create-stitchkit 0.3.2 → 0.4.0

package/examples/repository/packages/frontend/src/lib/api/server-client.ts

@@ -0,0 +1,11 @@
+import { createRepositoryApi } from './client';
+import { internalApiUrl } from './place';
+
+/**
+ * Server-side API client. Separate module on purpose: it reads the SERVER
+ * environment, and importing that from a module the browser bundle also pulls
+ * in would drag server configuration into the client graph.
+ */
+export function createServerRepositoryApi() {
+  return createRepositoryApi(internalApiUrl());
+}

package/examples/repository/packages/frontend/src/lib/realtime/repository.ts

@@ -1,20 +1,52 @@
 import { repositoryRealtimeContract } from '@app/shared';
 import { createRealtimeClient } from 'stitchkit';
 import { createCacheBridge } from 'stitchkit/react';
-import { env } from '@/env';
+import { optionalRealtimeOrigin } from '@/lib/api/cross-origin';
 import { useRepository } from '@/lib/api/queries';
 import { getQueryClient } from '@/lib/query-client';
 
-export const repositorySocket = createRealtimeClient(repositoryRealtimeContract, {
-  url: env.NEXT_PUBLIC_API_URL,
-});
+/**
+ * The one thing a route handler cannot proxy.
+ *
+ * A WebSocket upgrade does not survive a Next route handler, which is why this
+ * has a variable of its own — `PUBLIC_REALTIME_ORIGIN` — rather than sharing
+ * the HTTP one. A deployment can be same-origin for HTTP and still have to name
+ * the socket's address: two roles on two ports with no routing layer in front
+ * of them is exactly that. Unset picks the page's own origin, where a routing
+ * layer forwards `/socket.io`.
+ */
+function buildSocket() {
+  // `window.location.origin` is not a value baked in anywhere: it is what this
+  // browser actually dialled, read at connect time, exactly like the server
+  // reads the request's origin. This function only ever runs in an effect.
+  const url = optionalRealtimeOrigin() ?? window.location.origin;
+  return createRealtimeClient(repositoryRealtimeContract, { url });
+}
 
-export const repositoryBridge = createCacheBridge({
-  socket: repositorySocket,
-  queryClient: getQueryClient,
-  handlers: {
-    'repository:refreshed': (snapshot, { queryClient }) => {
-      queryClient.setQueryData(useRepository.getKey(), snapshot);
+function buildBridge() {
+  return createCacheBridge({
+    socket: repositorySocket(),
+    queryClient: getQueryClient,
+    handlers: {
+      'repository:refreshed': (snapshot, { queryClient }) => {
+        queryClient.setQueryData(useRepository.getKey(), snapshot);
+      },
     },
-  },
-});
+  });
+}
+
+// Built on FIRST USE: the socket needs whatever origin the server supplied,
+// and that arrives at runtime rather than from the build. See
+// `lib/api/cross-origin.ts`.
+let socket: ReturnType<typeof buildSocket> | undefined;
+let bridge: ReturnType<typeof buildBridge> | undefined;
+
+export function repositorySocket(): ReturnType<typeof buildSocket> {
+  socket ??= buildSocket();
+  return socket;
+}
+
+export function repositoryBridge(): ReturnType<typeof buildBridge> {
+  bridge ??= buildBridge();
+  return bridge;
+}

package/examples/repository/packages/frontend/src/providers/client-providers.tsx

@@ -0,0 +1,30 @@
+'use client';
+
+import { TooltipProvider } from '@radix-ui/react-tooltip';
+import type { ReactNode } from 'react';
+import { Toaster } from '@/components/ui/toaster';
+import { type PublicOrigins, setPublicOrigins } from '@/lib/api/cross-origin';
+import { ReactQueryProvider } from './react-query';
+import { RealtimeProvider } from './realtime';
+
+export function ClientProviders({
+  origins,
+  children,
+}: {
+  origins: PublicOrigins;
+  children: ReactNode;
+}) {
+  // Recorded before any child renders, so the realtime socket can be built
+  // lazily on first use. Idempotent: the same values every render. `undefined`
+  // means this deployment serves both roles on one origin.
+  setPublicOrigins(origins);
+
+  return (
+    <ReactQueryProvider>
+      <RealtimeProvider>
+        <TooltipProvider delayDuration={250}>{children}</TooltipProvider>
+      </RealtimeProvider>
+      <Toaster />
+    </ReactQueryProvider>
+  );
+}

