@voltro/cli 0.28.0 → 0.30.0

package/templates/apps/api-backend-sqlite/app.config.ts

@@ -0,0 +1,35 @@
+// Backend app for the {{projectName}} project, backed by SQLite. Read by
+// `voltro dev` (local) and `voltro serve` (production).
+//
+// `store: 'sqlite'` is the simplest DURABLE store: an embedded, single-file
+// (or `:memory:`) database with no server to run and one native dependency
+// (`better-sqlite3`, pulled by `@voltro/sql-sqlite`). Great for a single
+// process — a CLI tool, an edge box, a small self-hosted app, or a durable
+// local dev store that survives restarts (unlike `store: 'memory'`).
+//
+// The database file + dialect come from env — see `.env.example`:
+//   DB_DIALECT=sqlite
+//   DB_URL=file:./.data/{{projectNameSnake}}.sqlite   (or ':memory:')
+//
+// SQLite is single-writer and single-process by design, so it does NOT
+// fan real-time subscriptions across replicas (there is no CDC bus). Within
+// the one process, reactive queries work exactly as elsewhere. Reach for
+// postgres/mysql/mariadb when you scale to more than one replica.
+import { defineEnv, envVar } from '@voltro/env'
+
+// Typed environment — declare your env once; it's validated at boot (fail-fast)
+// and read on the server via `serverEnv` / `getSecret` from '@voltro/env/server'.
+// `access` is required: 'public' (browser-safe) or 'secret' (server-only, never
+// bundled). Run `voltro env` to see the manifest. See the Environment docs.
+export const env = defineEnv({
+  LOG_LEVEL: envVar.enum(['debug', 'info', 'warn', 'error'], { access: 'public', default: 'info' }),
+  // Add your own, e.g.:
+  //   STRIPE_KEY: envVar.string({ access: 'secret' }),
+})
+
+export default {
+  type:  'api' as const,
+  name:  '{{capProjectName}}{{capAppName}}',
+  store: 'sqlite' as const,
+  env,
+}

package/templates/apps/api-backend-sqlite/database/schema.ts

@@ -0,0 +1,54 @@
+// Schema for the {{projectName}} backend.
+//
+// Tables are auto-discovered: every exported `table(...)` in this file
+// (or any `*.entity.ts` / `*.schema.ts` file) is registered by
+// `voltro dev` — no manual barrel. `actors` + `tenants` are the
+// framework's core tables: the built-in `audit()` / `tenant()` /
+// `softDelete()` mixins reference them, so they must be declared (the
+// CLI wires them into the mixin registry once it finds them).
+//
+// Add the `tenant()` mixin to a table to make it tenant-scoped — the
+// runtime AND-merges `eq('tenantId', subject.tenantId)` into every
+// subscription predicate, so cross-tenant reads can't leak.
+
+import {
+  boolean,
+  databaseHandle,
+  id,
+  table,
+  text,
+  timestamp,
+  type InferRow,
+} from '@voltro/database'
+import { tenant } from '@voltro/plugin-multitenancy'
+
+// ---------- Core tables (required by the audit / tenant mixins) ----------
+
+export const actors = table('actors', {
+  id:          id(),
+  kind:        text().oneOf(['user', 'serviceAccount', 'apiKey', 'system']),
+  displayName: text().nullable(),
+  createdAt:   timestamp().default('now'),
+})
+
+export const tenants = table('tenants', {
+  id:        id(),
+  name:      text(),
+  createdAt: timestamp().default('now'),
+})
+
+// ---------- Application tables — rename / replace with your own ----------
+
+export const notes = table('notes', {
+  id:    id({ prefix: 'note' }),
+  title: text(),
+  body:  text(),
+  done:  boolean().default(false),
+})
+  // tenant() pulls audit() transitively → adds tenantId + createdAt /
+  // updatedAt / createdBy / updatedBy (auto-stamped by the runtime).
+  .with(tenant())
+
+export type Note = InferRow<typeof notes>
+
+export const database = databaseHandle({ actors, tenants, notes })

package/templates/apps/api-backend-sqlite/mutations/notes.create.mutation.server.ts

