create-elytra 0.0.0 → 0.0.1

package/template/dot-gitignore

@@ -0,0 +1,34 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+.yarn/install-state.gz
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# env files
+.env
+.env.*
+!.env.example
+
+# vercel
+.vercel
+
+# turbo
+.turbo
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+
+# VS Code
+.vscode

package/template/elytra.config.ts

@@ -0,0 +1,39 @@
+import { defineElytraConfig } from '@elytracms/core/studio-core'
+import { collections, redirects, routes } from './cms'
+import { marketingComponents } from './components/marketing'
+
+/**
+ * {{projectName}} — config-as-code (the Elytra mount contract). Project identity,
+ * structure (cms/), and the page-builder components all live HERE, in your repo;
+ * editing this file never writes to the backend (the backend holds content only).
+ * The studio (`studio/`) reads this config to mount; the delivery frontend
+ * (`frontend/`) reads the same `cms/` directly — both by plain path import.
+ *
+ * Backend mode is chosen by env (studio/.env), not here:
+ *   - Playground (default): VITE_ELYTRA_MODE=playground — in-memory, seeded, no
+ *     signup. The studio boots straight into an editable starter project.
+ *   - Connected: set VITE_CONVEX_URL (and add `convex.deployment` below) after
+ *     provisioning a deployment. See CONNECT.md.
+ */
+export default defineElytraConfig({
+  projects: [
+    {
+      name: '{{projectName}}',
+      slug: '{{projectSlug}}',
+      locales: ['en'],
+      defaultLocale: 'en',
+      // Structure is config-owned, authored in this repo's cms/.
+      collections,
+      routes,
+      redirects,
+      // Your real page-builder components (manifest + implementation pairs),
+      // injected by dependency injection — the same modules the frontend renders.
+      components: marketingComponents,
+      // Connected mode only — uncomment after provisioning Convex (CONNECT.md):
+      //   convex: { deployment: 'https://<your-deployment>.convex.cloud' },
+      // The public base URL of the delivery site (the studio links live URLs here).
+      frontendUrl: 'http://localhost:3000',
+      environments: [{ key: 'production', label: 'Production' }],
+    },
+  ],
+})

package/template/frontend/app/[[...slug]]/page.tsx

@@ -0,0 +1,22 @@
+import { createCanvasRoute } from '@elytracms/next'
+import { hostComponents } from '../../lib/host'
+import { contentScope, loadContent } from '../../lib/content'
+
+/**
+ * The Elytra canvas route — the site's delivery surface. Mounted at the root
+ * optional catch-all `/[[...slug]]`, it serves every page: `/` → the home page,
+ * `/{slug}` → the matching `page` document (routes-as-code, `cms/routes.ts`).
+ * Redirects via redirect()/permanentRedirect(); unknown URLs via notFound();
+ * perspective via draftMode(). Instant publish (with `cache` configured): the
+ * studio's publish webhook hits `/api/revalidate` → revalidateTag.
+ */
+const route = createCanvasRoute({
+  loadContent,
+  components: hostComponents,
+  // Tag scope = the project id the studio publishes under, so its webhook tags
+  // match this site's cached entries.
+  cache: { scope: contentScope },
+})
+
+export default route.Page
+export const generateMetadata = route.generateMetadata

package/template/frontend/app/api/revalidate/route.ts

@@ -0,0 +1,14 @@
+import { createRevalidateRoute } from '@elytracms/next'
+
+/**
+ * Instant publish webhook receiver: `POST /api/revalidate` with a signed body
+ * (HMAC-SHA256, `x-elytra-signature: sha256=<hex>`) drops exactly the cached
+ * pages whose fetch-time tag sets contain the carried tags — publish in the
+ * studio, fresh content here within seconds, no rebuild. Set REVALIDATE_SECRET
+ * (matching the studio's VITE_REVALIDATE_SECRET) and STUDIO_ORIGIN in connected
+ * mode. Unsigned/invalid requests: 401, nothing revalidated.
+ */
+export const { POST, OPTIONS } = createRevalidateRoute({
+  secret: process.env.REVALIDATE_SECRET ?? 'change-me-revalidate-secret',
+  ...(process.env.STUDIO_ORIGIN ? { allowOrigin: process.env.STUDIO_ORIGIN } : {}),
+})

