@pplethai/cli 0.1.0

package/templates/golden-path/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "pple-app",
+  "private": true,
+  "type": "module",
+  "//": "Golden-path template for a PPLE Platform Builder App. Rename this to your app slug. Everything runs on Cloudflare: a Hono Worker (API), D1 (database), R2 (files); the UI is a React SPA built with the People's Party design system.",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.worker.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "db:migrate:local": "wrangler d1 migrations apply DB --local",
+    "db:migrate:remote": "wrangler d1 migrations apply DB --remote",
+    "deploy": "vite build && wrangler deploy"
+  },
+  "dependencies": {
+    "@pplethai/components": "^1.4.1",
+    "@pplethai/pple-today-miniapp-sdk": "^0.1.4",
+    "hono": "^4.12.30",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-hook-form": "^7.81.0",
+    "zod": "^4.4.0"
+  },
+  "devDependencies": {
+    "@cloudflare/vite-plugin": "^1.45.1",
+    "@cloudflare/vitest-pool-workers": "^0.18.6",
+    "@cloudflare/workers-types": "^5.20260714.1",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "@vitejs/plugin-react": "^6.0.3",
+    "typescript": "^5.8.0",
+    "vite": "^8.1.5",
+    "vitest": "^4.1.10",
+    "wrangler": "^4.112.0"
+  }
+}

package/templates/golden-path/shared/api.ts

@@ -0,0 +1,56 @@
+// The API contract shared by the Worker (src/) and the React app (web/).
+// Defining request/response shapes once, as Zod schemas, means the server
+// validates exactly what the client promises to send — and both sides share
+// the inferred TypeScript types.
+import { z } from "zod";
+
+/** The signed-in user, as the Worker resolves it from the PPLE ID token. */
+export const MeSchema = z.object({
+  sub: z.string(),
+  name: z.string().nullable(),
+});
+export type Me = z.infer<typeof MeSchema>;
+
+/** A row in the example `notes` table (the D1 read/write demo). */
+export const NoteSchema = z.object({
+  id: z.number(),
+  body: z.string(),
+  createdAt: z.string(),
+});
+export type Note = z.infer<typeof NoteSchema>;
+
+/** Body for creating a note. */
+export const CreateNoteSchema = z.object({
+  body: z.string().trim().min(1).max(500),
+});
+export type CreateNote = z.infer<typeof CreateNoteSchema>;
+
+/** An uploaded file's metadata (the R2 demo). */
+export const UploadedFileSchema = z.object({
+  key: z.string(),
+  name: z.string(),
+  size: z.number(),
+  uploadedAt: z.string(),
+});
+export type UploadedFile = z.infer<typeof UploadedFileSchema>;
+
+/**
+ * A notification to send to this app's App Users. Content only — never phone
+ * numbers or user ids. The platform resolves the audience server-side (see
+ * src/notify.ts and docs/integration/today-sso-changes.md §6).
+ *
+ * Optional `linkPath` is a path-only deep link into *this* app (must start
+ * with `/`). The platform joins it to this app's known entry and rejects
+ * absolute URLs / cross-app destinations. Free-form destinations that could
+ * address another mini app are not accepted.
+ */
+export const NotificationSchema = z.object({
+  title: z.string().trim().min(1).max(120),
+  body: z.string().trim().min(1).max(500),
+  linkPath: z
+    .string()
+    .trim()
+    .regex(/^\/(?!\/).*/, "linkPath must be a path starting with a single /")
+    .optional(),
+});
+export type Notification = z.infer<typeof NotificationSchema>;

