@voltro/cli 0.28.0 → 0.29.0

package/templates/apps/frontend-auth/src/pages/login/page.test.tsx

@@ -0,0 +1,53 @@
+// @vitest-environment jsdom
+//
+// The sign-in page. Asserts config + that it renders the credential form and the
+// footer navigation to the other flows. The network submit (CSRF + POST
+// /auth/sign-in) is exercised against a running api by `voltro dev`, not here.
+
+import { afterEach, describe, expect, test } from 'vitest'
+import { act, createElement, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { I18nProvider } from '@voltro/i18n'
+import enCatalog from '../../locales/en'
+
+const { default: Login, meta, renderMode } = await import('./page')
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+let container: HTMLDivElement
+let root: Root
+
+const render = (node: ReactNode): void => {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  act(() => {
+    root = createRoot(container)
+    root.render(
+      createElement(I18nProvider, { locale: 'en', messages: enCatalog, defaultLocale: 'en', children: node }),
+    )
+  })
+}
+
+afterEach(() => {
+  if (root) act(() => root.unmount())
+  container?.remove()
+  document.body.innerHTML = ''
+})
+
+describe('login — config', () => {
+  test('is a static page titled Sign in', () => {
+    expect(renderMode).toBe('static')
+    expect(meta({ locale: 'en' }).title).toBe('Sign in')
+  })
+})
+
+describe('login — render', () => {
+  test('renders email + password inputs and the flow links', () => {
+    render(createElement(Login))
+    expect(container.querySelector('input[type="email"]')).not.toBeNull()
+    expect(container.querySelector('input[type="password"]')).not.toBeNull()
+    expect(container.querySelector('a[href="/signup"]')).not.toBeNull()
+    expect(container.querySelector('a[href="/forgot"]')).not.toBeNull()
+    expect(container.querySelector('a[href="/magic"]')).not.toBeNull()
+  })
+})

package/templates/apps/frontend-auth/src/pages/login/page.tsx

@@ -0,0 +1,67 @@
+// Sign in — URL `/login`. Email + password → POST /auth/sign-in (CSRF-guarded).
+// On success we do a FULL navigation to the safelisted `?next=` (default
+// AUTH_HOME) so the destination app's SSR gate re-runs with the fresh cookie.
+import type { ReactNode } from 'react'
+import { useState, type FormEvent } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T, useT } from '@voltro/i18n'
+import { AuthShell } from '../../components/AuthShell'
+import { AUTH_HOME } from '../../config'
+import { postAuth } from '../../lib/auth'
+import { nextFromLocation } from '../../lib/redirect'
+import { getCatalog } from '../../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.login.title'],
+})
+
+export default function Login(): ReactNode {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [pending, setPending] = useState(false)
+  const [failed, setFailed] = useState(false)
+  const emailLabel = useT('auth.email')
+  const passwordLabel = useT('auth.password')
+
+  const onSubmit = (e: FormEvent): void => {
+    e.preventDefault()
+    setPending(true)
+    setFailed(false)
+    void postAuth('/auth/sign-in', { email, password })
+      .then((res) => {
+        if (res.ok) window.location.assign(nextFromLocation(AUTH_HOME))
+        else { setFailed(true); setPending(false) }
+      })
+      .catch(() => { setFailed(true); setPending(false) })
+  }
+
+  return (
+    <AuthShell
+      titleId="login.title"
+      footer={
+        <>
+          <a href="/forgot"><T id="login.forgot" /></a>
+          <a href="/magic"><T id="login.magic" /></a>
+          <a href="/signup"><T id="login.toSignup" /></a>
+        </>
+      }
+    >
+      <form className="auth-form" onSubmit={onSubmit}>
+        <label>
+          <span><T id="auth.email" /></span>
+          <input type="email" required aria-label={emailLabel} value={email} onChange={(e) => setEmail(e.target.value)} />
+        </label>
+        <label>
+          <span><T id="auth.password" /></span>
+          <input type="password" required aria-label={passwordLabel} value={password} onChange={(e) => setPassword(e.target.value)} />
+        </label>
+        {failed ? <p className="error-text"><T id="auth.error" /></p> : null}
+        <button type="submit" className="btn" disabled={pending}>
+          <T id={pending ? 'auth.pending' : 'login.submit'} />
+        </button>
+      </form>
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/src/pages/logout/page.tsx