package/template/frontend/app/layout.tsx

@@ -0,0 +1,14 @@
+import type { ReactNode } from 'react'
+
+export const metadata = {
+  title: { default: '{{projectName}}', template: '%s · {{projectName}}' },
+  description: '{{projectName}} — built with Elytra.',
+}
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  )
+}

package/template/frontend/app/not-found.tsx

@@ -0,0 +1,8 @@
+export default function NotFound() {
+  return (
+    <main data-page="not-found">
+      <h1>404 — Not found</h1>
+      <p>No route in the project matched this URL.</p>
+    </main>
+  )
+}

package/template/frontend/app/sitemap.ts

@@ -0,0 +1,22 @@
+import { createCanvasSitemap } from '@elytracms/next'
+import { loadContent } from '../lib/content'
+import { projectConfig } from '../lib/project-config'
+
+/**
+ * sitemap.xml from published routes: the helper walks the same route records the
+ * canvas route resolves against, resolves every URL in the published perspective,
+ * and omits noindex pages. Dynamic routes (`/blog/:slug`) are enumerated through
+ * the params provider — one entry per published post.
+ */
+export default createCanvasSitemap({
+  loadContent,
+  baseUrl: projectConfig.frontendUrl ?? process.env.SITE_URL ?? 'http://localhost:3000',
+  params: ({ route, client }) => {
+    if (route.id !== 'r-post') return null
+    const posts = client.listDocuments('post')
+    if (!posts.ok) return []
+    return posts.documents
+      .filter((post) => typeof post['slug'] === 'string')
+      .map((post) => ({ slug: post['slug'] as string }))
+  },
+})

package/template/frontend/dot-env

@@ -0,0 +1,14 @@
+# {{projectName}} — frontend (delivery) environment.
+#
+# Seeded mode (default): no env needed. The site renders the in-memory starter
+# world locally — the same content the playground studio boots into.
+#
+# Connected mode: point the frontend at your Convex deployment so published
+# content is served live. See CONNECT.md.
+#
+# ELYTRA_CONVEX_URL=https://<your-deployment>.convex.cloud
+# ELYTRA_PROJECT_ID=<your-project-id>
+#
+# Instant publish (must match the studio's revalidate secret):
+# REVALIDATE_SECRET=change-me-revalidate-secret
+# STUDIO_ORIGIN=http://localhost:5180

package/template/frontend/lib/content.ts

@@ -0,0 +1,68 @@
+import { createContentSnapshot } from '@elytracms/next'
+import type { CanvasContentRequest, ContentSource } from '@elytracms/next'
+import type { RedirectRecord, RouteRecord } from '@elytracms/core/cms-core'
+import { SEED_PROJECT_ID, createSeededPersistenceAdapter } from '@elytracms/core/persistence'
+import { projectConfig } from './project-config'
+import { loadLiveContent } from './live-content'
+
+/**
+ * Content for the delivery frontend, in one of two modes:
+ *
+ * - **Live** — when `ELYTRA_CONVEX_URL` + `ELYTRA_PROJECT_ID` are set, every load
+ *   fetches the delivery snapshot from the Convex deployment (`live-content.ts`).
+ *   Locales, collections, routes, and redirects come from this repo's own `cms/`
+ *   (config-owned), never the wire. Draft-mode requests load the token-gated draft.
+ * - **Seeded** (default) — the deterministic in-memory starter world, the same
+ *   one the playground studio boots into, bridged into a `ContentSource`. Lets the
+ *   site render locally with zero backend; connect Convex to make edits persist.
+ */
+
+const convexUrl = process.env.ELYTRA_CONVEX_URL
+const projectId = process.env.ELYTRA_PROJECT_ID
+
+/** The cache tag scope — the live project id, or the seeded fixture project. */
+export const contentScope: string = projectId ?? SEED_PROJECT_ID
+
+/** Materialize a config `routes`/`redirects` value: run a derive, or pass an array through. */
+function materializeRecords<T>(
+  input: readonly T[] | ((collections: typeof projectConfig.collections) => T[]),
+): T[] {
+  return typeof input === 'function' ? input(projectConfig.collections) : [...input]
+}
+
+const projectRoutes: RouteRecord[] = materializeRecords(projectConfig.routes)
+const projectRedirects: RedirectRecord[] = materializeRecords(projectConfig.redirects)
+
+// The seeded world is deterministic, so one snapshot serves every request.
+let seededSource: Promise<ContentSource> | undefined
+
+async function buildSeededSource(): Promise<ContentSource> {
+  const adapter = await createSeededPersistenceAdapter()
+  // Re-save this repo's collections so the snapshot is shaped by YOUR schema.
+  await adapter.cms.saveSchema(SEED_PROJECT_ID, [...projectConfig.collections])
+  return createContentSnapshot(adapter, SEED_PROJECT_ID, {
+    routes: projectRoutes,
+    redirects: projectRedirects,
+    locales: projectConfig.locales,
+  })
+}
+
+export function loadContent(request: CanvasContentRequest): Promise<ContentSource> {
+  if (convexUrl && projectId) {
+    const draftToken = process.env.DRAFT_PREVIEW_TOKEN
+    return loadLiveContent(
+      {
+        convexUrl,
+        projectId,
+        locales: projectConfig.locales,
+        collections: projectConfig.collections,
+        routes: projectRoutes,
+        redirects: projectRedirects,
+        ...(draftToken ? { draftToken } : {}),
+      },
+      request.perspective,
+    )
+  }
+  seededSource ??= buildSeededSource()
+  return seededSource
+}

