create-ortha-app 0.4.2 → 0.4.3

package/dist/cli.js

@@ -49,6 +49,36 @@ function idList(raw) {
         .map((id) => id.trim())
         .filter(Boolean);
 }
+/**
+ * The ids a `--media` / `--copilot` / `--sso` / `--protocols` flag named, checked
+ * against the group it belongs to.
+ *
+ * An id nobody recognises has to stop the run. The flags take *feature ids*
+ * (`media-s3`), not the label or the bare adapter name, and `--media s3` is the
+ * natural guess — it used to select nothing, and "nothing" is a real answer for
+ * three of the four groups, so it scaffolded an app quietly missing whatever was
+ * asked for. For storage that app cannot even compile: no adapter means no
+ * `storage` setting and no `mediaStorage()` for the config to call. Naming the
+ * valid ids here costs a typo nothing and turns a broken app into one line of
+ * output.
+ *
+ * `required` marks a single-choice group that must end up with something —
+ * storage, where "no adapter" is not a configuration an app can run.
+ */
+function selected(argv, name, group, required = false) {
+    const chosen = idList(option(argv, name)) ?? defaultsOf(group);
+    const known = new Set(group.map((feature) => feature.id));
+    const unknown = chosen.filter((id) => !known.has(id));
+    if (unknown.length > 0) {
+        throw new Error(`--${name}: no such option ${unknown.map((id) => `"${id}"`).join(', ')}. ` +
+            `Expected ${[...known].join(', ')}${required ? '' : ', or none'}.`);
+    }
+    if (required && chosen.length === 0) {
+        throw new Error(`--${name}: an app needs one of ${[...known].join(', ')} — ` +
+            'there is no configuration for "no adapter at all".');
+    }
+    return chosen;
+}
 /**
  * This package's own version, which every `@orthacms/*` dependency in the
  * generated app is pinned to.
@@ -132,12 +162,14 @@ async function askText(label, fallback, validate) {
 async function resolveAnswers(argv, defaultName) {
     const asked = !flag(argv, 'yes') && ui.interactive();
     const defaultDatabaseUrl = `postgresql://ortha:ortha@localhost:5432/${defaultName.replace(/[^a-z0-9_]/gi, '_')}`;
-    const media = idList(option(argv, 'media')) ?? defaultsOf(features_1.MEDIA_PROVIDERS);
-    const copilot = idList(option(argv, 'copilot')) ?? defaultsOf(features_1.COPILOT_PROVIDERS);
-    const sso = idList(option(argv, 'sso')) ?? defaultsOf(features_1.SSO_PROVIDERS);
+    // Storage is `required`: it is a single choice, and an app with no adapter
+    // has no `storage` setting for `plugins.ts` to hand its factory.
+    const media = selected(argv, 'media', features_1.MEDIA_PROVIDERS, true);
+    const copilot = selected(argv, 'copilot', features_1.COPILOT_PROVIDERS);
+    const sso = selected(argv, 'sso', features_1.SSO_PROVIDERS);
     const protocols = [
         ...lockedOf(features_1.PROTOCOLS),
-        ...(idList(option(argv, 'protocols')) ?? defaultsOf(features_1.PROTOCOLS))
+        ...selected(argv, 'protocols', features_1.PROTOCOLS)
     ];
     if (!asked) {
         return {
@@ -197,8 +229,8 @@ function describeSelection(selection) {
         [
             'Copilot',
             providers.length > 0
-                ? `${providers.map((p) => p.label).join(', ')} + offline fake`
-                : 'offline fake only'
+                ? providers.map((p) => p.label).join(', ')
+                : ui.dim('no backend')
         ],
         ['Sign-in', labelsFor(features_1.SSO_PROVIDERS)],
         ['Ortha packages', String((0, features_1.resolvePackages)(selection).length + 1)]

