create-ortha-app 0.5.0 → 0.5.2

package/README.md

@@ -1,6 +1,7 @@
 # create-ortha-app
 
-Part of [Ortha CMS](https://github.com/ortha-source/ortha-cms).
+Part of [Ortha CMS](https://orthacms.com) — the source is on
+[GitHub](https://github.com/ortha-source/ortha-cms/tree/main/packages/create-ortha-app).
 
 ```sh
 npm install create-ortha-app

package/dist/lib/features.d.ts

@@ -41,7 +41,7 @@ export interface Feature {
  *
  * The **copilot** is here — plugin and admin panel — even though it is a large
  * feature nobody may want, because its server half arrives anyway: five core
- * plugins (`content`, `activity`, `i18n`, `media`, `users`) depend on
+ * plugins (`content`, `i18n`, `media`, `segments`, `users`) depend on
  * `copilot-server` to contribute their tools, so the code is on disk whatever
  * the manifest says, and leaving it undeclared bought nothing but a missing chat
  * panel. No **model backend** comes with it: those are the opt-in
@@ -53,7 +53,8 @@ export interface Feature {
  * answer.
  *
  * The **extension points** are here for the same reason — `content-domain`,
- * `copilot-domain`, `tools-server`, `query-builder-admin`. Every one of them
+ * `copilot-domain`, `segments-domain`, `transfer-domain`, `webhooks-domain`,
+ * `tools-server`, `query-builder-admin`. Every one of them
  * already arrives transitively, so an import would resolve on npm's flat
  * `node_modules` today; declaring them is what makes that resolution something
  * the app owns rather than something it borrows. An undeclared import breaks
@@ -109,8 +110,9 @@ export declare const TRANSITIVE_PACKAGES: readonly string[];
  * Where uploads are written.
  *
  * A single-choice group: media always runs, the question is only which adapter
- * backs it. S3 is listed and disabled — the package exists but has never been
- * released, and offering it would generate an app that cannot install.
+ * backs it. All five are published and selectable; `available` stays on the
+ * type for the next adapter that lands in the codebase before it lands on npm,
+ * which is shown greyed out rather than hidden.
  */
 export declare const MEDIA_PROVIDERS: readonly Feature[];
 /**

package/dist/lib/features.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/lib/features.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACpB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EA6C1C,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,OAAO,EAyC7C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,OAAO,EAiB/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,OAAO,EAyB3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,OAAO,EA0BvC,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,SAAS,OAAO,EAK1C,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC7B,gFAAgF;IAChF,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CASrE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAQrE"}
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/lib/features.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACpB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EA6C1C,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,OAAO,EAyC7C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,OAAO,EAiB/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,OAAO,EAyB3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,OAAO,EA0BvC,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,SAAS,OAAO,EAK1C,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC7B,gFAAgF;IAChF,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CASrE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAQrE"}

package/dist/lib/features.js

@@ -23,7 +23,7 @@ exports.resolveFlags = resolveFlags;
  *
  * The **copilot** is here — plugin and admin panel — even though it is a large
  * feature nobody may want, because its server half arrives anyway: five core
- * plugins (`content`, `activity`, `i18n`, `media`, `users`) depend on
+ * plugins (`content`, `i18n`, `media`, `segments`, `users`) depend on
  * `copilot-server` to contribute their tools, so the code is on disk whatever
  * the manifest says, and leaving it undeclared bought nothing but a missing chat
  * panel. No **model backend** comes with it: those are the opt-in
@@ -35,7 +35,8 @@ exports.resolveFlags = resolveFlags;
  * answer.
  *
  * The **extension points** are here for the same reason — `content-domain`,
- * `copilot-domain`, `tools-server`, `query-builder-admin`. Every one of them
+ * `copilot-domain`, `segments-domain`, `transfer-domain`, `webhooks-domain`,
+ * `tools-server`, `query-builder-admin`. Every one of them
  * already arrives transitively, so an import would resolve on npm's flat
  * `node_modules` today; declaring them is what makes that resolution something
  * the app owns rather than something it borrows. An undeclared import breaks
@@ -139,8 +140,9 @@ exports.TRANSITIVE_PACKAGES = [
  * Where uploads are written.
  *
  * A single-choice group: media always runs, the question is only which adapter
- * backs it. S3 is listed and disabled — the package exists but has never been
- * released, and offering it would generate an app that cannot install.
+ * backs it. All five are published and selectable; `available` stays on the
+ * type for the next adapter that lands in the codebase before it lands on npm,
+ * which is shown greyed out rather than hidden.