package/templates/golden-path/src/auth.ts

@@ -0,0 +1,53 @@
+// PPLE ID authentication.
+//
+// PPLE Today launches your mini-app with an access token in the URL; the
+// frontend SDK captures it and sends it as a bearer token on every API call.
+// The Worker validates that token server-side against the PPLE ID userinfo
+// endpoint — the same seam the platform's own services use. There is no local
+// session or cookie: each request carries the token.
+
+export interface Identity {
+  sub: string;
+  name: string | null;
+}
+
+export type AuthResult =
+  | { ok: true; identity: Identity }
+  | { ok: false; status: 401 | 502 };
+
+interface AuthEnv {
+  SSO_BASE_URL: string;
+  /** Local-only bypass token; unset in production. See .dev.vars.example. */
+  DEV_AUTH?: string;
+}
+
+/**
+ * Resolve the caller's identity from a bearer token. Distinguishes an
+ * invalid token (401) from PPLE ID being unreachable (502) so the client can
+ * tell "sign in again" apart from "try again later".
+ */
+export async function authenticate(
+  env: AuthEnv,
+  token: string,
+  fetchImpl: typeof fetch = globalThis.fetch.bind(globalThis),
+): Promise<AuthResult> {
+  // Local development bypass: accept a fake user when the request carries the
+  // configured DEV_AUTH token. Never active in production, because the
+  // platform never provisions DEV_AUTH.
+  if (env.DEV_AUTH && token === env.DEV_AUTH) {
+    return { ok: true, identity: { sub: "dev-user", name: "Local Dev" } };
+  }
+
+  const res = await fetchImpl(`${env.SSO_BASE_URL}/oidc/v1/userinfo`, {
+    headers: { authorization: `Bearer ${token}` },
+  });
+  if (res.status === 401 || res.status === 403) return { ok: false, status: 401 };
+  if (!res.ok) return { ok: false, status: 502 };
+
+  const body = (await res.json().catch(() => ({}))) as {
+    sub?: string;
+    name?: string;
+  };
+  if (!body.sub) return { ok: false, status: 502 };
+  return { ok: true, identity: { sub: body.sub, name: body.name ?? null } };
+}

package/templates/golden-path/src/db.ts

@@ -0,0 +1,32 @@
+// D1 (SQLite) read/write example. D1 is your app's private database; the
+// schema lives in ./migrations. Keep queries here so routes stay thin and the
+// SQL is easy to find.
+import type { Note } from "../shared/api";
+
+interface NoteRow {
+  id: number;
+  body: string;
+  created_at: string;
+}
+
+function toNote(row: NoteRow): Note {
+  return { id: row.id, body: row.body, createdAt: row.created_at };
+}
+
+export async function listNotes(db: D1Database): Promise<Note[]> {
+  const { results } = await db
+    .prepare("SELECT id, body, created_at FROM notes ORDER BY id DESC LIMIT 50")
+    .all<NoteRow>();
+  return results.map(toNote);
+}
+
+export async function addNote(db: D1Database, body: string): Promise<Note> {
+  // Always bind values (never string-concatenate) — D1 uses prepared
+  // statements, which keeps user input from being interpreted as SQL.
+  const row = await db
+    .prepare("INSERT INTO notes (body) VALUES (?) RETURNING id, body, created_at")
+    .bind(body)
+    .first<NoteRow>();
+  if (!row) throw new Error("insert returned no row");
+  return toNote(row);
+}

package/templates/golden-path/src/env.ts

@@ -0,0 +1,19 @@
+// Everything the Worker needs from its environment. The platform injects the
+// real bindings and secrets at deploy time; local defaults live in
+// wrangler.jsonc and .dev.vars.
+export interface Env {
+  // Your app's private database and file storage.
+  DB: D1Database;
+  FILES: R2Bucket;
+
+  // PPLE ID — the Worker validates bearer tokens against this base URL.
+  SSO_BASE_URL: string;
+
+  // Audience-bound notifications (see src/notify.ts). Base is a var; the key
+  // is a platform-provisioned secret. Both may be empty locally.
+  NOTIFY_API_BASE: string;
+  NOTIFY_API_KEY?: string;
+
+  // Local development auth bypass. Never set in production.
+  DEV_AUTH?: string;
+}