package/examples/repository/packages/frontend/src/providers/index.tsx

@@ -1,18 +1,23 @@
-'use client';
-
-import { TooltipProvider } from '@radix-ui/react-tooltip';
 import type { ReactNode } from 'react';
-import { Toaster } from '@/components/ui/toaster';
-import { ReactQueryProvider } from './react-query';
-import { RealtimeProvider } from './realtime';
+import { publicApiOrigin, publicRealtimeOrigin } from '@/lib/api/place';
+import { ClientProviders } from './client-providers';
 
+/**
+ * A SERVER component on purpose.
+ *
+ * The browser's data calls are same-origin and need no address at all. What
+ * still can is the realtime socket, which no route handler can proxy: when this
+ * deployment runs the two roles on two origins, the socket's address is read
+ * HERE, per request, and handed down. Reading it at request time rather than at
+ * build time is what lets one artifact serve every address it is routed to; a
+ * `NEXT_PUBLIC_` variable would have frozen one into the bundle.
+ *
+ * `undefined` for both is the normal answer for a single-origin deployment.
+ */
 export function Providers({ children }: { children: ReactNode }) {
   return (
-    <ReactQueryProvider>
-      <RealtimeProvider>
-        <TooltipProvider delayDuration={250}>{children}</TooltipProvider>
-      </RealtimeProvider>
-      <Toaster />
-    </ReactQueryProvider>
+    <ClientProviders origins={{ api: publicApiOrigin(), realtime: publicRealtimeOrigin() }}>
+      {children}
+    </ClientProviders>
   );
 }

package/examples/repository/packages/frontend/src/providers/realtime.tsx

@@ -5,11 +5,13 @@ import { repositoryBridge, repositorySocket } from '@/lib/realtime/repository';
 
 export function RealtimeProvider({ children }: { children: ReactNode }) {
   useEffect(() => {
-    repositorySocket.connect();
-    repositoryBridge.connect();
+    const socket = repositorySocket();
+    const bridge = repositoryBridge();
+    socket.connect();
+    bridge.connect();
     return () => {
-      repositoryBridge.disconnect();
-      repositorySocket.disconnect();
+      bridge.disconnect();
+      socket.disconnect();
     };
   }, []);
   return children;