package/template/frontend/lib/host.ts

@@ -0,0 +1,9 @@
+import { hostComponents } from '../../components'
+
+/**
+ * The host component surface for the @elytracms/next runtime — your repo's OWN
+ * page-builder components (the SAME modules the studio composes with, so the
+ * editor preview matches what ships). Re-exported here so the app routes import
+ * from `lib/` and never reach across the repo root.
+ */
+export { hostComponents }

package/template/frontend/lib/live-content.ts

@@ -0,0 +1,270 @@
+import { documentSchema } from '@elytracms/core/cms-core'
+import type {
+  CmsDocument,
+  CollectionDef,
+  LocaleConfig,
+  RedirectRecord,
+  RouteRecord,
+} from '@elytracms/core/cms-core'
+import type { ContentDocumentSource, Perspective } from '@elytracms/core/content'
+import { createStaticContentSource, mergeRouteRecords, z } from '@elytracms/next'
+import type { CanvasDataSource, ContentSource } from '@elytracms/next'
+import type { AssetRecord } from '@elytracms/core/persistence'
+import { parseProjectGraph } from '@elytracms/core/project-graph'
+import type { ProjectGraph } from '@elytracms/core/project-graph'
+
+/**
+ * Live `ContentSource` (EC-156): fetch the delivery snapshot from a Convex
+ * deployment (`convex/delivery.ts` in the builder app) over Convex's public
+ * HTTP query API — a plain `fetch` to `POST {deployment}/api/query`, no
+ * Convex npm dependency — and assemble it through the same
+ * `createStaticContentSource` path the fixture snapshot uses, so accessor and
+ * rendering semantics are byte-identical across the seeded and live modes.
+ *
+ * Design choice (documented per EC-156): rather than faking a
+ * `PersistenceAdapter` around the payload, `@elytracms/next` exports the pure
+ * assembly half of its snapshot bridge (`createStaticContentSource`), and
+ * this module only (a) fetches, (b) validates the payload against the
+ * canonical Zod schemas, and (c) parses the serialized graphs. Least code,
+ * maximum reuse — no resolution logic is reimplemented here.
+ *
+ * Perspective handling: the route helper passes the request's perspective to
+ * `loadContent`. Published requests fetch the PUBLIC `delivery:snapshot`
+ * (published documents + the publishing-state-pinned graph only). Draft-mode
+ * requests fetch `delivery:draftSnapshot`, gated by the deployment's
+ * `DRAFT_PREVIEW_TOKEN` — the token never reaches the browser; the host
+ * server sends it after Next draft mode (itself token-gated) was enabled.
+ *
+ * Routes: config-sourced route records (EC-207 — from the host's own
+ * `elytra.config.ts`, passed via options) and the implicit per-locale home
+ * fallback are MERGED (EC-177 gap 2), never XOR'd — config records win per
+ * pattern+locale, and the `/` → first-page fallback fills every locale the
+ * config set does not cover. The backend never carries route data.
+ */
+
+export interface LiveContentOptions {
+  /** Convex deployment URL, e.g. `https://scintillating-goldfish-704.convex.cloud`. */
+  convexUrl: string
+  projectId: string
+  /**
+   * Project locale config, read from the host's own `elytra.config.ts`
+   * (AD-11, EC-182) — NOT from the snapshot. The backend holds data only and no
+   * longer carries project settings.
+   */
+  locales: LocaleConfig
+  /**
+   * CMS collection schema, read from the host's own `elytra.config.ts`
+   * (AD-11, EC-183) — NOT from the snapshot. Drives depth-1 relation population
+   * (AD-4) during delivery; the backend no longer carries the schema.
+   */
+  collections: readonly CollectionDef[]
+  /**
+   * Routes/redirects, config-owned (AD-3/AD-11, EC-207) — materialized from the
+   * host's own `elytra.config.ts` and passed in here, NOT read from the snapshot.
+   * The live router resolves URLs from these (merged with the home fallback).
+   */
+  routes: readonly RouteRecord[]
+  redirects: readonly RedirectRecord[]
+  /** `DRAFT_PREVIEW_TOKEN` — required for draft-perspective loads. */
+  draftToken?: string
+}
+
+interface GraphRevisionPayload {
+  revision: number
+  serializedGraph: string
+}
+
+/**