  */
 exports.MEDIA_PROVIDERS = [
     {

package/dist/lib/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/lib/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAMH,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACxB,MAAM,YAAY,CAAC;AASpB,eAAO,MAAM,KAAK,8oBAcjB,CAAC;AA6HF,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,EAAE,CAI/D;AA6BD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAuFlB;AA+BD,wBAAsB,IAAI,CACtB,IAAI,GAAE,SAAS,MAAM,EAA0B,GAChD,OAAO,CAAC,IAAI,CAAC,CAsFf"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/lib/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAMH,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACxB,MAAM,YAAY,CAAC;AASpB,eAAO,MAAM,KAAK,8oBAcjB,CAAC;AA6HF,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,EAAE,CAI/D;AA6BD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAwFlB;AA+BD,wBAAsB,IAAI,CACtB,IAAI,GAAE,SAAS,MAAM,EAA0B,GAChD,OAAO,CAAC,IAAI,CAAC,CAsFf"}

package/dist/lib/run.js

@@ -202,9 +202,10 @@ async function resolveAnswers(argv, defaultName) {
     ui.section('Features');
     ui.note('Everything else is installed for you. These are the choices.');
     console.log('');
-    // Only ask when there is more than one answer available. S3 is not
-    // published, so today this is a question with a single possible reply, and
-    // asking it would be noise pretending to be a choice.
+    // Only ask when there is more than one answer available — a question with a
+    // single possible reply is noise pretending to be a choice. Every adapter
+    // is published today, so the question is asked; it stops being asked by
+    // itself if all but one are ever marked unavailable.
     const selectable = features_1.MEDIA_PROVIDERS.filter((provider) => provider.available);
     const chosenMedia = selectable.length > 1
         ? [

package/package.json

@@ -1,9 +1,9 @@
 {
     "name": "create-ortha-app",
-    "version": "0.5.0",
+    "version": "0.5.2",
     "description": "Create an Ortha CMS app: npx create-ortha-app my-cms",
     "license": "MIT",
-    "homepage": "https://github.com/ortha-source/ortha-cms/tree/main/packages/create-ortha-app",
+    "homepage": "https://orthacms.com",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/ortha-source/ortha-cms.git",

package/templates/default/apps/server/config/graphql.ts

@@ -0,0 +1,25 @@
+// ortha:if graphql
+import type { ContentGraphqlPluginConfig } from '@orthacms/content-graphql';
+import { readPositiveInt } from '@orthacms/utils-server';
+
+/** The public GraphQL endpoint's cost budget. */
+export function contentGraphqlConfig(): ContentGraphqlPluginConfig {
+    return {
+        // The cost budget one GraphQL operation may spend. REST bounded a
+        // request structurally — one route, one page — and a GraphQL document
+        // does not, so these are the replacement bound. Stable tuning, hence
+        // literals, with env overrides for an operator who needs to loosen or
+        // tighten them without a redeploy.
+        limits: {
+            maxDepth: readPositiveInt('GRAPHQL_MAX_DEPTH', 8),
+            maxComplexity: readPositiveInt('GRAPHQL_MAX_COMPLEXITY', 1000),
+            maxFields: readPositiveInt('GRAPHQL_MAX_FIELDS', 500),
+            maxQueryLength: readPositiveInt('GRAPHQL_MAX_QUERY_LENGTH', 16_384)
+        },
+        // How long a built schema is reused before it is derived again from the
+        // workspace's content grants. Freshness only — every read is authorized
+        // against the live grants regardless.
+        schemaCacheTtlMs: readPositiveInt('GRAPHQL_SCHEMA_CACHE_TTL_MS', 60_000)
+    };
+}
+// ortha:end

package/templates/default/apps/server/config/segments.ts

@@ -0,0 +1,23 @@
+import type { SegmentsPluginConfig } from '@orthacms/segments-server';
+
+/** Reader entitlements — where a reader's tags come from. */
+export function segmentsConfig(): SegmentsPluginConfig {
+    return {
+        // Where a reader's tags come from — the one line this feature needs per
+        // install. A resolver receives the request, so a JWT claim, a header the
+        // CDN sets, or a lookup against a billing system are all equally
+        // reachable:
+        //
+        //   resolver: {
+        //       resolve: async (request) => readTagsFrom(request)
+        //   }
+        //
+        // Left out — as it is here — every reader is anonymous, so unrestricted
+        // content serves and restricted content does not. That is a working
+        // configuration, and it fails in the safe direction: an audience nobody
+        // can be resolved into cannot accidentally be admitted.
+        //
+        // It is a function rather than an environment value, which is why this
+        // module reads no env: what it needs is code only you can write.
+    };
+}

package/templates/default/apps/server/config/transfer.ts

@@ -0,0 +1,28 @@
+import type { TransferPluginConfig } from '@orthacms/transfer-server';
+
+/** Export/import — the per-type identity fields and the transfer ceilings. */
+export function transferConfig(): TransferPluginConfig {
+    return {
+        // Which field identifies a record of each type, per content type.
