@ultimat3/cli 29.3.2 → 30.0.0

package/src/templates/shapes/api-keys.ts

@@ -0,0 +1,170 @@
+// The `api` shape's key slice: an org's API key, issued by an admin, resolved by the `/v1` bearer
+// mount. The framework's own `issueApiKey` / `apiKeyResolver` over `x_api_keys`; no second store.
+
+import type { GeneratedFile } from '../naming';
+
+const DIR = 'apps/web/app/keys';
+
+const keys = (): string => `/**
+ * An org's API key: a machine caller's credential for the actions and queries a browser would call.
+ * No second API — the \`/v1\` mount (\`api/index.ts\`) re-serves them behind \`resolveApiKey\`.
+ *
+ * A key's scopes ARE its permissions (\`apiKeyActor\`), so a key issued with \`post:write\` passes
+ * \`canPostWrite\` for the org it was issued in and for nothing else.
+ */
+
+import type { ApiKeyVerifyStore } from '@ultimat3/auth';
+import {
+  apiKeyResolver,
+  issueApiKey,
+  memoryAuthAdapter,
+  postgresAuthAdapter,
+} from '@ultimat3/auth';
+import { type Clock, resolveEnvironment, storeMode } from '@ultimat3/core';
+
+/** Every scope a key can carry; the map below says what each one reaches. */
+export const apiKeyScopes = ['post:read', 'post:write'] as const;
+
+export type ApiKeyScope = (typeof apiKeyScopes)[number];
+
+/** What a key may do, and the one map the \`/v1\` mount cuts its routes by. */
+export const API_KEY_SCOPES = {
+  'post:read': ['postList'],
+  'post:write': ['createPost', 'archivePost'],
+} as const satisfies Record<ApiKeyScope, readonly string[]>;
+
+/**
+ * \`x_api_keys\` through the framework's adapter, except under \`bun test\`, where no database client
+ * is installed — core's \`storeMode\`, the answer \`packages/db\`'s driver reads too. Built on first
+ * use: the adapter takes the process client, which the boot installs after this module loads.
+ */
+let store: ApiKeyVerifyStore | undefined;
+const keyStore = (): ApiKeyVerifyStore => {
+  store ??= storeMode(Bun.env) === 'memory' ? memoryAuthAdapter() : postgresAuthAdapter();
+  return store;
+};
+
+/** The mount's \`resolveToken\`: every wrong key is one \`null\` (401), a fault propagates. */
+export const resolveApiKey = apiKeyResolver(keyStore);
+
+export interface IssuedKey {
+  readonly id: string;
+  readonly prefix: string;
+  /** The plaintext. Stored nowhere: the record holds a hash of its secret half. */
+  readonly key: string;
+}
+
+/** A key for one org, with every scope unless \`scopes\` narrows it. Owned by the org, not a user. */
+export async function issueKeyFor(issuer: {
+  readonly orgId: string;
+  readonly clock: Clock;
+  readonly scopes?: readonly ApiKeyScope[] | undefined;
+}): Promise<IssuedKey> {
+  const issued = issueApiKey({
+    env: resolveEnvironment({ env: Bun.env }) === 'production' ? 'prod' : 'dev',
+    scopes: issuer.scopes ?? apiKeyScopes,
+    orgId: issuer.orgId,
+    clock: issuer.clock,
+  });
+  await keyStore().putApiKey(issued.record);
+  return { id: issued.record.id, prefix: issued.record.prefix, key: issued.plaintext };
+}
+`;
+
+const keysTest =
+  (): string => `// A key, issued and presented back: who it resolves to, and that a wrong one is nobody.
+import { systemClock } from '@ultimat3/core';
+import { expect, unitTest } from '@ultimat3/testing';
+import { apiKeyScopes, issueKeyFor, resolveApiKey } from './keys';
+
+const ORG = '00000000-0000-4000-8000-0000000000a1';
+
+unitTest('an issued key resolves to its org, carrying every scope', async () => {
+  const issued = await issueKeyFor({ orgId: ORG, clock: systemClock });
+  const caller = await resolveApiKey(issued.key);
+  expect(caller?.actor.orgId).toBe(ORG);
+  expect([...(caller?.scopes ?? [])].sort()).toEqual([...apiKeyScopes].sort());
+});
+
+unitTest('a key narrowed to reads carries reads only', async () => {
+  const issued = await issueKeyFor({ orgId: ORG, clock: systemClock, scopes: ['post:read'] });
+  expect([...((await resolveApiKey(issued.key))?.scopes ?? [])]).toEqual(['post:read']);
+});
+
+unitTest('a key nobody issued is nobody, never an error', async () => {
+  expect(await resolveApiKey('sk_dev_0000000000000000_not-a-real-secret')).toBeNull();
+});
+`;
+
+const policy =
+  (): string => `// Who may mint an org's API key: an admin of that org. A key is a credential that outlives the
+// session that issued it, so it is its own grant rather than a side effect of \`post:write\`.