+ * The `delivery.ts` payload shape (validated field-by-field below).
+ * Single-environment (EC-179): a deployment IS one environment, so the snapshot
+ * carries no `environment`.
+ */
+interface DeliverySnapshotPayload {
+  projectId: string
+  // routes/redirects are NO LONGER read from the snapshot (EC-207): they are
+  // config-owned and passed via options. The backend may still emit them on
+  // older deployments; the host ignores the wire fields.
+  /** Persisted data-source definitions (EC-166 LIVE mode); absent on older deployments. */
+  sources?: unknown
+  documents: unknown[]
+  assets: unknown[]
+  graphs: { draft: GraphRevisionPayload | null; published: GraphRevisionPayload | null }
+}
+
+/**
+ * Run one query through Convex's public HTTP API. Response envelope (verified
+ * against a live deployment): `{ status: 'success', value }` or
+ * `{ status: 'error', errorMessage }`. `cache: 'no-store'` keeps Next's fetch
+ * cache out of the loop — the route helper's tagged data cache is the only
+ * cache layer, so tag revalidation always reaches the deployment.
+ */
+async function runConvexQuery(
+  convexUrl: string,
+  path: string,
+  args: Record<string, unknown>,
+): Promise<unknown> {
+  const response = await fetch(`${convexUrl.replace(/\/$/, '')}/api/query`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ path, args, format: 'json' }),
+    cache: 'no-store',
+  })
+  const body = (await response.json().catch(() => undefined)) as
+    | { status?: string; value?: unknown; errorMessage?: string; message?: string }
+    | undefined
+  if (!response.ok || body?.status !== 'success') {
+    throw new Error(
+      `Convex query "${path}" failed (${response.status}): ${
+        body?.errorMessage ?? body?.message ?? 'no error message'
+      }`,
+    )
+  }
+  return body.value
+}
+
+function parseGraph(payload: GraphRevisionPayload | null): ProjectGraph | null {
+  if (!payload) return null
+  const parsed = parseProjectGraph(payload.serializedGraph)
+  // An unparsable stored graph degrades to "no graph" (the runtime renders
+  // explicit fallbacks) — never a crash.
+  return parsed.ok ? parsed.graph : null
+}
+
+/** Canonical-schema validation: invalid stored rows are skipped, not fatal. */
+function parseDocuments(rows: unknown[]): CmsDocument[] {
+  const documents: CmsDocument[] = []
+  for (const row of rows) {
+    const parsed = documentSchema.safeParse(row)
+    if (parsed.success) documents.push(parsed.data)
+  }
+  return documents
+}
+
+/**
+ * The snapshot's data-source envelope — the structural `CanvasDataSource`
+ * shape `materializeSourcePayloads` consumes (cms query configs themselves are
+ * re-validated by `@elytracms/content`'s lenient parser inside `@elytracms/next`).
+ */
+const canvasDataSourceSchema = z.object({
+  kind: z.string().min(1),
+  id: z.string().min(1),
+  label: z.string().optional(),
+  config: z.unknown().optional(),
+})
+
+/**
+ * Parse the snapshot's `sources` array (EC-166 LIVE mode). Tolerant by design:
+ * an older deployment without the field — or an invalid entry — degrades to no
+ * source definitions, which the runtime renders as unresolved-binding
+ * fallbacks, never a crash.
+ */
+function parseSources(rows: unknown): CanvasDataSource[] {
+  if (!Array.isArray(rows)) return []
+  const sources: CanvasDataSource[] = []
+  for (const row of rows) {
+    const parsed = canvasDataSourceSchema.safeParse(row)
+    if (parsed.success) sources.push(parsed.data)
+  }
+  return sources
+}
+
+/**
+ * Implicit fallback route table (EC-187): `/` → the first `page`-collection
+ * document (lowest id), once per configured locale. Merged UNDER the stored
+ * records (see module docs). The delivery snapshot is already
+ * perspective-filtered server-side (`delivery:snapshot` ships only published
+ * content; `delivery:draftSnapshot` ships drafts), so this no longer re-checks
+ * the flat `state` flag (EC-224 B-1 — `state` is being retired; in draft mode
+ * this now correctly previews the draft home even when unpublished).
+ */