@@ -0,0 +1,19 @@
+import { assertOwnTenant } from '@voltro/plugin-multitenancy/guard'
+import type { AppContext } from '@voltro/runtime'
+
+const execute = async (
+  input: { tenantId: string; title: string; body: string },
+  ctx: AppContext,
+) => {
+  assertOwnTenant(input.tenantId, ctx.request.subject)
+  // Framework auto-injects a `note_…` id from the table's id() decl.
+  return ctx.store.insert('notes', {
+    title: input.title,
+    body: input.body,
+    done: false,
+    tenantId: input.tenantId,
+    createdAt: new Date(),
+  })
+}
+
+export default execute

package/templates/apps/api-backend-sqlite/mutations/notes.create.mutation.ts

@@ -0,0 +1,37 @@
+// Creates a note. The handler's `assertOwnTenant` guard rejects
+// cross-tenant spoofing — input.tenantId MUST match the resolved
+// subject's tenantId, else the rpc layer surfaces a typed
+// `TenantMismatch` error.
+
+import { defineMutation } from '@voltro/protocol'
+import { TenantMismatch } from '@voltro/plugin-multitenancy/guard'
+import { Schema } from 'effect'
+
+export const createNote = defineMutation({
+  name: 'notes.create',
+  target: {
+    table: 'notes',
+    op: 'insert',
+    shape: (input: { tenantId: string; title: string; body: string }) => ({
+      title: input.title,
+      body: input.body,
+      done: false,
+      tenantId: input.tenantId,
+      createdAt: new Date(),
+    }),
+  },
+  input: Schema.Struct({
+    tenantId: Schema.String,
+    title: Schema.NonEmptyString,
+    body: Schema.String,
+  }),
+  output: Schema.Struct({
+    id: Schema.String,
+    title: Schema.String,
+    body: Schema.String,
+    done: Schema.Boolean,
+    tenantId: Schema.String,
+    createdAt: Schema.Date,
+  }),
+  error: TenantMismatch,
+})

package/templates/apps/api-backend-sqlite/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@{{projectName}}/{{appName}}",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "voltro dev .",
+    "lint": "voltro doctor .",
+    "migrate": "voltro migrate",
+    "test": "voltro test",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@effect/platform": "^0.97.0",
+    "@effect/rpc": "^0.76.0",
+    "@voltro/cli": "0.30.0",
+    "@voltro/database": "0.30.0",
+    "@voltro/env": "0.30.0",
+    "@voltro/plugin-multitenancy": "0.30.0",
+    "@voltro/protocol": "0.30.0",
+    "@voltro/runtime": "0.30.0",
+    "@voltro/sql-sqlite": "0.30.0",
+    "effect": "^3.22.0"
+  },
+  "devDependencies": {
+    "@voltro/testing": "0.30.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  }
+}

package/templates/apps/api-backend-sqlite/queries/notes.query.server.ts

@@ -0,0 +1,14 @@
+import type { AppContext } from '@voltro/runtime'
+
+const execute = (_input: Record<string, never>, _ctx: AppContext) => ({
+  descriptor: {
+    table: 'notes' as const,
+    predicate: undefined,
+    order: [{ column: 'createdAt' as const, direction: 'desc' as const }],
+    take: 100,
+    skip: undefined,
+    projection: undefined,
+  },
+})
+
+export default execute