package/dist/lib/features.d.ts

@@ -39,15 +39,18 @@ export interface Feature {
 /**
  * The packages every app gets, whatever it opts into.
  *
- * The **copilot** is here — plugin, admin panel and the offline `fake` adapter —
- * even though it is a large feature nobody may want. Two reasons. Its server
- * half arrives anyway: five core plugins (`content`, `activity`, `i18n`,
- * `media`, `users`) depend on `copilot-server` to contribute their tools, so
- * the code is on disk whatever the manifest says, and leaving it undeclared
- * bought nothing but a missing chat panel. And `fake` needs no key and no
- * network, so a default app gets a copilot that genuinely works offline —
- * while `COPILOT_ENABLED` stays `false`, so nothing reaches a model until an
- * operator says so.
+ * The **copilot** is here — plugin and admin panel — even though it is a large
+ * feature nobody may want, because its server half arrives anyway: five core
+ * plugins (`content`, `activity`, `i18n`, `media`, `users`) depend on
+ * `copilot-server` to contribute their tools, so the code is on disk whatever
+ * the manifest says, and leaving it undeclared bought nothing but a missing chat
+ * panel. No **model backend** comes with it: those are the opt-in
+ * `COPILOT_PROVIDERS` below, and an app that picks none has the plugin
+ * installed and nothing registered. `COPILOT_ENABLED` stays `false`, which
+ * unregisters the copilot's routes, so a generated app ships with the chat
+ * surfaces absent rather than visible and refusing — and turning it on without
+ * a configured backend fails at boot rather than shipping a chat that cannot
+ * answer.
  *
  * The **extension points** are here for the same reason — `content-domain`,
  * `copilot-domain`, `tools-server`, `query-builder-admin`. Every one of them
@@ -64,9 +67,9 @@ export interface Feature {
  * what makes that resolution something the app owns rather than borrows.
  * `identity-provider-fake` is the scripted identity provider: it needs no
  * tenant and no network, so it is how a generated app's sign-in page can be
- * exercised offline, exactly as `copilot-provider-fake` is for the chat. Note
- * that shipping it installs nothing: an adapter only does something once the
- * composition root registers it, and the template registers none.
+ * exercised offline. Note that shipping it installs nothing: an adapter only
+ * does something once the composition root registers it, and the template
+ * registers none.
  *
  * `design-system`, `utils-admin` and `utils-server` are here even though the
  * template's own files barely touch them: they are the first things anyone
@@ -112,11 +115,10 @@ export declare const MEDIA_PROVIDERS: readonly Feature[];
  * §10 says is an operator's decision to make explicitly. Pick nothing and the
  * copilot is not registered at all.
  *
- * `copilot-provider-fake` is not offered here — it is installed automatically
- * whenever the copilot is on. It is a shipped adapter rather than test
- * scaffolding (ADR-0004 §3): it needs no key and no network, so it is what
- * makes the chat work offline, and it is registered last so it is the default
- * only when it is the only one.
+ * There is no offline stand-in to fall back on. The scripted `fake` adapter is
+ * a private test fixture of the CMS repo, not a published package, so an app
+ * that picks nothing here has the copilot plugin installed with no backend
+ * registered — and `COPILOT_ENABLED` must stay `false` until one is.
  */
 export declare const COPILOT_PROVIDERS: readonly Feature[];
 /**
@@ -141,8 +143,8 @@ export declare const COPILOT_PROVIDERS: readonly Feature[];
  * second reason not to install them for an app that will never speak them.
  *
  * `identity-provider-fake` is not offered: it is installed unconditionally,
- * like `copilot-provider-fake`, because it needs no tenant and no network and
- * is how a generated app's sign-in page is exercised offline. Installing it
+ * because it needs no tenant and no network and is how a generated app's
+ * sign-in page is exercised offline. Installing it
  * registers nothing — an adapter only does something once the composition root
  * names it, and the template names none.
  */

package/dist/lib/features.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/lib/features.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACpB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqC1C,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,OAAO,EAyC7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,OAAO,EAiB/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,OAAO,EAyB3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,OAAO,EA0BvC,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,SAAS,OAAO,EAK1C,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC7B,gFAAgF;IAChF,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CASrE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAErE"}
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/lib/features.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACpB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAyC1C,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,OAAO,EAyC7C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,OAAO,EAiB/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,OAAO,EAyB3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,OAAO,EA0BvC,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,SAAS,OAAO,EAK1C,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC7B,gFAAgF;IAChF,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CASrE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAErE"}

