App templates and remixes

Availability

The template manifest and app-record workflow is implemented. It can list operator-curated manifests, create a new app record from one, seed non-secret environment values when the environment store is configured, and create a clean remix record from an eligible app.

Instantiation does not deploy the app. Declared databases, buckets, and authentication services are not provisioned automatically. Some declared services are themselves stub-only, so a manifest declaration is not evidence that a dependency exists.

Browse manifests

GET /api/apps/templates?category=web&q=next
GET /api/apps/templates/{template_id}

The gallery is public-read. A manifest describes a source Git URL, branch, runtime defaults, environment-variable schema, and declared services. Review the repository, current revision, license, maintenance state, and runtime commands before instantiation. A manifest is operator metadata, not a security endorsement.

Two built-in seed manifests make the API non-empty. Their external repositories can change or disappear, and there is not yet an automated smoke test for every seed.

Instantiate

POST /api/apps/templates/{template_id}/instantiate
Content-Type: application/json
 
{
  "name": "My app",
  "env": {
    "NEXT_PUBLIC_APP_NAME": "My app"
  }
}

The call creates a private app record and returns its app_id, source information, runtime type, and declared services. Only keys declared by the manifest are accepted. Secret fields are not seeded by this call.

After instantiation:

1. inspect the new app’s source and runtime settings;
2. supply secrets through App environment variables;
3. provide real external dependencies yourself unless a service is explicitly reported ready;
4. call the deployment endpoint; and
5. follow the deployment through build, health check, and activation.

Remix

POST /api/apps/{source_app_id}/remix
Content-Type: application/json
 
{
  "name": "My private remix"
}

Owners may remix their own app. Another user may remix only an app that is both public and marked remixable. The new app is private.

The remix carries source URL, branch, deployment type, port, and lineage. It deliberately does not copy environment values, secrets, database or bucket references, authentication bindings, checkpoints, IDE state, or data. It also does not fork or pin the remote Git repository. If the source owner later changes or removes that repository, a new deployment can differ or fail.

For a durable remix, fork the source into a repository you control, review and pin a revision, update the new app’s source, and then deploy.

Publication checklist for a template

Before presenting a template as usable:

• confirm the repository and license;
• pin or record a tested revision;
• validate install, build, run, port, and health behavior;
• test required environment fields without exposing secrets;
• verify every declared service is actually available; and
• instantiate, deploy, smoke-test, and remove it in a clean environment.