package/examples/repository/project.json

@@ -0,0 +1,189 @@
+{
+  "schemaVersion": 1,
+  "kind": "application",
+  "identity": {
+    "slug": "stitchkit-starter",
+    "name": "Stitchkit Starter",
+    "version": "0.1.0",
+    "description": {
+      "en": "Stitchkit Starter is a production application built with Stitchkit.",
+      "ru": "Stitchkit Starter — production-приложение на Stitchkit."
+    }
+  },
+  "roles": [
+    {
+      "name": "api",
+      "workingDirectory": "packages/backend",
+      "commands": {
+        "development": {
+          "executable": "bun",
+          "args": [
+            "--watch",
+            "src/index.ts"
+          ]
+        },
+        "production": {
+          "executable": "bun",
+          "args": [
+            "dist/index.js"
+          ]
+        }
+      },
+      "listener": {
+        "portVariable": "API_PORT",
+        "bindVariable": "BIND_HOST",
+        "readinessPath": "/health"
+      },
+      "drainFloorMs": 15000
+    },
+    {
+      "name": "web",
+      "workingDirectory": "packages/frontend",
+      "commands": {
+        "development": {
+          "executable": "bun",
+          "args": [
+            "scripts/serve.ts",
+            "development"
+          ]
+        },
+        "production": {
+          "executable": "bun",
+          "args": [
+            "scripts/serve.ts",
+            "production"
+          ]
+        }
+      },
+      "listener": {
+        "portVariable": "WEB_PORT",
+        "bindVariable": "BIND_HOST",
+        "readinessPath": "/"
+      },
+      "drainFloorMs": 5000
+    }
+  ],
+  "build": {
+    "command": {
+      "executable": "bun",
+      "args": [
+        "run",
+        "build"
+      ]
+    },
+    "artifacts": [
+      "packages/backend/dist",
+      "packages/frontend/.next",
+      "packages/db/src/generated"
+    ]
+  },
+  "requires": [
+    {
+      "name": "postgres",
+      "phases": [
+        "release",
+        "start"
+      ]
+    }
+  ],
+  "release": {
+    "migrations": {
+      "engine": "prisma",
+      "root": "packages/db/migrations",
+      "lockfile": "packages/db/migrations/migration_lock.toml"
+    }
+  },
+  "env": {
+    "variables": [
+      {
+        "name": "API_PORT",
+        "shape": "integer",
+        "required": true
+      },
+      {
+        "name": "BIND_HOST",
+        "shape": "string",
+        "required": false
+      },
+      {
+        "name": "CORS_ORIGIN",
+        "shape": "url",
+        "required": false
+      },
+      {
+        "name": "DATABASE_URL",
+        "shape": "url",
+        "required": true
+      },
+      {
+        "name": "GITHUB_API_URL",
+        "shape": "url",
+        "required": false
+      },
+      {
+        "name": "GITHUB_CACHE_TTL_SECONDS",
+        "shape": "integer",
+        "required": false
+      },
+      {
+        "name": "GITHUB_REPOSITORY",
+        "shape": "string",
+        "required": true
+      },
+      {
+        "name": "GITHUB_TOKEN",
+        "shape": "string",
+        "required": false
+      },
+      {
+        "name": "INTERNAL_API_URL",
+        "shape": "url",
+        "required": true
+      },
+      {
+        "name": "LOG_FORMAT",
+        "shape": "enum",
+        "required": false,
+        "members": [
+          "pretty",
+          "json"
+        ]
+      },
+      {
+        "name": "NODE_ENV",
+        "shape": "enum",
+        "required": false,
+        "members": [
+          "development",
+          "test",
+          "production"
+        ]
+      },
+      {
+        "name": "PUBLIC_API_ORIGIN",
+        "shape": "url",
+        "required": false
+      },
+      {
+        "name": "PUBLIC_REALTIME_ORIGIN",
+        "shape": "url",
+        "required": false
+      },
+      {
+        "name": "PUBLIC_WEB_HOSTS",
+        "shape": "string",
+        "required": false
+      },
+      {
+        "name": "PUBLIC_WEB_ORIGIN",
+        "shape": "url",
+        "required": false
+      },
+      {
+        "name": "WEB_PORT",
+        "shape": "integer",
+        "required": true
+      }
+    ]
+  }
+}

package/examples/repository/scripts/runtime-smoke.ts

@@ -3,10 +3,10 @@ import { createRealtimeClient, defineRealtimeContract } from 'stitchkit';
 import { z } from 'zod';
 import { defineSurfaceProbe, runSurfaceConformance } from './surface-conformance';
 import { loadToolingEnv } from './tooling-env';
-import { assertPublicWebSurface } from './web-surface-smoke';
+import { assertArtifactIsPlacementFree, assertPublicWebSurface } from './web-surface-smoke';
 
 const toolingEnv = loadToolingEnv();
-const apiOrigin = toolingEnv.NEXT_PUBLIC_API_URL;
+const apiOrigin = toolingEnv.SMOKE_API_ORIGIN;
 
 async function json(path: string, init?: RequestInit): Promise<unknown> {
   const response = await fetch(`${apiOrigin}${path}`, init);
@@ -155,7 +155,7 @@ await runSurfaceConformance({
   });
   if (
     corsResponse.headers.get('access-control-allow-origin') !==
-    new URL(toolingEnv.NEXT_PUBLIC_WEB_URL).origin
+    new URL(toolingEnv.SMOKE_WEB_ORIGIN).origin
   ) {
     throw new Error('API CORS origin differs from the configured web origin');
   }
@@ -167,6 +167,26 @@ await runSurfaceConformance({
   }
 }
 
-await assertPublicWebSurface(toolingEnv.NEXT_PUBLIC_WEB_URL);
+{
+  // THE DEFAULT PATH, end to end: the browser's own origin answers `/api/…`
+  // because the web role forwards it. This is what makes the example's client a
+  // module constant, so it is checked rather than described.
+  const proxied = await fetch(`${toolingEnv.SMOKE_WEB_ORIGIN}/api/repository`);
+  if (!proxied.ok) {
+    throw new Error(
+      `The web role did not forward /api/repository (${proxied.status}) — the same-origin default is broken`,
+    );
+  }
+  const sameOrigin = RepositorySnapshotSchema.parse(await proxied.json());
+  const direct = RepositorySnapshotSchema.parse(await json('/api/repository/'));
+  if (sameOrigin.fullName !== direct.fullName) {
+    throw new Error("the forwarded answer differs from the API role's own");
+  }
+}
+
+await assertPublicWebSurface(toolingEnv.SMOKE_WEB_ORIGIN);
+await assertArtifactIsPlacementFree(toolingEnv.SMOKE_WEB_ORIGIN);
 