package/templates/golden-path/src/files.ts

@@ -0,0 +1,38 @@
+// R2 (object storage) upload example. R2 is your app's private bucket for
+// files — images, PDFs, exports. Store the human-facing filename in custom
+// metadata so listings can show it; the object key itself is a random id.
+import type { UploadedFile } from "../shared/api";
+
+function toUploaded(
+  key: string,
+  name: string,
+  size: number,
+  uploaded: Date,
+): UploadedFile {
+  return { key, name, size, uploadedAt: uploaded.toISOString() };
+}
+
+export async function putFile(
+  bucket: R2Bucket,
+  name: string,
+  body: ReadableStream | ArrayBuffer | string,
+  contentType?: string,
+): Promise<UploadedFile> {
+  const key = crypto.randomUUID();
+  const obj = await bucket.put(key, body, {
+    httpMetadata: contentType ? { contentType } : undefined,
+    customMetadata: { name },
+  });
+  return toUploaded(obj.key, name, obj.size, obj.uploaded);
+}
+
+export async function listFiles(bucket: R2Bucket): Promise<UploadedFile[]> {
+  const listed = await bucket.list({ limit: 50, include: ["customMetadata"] });
+  return listed.objects.map((o) =>
+    toUploaded(o.key, o.customMetadata?.name ?? o.key, o.size, o.uploaded),
+  );
+}
+
+export function getFile(bucket: R2Bucket, key: string): Promise<R2ObjectBody | null> {
+  return bucket.get(key);
+}

package/templates/golden-path/src/index.ts

@@ -0,0 +1,104 @@
+// The Worker: your app's API. Hono routes everything under /api/*; the React
+// SPA is served for every other path (see wrangler.jsonc). Keep route
+// handlers thin — the real work lives in the helpers (auth, db, files, notify)
+// so each concern is easy to find and test.
+import { Hono } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { CreateNoteSchema, NotificationSchema } from "../shared/api";
+import { authenticate, type Identity } from "./auth";
+import { addNote, listNotes } from "./db";
+import type { Env } from "./env";
+import { getFile, listFiles, putFile } from "./files";
+import { sendNotification } from "./notify";
+
+/** Test seam: real fetch by default, an injected fake in tests. */
+export interface AppOverrides {
+  fetchImpl?: typeof fetch;
+}
+
+type AppContext = {
+  Bindings: Env;
+  Variables: { identity: Identity };
+};
+
+export function createApp(overrides: AppOverrides = {}) {
+  const fetchImpl = overrides.fetchImpl ?? globalThis.fetch.bind(globalThis);
+
+  const app = new Hono<AppContext>().basePath("/api");
+
+  // Liveness check — no auth, so uptime monitors and CI smoke tests can hit it.
+  app.get("/health", (c) => c.json({ ok: true }));
+
+  // Everything below requires a valid PPLE ID token.
+  app.use("*", async (c, next) => {
+    const token = (c.req.header("authorization") ?? "")
+      .replace(/^Bearer\s+/i, "")
+      .trim();
+    if (!token) return c.json({ error: "not_authenticated" }, 401);
+    const result = await authenticate(c.env, token, fetchImpl);
+    if (!result.ok) {
+      return c.json(
+        { error: result.status === 401 ? "not_authenticated" : "sso_unavailable" },
+        result.status,
+      );
+    }
+    c.set("identity", result.identity);
+    await next();
+  });
+
+  app.get("/me", (c) => {
+    const { sub, name } = c.get("identity");
+    return c.json({ sub, name });
+  });
+
+  // --- D1 demo: a shared notes list ---
+  app.get("/notes", async (c) => c.json({ notes: await listNotes(c.env.DB) }));
+
+  app.post("/notes", async (c) => {
+    const parsed = CreateNoteSchema.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) return c.json({ error: "invalid_body" }, 400);
+    return c.json(await addNote(c.env.DB, parsed.data.body), 201);
+  });
+
+  // --- R2 demo: file upload/list/download ---
+  app.get("/files", async (c) => c.json({ files: await listFiles(c.env.FILES) }));
+
+  app.post("/files", async (c) => {
+    const form = await c.req.formData().catch(() => null);
+    const file = form?.get("file");
+    if (!(file instanceof File)) return c.json({ error: "no_file" }, 400);
+    const uploaded = await putFile(
+      c.env.FILES,
+      file.name,
+      file.stream(),
+      file.type,
+    );
+    return c.json(uploaded, 201);
+  });
+
+  app.get("/files/:key", async (c) => {
+    const obj = await getFile(c.env.FILES, c.req.param("key"));
+    if (!obj) return c.json({ error: "not_found" }, 404);
+    const headers = new Headers();
+    obj.writeHttpMetadata(headers);
+    headers.set("etag", obj.httpEtag);
+    return new Response(obj.body, { headers });
+  });
+
+  // --- Notification demo: audience-bound send (content only) ---
+  app.post("/notify", async (c) => {
+    const parsed = NotificationSchema.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) return c.json({ error: "invalid_body" }, 400);
+    const result = await sendNotification(c.env, parsed.data, fetchImpl);
+    if (result.ok) return c.json({ ok: true });
+    return c.json({ error: result.error }, result.status as ContentfulStatusCode);
+  });
+
+  return app;
+}
+
+export default createApp();