package/templates/apps/api-backend-sqlite/queries/notes.query.ts

@@ -0,0 +1,20 @@
+// Streaming subscription: every change to `notes` for the caller's
+// tenant lands as a delta. The runtime AND-merges tenant scope into
+// the predicate via the `tenant()` mixin on the table — no manual
+// `eq('tenantId', ...)` needed in the handler.
+
+import { defineQuery } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+export const listNotes = defineQuery({
+  name: 'notes.list',
+  input: Schema.Struct({}),
+  output: Schema.Struct({
+    id: Schema.String,
+    title: Schema.String,
+    body: Schema.String,
+    done: Schema.Boolean,
+    tenantId: Schema.String,
+    createdAt: Schema.Date,
+  }),
+})

package/templates/apps/api-backend-sqlite/template.json

@@ -0,0 +1,6 @@
+{
+  "id": "api-backend-sqlite",
+  "kind": "api",
+  "summary": "SQLite-backed Voltro backend: a single-process, embedded, zero-server database (file or :memory:). The simplest durable-store shape — no docker, one dependency.",
+  "tags": ["api", "backend", "sqlite", "embedded", "single-process", "durable"]
+}

package/templates/apps/api-backend-sqlite/tests/notes.create.test.ts

@@ -0,0 +1,50 @@
+// Unit test with `@voltro/testing` — no database, no running server. Importing
+// `../database/schema` registers the `notes` / `actors` / `tenants` tables
+// globally, so `makeTestContext` auto-wires them into the in-memory store.
+// `ctx.store` is the SAME mixin-wrapped store the handler gets in production,
+// so tenant auto-scoping + audit auto-fill behave exactly as at runtime.
+// Run with `voltro test` (vitest).
+
+import { describe, it, expect } from 'vitest'
+import { makeTestContext, mockStore } from '@voltro/testing'
+import { database } from '../database/schema' // registers notes / actors / tenants
+import { TenantMismatch } from '@voltro/plugin-multitenancy/guard'
+import createNote from '../mutations/notes.create.mutation.server'
+
+describe('notes.create', () => {
+  it('inserts a note stamped to the caller tenant', async () => {
+    const ctx = makeTestContext({
+      subject: { type: 'user', id: 'user_1', tenantId: 'acme' },
+      store:   mockStore({ notes: [] }),
+    })
+    const row = await createNote({ tenantId: 'acme', title: 'Hello', body: 'World' }, ctx)
+
+    expect(row['title']).toBe('Hello')
+    expect(row['tenantId']).toBe('acme')  // assertOwnTenant let it through + stamped
+    expect(row['done']).toBe(false)
+    expect(String(row['id'])).toMatch(/^note_/) // TypeID auto-injected from id()
+  })
+
+  it('rejects a cross-tenant spoof — input.tenantId must match the subject', async () => {
+    const ctx = makeTestContext({
+      subject: { type: 'user', id: 'user_1', tenantId: 'acme' },
+      store:   mockStore({ notes: [] }),
+    })
+    await expect(
+      createNote({ tenantId: 'other-tenant', title: 'spoof', body: '' }, ctx),
+    ).rejects.toBeInstanceOf(TenantMismatch)
+  })
+
+  it('isolates tenants — t2 never sees t1 rows (REAL tenant scoping)', async () => {
+    const ctx = makeTestContext({
+      subject: { type: 'user', id: 'u1', tenantId: 't1' },
+      store:   mockStore({ notes: [] }),
+    })
+    await createNote({ tenantId: 't1', title: 'secret', body: '' }, ctx)
+
+    // Re-scope the SAME store to a different tenant — the real WHERE filter
+    // (eq tenantId) hides t1's row from t2.
+    const seenByT2 = await ctx.withTenant('t2', (c) => c.store.query(database.notes.descriptor))
+    expect(seenByT2).toHaveLength(0)
+  })
+})

package/templates/apps/api-backend-sqlite/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "include": ["**/*.ts", "**/*.tsx"],
+  "exclude": ["node_modules", "dist"]
+}