+        //
+        // This is the setting that decides whether importing the same file
+        // twice updates the records or duplicates them. Left out, a type falls
+        // back to a derived guess — a field *named* like an identifier
+        // (`slug`, `sku`, `email`), then the first required text field — which
+        // is usually right and is reported in every export's manifest, but is
+        // still a guess. Name the fields for any type where being wrong would
+        // be expensive:
+        //
+        //   identity: { product: ['sku'], author: ['email'] }
+        //
+        // This app registers no content types yet, so there is nothing to key
+        // here until you add some.
+        identity: {},
+        // Ceilings on one transfer. The defaults (see `DEFAULT_TRANSFER_LIMITS`)
+        // sit comfortably above real editorial work and far below "the whole
+        // library"; the import-side archive limits are a safety boundary rather
+        // than a capacity setting, so lowering them costs nothing and raising
+        // them should be deliberate.
+        limits: {}
+    };
+}

package/templates/default/apps/server/config/webhooks.ts

@@ -0,0 +1,34 @@
+import type { WebhooksPluginConfig } from '@orthacms/webhooks-server';
+import { readFlag, readPositiveInt } from '@orthacms/utils-server';
+
+/**
+ * Outgoing webhooks — how hard the sender pushes, and where it may reach.
+ *
+ * Endpoints themselves live in the database; an administrator adds them on the
+ * admin's Webhooks page. Only the five values a deployment genuinely varies are
+ * env-sourced, and the rest are left to the plugin's own defaults, where the
+ * reasoning behind them is written down.
+ *
+ * The two `allow*` flags are the ones worth reading twice. Both default to
+ * **off**, and both widen what a URL an operator types can reach:
+ * `WEBHOOKS_ALLOW_INSECURE_URLS` permits plain HTTP, and
+ * `WEBHOOKS_ALLOW_PRIVATE_NETWORKS` permits loopback and RFC 1918 — which a
+ * self-hosted install with an in-cluster receiver genuinely needs, and an
+ * internet-facing one must not have. A webhook is this server making a request
+ * to an address a user typed, which is the shape of every SSRF.
+ */
+export function webhooksConfig(): WebhooksPluginConfig {
+    return {
+        // 0 turns the sender off in this process. Rows still queue, so a
+        // deployment can run web nodes that only enqueue and one that sends.
+        deliveryIntervalMs: readPositiveInt(
+            'WEBHOOKS_DELIVERY_INTERVAL',
+            2_000
+        ),
+        timeoutMs: readPositiveInt('WEBHOOKS_TIMEOUT', 10_000),
+        // Nothing else prunes the delivery log.
+        retentionDays: readPositiveInt('WEBHOOKS_RETENTION_DAYS', 30),
+        allowInsecureUrls: readFlag('WEBHOOKS_ALLOW_INSECURE_URLS', false),
+        allowPrivateNetworks: readFlag('WEBHOOKS_ALLOW_PRIVATE_NETWORKS', false)
+    };
+}

package/templates/default/apps/server/ortha.config.ts

@@ -34,6 +34,12 @@ import type {
     TrustProxySetting
 } from '@orthacms/bootstrap-server';
 import type { I18nPluginConfig } from '@orthacms/i18n-server';
+import type { SegmentsPluginConfig } from '@orthacms/segments-server';
+import type { TransferPluginConfig } from '@orthacms/transfer-server';
+import type { WebhooksPluginConfig } from '@orthacms/webhooks-server';
+// ortha:if graphql
+import type { ContentGraphqlPluginConfig } from '@orthacms/content-graphql';
+// ortha:end
 // ortha:if mcp
 import type { McpPluginConfig } from '@orthacms/mcp-server';
 // ortha:end
@@ -49,6 +55,12 @@ import { identityConfig, type AppIdentityConfig } from './config/identity';
 import { i18nConfig } from './config/i18n';
 import { mediaConfig, type AppMediaConfig } from './config/media';
 import { copilotConfig, type AppCopilotConfig } from './config/copilot';
+import { segmentsConfig } from './config/segments';
+import { transferConfig } from './config/transfer';
+import { webhooksConfig } from './config/webhooks';
+// ortha:if graphql
+import { contentGraphqlConfig } from './config/graphql';
+// ortha:end
 // ortha:if mcp
 import { mcpConfig } from './config/mcp';
 // ortha:end
@@ -74,6 +86,16 @@ export interface OrthaConfig {
         i18n: I18nPluginConfig;
         media: AppMediaConfig;
         copilot: AppCopilotConfig;
+        /** Export/import — per-type identity fields and transfer ceilings. */
+        transfer: TransferPluginConfig;
+        /** Reader entitlements — where a reader's tags come from. */
+        segments: SegmentsPluginConfig;
+        /** Outgoing webhooks — delivery pacing and the URL policy. */
+        webhooks: WebhooksPluginConfig;
+        // ortha:if graphql
+        /** Public GraphQL endpoint — the per-operation cost budget. */
+        contentGraphql: ContentGraphqlPluginConfig;
+        // ortha:end
         // ortha:if mcp
         mcp: McpPluginConfig;
         // ortha:end
@@ -107,6 +129,12 @@ const config: OrthaConfig = {
         i18n: i18nConfig(),
         media: mediaConfig(),
         copilot: copilotConfig(),
+        transfer: transferConfig(),
+        segments: segmentsConfig(),
+        webhooks: webhooksConfig(),
+        // ortha:if graphql
+        contentGraphql: contentGraphqlConfig(),
+        // ortha:end
         // ortha:if mcp
         mcp: mcpConfig()
         // ortha:end

package/templates/default/apps/server/src/plugins.ts

@@ -212,6 +212,10 @@ export function buildPlugins(config: OrthaConfig): ServerPlugin[] {
         // first request from a workspace granted both.