package/templates/golden-path/src/notify.ts

@@ -0,0 +1,64 @@
+// Audience-bound push notifications.
+//
+// Your app sends *content* — a title and body, never phone numbers or user
+// ids — plus an optional path-only self-link. The platform resolves the
+// recipients server-side (this app's App Users ∩ its current publication-tier
+// audience), joins `linkPath` to this app's known entry, and enforces the
+// per-app rate limit. This is the whole privacy model: an app can reach the
+// people who use it, and no one else; and it can deep-link into itself, not
+// into another team's mini app.
+//
+// See docs/integration/today-sso-changes.md §6 for the contract.
+//
+// Wiring: the platform provisions NOTIFY_API_BASE and this app's own
+// NotificationApiKey as NOTIFY_API_KEY, so `POST {NOTIFY_API_BASE}/notifications`
+// lands on PPLE Today's audience-bound send route. The key is the whole
+// address — PPLE Today resolves it to this app and derives the audience from
+// that, so the request carries neither an app id nor any recipient.
+//
+// The wire shape below is PPLE Today's, not this app's: your code passes the
+// friendlier `{ title, body, linkPath? }` and this is where it becomes
+// `{ content: { header, message }, linkPath? }`. Keeping that translation in
+// one place means the rest of the app never has to know the platform's
+// vocabulary.
+import type { Notification } from "../shared/api";
+
+interface NotifyEnv {
+  NOTIFY_API_BASE: string;
+  NOTIFY_API_KEY?: string;
+}
+
+export type NotifyResult =
+  | { ok: true }
+  | { ok: false; status: number; error: string };
+
+export async function sendNotification(
+  env: NotifyEnv,
+  input: Notification,
+  fetchImpl: typeof fetch = globalThis.fetch.bind(globalThis),
+): Promise<NotifyResult> {
+  if (!env.NOTIFY_API_BASE || !env.NOTIFY_API_KEY) {
+    // Not wired up (e.g. local dev without a key). Fail loud, not silent.
+    return { ok: false, status: 503, error: "notifications_not_configured" };
+  }
+
+  const res = await fetchImpl(`${env.NOTIFY_API_BASE}/notifications`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${env.NOTIFY_API_KEY}`,
+      "content-type": "application/json",
+    },
+    // Content (+ optional self-link). The audience is resolved by the platform.
+    body: JSON.stringify({
+      content: { header: input.title, message: input.body },
+      ...(input.linkPath !== undefined ? { linkPath: input.linkPath } : {}),
+    }),
+  });
+
+  if (res.ok) return { ok: true };
+  return {
+    ok: false,
+    status: res.status,
+    error: res.status === 429 ? "rate_limited" : "send_failed",
+  };
+}

package/templates/golden-path/test/apply-migrations.ts

@@ -0,0 +1,4 @@
+import { applyD1Migrations, env } from "cloudflare:test";
+
+// Bring the local test D1 up to the latest migration before any test runs.
+await applyD1Migrations(env.DB, env.TEST_MIGRATIONS);

package/templates/golden-path/test/env.d.ts

@@ -0,0 +1,17 @@
+import type { Env } from "../src/env";
+
+// The test runtime's `env` (from "cloudflare:test") is typed as Cloudflare.Env.
+// Extend it with our app's bindings/vars plus the migrations the setup file
+// applies, so tests get full type-checking of env.
+declare global {
+  namespace Cloudflare {
+    interface Env extends /* app bindings + vars */ AppEnvForTests {
+      TEST_MIGRATIONS: D1Migration[];
+    }
+  }
+}
+
+// Alias so the `extends` clause reads clearly above.
+type AppEnvForTests = Env;
+
+export {};