package/templates/apps/api-backend-storage/package.json

@@ -11,17 +11,17 @@
     "test": "voltro test"
   },
   "dependencies": {
-    "@voltro/cli": "0.28.0",
-    "@voltro/database": "0.28.0",
-    "@voltro/env": "0.28.0",
-    "@voltro/plugin-multitenancy": "0.28.0",
-    "@voltro/plugin-storage": "0.28.0",
-    "@voltro/protocol": "0.28.0",
-    "@voltro/runtime": "0.28.0",
+    "@voltro/cli": "0.30.0",
+    "@voltro/database": "0.30.0",
+    "@voltro/env": "0.30.0",
+    "@voltro/plugin-multitenancy": "0.30.0",
+    "@voltro/plugin-storage": "0.30.0",
+    "@voltro/protocol": "0.30.0",
+    "@voltro/runtime": "0.30.0",
     "effect": "^3.22.0"
   },
   "devDependencies": {
-    "@voltro/testing": "0.28.0",
+    "@voltro/testing": "0.30.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   }

package/templates/apps/api-cms/README.md

@@ -0,0 +1,104 @@
+# {{capProjectName}} {{capAppName}} — headless CMS backend
+
+A headless CMS composed from [`@voltro/cms`](https://voltro.cloud/docs): content
+types declared as **code**, compiled to draft/published tables, driven by the
+write pipeline, and exposed as a typed rpc surface an editor consumes. Content is
+tenant-scoped and gated by real editor auth. Boots **zero-infra** (`store:
+'memory'`, in-process users).
+
+Pair it with the **frontend-cms** editor web template:
+
+```bash
+voltro init my-cms --api=api-cms --web=frontend-cms
+```
+
+## Content types as code
+
+Each `content/*.contentType.ts` file declares a type with the CMS `Schema` field
+DSL. `@voltro/cms` is a **library, not a plugin** — there is no discovery of
+`*.contentType.ts`; `database/schema.ts` imports the types and registers their
+derived tables, and THAT is what makes them migrate.
+
+```ts
+// content/blogPost.contentType.ts
+export const blogPost = defineContentType({
+  name: 'blogPost', displayName: 'Blog post', pluralName: 'Blog posts',
+  fields: {
+    title: Schema.String.pipe(Schema.maxLength(200)),
+    slug:  Schema.String.pipe(Schema.pattern(/^[a-z0-9-]+$/), Schema.unique(), derivedFrom('title', slugify)),
+    body:  Schema.RichText({ allowImages: true }),
+  },
+})
+```
+
+`contentTypeToEntities(blogPost)` compiles this to a `blogPost_drafts` +
+`blogPost_published` table pair — both tenant-scoped (`tenant()`), both carrying
+the lifecycle `status` column, both reactive so a publish wakes subscriptions.
+
+## The rpc surface
+
+| Procedure | Kind | Does |
+|---|---|---|
+| `content.types` | action | the registered types, wire-safe — the editor renders forms from this |
+| `content.list` | query (live) | one type's rows, tenant-scoped; `status` picks drafts vs published |
+| `content.get` | action | one row by id, for the edit form |
+| `content.saveDraft` | mutation | derive → validate → upsert `<type>_drafts`; invalid input → typed `{ ok: false, violations }` |
+| `content.publish` | mutation | copy draft → published (atomic); wakes consumer subscriptions |
+| `content.unpublish` | mutation | remove the published copy, keep the draft |
+| `session.me` | action | the resolved Subject (the editor's SSR gate reads it) |
+
+Validation and not-found are RESULT UNIONS, not thrown errors — `saveDraft`
+returns `{ ok: false, violations }` so the editor annotates the form, and
+`publish` returns `{ ok: false }` for a missing/foreign draft. The descriptors
+stay pure effect/Schema (browser-safe with nothing extra pulled in).
+
+## Run it
+
+```bash
+voltro dev .
+# → http://localhost:4000   (rpc + /auth/* HTTP routes)
+```
+
+`voltro dev` mints a unique `VOLTRO_SESSION_SECRET` into a gitignored
+`.env.local` on first boot — no secret ships with the template. It signs both
+the session cookie and CMS preview tokens.
+
+## Files
+
+```
+app.config.ts                 authRoutesPlugin + voltroPasswordStrategy (editor auth)
+content/
+  blogPost.contentType.ts     a content type as code (derived slug, rich text)
+  page.contentType.ts         a second type (Literal layout → <select>)
+  index.ts                    the type registry + name lookup
+database/schema.ts            core actors/tenants + contentTypeToEntities(...) tables
+actions/
+  content.types.*             the wire-safe type descriptors the editor renders
+  content.get.*               one row by id
+  me.action.*                 session.me
+queries/content.list.*        live, tenant-scoped, drafts-or-published
+mutations/
+  content.saveDraft.*         derive + validate + upsert draft
+  content.publish.*           draft → published
+  content.unpublish.*         take a published row down
+tests/                        write pipeline vs a real store + descriptor pins
+```
+
+## Going to production
+
+| Want… | Do |
+|---|---|
+| Durable content + editors | `store: 'postgres'` + `postgresUserStore({ sql })` |
+| A REST read API for consumers | mount `handleCmsRest(...)` (from `@voltro/cms`) — `GET /v1/cms/<type>`, API-key scoped |
+| Draft preview from a consumer app | `previewToken(type, id)` / `verifyPreviewToken` (HMAC over `VOLTRO_SESSION_SECRET`) |
+| Media fields | `Schema.Media()` + `@voltro/plugin-storage`; resolve keys with `resolveMedia(...)` |
+| A real rich-text editor | swap the `richText` widget via `<ContentForm widgets={{ richText: … }} />` in the editor |
+
+## Anti-patterns
+
+- **Expecting `*.contentType.ts` to be auto-discovered.** It isn't — register the
+  derived entities in `database/schema.ts` or the tables never migrate.
+- **Importing a content-type file into the browser.** The editor fetches
+  `content.types` instead; content-type files import the server `@voltro/cms`.
+- **Reusing a reserved field name** (`status`, `tenantId`, `publishAt`, the audit
+  columns). `defineContentType` throws — rename the field.