+
+import { can, definePermissions } from '@ultimat3/policy';
+
+declare module '@ultimat3/policy' {
+  interface PermissionRegistry {
+    'key:issue': true;
+  }
+}
+
+export const keyPermissions = definePermissions(['key:issue']);
+
+/** Issue takes no org from its input — the key is the actor's own org's — so the actor must HAVE one. */
+export const canKeyIssue = can(
+  'key:issue',
+  ({ actor }) => actor !== null && typeof actor.orgId === 'string' && actor.orgId !== '',
+);
+`;
+
+const issueAction =
+  (): string => `// Mint an API key for the caller's org. The answer is a credential shown once, so there is no
+// \`mcp\` block: a tool result is kept in a transcript.
+
+import { action, t } from '@ultimat3/action';
+import { apiKeyScopes, issueKeyFor } from '../keys';
+import { canKeyIssue } from '../policy';
+
+export const issueKey = action({
+  input: t.object({ scopes: t.array(t.enum(apiKeyScopes)).optional() }),
+  output: t.object({ id: t.string, prefix: t.string, key: t.string }),
+  policy: canKeyIssue,
+  async handle({ input, ctx }) {
+    return issueKeyFor({ orgId: ctx.actor?.orgId ?? '', clock: ctx.clock, scopes: input.scopes });
+  },
+});
+`;
+
+const issueActionTest = (): string => `// Who may mint a key, and what the key can then do.
+import { testActor } from '@ultimat3/policy';
+import { expect, unitTest } from '@ultimat3/testing';
+import { resolveApiKey } from '../keys';
+import { issueKey } from './issue-key';
+
+const ORG = '00000000-0000-4000-8000-0000000000a1';
+const target = issueKey.named('issueKey');
+
+unitTest('a member without the grant is refused', async () => {
+  const member = testActor('member', { orgId: ORG, permissions: ['post:read'] }).actor;
+  await expect(target.as(member, {})).rejects.toBeUltimateError('X_FORBIDDEN');
+});
+
+unitTest("an admin's key resolves to the admin's org, with the scopes asked for", async () => {
+  const admin = testActor('admin', { orgId: ORG, permissions: ['key:issue'] }).actor;
+  const issued = await target.as(admin, { scopes: ['post:read'] });
+  const caller = await resolveApiKey(issued.key);
+  expect(caller?.actor.orgId).toBe(ORG);
+  expect([...(caller?.scopes ?? [])]).toEqual(['post:read']);
+});
+`;
+
+/** `apps/web/app/keys/`: the key store, its policy, the issuing action and their tests. */
+export function apiKeyFiles(): readonly GeneratedFile[] {
+  return [
+    { path: `${DIR}/keys.ts`, contents: keys() },
+    { path: `${DIR}/keys.test.ts`, contents: keysTest() },
+    { path: `${DIR}/policy.ts`, contents: policy() },
+    { path: `${DIR}/actions/issue-key.ts`, contents: issueAction() },
+    { path: `${DIR}/actions/issue-key.test.ts`, contents: issueActionTest() },
+  ];
+}

package/src/templates/shapes/api.ts

@@ -0,0 +1,101 @@
+// `x new <name> --shape api`: the example `post` slice as an API — actions, a live query and a job,
+// served over a session, an org API key on `/v1`, OpenAPI and MCP. No page beyond the error
+// documents and the offline fallback, no island, no app UI. `/admin` stays: it is the operator's
+// console. The PWA block stays too: a page `x g` writes into this app is tested offline.
+
+import type { GeneratedFile, NameSet } from '../naming';
+import { apiKeyFiles } from './api-keys';
+import type { ShapeEdit, ShapeOverlay } from './overlay';
+import { claudeRows, shapeLines } from './shared-edits';
+
+const apiIndex = (app: NameSet): string => `/**
+ * The API surface: every action, query and job this app exposes, registered in one call. From this
+ * list the framework projects HTTP routes, \`openapi.json\`, the typed client, job handles and MCP
+ * tools. \`defineApi\` takes whole MODULES, so the export name IS the primitive's name.