@@ -0,0 +1,28 @@
+// Logout — URL `/logout`. On mount it POSTs /auth/sign-out (revokes the session
+// row + clears the cookie), then sends the browser to /login regardless of the
+// result (a failed sign-out still shouldn't strand the user).
+import type { ReactNode } from 'react'
+import { useEffect } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T } from '@voltro/i18n'
+import { AuthShell } from '../../components/AuthShell'
+import { postAuth } from '../../lib/auth'
+import { getCatalog } from '../../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.logout.title'],
+})
+
+export default function Logout(): ReactNode {
+  useEffect(() => {
+    void postAuth('/auth/sign-out', {}).finally(() => window.location.assign('/login'))
+  }, [])
+
+  return (
+    <AuthShell titleId="logout.title">
+      <p className="muted" role="status"><T id="logout.body" /></p>
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/src/pages/magic/page.tsx

@@ -0,0 +1,51 @@
+// Magic link — URL `/magic`. Passwordless sign-in: POST /auth/magic-link
+// { email } mints a single-use, short-lived token and (when `sendEmail` is wired
+// on the api) emails a link to `/verify?token=…`. Always shows the neutral
+// "check your email" so it can't be used to probe which addresses exist.
+import type { ReactNode } from 'react'
+import { useState, type FormEvent } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T, useT } from '@voltro/i18n'
+import { AuthShell } from '../../components/AuthShell'
+import { postAuth } from '../../lib/auth'
+import { getCatalog } from '../../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.magic.title'],
+})
+
+export default function Magic(): ReactNode {
+  const [email, setEmail] = useState('')
+  const [pending, setPending] = useState(false)
+  const [sent, setSent] = useState(false)
+  const emailLabel = useT('auth.email')
+
+  const onSubmit = (e: FormEvent): void => {
+    e.preventDefault()
+    setPending(true)
+    void postAuth('/auth/magic-link', { email })
+      .then(() => { setSent(true); setPending(false) })
+      .catch(() => { setSent(true); setPending(false) })
+  }
+
+  return (
+    <AuthShell titleId="magic.title" footer={<a href="/login"><T id="magic.toLogin" /></a>}>
+      {sent ? (
+        <p className="ok" role="status"><T id="magic.sent" /></p>
+      ) : (
+        <form className="auth-form" onSubmit={onSubmit}>
+          <p className="muted"><T id="magic.body" /></p>
+          <label>
+            <span><T id="auth.email" /></span>
+            <input type="email" required aria-label={emailLabel} value={email} onChange={(e) => setEmail(e.target.value)} />
+          </label>
+          <button type="submit" className="btn" disabled={pending}>
+            <T id={pending ? 'auth.pending' : 'magic.submit'} />
+          </button>
+        </form>
+      )}
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/src/pages/page.tsx

@@ -0,0 +1,26 @@
+// Root — URL `/`. The auth app has no landing of its own; send visitors to
+// /login (preserving any `?next=`/`?token=` query so a deep link survives).
+import type { ReactNode } from 'react'
+import { useEffect } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T } from '@voltro/i18n'
+import { AuthShell } from '../components/AuthShell'
+import { getCatalog } from '../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.login.title'],
+})
+
+export default function Index(): ReactNode {
+  useEffect(() => {
+    const search = window.location.search
+    window.location.replace(`/login${search}`)
+  }, [])
+  return (
+    <AuthShell titleId="login.title">
+      <p className="muted"><a href="/login"><T id="login.submit" /></a></p>
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/src/pages/reset/page.test.tsx