package/dist/lib/features.js

@@ -21,15 +21,18 @@ exports.resolveFlags = resolveFlags;
 /**
  * The packages every app gets, whatever it opts into.
  *
- * The **copilot** is here — plugin, admin panel and the offline `fake` adapter —
- * even though it is a large feature nobody may want. Two reasons. Its server
- * half arrives anyway: five core plugins (`content`, `activity`, `i18n`,
- * `media`, `users`) depend on `copilot-server` to contribute their tools, so
- * the code is on disk whatever the manifest says, and leaving it undeclared
- * bought nothing but a missing chat panel. And `fake` needs no key and no
- * network, so a default app gets a copilot that genuinely works offline —
- * while `COPILOT_ENABLED` stays `false`, so nothing reaches a model until an
- * operator says so.
+ * The **copilot** is here — plugin and admin panel — even though it is a large
+ * feature nobody may want, because its server half arrives anyway: five core
+ * plugins (`content`, `activity`, `i18n`, `media`, `users`) depend on
+ * `copilot-server` to contribute their tools, so the code is on disk whatever
+ * the manifest says, and leaving it undeclared bought nothing but a missing chat
+ * panel. No **model backend** comes with it: those are the opt-in
+ * `COPILOT_PROVIDERS` below, and an app that picks none has the plugin
+ * installed and nothing registered. `COPILOT_ENABLED` stays `false`, which
+ * unregisters the copilot's routes, so a generated app ships with the chat
+ * surfaces absent rather than visible and refusing — and turning it on without
+ * a configured backend fails at boot rather than shipping a chat that cannot
+ * answer.
  *
  * The **extension points** are here for the same reason — `content-domain`,
  * `copilot-domain`, `tools-server`, `query-builder-admin`. Every one of them
@@ -46,9 +49,9 @@ exports.resolveFlags = resolveFlags;
  * what makes that resolution something the app owns rather than borrows.
  * `identity-provider-fake` is the scripted identity provider: it needs no
  * tenant and no network, so it is how a generated app's sign-in page can be
- * exercised offline, exactly as `copilot-provider-fake` is for the chat. Note
- * that shipping it installs nothing: an adapter only does something once the
- * composition root registers it, and the template registers none.
+ * exercised offline. Note that shipping it installs nothing: an adapter only
+ * does something once the composition root registers it, and the template
+ * registers none.
  *
  * `design-system`, `utils-admin` and `utils-server` are here even though the
  * template's own files barely touch them: they are the first things anyone
@@ -60,6 +63,8 @@ exports.resolveFlags = resolveFlags;
 exports.CORE_PACKAGES = [
     '@orthacms/activity-admin',
     '@orthacms/activity-server',
+    '@orthacms/alarms-admin',
+    '@orthacms/alarms-server',
     '@orthacms/api-tokens-admin',
     '@orthacms/bootstrap-admin',
     '@orthacms/bootstrap-server',
@@ -68,7 +73,6 @@ exports.CORE_PACKAGES = [
     '@orthacms/content-server',
     '@orthacms/copilot-admin',
     '@orthacms/copilot-domain',
-    '@orthacms/copilot-provider-fake',
     '@orthacms/copilot-server',
     '@orthacms/database',
     '@orthacms/design-system',
@@ -82,6 +86,9 @@ exports.CORE_PACKAGES = [
     '@orthacms/media-admin',
     '@orthacms/media-server',
     '@orthacms/query-builder-admin',
+    '@orthacms/segments-admin',
+    '@orthacms/segments-domain',
+    '@orthacms/segments-server',
     '@orthacms/shell-admin',
     '@orthacms/tools-server',
     '@orthacms/transfer-admin',
@@ -175,11 +182,10 @@ exports.MEDIA_PROVIDERS = [
  * §10 says is an operator's decision to make explicitly. Pick nothing and the
  * copilot is not registered at all.
  *
- * `copilot-provider-fake` is not offered here — it is installed automatically
- * whenever the copilot is on. It is a shipped adapter rather than test
- * scaffolding (ADR-0004 §3): it needs no key and no network, so it is what
- * makes the chat work offline, and it is registered last so it is the default
- * only when it is the only one.
+ * There is no offline stand-in to fall back on. The scripted `fake` adapter is
+ * a private test fixture of the CMS repo, not a published package, so an app
+ * that picks nothing here has the copilot plugin installed with no backend
+ * registered — and `COPILOT_ENABLED` must stay `false` until one is.
  */
 exports.COPILOT_PROVIDERS = [
     {
@@ -221,8 +227,8 @@ exports.COPILOT_PROVIDERS = [
  * second reason not to install them for an app that will never speak them.
  *
  * `identity-provider-fake` is not offered: it is installed unconditionally,
- * like `copilot-provider-fake`, because it needs no tenant and no network and
- * is how a generated app's sign-in page is exercised offline. Installing it
+ * because it needs no tenant and no network and is how a generated app's
+ * sign-in page is exercised offline. Installing it
  * registers nothing — an adapter only does something once the composition root
  * names it, and the template names none.
  */