+ *
+ * Two doors onto the same handlers: a session (or \`x dev\`'s development viewer) on \`/api\`, and an
+ * org's API key on \`/v1\` — cut by \`API_KEY_SCOPES\`, so a read-only key reaches \`postList\` only.
+ */
+
+import { defineApi } from '@ultimat3/action';
+import * as issueKey from '../app/keys/actions/issue-key';
+import { API_KEY_SCOPES, resolveApiKey } from '../app/keys/keys';
+import * as archivePost from '../app/post/actions/archive-post';
+import * as createPost from '../app/post/actions/create-post';
+import * as reindexPost from '../app/post/jobs/reindex-post';
+import * as postList from '../app/post/live/post-list';
+import * as health from './health';
+
+export const api = defineApi({
+  actions: [health, createPost, archivePost, issueKey],
+  queries: [postList],
+  jobs: [reindexPost],
+  http: { mounts: [{ prefix: '/v1', scopes: API_KEY_SCOPES, resolveToken: resolveApiKey }] },
+  // Declared, so \`openapi.json\` is the complete document: every operation, both security schemes.
+  openapi: { title: '${app.pascal}', version: '1.0.0' },
+});
+
+/** What a typed client is shaped from. */
+export type Api = typeof api;
+`;
+
+const apiIndexTest =
+  (): string => `// The registration, read back: an action left out of the list is a route that answers 404 with
+// every test of the action itself still green.
+import { expect, unitTest } from '@ultimat3/testing';
+import { API_KEY_SCOPES } from '../app/keys/keys';
+import { api } from './index';
+
+unitTest('every action, the live query and the job are registered under their export names', () => {
+  for (const name of ['health', 'createPost', 'archivePost', 'issueKey'] as const) {
+    expect(api.actions[name].describe().name).toBe(name);
+  }
+  expect(api.queries.postList.isLive).toBe(true);
+  expect(api.jobs.reindexPost.name).toBe('reindexPost');
+});
+
+unitTest('every operation a key scope names is registered', () => {
+  const registered = new Set([...Object.keys(api.actions), ...Object.keys(api.queries)]);
+  for (const names of Object.values(API_KEY_SCOPES)) {
+    for (const name of names)
+      expect({ name, registered: registered.has(name) }).toEqual({ name, registered: true });
+  }
+});
+`;
+
+const edits = (): readonly ShapeEdit[] => [
+  {
+    path: 'apps/web/shared/roles.ts',
+    find: "    grants: [\n      'admin:read',",
+    replace: "    grants: [\n      'key:issue',\n      'admin:read',",
+  },
+  ...claudeRows({
+    page: 'none in this shape: `bunx x g route <name>` writes one with its test',
+    island: 'none in this shape: `bunx x g island <name>` writes one with its states',
+  }),
+  ...shapeLines(
+    'api',
+    'an API — `apps/web/api/index.ts` registers every primitive, `/v1` takes an org API key (`apps/web/app/keys/`)',
+  ),
+];
+
+export const apiShape: ShapeOverlay = {
+  example: true,
+  drop: [
+    'apps/web/app/dashboard/',
+    'apps/web/app/posts/',
+    'apps/web/app/post/post-form.island.',
+    'apps/web/app/post/ui',
+    'apps/web/shared/shell',
+    'apps/web/shared/theme-toggle.island',
+    'apps/web/shared/browser-client',
+    'apps/web/site/page.',
+  ],
+  dropKeys: ['app.dashboard', 'app.post', 'app.posts', 'shell', 'site'],
+  edits,
+  files: (app): readonly GeneratedFile[] => [
+    ...apiKeyFiles(),
+    { path: 'apps/web/api/index.ts', contents: apiIndex(app) },
+    { path: 'apps/web/api/index.test.ts', contents: apiIndexTest() },
+  ],
+};

package/src/templates/shapes/blog-site.ts

@@ -0,0 +1,340 @@
+// The `blog` shape's site: the index at `/` and one page per post at `/posts/<slug>`, both `isr`
+// with zero JavaScript, read over the app's own typed query client — `site/` never imports `app/`,
+// so a page reaches the slice the way a stranger's client would, and the build prerenders it.