@@ -0,0 +1,51 @@
+// @vitest-environment jsdom
+//
+// The reset page. Asserts config + that submitting with NO `?token=` in the URL
+// (jsdom's default location) surfaces the invalid-link message without a network
+// call — the guard that a reset can't proceed tokenless.
+
+import { afterEach, describe, expect, test } from 'vitest'
+import { act, createElement, type ReactNode } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { I18nProvider } from '@voltro/i18n'
+import enCatalog from '../../locales/en'
+
+const { default: Reset, meta, renderMode } = await import('./page')
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+let container: HTMLDivElement
+let root: Root
+
+const render = (node: ReactNode): void => {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  act(() => {
+    root = createRoot(container)
+    root.render(
+      createElement(I18nProvider, { locale: 'en', messages: enCatalog, defaultLocale: 'en', children: node }),
+    )
+  })
+}
+
+afterEach(() => {
+  if (root) act(() => root.unmount())
+  container?.remove()
+  document.body.innerHTML = ''
+})
+
+describe('reset — config', () => {
+  test('is a static page titled Set a new password', () => {
+    expect(renderMode).toBe('static')
+    expect(meta({ locale: 'en' }).title).toBe('Set a new password')
+  })
+})
+
+describe('reset — tokenless guard', () => {
+  test('submitting without a ?token= shows the invalid-link message', () => {
+    render(createElement(Reset))
+    const form = container.querySelector('form')!
+    act(() => { form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true })) })
+    expect(container.querySelector('.error-text')?.textContent).toContain('invalid or has expired')
+  })
+})

package/templates/apps/frontend-auth/src/pages/reset/page.tsx

@@ -0,0 +1,63 @@
+// Reset password — URL `/reset?token=…`. The link the reset email points at.
+// Reads the single-use token from the URL and POSTs it with the new password to
+// /auth/password-reset/confirm. On success the api invalidates the token and the
+// user signs in with the new password.
+import type { ReactNode } from 'react'
+import { useState, type FormEvent } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T, useT } from '@voltro/i18n'
+import { AuthShell } from '../../components/AuthShell'
+import { PasswordStrength } from '../../components/PasswordStrength'
+import { postAuth } from '../../lib/auth'
+import { tokenFromLocation } from '../../lib/redirect'
+import { getCatalog } from '../../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.reset.title'],
+})
+
+export default function Reset(): ReactNode {
+  const [password, setPassword] = useState('')
+  const [pending, setPending] = useState(false)
+  const [failed, setFailed] = useState(false)
+  const [done, setDone] = useState(false)
+  const passwordLabel = useT('auth.newPassword')
+
+  const onSubmit = (e: FormEvent): void => {
+    e.preventDefault()
+    const token = tokenFromLocation()
+    if (!token) { setFailed(true); return }
+    setPending(true)
+    setFailed(false)
+    void postAuth('/auth/password-reset/confirm', { token, password })
+      .then((res) => {
+        if (res.ok) setDone(true)
+        else setFailed(true)
+        setPending(false)
+      })
+      .catch(() => { setFailed(true); setPending(false) })
+  }
+
+  return (
+    <AuthShell titleId="reset.title" footer={<a href="/login"><T id="reset.toLogin" /></a>}>
+      {done ? (
+        <p className="ok" role="status"><T id="reset.done" /></p>
+      ) : (
+        <form className="auth-form" onSubmit={onSubmit}>
+          <p className="muted"><T id="reset.body" /></p>
+          <label>
+            <span><T id="auth.newPassword" /></span>
+            <input type="password" required minLength={8} aria-label={passwordLabel} value={password} onChange={(e) => setPassword(e.target.value)} />
+          </label>
+          <PasswordStrength value={password} />
+          {failed ? <p className="error-text"><T id="reset.failed" /></p> : null}
+          <button type="submit" className="btn" disabled={pending}>
+            <T id={pending ? 'auth.pending' : 'reset.submit'} />
+          </button>
+        </form>
+      )}
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/src/pages/signup/page.tsx