         ContentGraphqlPlugin({
             content,
+            ...config.plugins.contentGraphql,
+            // GraphiQL rides the same switch as the Scalar reference: both are
+            // developer tooling, and neither should be reachable in production
+            // unless the operator asks (`API_DOCS=true`).
             playground: config.docs.enabled === true
         }),
         // ortha:end
@@ -227,8 +231,9 @@ export function buildPlugins(config: OrthaConfig): ServerPlugin[] {
         AlarmsPlugin(),
         // Outgoing webhooks. Inert until someone adds an endpoint in the admin,
         // and it only subscribes to the outbox, so nothing depends on it being
-        // registered any earlier than this.
-        WebhooksPlugin(),
+        // registered any earlier than this. The settings worth knowing about
+        // are the two `WEBHOOKS_ALLOW_*` flags — see `config/webhooks.ts`.
+        WebhooksPlugin(config.plugins.webhooks),
         MediaServerPlugin({
             // ortha:if media-local
             provider: createLocalStorageProvider(config.plugins.media.storage),
@@ -259,9 +264,10 @@ export function buildPlugins(config: OrthaConfig): ServerPlugin[] {
         // The setting worth filling in per install is `identity`: it says
         // which field identifies a record of each type, which is what lets an
         // import recognise "this is that record" instead of adding a
-        // duplicate. Without it the natural key is a heuristic —
-        // `TransferPlugin({ identity: { post: ['slug'] } })`.
-        TransferPlugin(),
+        // duplicate. Without it the natural key is a heuristic. It is a map of
+        // your own content types rather than an environment value, so it lives
+        // in `config/transfer.ts`.
+        TransferPlugin(config.plugins.transfer),
         // Reader entitlements — who may *read* published content, as against
         // who may touch it. After content, whose read-scope port it binds, so
         // one decision covers REST, GraphQL and MCP at once.
@@ -270,8 +276,10 @@ export function buildPlugins(config: OrthaConfig): ServerPlugin[] {
         // in the admin no predicate is emitted and every read costs what it
         // did before. The line to fill in per install is `resolver` — it says
         // where a reader's tags come from, and its absence means every reader
-        // is anonymous, which serves unrestricted content and nothing else.
-        SegmentsPlugin(),
+        // is anonymous, which serves unrestricted content and nothing else. It
+        // is a function you write, not an environment value, so it lives in
+        // `config/segments.ts`.
+        SegmentsPlugin(config.plugins.segments),
         // Registered after workspaces (runs are workspace-scoped) and identity
         // (runs execute as the calling user, gated on `copilot:use`). The
         // composition root is the single place that selects a backend: the

package/templates/default/env.tmpl

@@ -103,6 +103,21 @@ COPILOT_OPENAI_MODELS=llama3.1
 # Leave empty for a local runtime that wants no auth.
 COPILOT_OPENAI_API_KEY=
 # ortha:end
+# ortha:if graphql
+# --- graphql ---
+# The cost budget one GraphQL operation may spend. REST bounds a request
+# structurally — one route, one page — and a document does not, so these are the
+# replacement bound. The defaults suit an ordinary content API; loosen them only
+# for a client you control.
+GRAPHQL_MAX_DEPTH=8
+GRAPHQL_MAX_COMPLEXITY=1000
+GRAPHQL_MAX_FIELDS=500
+GRAPHQL_MAX_QUERY_LENGTH=16384
+# How long a built schema is reused before it is derived again from the
+# workspace's content grants. Freshness only — every read is authorized against
+# the live grants regardless.
+GRAPHQL_SCHEMA_CACHE_TTL_MS=60000
+# ortha:end
 # ortha:if mcp
 # --- mcp ---
 # Global kill switch. OFF by default: once on, any holder of a `full`-scope API