package/dist/lib/template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/lib/template.ts"],"names":[],"mappings":"AAWA,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,YAAY,CAAC;AAEpB,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC3B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,SAAS,EAAE,gBAAgB,CAAC;CAC/B;AAoBD,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CAevE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,GACvB,MAAM,CAmBR;AAuBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,GACvB,IAAI,CAiCN;AAED,+CAA+C;AAC/C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMxD"}
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/lib/template.ts"],"names":[],"mappings":"AAWA,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,YAAY,CAAC;AAEpB,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC3B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,SAAS,EAAE,gBAAgB,CAAC;CAC/B;AAoBD,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CAevE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,GACvB,MAAM,CAmBR;AAuBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,GACvB,IAAI,CA0CN;AAED,+CAA+C;AAC/C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMxD"}

package/dist/lib/template.js

@@ -104,7 +104,17 @@ function renderTemplate(templateDir, target, values) {
             (0, node_fs_1.writeFileSync)(destination, renderManifest(raw, values));
             continue;
         }
-        (0, node_fs_1.writeFileSync)(destination, render((0, conditionals_1.applyConditionals)(raw, flags, file), values));
+        const contents = (0, conditionals_1.applyConditionals)(raw, flags, file);
+        // A file that conditioned *itself* away is not written at all. This is
+        // what lets one module per optional plugin live under `config/`: wrap
+        // the whole of `config/mcp.ts` in `ortha:if mcp` and an app generated
+        // without MCP has no such file, rather than an empty one whose only
+        // job is to explain why it is empty. Guarded on the source having had
+        // content, so a template file that is deliberately blank still ships.
+        if (raw.trim() !== '' && contents.trim() === '') {
+            continue;
+        }
+        (0, node_fs_1.writeFileSync)(destination, render(contents, values));
     }
 }
 /** Whether `dir` exists and holds anything. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "create-ortha-app",
-    "version": "0.4.2",
+    "version": "0.4.3",
     "description": "Create an Ortha CMS app: npx create-ortha-app my-cms",
     "license": "MIT",
     "homepage": "https://github.com/ortha-source/ortha-cms/tree/main/packages/create-ortha-app",

package/templates/default/README.md.tmpl

@@ -145,8 +145,14 @@ talking to itself.
 ### AI copilot
 
 Installed, and **off** until you turn it on: set `COPILOT_ENABLED=true` in
-`.env`. Enabling a hosted backend sends workspace content to a third party, so
-it is an explicit decision rather than a default.
+`.env`. Off means off — with it `false` the app registers no `/api/copilot`
+route, so those endpoints 404 and the admin's chat panel, Agents view and
+Skills page are not there. Whether this app offers an AI assistant at all is a
+decision rather than a default.
+
+It is not the switch that keeps your content in-house, though. A backend is
+registered only when its settings are present (below), so an app with no key
+reaches no third party either way.
 
 Backends are registered in `src/server/plugins.ts`, and **the order is the
 setting** — there is no `defaultProvider`. The first registered backend serves a
@@ -154,9 +160,10 @@ run that names none, and it is what the admin's model picker opens on. A backend
 is only registered when its connection settings are present, so an unconfigured
 one never appears as an option that fails on the first message.
 
-The bundled `fake` provider needs no key and no network, and is registered last
-— so with nothing configured the chat still works, and it is the default only
-because it is the only one.
+There is no offline stand-in. Configure no backend and the copilot has nothing
+to call, so leave `COPILOT_ENABLED=false` until you have one — turning it on
+with an empty provider list refuses to boot rather than shipping a chat that
+cannot answer.
 <!-- ortha:if graphql -->
 ### GraphQL
 

package/templates/default/apps/admin/src/plugins.spec.ts

@@ -31,6 +31,7 @@ const EXPECTED_PLUGINS = [
     'i18n',
     'wysiwyg',
     'media',
+    'alarms',
     'copilot',
     'users',
     'activity',

package/templates/default/apps/admin/src/plugins.ts

@@ -11,6 +11,7 @@ import { UsersPlugin } from '@orthacms/users-admin';
 import { WorkspacesPlugin } from '@orthacms/workspaces-admin';
 import { WysiwygPlugin } from '@orthacms/wysiwyg-admin';
 import { CopilotPlugin } from '@orthacms/copilot-admin';
+import { AlarmsPlugin } from '@orthacms/alarms-admin';
 