+
+import { catalogJson } from '../catalog-json';
+import { catalogPath } from '../locales';
+import type { GeneratedFile, NameSet } from '../naming';
+
+const client =
+  (): string => `// The typed read client a \`site/\` page loads through. \`Api\` is a TYPE import, so no module edge
+// reaches \`app/\`: the page asks its own server over HTTP, and \`x build\` answers it in process.
+
+import { queryClient } from '@ultimat3/query';
+import type { Api } from '../api';
+
+type Env = Readonly<Record<string, string | undefined>>;
+
+/** The origin the server reads itself through: \`APP_URL\`, or this process's own port. */
+export const appUrl = (env: Env): string => env.APP_URL || \`http://localhost:\${env.PORT || '3000'}\`;
+
+export const queries = queryClient<Api['queries']>({
+  get baseUrl() {
+    return appUrl(Bun.env);
+  },
+});
+`;
+
+const clientTest =
+  (): string => `// Where the server reads itself: the one origin rule the pages' client depends on.
+import { expect, unitTest } from '@ultimat3/testing';
+import { appUrl } from './client';
+
+unitTest('the server reads itself at APP_URL, or at its own port when none is set', () => {
+  expect(appUrl({ APP_URL: 'https://blog.example' })).toBe('https://blog.example');
+  expect(appUrl({ PORT: '4000' })).toBe('http://localhost:4000');
+  expect(appUrl({})).toBe('http://localhost:3000');
+});
+`;
+
+const rows =
+  (): string => `// The one row a detail page renders. A read answers rows, \`limit(1)\` included; the empty answer is
+// a 404 decided here rather than in every \`load\`.
+
+import { assertCoded } from '@ultimat3/core';
+
+export function oneRow<TRow>(found: readonly TRow[], reference: string): TRow {
+  const [row] = found;
+  assertCoded(
+    row !== undefined,
+    'X_NOT_FOUND',
+    \`no published post at "\${reference}"\`,
+    'bunx x db seed   # or publish the post at /admin',
+  );
+  return row;
+}
+`;
+
+const rowsTest = (): string => `// A detail page's one row: the row, or the 404 the route answers.
+import { expect, unitTest } from '@ultimat3/testing';
+import { oneRow } from './rows';
+
+unitTest('one row is the row, and none is X_NOT_FOUND', () => {
+  expect(oneRow(['a'], 'a')).toBe('a');
+  expect(() => oneRow([], 'missing')).toThrow(expect.objectContaining({ code: 'X_NOT_FOUND' }));
+});
+`;
+
+/** One zone for every reader: an \`isr\` page is ONE document, rendered once for all of them. */
+const ISR_HEAD = `  render: 'isr',
+  // A post edited at /admin reaches readers within five minutes. No query parameter is part of an
+  // \`isr\` page by default, so \`?utm_source=…\` cannot mint another stored copy.
+  revalidate: { ttl: '5m' },
+  offline: 'runtime',
+  hydrate: 'never',
+  budget: { js: '0kb' },`;
+
+const indexPage = (
+  app: NameSet,
+): string => `// The blog index: every published post, newest first. Zero JavaScript.
+
+import { useT } from '@${app.kebab}/i18n';
+import { defineRoute } from '@ultimat3/render';
+import { DateTime } from '@ultimat3/ui';
+import type { JSX } from 'solid-js';
+import { For, Show } from 'solid-js';
+import { queries } from '../shared/client';
+import styles from './page.module.scss';
+
+export const config = defineRoute({
+${ISR_HEAD}
+  load: async () => await queries.publishedPosts({}),
+  meta: ({ t }) => ({ title: t('site.blog.title'), description: t('site.blog.description') }),
+});
+
+export type BlogIndex = Awaited<ReturnType<typeof queries.publishedPosts>>;
+
+export function Page(props: { readonly data: BlogIndex }): JSX.Element {
+  const t = useT();
+  return (
+    <main class={styles.page}>
+      <h1>{t('site.blog.title')}</h1>
+      <Show when={props.data.length > 0} fallback={<p>{t('site.blog.empty')}</p>}>
+        <ul class={styles.list}>
+          <For each={props.data}>
+            {(post) => (
+              <li class={styles.item}>
+                <a href={\`/posts/\${encodeURIComponent(post.slug)}\`}>{post.title}</a>
+                <Show when={post.publishedAt}>
+                  {(at) => <DateTime value={at()} timeZone="UTC" dateStyle="long" />}
+                </Show>
+              </li>
+            )}
+          </For>
+        </ul>
+      </Show>
+    </main>
+  );
+}
+`;
+
+/** The test helper both page tests share: the app's own HTTP answer, as the query route sends it. */
+const ANSWER = `/** Every read the page makes, answered in process with \`rows\` — the query route's JSON body. */
+const answering = (rows: readonly unknown[]) => async (): Promise<Response> => Response.json(rows);
+`;
+
+const indexTest = (
+  app: NameSet,
+): string => `// The blog index: what it links, its empty state, its zero-JS contract and its read.