@@ -0,0 +1,60 @@
+// Sign up — URL `/signup`. Email + password → POST /auth/sign-up (registers +
+// auto signs in, setting the session cookie). A live password-strength meter is
+// advisory; the api is the authority on policy.
+import type { ReactNode } from 'react'
+import { useState, type FormEvent } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T, useT } from '@voltro/i18n'
+import { AuthShell } from '../../components/AuthShell'
+import { PasswordStrength } from '../../components/PasswordStrength'
+import { AUTH_HOME } from '../../config'
+import { postAuth } from '../../lib/auth'
+import { nextFromLocation } from '../../lib/redirect'
+import { getCatalog } from '../../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.signup.title'],
+})
+
+export default function Signup(): ReactNode {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [pending, setPending] = useState(false)
+  const [failed, setFailed] = useState(false)
+  const emailLabel = useT('auth.email')
+  const passwordLabel = useT('auth.password')
+
+  const onSubmit = (e: FormEvent): void => {
+    e.preventDefault()
+    setPending(true)
+    setFailed(false)
+    void postAuth('/auth/sign-up', { email, password })
+      .then((res) => {
+        if (res.ok) window.location.assign(nextFromLocation(AUTH_HOME))
+        else { setFailed(true); setPending(false) }
+      })
+      .catch(() => { setFailed(true); setPending(false) })
+  }
+
+  return (
+    <AuthShell titleId="signup.title" footer={<a href="/login"><T id="signup.toLogin" /></a>}>
+      <form className="auth-form" onSubmit={onSubmit}>
+        <label>
+          <span><T id="auth.email" /></span>
+          <input type="email" required aria-label={emailLabel} value={email} onChange={(e) => setEmail(e.target.value)} />
+        </label>
+        <label>
+          <span><T id="auth.password" /></span>
+          <input type="password" required minLength={8} aria-label={passwordLabel} value={password} onChange={(e) => setPassword(e.target.value)} />
+        </label>
+        <PasswordStrength value={password} />
+        {failed ? <p className="error-text"><T id="auth.error" /></p> : null}
+        <button type="submit" className="btn" disabled={pending}>
+          <T id={pending ? 'auth.pending' : 'signup.submit'} />
+        </button>
+      </form>
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/src/pages/verify/page.tsx

@@ -0,0 +1,50 @@
+// Verify — URL `/verify?token=…`. The landing the magic-link / email-verification
+// mail points at. On mount it consumes the token via POST
+// /auth/magic-link/callback: a valid token signs the user in (session cookie
+// set) and we redirect home; an invalid/expired one shows a retry path. The same
+// page doubles as the email-verification confirmation.
+import type { ReactNode } from 'react'
+import { useEffect, useState } from 'react'
+import type { PageMeta } from '@voltro/web'
+import { T } from '@voltro/i18n'
+import { AuthShell } from '../../components/AuthShell'
+import { AUTH_HOME } from '../../config'
+import { postAuth } from '../../lib/auth'
+import { nextFromLocation, tokenFromLocation } from '../../lib/redirect'
+import { getCatalog } from '../../locales'
+
+export const renderMode = 'static' as const
+
+export const meta = ({ locale }: { readonly locale: string }): PageMeta => ({
+  title: getCatalog(locale)['meta.verify.title'],
+})
+
+type State = 'pending' | 'success' | 'failed' | 'noToken'
+
+export default function Verify(): ReactNode {
+  const [state, setState] = useState<State>('pending')
+
+  useEffect(() => {
+    const token = tokenFromLocation()
+    if (!token) { setState('noToken'); return }
+    void postAuth('/auth/magic-link/callback', { token })
+      .then((res) => {
+        if (res.ok) {
+          setState('success')
+          window.location.assign(nextFromLocation(AUTH_HOME))
+        } else {
+          setState('failed')
+        }
+      })
+      .catch(() => setState('failed'))
+  }, [])
+
+  return (
+    <AuthShell titleId="verify.title" footer={state !== 'pending' ? <a href="/login"><T id="verify.toLogin" /></a> : null}>
+      {state === 'pending' ? <p className="muted" role="status"><T id="verify.pending" /></p> : null}
+      {state === 'success' ? <p className="ok" role="status"><T id="verify.success" /></p> : null}
+      {state === 'failed' ? <p className="error-text" role="alert"><T id="verify.failed" /></p> : null}
+      {state === 'noToken' ? <p className="error-text" role="alert"><T id="verify.noToken" /></p> : null}
+    </AuthShell>
+  )
+}