 /**
  * The admin's composition, mirroring `src/server/plugins.ts` on the UI side.
@@ -46,6 +47,9 @@ export function buildPlugins(): AdminPlugin[] {
         I18nPlugin(),
         WysiwygPlugin(),
         MediaPlugin(),
+        // Another Content Library slot filler — the entry rail's checks block,
+        // an optional records column, and "Save as rule" in the toolbar.
+        AlarmsPlugin(),
         // The docked chat panel plus the full-page Agents view. Belongs with
         // the workspace-interior features: the panel mounts into the workspace
         // shell's sidebar footer.

package/templates/default/apps/admin/tsconfig.json

@@ -11,7 +11,8 @@
         "jsx": "react-jsx",
         "types": [
             "node",
-            "vite/client"
+            "vite/client",
+            "vitest/globals"
         ],
         "strict": true,
         "skipLibCheck": true,

package/templates/default/apps/server/config/copilot-anthropic.ts

@@ -0,0 +1,22 @@
+// ortha:if copilot-anthropic
+import type { AnthropicProviderConfig } from '@orthacms/copilot-provider-anthropic';
+import { readEnv, readList } from '@orthacms/utils-server';
+
+/**
+ * Native Claude, or nothing.
+ *
+ * Setting the key is what REGISTERS this backend — leave it empty and there is
+ * no `claude` in the picker at all, rather than one that fails on the first
+ * message.
+ */
+export function anthropicProvider(): AnthropicProviderConfig | undefined {
+    const apiKey = readEnv('ANTHROPIC_API_KEY');
+    if (!apiKey) {
+        return undefined;
+    }
+    return {
+        apiKey,
+        models: readList('COPILOT_ANTHROPIC_MODELS', 'claude-sonnet-5')
+    };
+}
+// ortha:end

package/templates/default/apps/server/config/copilot-openai.ts

@@ -0,0 +1,21 @@
+// ortha:if copilot-openai
+import type { OpenAiProviderConfig } from '@orthacms/copilot-provider-openai';
+import { readEnv, readList } from '@orthacms/utils-server';
+
+/**
+ * An OpenAI-wire backend, or nothing. No default endpoint: an unset variable
+ * means "this deployment has no such backend", not "assume one is running on
+ * this laptop".
+ */
+export function openAiProvider(): OpenAiProviderConfig | undefined {
+    const baseUrl = readEnv('COPILOT_OPENAI_BASE_URL');
+    if (!baseUrl) {
+        return undefined;
+    }
+    return {
+        baseUrl,
+        apiKey: process.env['COPILOT_OPENAI_API_KEY'] ?? '',
+        models: readList('COPILOT_OPENAI_MODELS', 'llama3.1')
+    };
+}
+// ortha:end