+import { useT } from '@${app.kebab}/i18n';
+import { withInProcessFetch } from '@ultimat3/core';
+import { expect, renderRoute, renderView, unitTest } from '@ultimat3/testing';
+import * as page from './page';
+import { config, Page } from './page';
+
+${ANSWER}
+const post = { slug: 'hello world', title: 'Hello', body: 'b', id: 'p1' };
+
+unitTest('the index links every post by its slug, newest first as the read answers', async () => {
+  const at = new Date('2026-01-01T00:00:00Z');
+  const view = await renderView(Page, {
+    data: [
+      { ...post, publishedAt: at, createdAt: at },
+      { ...post, slug: 'two', title: 'Two', publishedAt: at, createdAt: at },
+    ],
+  });
+  const hrefs = [...view.html.matchAll(/href="([^"]*)"/g)].map((match) => match[1]);
+  expect(hrefs).toEqual(['/posts/hello%20world', '/posts/two']);
+  expect(view.text).toContain('Hello');
+});
+
+unitTest('no post is an empty state, not an empty list', async () => {
+  const view = await renderView(Page, { data: [] });
+  expect(view.text).toContain(useT()('site.blog.empty'));
+  expect(view.html).not.toContain('<ul');
+});
+
+unitTest('it is isr with zero JavaScript', () => {
+  expect(config.render).toBe('isr');
+  expect(config.hydrate).toBe('never');
+  expect(config.budget.js).toBe('0kb');
+});
+
+unitTest('load reads the published posts through the typed client', async () => {
+  const rows = [{ ...post, publishedAt: null, createdAt: null }];
+  const view = await withInProcessFetch(answering(rows), () => renderRoute(page));
+  expect(view.data.map((row) => row.slug)).toEqual(['hello world']);
+  expect(view.meta.title).toBe(useT()('site.blog.title'));
+});
+`;
+
+const postPage = (
+  app: NameSet,
+): string => `// One published post. Prerendered at build for every published slug, then regenerated on read.
+
+import { useT } from '@${app.kebab}/i18n';
+import { defineRoute } from '@ultimat3/render';
+import { DateTime } from '@ultimat3/ui';
+import type { JSX } from 'solid-js';
+import { Show } from 'solid-js';
+import { queries } from '../../../shared/client';
+import { oneRow } from '../../../shared/rows';
+import styles from './page.module.scss';
+
+export const config = defineRoute({
+${ISR_HEAD}
+  prerender: async () => (await queries.publishedPosts({ limit: 50 })).map((post) => post.slug),
+  load: async ({ params }) => {
+    const slug = params.slug ?? '';
+    return oneRow(await queries.publishedPost({ slug }), slug);
+  },
+  meta: ({ data }) => ({ title: data.title, description: data.body.slice(0, 160) }),
+});
+
+export type BlogPost = Awaited<ReturnType<typeof queries.publishedPost>>[number];
+
+export function Page(props: { readonly data: BlogPost }): JSX.Element {
+  const t = useT();
+  return (
+    <main class={styles.page}>
+      <article>
+        <h1>{props.data.title}</h1>
+        <Show when={props.data.publishedAt}>
+          {(at) => <DateTime value={at()} timeZone="UTC" dateStyle="long" />}
+        </Show>
+        <p class={styles.body}>{props.data.body}</p>
+      </article>
+      <a href="/">{t('site.blog.back')}</a>
+    </main>
+  );
+}
+`;
+
+const postTest = (
+  app: NameSet,
+): string => `// One post: what it renders, which slugs the build prerenders, and the 404 for the rest.