package/templates/apps/api-cms/actions/content.get.action.server.ts

@@ -0,0 +1,27 @@
+// Executor for `content.get`. Reads one row by id from the requested lifecycle
+// table. `ctx.store.query` runs through the tenant-scoped store spine, so the
+// read is automatically confined to the caller's tenant — a foreign id returns
+// nothing.
+import { eq } from '@voltro/database'
+import type { AppContext } from '@voltro/runtime'
+import { contentTypeByName } from '../content'
+
+const execute = async (
+  input: { type: string; id: string; status?: 'draft' | 'published' },
+  ctx: AppContext,
+) => {
+  const ct = contentTypeByName.get(input.type)
+  if (ct === undefined) return { row: null }
+  const table = `${ct.name}_${input.status === 'published' ? 'published' : 'drafts'}`
+  const rows = await ctx.store.query({
+    table,
+    predicate:  eq('id', input.id),
+    order:      [],
+    take:       1,
+    skip:       undefined,
+    projection: undefined,
+  })
+  return { row: rows[0] ?? null }
+}
+
+export default execute

package/templates/apps/api-cms/actions/content.get.action.ts

@@ -0,0 +1,19 @@
+// `content.get` — one content row by id, for the edit form. Returns the full
+// row (arbitrary per-type fields), so the output is a loose record rather than a
+// closed struct. `status` selects the table: 'draft' (the editor's in-progress
+// copy, the default) or 'published' (the live copy). A row outside the caller's
+// tenant reads as absent (null) — the store scope never returns it.
+import { defineAction } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+export const getContent = defineAction({
+  name:  'content.get',
+  input: Schema.Struct({
+    type:   Schema.NonEmptyString,
+    id:     Schema.NonEmptyString,
+    status: Schema.optional(Schema.Literal('draft', 'published')),
+  }),
+  output: Schema.Struct({
+    row: Schema.NullOr(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
+  }),
+})