package/templates/default/apps/server/config/copilot.ts

@@ -0,0 +1,61 @@
+/** The copilot kill switch and the model backends it can reach. */
+import type { CopilotPluginConfig } from '@orthacms/copilot-server';
+// ortha:if copilot-anthropic
+import type { AnthropicProviderConfig } from '@orthacms/copilot-provider-anthropic';
+// ortha:end
+// ortha:if copilot-openai
+import type { OpenAiProviderConfig } from '@orthacms/copilot-provider-openai';
+// ortha:end
+import { defined, readFlag, readPositiveInt } from '@orthacms/utils-server';
+
+// ortha:if copilot-anthropic
+import { anthropicProvider } from './copilot-anthropic';
+// ortha:end
+// ortha:if copilot-openai
+import { openAiProvider } from './copilot-openai';
+// ortha:end
+
+/**
+ * Copilot settings plus the backends this deployment can reach.
+ *
+ * The provider settings live **here**, not inside `CopilotPluginConfig`: the
+ * plugin is adapter-agnostic by decision, so it names no provider kind. A key
+ * is present only when the deployment configured that backend, and `plugins.ts`
+ * registers exactly the ones that are — "configured" is a fact this file can
+ * read, where a `defaultProvider` naming one of them could be misspelled or
+ * point at a backend nobody registered.
+ */
+export interface AppCopilotConfig extends CopilotPluginConfig {
+    providers: {
+        // ortha:if copilot-anthropic
+        /** Native Claude. Present when ANTHROPIC_API_KEY is set. */
+        claude?: AnthropicProviderConfig;
+        // ortha:end
+        // ortha:if copilot-openai
+        /**
+         * An OpenAI-wire endpoint — Ollama, vLLM, LiteLLM, Azure or OpenAI.
+         * Present when COPILOT_OPENAI_BASE_URL is set: an endpoint nobody
+         * named is a backend that can only time out.
+         */
+        openai?: OpenAiProviderConfig;
+        // ortha:end
+    };
+}
+
+/** The copilot kill switch and the model backends it can reach. */
+export function copilotConfig(): AppCopilotConfig {
+    return {
+        // Off by default: enabling a hosted provider sends workspace content to
+        // a third party, which is an operator's decision to make explicitly.
+        enabled: readFlag('COPILOT_ENABLED', false),
+        maxOutputTokens: readPositiveInt('COPILOT_MAX_OUTPUT_TOKENS', 8192),
+        providers: defined({
+            // ortha:if copilot-anthropic
+            claude: anthropicProvider(),
+            // ortha:end
+            // ortha:if copilot-openai
+            openai: openAiProvider()
+            // ortha:end
+        })
+    };
+}

package/templates/default/apps/server/config/docs.ts

@@ -0,0 +1,14 @@
+/** The OpenAPI document and the API reference it is served as. */
+import type { ApiDocsOptions } from '@orthacms/bootstrap-server';
+import { isProduction, readFlag } from '@orthacms/utils-server';
+
+/** The OpenAPI document and the API reference it is served as. */
+export function docsConfig(): ApiDocsOptions {
+    return {
+        // On outside production, where the reference is a development tool.
+        // `API_DOCS=true` publishes it from a deployed instance.
+        enabled: readFlag('API_DOCS', !isProduction()),
+        title: '__APP_TITLE__ API',
+        version: '1.0.0'
+    };
+}

package/templates/default/apps/server/config/i18n.ts

@@ -0,0 +1,16 @@
+/** The content locales, and what to do about rows left in a removed one. */
+import type { I18nPluginConfig } from '@orthacms/i18n-server';
+
+/** The content locales, and what to do about rows left in a removed one. */
+export function i18nConfig(): I18nPluginConfig {
+    return {
+        // Content locales. Stable product configuration, hence literals. The
+        // slugs are stored on entry rows, so removing one hides its rows rather
+        // than deleting them — which is what `orphanedLocales` is about below.
+        locales: [{ slug: 'en', name: 'English', isDefault: true }],
+        // Rows in a locale no longer listed above are intact and unreachable,
+        // the worst shape for a silent failure. Fail the boot and put the
+        // choice in front of whoever edited the array.
+        orphanedLocales: 'fail'
+    };
+}