package/templates/apps/frontend-auth/template.json

@@ -0,0 +1,6 @@
+{
+  "id": "frontend-auth",
+  "kind": "web",
+  "summary": "A drop-in auth surface that mounts in ANY project: sign-in, sign-up, forgot/reset-password, magic-link request + consume (email verification). Every page is a real form POSTing to the sibling api's /auth/* routes (@voltro/plugin-auth) with CSRF, plus an open-redirect-guarded `next=`. Bilingual (en/de). Pair with the api-auth backend; the standalone-subdomain-SSO layout is an opt-in note.",
+  "tags": ["web", "frontend", "auth", "login", "signup", "password-reset", "magic-link", "ssr", "csrf"]
+}

package/templates/apps/frontend-auth/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "include": ["**/*.ts", "**/*.tsx"],
+  "exclude": ["node_modules", "dist"]
+}

package/templates/apps/frontend-blank/package.json

@@ -12,17 +12,17 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@voltro/cli": "0.28.0",
-    "@voltro/client": "0.28.0",
-    "@voltro/env": "0.28.0",
-    "@voltro/i18n": "0.28.0",
-    "@voltro/ui-shadcn": "0.28.0",
-    "@voltro/web": "0.28.0",
+    "@voltro/cli": "0.29.0",
+    "@voltro/client": "0.29.0",
+    "@voltro/env": "0.29.0",
+    "@voltro/i18n": "0.29.0",
+    "@voltro/ui-shadcn": "0.29.0",
+    "@voltro/web": "0.29.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@voltro/devtools": "0.28.0",
+    "@voltro/devtools": "0.29.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "typescript": "^6.0.3",

package/templates/apps/frontend-cms/README.md

@@ -0,0 +1,47 @@
+# {{capProjectName}} {{capAppName}} — CMS editor
+
+The editor UI for the **api-cms** backend. It signs editors in, gates the app
+behind that session, and generates a content form per type by INTROSPECTING the
+api — no content-type shape is hardcoded in the browser. Bilingual (en/de).
+
+```bash
+voltro init my-cms --api=api-cms --web=frontend-cms
+```
+
+## How it works
+
+- **`/login`** — a static sign-in page that POSTs to the api's `/auth/*` routes
+  (CSRF token first), which set the HttpOnly session cookie.
+- **`(app)/layout.tsx`** — the SSR auth gate. Its loader asks the api's
+  `session.me` server-side and RedirectErrors an anonymous visitor to `/login`.
+- **`(app)/page.tsx`** — the editor. It fetches the registered content types
+  (`content.types`) and renders `<ContentForm>` (from `@voltro/cms/web`) for the
+  selected type — the widget per field is driven entirely by the field's
+  `editorHint`. It lists a type's drafts live (`content.list`), saves them
+  (`content.saveDraft` — validation comes back as `{ ok: false, violations }` and
+  is shown inline), and publishes / unpublishes.
+
+Adding a content type on the api needs **zero** changes here — it appears as a
+new tab automatically.
+
+## Files
+
+```
+app.config.ts                     web app; apis.cms → @{{projectName}}/api
+src/pages/
+  layout.tsx                      root layout (stylesheet)
+  login/page.tsx(.test)           sign-in / sign-up form (POST /auth/*)
+  (app)/layout.tsx(.test)         editor shell + SSR auth gate (session.me)
+  (app)/page.tsx(.test)           the introspecting editor (<ContentForm>)
+  (app)/error.tsx · not-found.tsx scoped boundaries
+src/lib/api.ts                    wire shapes + toContentFormType()
+src/locales/{en,de}.ts            bilingual catalogs (parity-enforced)
+```
+
+## Customising
+
+- **Rich text** — the default `richText` widget is a textarea placeholder. Swap a
+  real editor (e.g. TipTap) via `<ContentForm widgets={{ richText: MyEditor }} />`
+  without forking the renderer.
+- **Media** — a `Schema.Media()` field renders a placeholder; wire an upload with
+  `@voltro/plugin-storage` + a custom `media` widget.