package/templates/apps/api-cms/actions/content.types.action.server.ts

@@ -0,0 +1,26 @@
+// Executor for `content.types`. Projects the registered content types down to
+// the wire-safe descriptor the editor renders forms from (dropping the
+// server-only `derived.transform` function + nested element/struct depth — the
+// two shipped types are flat, and deep widgets fall back to a placeholder).
+import type { AppContext } from '@voltro/runtime'
+import { contentTypes as registered } from '../content'
+
+const execute = async (_input: Record<string, never>, _ctx: AppContext) => ({
+  types: registered.map((ct) => ({
+    name:        ct.name,
+    displayName: ct.displayName,
+    pluralName:  ct.pluralName,
+    columns:     ct.list?.columns ?? Object.keys(ct.fields),
+    fields: Object.entries(ct.fields).map(([name, field]) => ({
+      name,
+      kind:       field.kind,
+      editorHint: field.editorHint,
+      isOptional: field.isOptional,
+      ...(field.maxLength !== undefined ? { maxLength: field.maxLength } : {}),
+      ...(field.literals !== undefined ? { literals: field.literals } : {}),
+      ...(field.referenceType !== undefined ? { referenceType: field.referenceType } : {}),
+    })),
+  })),
+})
+
+export default execute

package/templates/apps/api-cms/actions/content.types.action.ts

@@ -0,0 +1,40 @@
+// `content.types` — the registered content-type descriptors, in a WIRE-SAFE
+// shape. The editor calls this once and renders a `<ContentForm>` per field
+// purely from `editorHint` + the field metadata — no content-type file is
+// imported into the browser bundle, so adding a type on the server surfaces in
+// the editor with zero client changes.
+//
+// A field's `derived.transform` is a FUNCTION (not serialisable) and the editor
+// doesn't need it — the transform runs server-side on save — so the executor
+// projects each field down to the data the form widgets read.
+import { defineAction } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+// The browser-facing view of one field: enough to pick + configure a widget.
+const FieldWire = Schema.Struct({
+  name:          Schema.String,
+  kind:          Schema.String,
+  editorHint:    Schema.String,
+  isOptional:    Schema.Boolean,
+  maxLength:     Schema.optional(Schema.Number),
+  literals:      Schema.optional(Schema.Array(Schema.String)),
+  referenceType: Schema.optional(Schema.String),
+})
+
+export const contentTypes = defineAction({
+  name:  'content.types',
+  input: Schema.Struct({}),
+  output: Schema.Struct({
+    types: Schema.Array(
+      Schema.Struct({
+        name:        Schema.String,
+        displayName: Schema.String,
+        pluralName:  Schema.String,
+        // An ORDERED list (not a Record) so the editor renders fields in
+        // declaration order.
+        fields:  Schema.Array(FieldWire),
+        columns: Schema.Array(Schema.String),
+      }),
+    ),
+  }),
+})

package/templates/apps/api-cms/actions/me.action.server.ts

@@ -0,0 +1,18 @@
+// Executor for `session.me`. Reads the Subject the AuthMiddleware resolved (via
+// voltroPasswordStrategy reading the session cookie) and returns it.
+import type { AppContext } from '@voltro/runtime'
+
+const execute = async (_input: Record<string, never>, ctx: AppContext) => {
+  const subject = ctx.request.subject as {
+    readonly type: string
+    readonly id: string | null
+    readonly tenantId: string | null
+  }
+  return {
+    type:     subject.type,
+    id:       subject.id ?? null,
+    tenantId: subject.tenantId ?? null,
+  }
+}
+
+export default execute