+function fallbackHomeRoutes(documents: CmsDocument[], locales: LocaleConfig): RouteRecord[] {
+  const homePage = documents
+    .filter((doc) => doc.collection === 'page')
+    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))[0]
+  if (!homePage) return []
+  return locales.locales.map((locale) => ({
+    id: `r-live-home-${locale}`,
+    pattern: '/',
+    locale,
+    document: { collection: 'page', id: homePage.id },
+  }))
+}
+
+/** Fetch the live snapshot and assemble the `ContentSource` for one request. */
+export async function loadLiveContent(
+  options: LiveContentOptions,
+  perspective: Perspective,
+): Promise<ContentSource> {
+  const args: Record<string, unknown> = {
+    projectId: options.projectId,
+  }
+
+  let payload: DeliverySnapshotPayload
+  if (perspective === 'draft') {
+    if (!options.draftToken) {
+      // Explicit, visible failure: draft mode without a configured token must
+      // never silently fall back to published content.
+      throw new Error(
+        'Draft preview requested but DRAFT_PREVIEW_TOKEN is not configured on the host.',
+      )
+    }
+    payload = (await runConvexQuery(options.convexUrl, 'delivery:draftSnapshot', {
+      ...args,
+      token: options.draftToken,
+    })) as DeliverySnapshotPayload
+  } else {
+    payload = (await runConvexQuery(
+      options.convexUrl,
+      'delivery:snapshot',
+      args,
+    )) as DeliverySnapshotPayload
+  }
+
+  // Locales are config-owned (AD-11, EC-182): read from the host's
+  // `elytra.config.ts`, passed in via options — never from the snapshot.
+  const locales = options.locales
+  const draftGraph = parseGraph(payload.graphs.draft)
+  const publishedGraph = parseGraph(payload.graphs.published)
+  const documents = parseDocuments(payload.documents)
+
+  // MERGE, not XOR (EC-177 gap 2): config route records win per pattern+locale;
+  // the implicit per-locale home fallback fills the rest. EC-207: routes come
+  // from the host's config (options), never the wire. EC-187: the home fallback
+  // derives `/` from the first `page` document in the (perspective-filtered) set.
+  const routes = mergeRouteRecords([...options.routes], fallbackHomeRoutes(documents, locales))
+
+  // EC-224 B-1: the published snapshot already ships each document as its PINNED
+  // published content (delivery resolved the version pointer server-side). Wrap
+  // those rows as a `DocumentHistory` so the pure published gate
+  // (`selectPerspective`) serves `.published` directly — independent of the flat
+  // `state` field, which publish no longer stamps (and B removes).
+  //
+  // TRUST CONTRACT (the trust boundary moved fully into delivery): the wrap
+  // treats whatever the published fetch returned AS published (`published: doc`)
+  // and deliberately does NOT re-gate — it cannot, the wire carries no version
+  // pointer. Correctness therefore rests ENTIRELY on `delivery:snapshot` shipping
+  // published-only content (pinned version snapshots, never a draft — see
+  // `convex/delivery.ts`). This drops the host-side defense-in-depth gate; guard
+  // the invariant in delivery, not here.
+  // Draft-fetch rows stay bare: `selectPerspective('draft')` serves them as-is.
+  const documentSources: ContentDocumentSource[] =
+    perspective === 'published'
+      ? documents.map((doc) => ({ draft: doc, published: doc, versions: [] }))
+      : documents
+
+  return createStaticContentSource({
+    projectId: payload.projectId,
+    locales,
+    routes,
+    redirects: [...options.redirects],
+    // Collections are config-owned (AD-11, EC-183): from the host's own config,
+    // passed in via options — never from the snapshot.
+    collections: [...options.collections],
+    documents: documentSources,
+    assets: payload.assets as AssetRecord[],
+    graphs: { draft: draftGraph, published: publishedGraph },
+    // EC-166 LIVE mode: the builder's persisted section/template sources, so
+    // the route helper materializes their payloads (`materializeSourcePayloads`).
+    sources: parseSources(payload.sources),
+  })
+}