+import { useT } from '@${app.kebab}/i18n';
+import { withInProcessFetch } from '@ultimat3/core';
+import { expect, renderRoute, renderView, unitTest } from '@ultimat3/testing';
+import * as page from './page';
+import { config, Page } from './page';
+
+${ANSWER}
+unitTest('a post renders its title, its body and the way back', async () => {
+  const at = new Date('2026-01-01T00:00:00Z');
+  const data = {
+    id: 'p1',
+    slug: 'hello',
+    title: 'Hello',
+    body: 'The body.',
+    publishedAt: at,
+    createdAt: at,
+  };
+  const view = await renderView(Page, { data });
+  expect(view.html.match(/<h1\\b/g)).toHaveLength(1);
+  expect(view.text).toContain('The body.');
+  expect(view.text).toContain(useT()('site.blog.back'));
+});
+
+unitTest('it is isr with zero JavaScript', () => {
+  expect(config.render).toBe('isr');
+  expect(config.budget.js).toBe('0kb');
+});
+
+unitTest('prerender lists every published slug, and load renders one post', async () => {
+  const row = {
+    id: 'p1',
+    slug: 'hello',
+    title: 'Hello',
+    body: 'b',
+    publishedAt: null,
+    createdAt: null,
+  };
+  const slugs = await withInProcessFetch(answering([row]), () => config.prerender?.());
+  expect(slugs).toEqual(['hello']);
+  const view = await withInProcessFetch(answering([row]), () =>
+    renderRoute(page, { params: { slug: 'hello' } }),
+  );
+  expect(view.meta.title).toBe('Hello');
+});
+
+unitTest('a slug no published post has is X_NOT_FOUND', async () => {
+  const missing = withInProcessFetch(answering([]), () =>
+    renderRoute(page, { params: { slug: 'gone' } }),
+  );
+  await expect(missing).rejects.toThrow(expect.objectContaining({ code: 'X_NOT_FOUND' }));
+});
+`;
+
+const style = (): string => `@use '@ultimat3/ui/tokens' as tokens;
+
+.page {
+  display: grid;
+  gap: tokens.space(4);
+  padding: tokens.space(8);
+  background: tokens.role('bg');
+  color: tokens.role('fg');
+}
+
+.list {
+  display: grid;
+  gap: tokens.space(3);
+  padding: 0;
+  list-style: none;
+}
+
+.item {
+  display: grid;
+  gap: tokens.space(1);
+  color: tokens.role('fg-muted');
+}
+`;
+
+const postStyle = (): string => `@use '@ultimat3/ui/tokens' as tokens;
+
+.page {
+  display: grid;
+  gap: tokens.space(4);
+  padding: tokens.space(8);
+  background: tokens.role('bg');
+  color: tokens.role('fg');
+}
+
+.body {
+  white-space: pre-line;
+}
+`;
+
+/** `shared/` helpers and the two pages, with the catalog keys they read. */
+export function blogSiteFiles(app: NameSet): readonly GeneratedFile[] {
+  return [
+    { path: 'apps/web/shared/client.ts', contents: client() },
+    { path: 'apps/web/shared/client.test.ts', contents: clientTest() },
+    { path: 'apps/web/shared/rows.ts', contents: rows() },
+    { path: 'apps/web/shared/rows.test.ts', contents: rowsTest() },
+    { path: 'apps/web/site/page.tsx', contents: indexPage(app) },
+    { path: 'apps/web/site/page.test.ts', contents: indexTest(app) },
+    { path: 'apps/web/site/page.module.scss', contents: style() },
+    { path: 'apps/web/site/posts/[slug]/page.tsx', contents: postPage(app) },
+    { path: 'apps/web/site/posts/[slug]/page.test.ts', contents: postTest(app) },
+    { path: 'apps/web/site/posts/[slug]/page.module.scss', contents: postStyle() },
+    {
+      path: catalogPath('en'),
+      merge: 'json',
+      contents: catalogJson({
+        'site.blog.title': app.pascal,
+        'site.blog.description': `Posts from ${app.pascal}.`,
+        'site.blog.empty': 'Nothing published yet. Write the first post at /admin.',
+        'site.blog.back': 'All posts',
+        // The labels \`/admin\` renders for the \`posts\` screens it derives from the entity.
+        'admin.posts.title': 'Posts',
+        'admin.posts.field.id': 'ID',
+        'admin.posts.field.slug': 'Slug',
+        'admin.posts.field.title': 'Title',
+        'admin.posts.field.body': 'Body',
+        'admin.posts.field.publishedAt': 'Published at',
+        'admin.posts.field.createdAt': 'Created at',
+      }),
+    },
+  ];
+}