package/templates/default/apps/server/config/identity.ts

@@ -0,0 +1,96 @@
+/** Identity — sessions, tokens, the SSO handshake, and the first admin. */
+import type { IdentityPluginConfig } from '@orthacms/identity-server';
+// ortha:if sso-oidc
+import type { OidcProviderConfig } from '@orthacms/identity-provider-oidc';
+// ortha:end
+import {
+    defined,
+    isProduction,
+    readEnv,
+    readList,
+    readPositiveInt
+} from '@orthacms/utils-server';
+
+// ortha:if sso-oidc
+import { oidcProvider } from './sso-oidc';
+// ortha:end
+
+/**
+ * Identity settings, plus the identity providers this app can reach.
+ *
+ * The provider settings live here rather than inside `IdentityPluginConfig`,
+ * for the same reason the copilot's backends do: the plugin names no protocol,
+ * and this file is the one place that reads the environment. The constructed
+ * adapters are registered in `src/plugins.ts`.
+ */
+export interface AppIdentityConfig extends IdentityPluginConfig {
+    /**
+     * Identity providers, keyed by the name they are registered under. That
+     * name appears in the sign-in URL and in every `sso_identities` row, so
+     * renaming one orphans the links that name it.
+     *
+     * Optional, and absent unless this app was generated with single sign-on.
+     */
+    ssoProviders?: {
+        // ortha:if sso-oidc
+        /** A generic OpenID Connect provider. Present when both env vars are set. */
+        oidc?: OidcProviderConfig & { name: string };
+        // ortha:end
+    };
+}
+
+/** Identity — sessions, tokens, the SSO handshake, and the first admin. */
+export function identityConfig(): AppIdentityConfig {
+    return {
+        // Origins allowed to make state-changing calls (login-CSRF defence).
+        // In development that is the Vite dev server; in production the app is
+        // same-origin, so this list is what a separately-hosted admin would
+        // need adding to.
+        allowedOrigins: readList(
+            'ALLOWED_ORIGINS',
+            `http://localhost:${readPositiveInt('ADMIN_PORT', 4200)}`
+        ),
+        session: {
+            ttlSeconds: readPositiveInt('SESSION_TTL_SECONDS', 60 * 60 * 24 * 7),
+            cookieSecure: isProduction(),
+            cookieSameSite: 'lax' as const
+        },
+        token: {
+            inviteTtlSeconds: readPositiveInt(
+                'INVITE_TTL_SECONDS',
+                60 * 60 * 24 * 7
+            ),
+            resetTtlSeconds: readPositiveInt('RESET_TTL_SECONDS', 60 * 60)
+        },
+        rateLimit: {
+            ttlSeconds: readPositiveInt('LOGIN_RATE_LIMIT_TTL_SECONDS', 60),
+            limit: readPositiveInt('LOGIN_RATE_LIMIT', 10)
+        },
+        sso: ssoConfig(),
+        // ortha:if sso-oidc
+        ssoProviders: defined({ oidc: oidcProvider() }),
+        // ortha:end
+        // With an email set, an admin is provisioned on boot — idempotent and
+        // non-destructive. This is how you get your first login.
+        rootAdmin: {
+            email: process.env['ORTHA_ROOT_ADMIN_EMAIL'] ?? '',
+            password: process.env['ORTHA_ROOT_ADMIN_PASSWORD'] ?? '',
+            name: process.env['ORTHA_ROOT_ADMIN_NAME'] ?? ''
+        }
+    };
+}
+
+/**
+ * The shape of the single sign-on handshake. The providers themselves are
+ * constructed in `src/plugins.ts`; these settings say how the round trip runs.
+ */
+function ssoConfig(): NonNullable<IdentityPluginConfig['sso']> {
+    return defined({
+        // The origin browsers reach this API on. It builds the redirect_uri
+        // you register with each provider, and it is configured rather than
+        // read from the request's Host header, which a client controls. Leave
+        // it unset when the admin and the API share an origin — the usual case.
+        publicBaseUrl: readEnv('SSO_PUBLIC_BASE_URL'),
+        requestTtlSeconds: readPositiveInt('SSO_REQUEST_TTL_SECONDS', 600)
+    });
+}

package/templates/default/apps/server/config/mcp.ts

@@ -0,0 +1,25 @@
+// ortha:if mcp
+import type { McpPluginConfig } from '@orthacms/mcp-server';
+import { readFlag, readPositiveInt } from '@orthacms/utils-server';
+
+/** The MCP front door — off unless an operator turns it on. */
+export function mcpConfig(): McpPluginConfig {
+    return {
+        // Off by default: once on, any holder of a full-scope API token can
+        // drive content CRUD from an external agent.
+        enabled: readFlag('MCP_ENABLED', false),
+        // The identity MCP clients display in their connector lists.
+        name: '__APP_NAME__',
+        version: '1.0.0',
+        // A request/response transport owes its caller an answer, and the tool
+        // registry has no deadline of its own — so without this the only bound
+        // on a `tools/call` is the query underneath it, and a blocked pool
+        // turns one call into a socket held until the client gives up.
+        callTimeoutMs: readPositiveInt('MCP_CALL_TIMEOUT_MS', 30_000),
+        // Deliberately generous: the ceiling exists to stop a pathological
+        // result being serialised several times over, not to shape normal use.
+        // A result this large does not fit a model's context anyway.
+        maxResultBytes: readPositiveInt('MCP_MAX_RESULT_BYTES', 4_194_304)
+    };
+}
+// ortha:end