,
-      createdAt: 1,
+      createdAt: new Date("2026-01-15T10:00:00.000Z"),
     },
   );
 }
@@ -33,7 +33,7 @@ async function sampleNotes(fx: Fx) {
       title: "Shipping checklist",
       body: "Confirm schema with oke db push, then seed with oke db seed.",
       archivedAt: null,
-      createdAt: 2,
+      createdAt: new Date("2026-01-15T10:01:00.000Z"),
     },
   );
   await fx.store(db).upsert(
@@ -44,7 +44,7 @@ async function sampleNotes(fx: Fx) {
       title: "Ideas",
       body: "Replace these seed rows with your own domain data.",
       archivedAt: null,
-      createdAt: 3,
+      createdAt: new Date("2026-01-15T10:02:00.000Z"),
     },
   );
 }

package/templates/standard/src/flows/main/route.ts

@@ -3,14 +3,15 @@ import { z } from "zod";
 
 /** First-run welcome — visit :6530/ after `oke dev` (browser code block; curl stays JSON). */
 export const root = on(
-  http.get().public(),
-  flow({
+  http.get({
     out: z.object({
       ok: z.literal(true),
       app: z.string(),
       try: z.array(z.string()),
       console: z.string(),
     }),
+  }).public(),
+  flow({
     do: () => ({
       ok: true as const,
       app: "notes",

package/templates/standard/src/flows/notes/[id]/archive.ts

@@ -3,26 +3,23 @@ import { eq } from "drizzle-orm";
 
 import { db, notesMutate } from "@/core";
 import { notes } from "@/db/schema.decl";
-import { NoteIdIn, NoteOut, NotFound } from "../shapes";
+import { NoteIdIn, NoteOut, NotFound, toIsoInstant } from "../shapes";
 
 /** Soft-archive a note. */
 export const archive = on(
-  http.post().gate(notesMutate),
+  http.post({ in: NoteIdIn, out: NoteOut, errors: { NotFound } }).gate(notesMutate),
   flow({
-    in: NoteIdIn,
-    out: NoteOut,
-    errors: { NotFound },
     do: async (input, fx) => {
       const row = await fx.store(db).findById(notes, input.id);
       if (!row) return fail("NotFound", { id: input.id });
-      const archivedAt = fx.clock.now();
+      const archivedAt = new Date(fx.clock.now());
       await fx.store(db).update(notes).set({ archivedAt }).where(eq(notes.id, input.id));
       return {
         id: String(row.id),
         title: String(row.title),
         body: String(row.body),
-        archivedAt,
-        createdAt: Number(row.createdAt),
+        archivedAt: toIsoInstant(archivedAt),
+        createdAt: toIsoInstant(row.createdAt),
       };
     },
   }),