package/templates/golden-path/test/harness.ts

@@ -0,0 +1,57 @@
+import { env } from "cloudflare:test";
+import type { Env } from "../src/env";
+import { createApp } from "../src/index";
+
+export const DEV_TOKEN = "dev-token";
+
+export interface Fakes {
+  /** Handles GET {SSO_BASE_URL}/oidc/v1/userinfo */
+  sso?: (req: Request) => Response | Promise<Response>;
+  /** Handles POST {NOTIFY_API_BASE}/notifications */
+  notify?: (req: Request) => Response | Promise<Response>;
+}
+
+/**
+ * A copy of the Worker wired to fake PPLE ID / notification services (via an
+ * injected fetch) and the real local D1 + R2 from the test runtime. Records
+ * the requests sent to the notification endpoint so tests can assert the
+ * content-only contract.
+ */
+export function makeHarness(fakes: Fakes = {}, envOverrides: Partial<Env> = {}) {
+  const calls = { notify: [] as Request[] };
+
+  const fetchImpl: typeof fetch = async (input, init) => {
+    const req = new Request(input as RequestInfo, init);
+    const url = new URL(req.url);
+    if (url.pathname.endsWith("/oidc/v1/userinfo")) {
+      return fakes.sso ? fakes.sso(req) : new Response(null, { status: 502 });
+    }
+    if (url.pathname.endsWith("/notifications")) {
+      calls.notify.push(req.clone());
+      return fakes.notify ? fakes.notify(req) : new Response(null, { status: 502 });
+    }
+    return new Response(`unexpected fetch: ${req.url}`, { status: 599 });
+  };
+
+  const app = createApp({ fetchImpl });
+
+  const testEnv: Env = {
+    ...env,
+    SSO_BASE_URL: "https://sso.test",
+    NOTIFY_API_BASE: "",
+    DEV_AUTH: DEV_TOKEN,
+    ...envOverrides,
+  };
+
+  const request = (
+    path: string,
+    init: RequestInit = {},
+    token: string | null = DEV_TOKEN,
+  ) => {
+    const headers = new Headers(init.headers);
+    if (token !== null) headers.set("authorization", `Bearer ${token}`);
+    return app.request(path, { ...init, headers }, testEnv);
+  };
+
+  return { app, request, testEnv, calls };
+}