package/templates/apps/api-cms/actions/me.action.ts

@@ -0,0 +1,16 @@
+// `session.me` — the caller's resolved identity. The editor's SSR gate reads it
+// to decide render-vs-redirect-to-login, and it proves the auth loop end to end:
+// no cookie → anonymous Subject; sign in via POST /auth/sign-in → a `user`
+// Subject. Browser-safe descriptor — no server imports here.
+import { defineAction } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+export const me = defineAction({
+  name:  'session.me',
+  input: Schema.Struct({}),
+  output: Schema.Struct({
+    type:     Schema.String,
+    id:       Schema.NullOr(Schema.String),
+    tenantId: Schema.NullOr(Schema.String),
+  }),
+})

package/templates/apps/api-cms/app.config.ts

@@ -0,0 +1,61 @@
+// The headless CMS backend for the {{projectName}} project. Read by `voltro dev`.
+//
+// It composes @voltro/cms — a LIBRARY, not a plugin — with real editor auth:
+//
+//   • @voltro/cms — content types declared as code (`content/*.contentType.ts`
+//     via `defineContentType` + the `Schema` field DSL). `contentTypeToEntities`
+//     compiles each to a `<type>_drafts` + `<type>_published` table pair (see
+//     database/schema.ts), and the write pipeline (`saveDraft` → derive+validate,
+//     `publish`/`unpublish`) drives the lifecycle. There is NO framework
+//     discovery of `*.contentType.ts` — the schema file imports the types and
+//     registers their tables, which is what makes them migrate.
+//   • @voltro/plugin-auth — password sign-up/in/out over an HttpOnly session
+//     cookie so only signed-in editors reach the write surface, and
+//     `voltroPasswordStrategy` resolving that cookie into a typed `Subject`.
+//
+// Content is tenant-scoped: every derived content table carries `tenant()`, so
+// the runtime AND-merges `tenantId = subject.tenantId` into reads and stamps it
+// on writes — one tenant's drafts never leak to another. Boots ZERO-infra
+// (`store: 'memory'`, in-process users); the README shows the production swaps.
+import { defineEnv, envVar } from '@voltro/env'
+import { authRoutesPlugin, memoryUserStore, voltroPasswordStrategy } from '@voltro/plugin-auth'
+
+export const env = defineEnv({
+  LOG_LEVEL: envVar.enum(['debug', 'info', 'warn', 'error'], { access: 'public', default: 'info' }),
+  // HMAC key that signs + verifies the session cookie AND the CMS preview
+  // tokens (`previewToken` reads VOLTRO_SESSION_SECRET). `generate` means this
+  // project mints its OWN key into a gitignored `.env.local` on first boot — no
+  // value ships with the template (a shipped placeholder would be a signing key
+  // published to everyone who downloads it). Production mints its own the same
+  // way; a missing secret is a hard boot failure in serve/build/start.
+  VOLTRO_SESSION_SECRET: envVar.secret({
+    generate: 'base64url',
+    description: 'HMAC key that signs session cookies and CMS preview tokens.',
+  }),
+})
+
+// In-process user store — zero infra. `postgresUserStore({ sql })` for durable
+// editor accounts (it manages its own `_voltro_auth_*` tables, auto-migrated).
+const userStore = memoryUserStore()
+
+export default {
+  type:  'api' as const,
+  name:  '{{capProjectName}}{{capAppName}}',
+  store: 'memory' as const,
+  env,
+  plugins: [
+    authRoutesPlugin({
+      store: userStore,
+      // New editor sign-ups land in this tenant; all content they author is
+      // scoped to it.
+      defaultTenantId: 'acme',
+      successRedirect: '/',
+      cookieSecure: process.env.NODE_ENV === 'production',
+    }),
+  ],
+  auth: {
+    // Resolves the session cookie into the request Subject the handlers read
+    // (`ctx.request.subject`) and the store spine scopes writes by.
+    strategies: [voltroPasswordStrategy()],
+  },
+}