package/template/frontend/lib/project-config.ts

@@ -0,0 +1,22 @@
+import type { LocaleConfig } from '@elytracms/core/cms-core'
+import { collections, redirects, routes } from '../../cms'
+
+/**
+ * Host-owned project config for the @elytracms/next runtime. Structure is code:
+ * the frontend reads its locales, CMS model, and routing from THIS repo's `cms/`
+ * (the same files the studio reads) — never from the delivery snapshot. The
+ * backend holds data only. Connection details (the Convex deployment URL) stay
+ * in env — see `content.ts`. Mirrors the root `elytra.config.ts`; `slug`/`locales`
+ * are inlined so the frontend bundle stays free of `defineElytraConfig`.
+ */
+export const projectConfig = {
+  slug: '{{projectSlug}}',
+  frontendUrl: 'http://localhost:3000',
+  locales: {
+    default: 'en',
+    locales: ['en'],
+  } satisfies LocaleConfig,
+  collections,
+  routes,
+  redirects,
+}

package/template/frontend/next.config.mjs

@@ -0,0 +1,19 @@
+/**
+ * Delivery host for the Elytra embedded runtime. The @elytracms/* packages are
+ * consumed from the registry as compiled `dist`, so no `transpilePackages` is
+ * needed.
+ *
+ * @type {import('next').NextConfig}
+ */
+const nextConfig = {
+  images: {
+    remotePatterns: [
+      // Convex file-storage serve URLs (uploaded assets) in connected mode.
+      { protocol: 'https', hostname: '*.convex.cloud' },
+      // The starter content's demo images.
+      { protocol: 'https', hostname: 'picsum.photos' },
+    ],
+  },
+}
+
+export default nextConfig

package/template/frontend/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "frontend",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "next build",
+    "dev": "next dev --port 3000",
+    "start": "next start",
+    "lint": "next lint",
+    "type-check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@elytracms/core": "^0.0.7",
+    "@elytracms/next": "^0.0.7",
+    "next": "^16.2.9",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "typescript": "^5.7.0"
+  }
+}

package/template/frontend/tsconfig.json

@@ -0,0 +1,39 @@
+{
+  "compilerOptions": {
+    "target": "esnext",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": true,
+    "module": "preserve",
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/template/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "{{projectSlug}}",
+  "description": "{{projectName}} — website on Elytra (studio + frontend).",
+  "private": true,
+  "packageManager": "pnpm@10.33.2",
+  "scripts": {
+    "dev": "elytra dev",
+    "build": "elytra build",
+    "format": "prettier --cache --write .",
+    "lint": "turbo run lint",
+    "type-check": "turbo run type-check"
+  },
+  "dependencies": {
+    "@elytracms/core": "^0.0.7",
+    "@elytracms/next": "^0.0.7"
+  },
+  "devDependencies": {
+    "@elytracms/cli": "^0.0.1",
+    "prettier": "^3.4.0",
+    "turbo": "^2.3.0"
+  }
+}

package/template/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages:
+  - frontend
+  - studio

package/template/studio/convex/assets.ts

@@ -0,0 +1 @@
+export * from '@elytracms/studio/convex/assets'

package/template/studio/convex/auth.config.ts

@@ -0,0 +1,3 @@
+// EC-252: generic OIDC config (the deployment issues its own JWTs via CONVEX_SITE_URL) —
+// package-shipped, re-exported here so Convex finds convex/auth.config.ts.
+export { default } from '@elytracms/studio/convex/auth.config'