package/templates/apps/frontend-cms/app.config.ts

@@ -0,0 +1,37 @@
+// Web app for the {{projectName}} project — the CMS EDITOR that drives the
+// sibling `api-cms` backend.
+//
+// Two areas:
+//   - `/login` — a static sign-in page that POSTs to the api's `/auth/*` routes.
+//   - The authed editor in the SILENT route group `src/pages/(app)/`. Its
+//     `layout.tsx` loader is the auth gate: server-side it asks the api's
+//     `session.me` and RedirectErrors an anonymous visitor to /login. Its pages
+//     are `renderMode: 'ssr'` so the gate runs per request.
+//
+// The editor fetches the registered content types (`content.types`) and renders
+// a `<ContentForm>` per type from @voltro/cms — no content-type file is imported
+// into the browser bundle.
+import { defineEnv, envVar } from '@voltro/env'
+
+// Public, build-time env (baked into the bundle). Never a secret in the browser.
+export const env = defineEnv({
+  VOLTRO_PUBLIC_APP_NAME: envVar.string({ access: 'public', default: '{{capProjectName}} CMS' }),
+})
+
+export default {
+  type: 'web' as const,
+  name: '{{capProjectName}}{{capAppName}}',
+  port: {{port}},
+  theme: 'system' as const,
+  env,
+  // Bilingual by default (cookie-driven <I18nProvider>, SSR too). Add a code +
+  // `src/locales/<code>.ts` to grow the app.
+  locales:       ['en', 'de'] as const,
+  defaultLocale: 'en'         as const,
+  // The api this editor consumes. The lookup key ('cms') is what the hooks pass:
+  // `useAction('cms', 'content.types')`, `useSubscription('cms', 'content.list')`.
+  // Codegen pulls its typed rpc surface (content.* + the plugin's /auth).
+  apis: {
+    cms: { package: '@{{projectName}}/api' },
+  },
+}

package/templates/apps/frontend-cms/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@{{projectName}}/{{appName}}",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "voltro dev .",
+    "lint": "voltro doctor .",
+    "build": "voltro build .",
+    "start": "voltro start .",
+    "typecheck": "tsc --noEmit",
+    "test": "voltro test"
+  },
+  "dependencies": {
+    "@{{projectName}}/api": "0.29.0",
+    "@voltro/cli": "0.29.0",
+    "@voltro/client": "0.29.0",
+    "@voltro/cms": "0.29.0",
+    "@voltro/env": "0.29.0",
+    "@voltro/i18n": "0.29.0",
+    "@voltro/ui-shadcn": "0.29.0",
+    "@voltro/web": "0.29.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@voltro/devtools": "0.29.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  }
+}

package/templates/apps/frontend-cms/src/config.ts

@@ -0,0 +1,8 @@
+// The brand name shown in the marketing header + dashboard sidebar.
+//
+// A plain constant — not `publicEnv` — so the template typechecks BEFORE
+// `voltro dev` generates the env types. `VOLTRO_PUBLIC_APP_NAME` is still
+// declared in app.config.ts (validated + in the env manifest); to read it typed
+// instead, after one `voltro dev` swap this for
+// `publicEnv.VOLTRO_PUBLIC_APP_NAME` from '@voltro/env/public'.
+export const APP_NAME = '{{capProjectName}}'