package/templates/golden-path/test/smoke.test.ts

@@ -0,0 +1,155 @@
+import { describe, expect, it } from "vitest";
+import type { Note, UploadedFile } from "../shared/api";
+import { makeHarness } from "./harness";
+
+describe("health", () => {
+  it("is public and reports ok", async () => {
+    const h = makeHarness();
+    const res = await h.request("/api/health", {}, null);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+  });
+});
+
+describe("authentication", () => {
+  it("rejects requests without a token", async () => {
+    const h = makeHarness();
+    const res = await h.request("/api/me", {}, null);
+    expect(res.status).toBe(401);
+    expect(await res.json()).toMatchObject({ error: "not_authenticated" });
+  });
+
+  it("accepts the dev-bypass token locally", async () => {
+    const h = makeHarness();
+    const res = await h.request("/api/me");
+    expect(res.status).toBe(200);
+    expect(await res.json()).toMatchObject({ sub: "dev-user" });
+  });
+
+  it("validates real tokens against PPLE ID userinfo", async () => {
+    // No dev bypass here; an unknown token must be checked with PPLE ID.
+    const h = makeHarness(
+      { sso: () => Response.json({ error: "invalid_token" }, { status: 401 }) },
+      { DEV_AUTH: undefined },
+    );
+    const res = await h.request("/api/me", {}, "some-real-looking-token");
+    expect(res.status).toBe(401);
+  });
+
+  it("resolves identity from a valid PPLE ID token", async () => {
+    const h = makeHarness(
+      { sso: () => Response.json({ sub: "u-42", name: "Somchai" }) },
+      { DEV_AUTH: undefined },
+    );
+    const res = await h.request("/api/me", {}, "valid-token");
+    expect(await res.json()).toMatchObject({ sub: "u-42", name: "Somchai" });
+  });
+});
+
+describe("D1 read/write (notes)", () => {
+  it("stores a note and reads it back", async () => {
+    const h = makeHarness();
+
+    const created = await h.request("/api/notes", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ body: "hello d1" }),
+    });
+    expect(created.status).toBe(201);
+    expect(await created.json<Note>()).toMatchObject({ body: "hello d1" });
+
+    const listed = await h.request("/api/notes");
+    const { notes } = await listed.json<{ notes: Note[] }>();
+    expect(notes.some((n) => n.body === "hello d1")).toBe(true);
+  });
+
+  it("rejects an empty note", async () => {
+    const h = makeHarness();
+    const res = await h.request("/api/notes", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ body: "   " }),
+    });
+    expect(res.status).toBe(400);
+  });
+});
+
+describe("R2 upload (files)", () => {
+  it("uploads a file and lists it", async () => {
+    const h = makeHarness();
+
+    const form = new FormData();
+    form.append("file", new File(["file contents"], "photo.txt", { type: "text/plain" }));
+    const uploaded = await h.request("/api/files", { method: "POST", body: form });
+    expect(uploaded.status).toBe(201);
+    const meta = await uploaded.json<UploadedFile>();
+    expect(meta).toMatchObject({ name: "photo.txt", size: 13 });
+
+    const listed = await h.request("/api/files");
+    const { files } = await listed.json<{ files: UploadedFile[] }>();
+    expect(files.some((f) => f.name === "photo.txt")).toBe(true);
+  });
+});
+
+describe("audience-bound notifications", () => {
+  it("reports not-configured when no key is set", async () => {
+    const h = makeHarness();
+    const res = await h.request("/api/notify", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ title: "Hi", body: "there" }),
+    });
+    expect(res.status).toBe(503);
+    expect(await res.json()).toMatchObject({ error: "notifications_not_configured" });
+  });
+
+  it("sends content only (never phone numbers) to the platform endpoint", async () => {
+    const h = makeHarness(
+      { notify: () => new Response(null, { status: 202 }) },
+      // Shaped like what the platform actually binds, so the test exercises
+      // the real `${base}/notifications` the Worker will call in production.
+      { NOTIFY_API_BASE: "https://today.test/external", NOTIFY_API_KEY: "app-key" },
+    );
+
+    const res = await h.request("/api/notify", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ title: "Event tonight", body: "Doors at 7" }),
+    });
+    expect(res.status).toBe(200);
+
+    expect(h.calls.notify).toHaveLength(1);
+    const sent = h.calls.notify[0]!;
+    expect(sent.headers.get("authorization")).toBe("Bearer app-key");
+    // PPLE Today's wire shape, which src/notify.ts translates into.
+    const payload = await sent.json<Record<string, unknown>>();
+    expect(payload).toEqual({
+      content: { header: "Event tonight", message: "Doors at 7" },
+    });
+    expect(JSON.stringify(payload)).not.toMatch(/phone|recipient|number/i);
+  });
+
+  it("forwards optional linkPath on the platform wire shape", async () => {
+    const h = makeHarness(
+      { notify: () => new Response(null, { status: 202 }) },
+      { NOTIFY_API_BASE: "https://today.test/external", NOTIFY_API_KEY: "app-key" },
+    );
+
+    const res = await h.request("/api/notify", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        title: "Check-in open",
+        body: "Tap to open the form",
+        linkPath: "/check-in",
+      }),
+    });
+    expect(res.status).toBe(200);
+
+    const payload = await h.calls.notify[0]!.json<Record<string, unknown>>();
+    expect(payload).toEqual({
+      content: { header: "Check-in open", message: "Tap to open the form" },
+      linkPath: "/check-in",
+    });
+  });
+});

package/templates/golden-path/tsconfig.json

@@ -0,0 +1,20 @@
+// TypeScript config for the React SPA (web/) and shared code. The Worker has
+// its own config (tsconfig.worker.json) because it runs in the Workers
+// runtime, not the browser. `npm run typecheck` checks both.
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "types": [],
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["web", "shared"]
+}