-console.log('Runtime HTTP, OpenAPI, Socket.IO, MCP and public web smoke passed');
+console.log(
+  'Runtime HTTP (same-origin and direct), OpenAPI, Socket.IO, MCP and public web smoke passed',
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-stitchkit",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Create a production-shaped Stitchkit application",
   "license": "MIT",
   "author": "Max Listov <maxlistov@gmail.com>",
@@ -27,13 +27,21 @@
     "!template/**/src/generated/**",
     "!template/**/*.log",
     "!template/**/*.tsbuildinfo",
+    "!template/**/coverage/**",
+    "!examples/**/.env",
     "!examples/**/node_modules/**",
     "!examples/**/.next/**",
     "!examples/**/dist/**",
+    "!examples/**/coverage/**",
+    "!examples/**/playwright-report/**",
+    "!examples/**/test-results/**",
+    "!examples/**/next-env.d.ts",
+    "!examples/**/src/generated/**",
     "!examples/**/*.log",
     "!examples/**/*.tsbuildinfo",
     "README.md",
     "CHANGELOG.md",
+    "UPGRADING.md",
     "LICENSE"
   ],
   "publishConfig": {

package/template/AGENTS.md

@@ -12,8 +12,18 @@ framework source repository.
   owns application policy. Routes remain thin transport boundaries.
 - `packages/frontend` owns Next.js pages, typed clients, query/mutation hooks and
   cache reactions.
-- `packages/config/src/server.ts` is the only server environment boundary.
-  `app.config.json` is the only application identity boundary.
+- `packages/config/src/variables.ts` is the only declaration of an environment
+  variable. `server.ts` and `frontend/src/env.ts` are projections of it, and
+  the declaration's `env.variables` is derived from it — never restated.
+- `project.json` is the only place this project describes itself. It is written
+  by machine — the scaffolder stamps the identity, `bun run gen:declaration`
+  derives `env.variables` — so the formatter leaves it alone and
+  `scripts/declaration.test.ts` is what checks it.
+- Three files are generated from it and must not be hand-edited:
+  `ecosystem.config.cjs`, `ecosystem.dev.config.cjs` and the `env.variables`
+  block of `project.json`. Run `bun run gen:declaration` after changing a role. It holds
+  nothing that differs between two deployments; those are named there by
+  variable and supplied by the place.
 
 Dependencies point inward: frontend/backend → shared; backend → db/config.
 Shared never imports an application runtime package.
@@ -29,6 +39,9 @@ Shared never imports an application runtime package.
   endpoint URLs, query keys or error envelopes by hand.
 - Use Socket.IO through the shared realtime contract and Stitchkit wrappers.
   Authentication, authorization and room membership remain application policy.
+- Drive Prisma only through the root `bun run db:*` scripts; the `prisma` CLI
+  invoked directly has no datasource URL. Keep `BIND_HOST` at its loopback
+  default unless network exposure is an explicit requirement.
 - Extend runtime smoke with an explicit typed probe for operations whose handler
   behavior matters. Generic OpenAPI/MCP discovery checks are already derived.
 

package/template/README.md

@@ -2,9 +2,21 @@
 
 Production-shaped application generated by `create-stitchkit`.
 
-Application identity lives in [`app.config.json`](app.config.json). Change the
-slug, display name, version and localized description there; package names,
-process names, MCP/OpenAPI identity, UI copy and SEO derive from it.
+This project describes itself in [`project.json`](project.json) — its
+**declaration**: identity, the roles it runs, what it builds, what it needs
+before it starts, and the environment variables a deployment must supply.
+
+The declaration is true **with no machine in existence**. A field you cannot
+fill in without knowing where the code will run is a *binding*, not a
+declaration: ports, hosts, addresses, machine paths and supervision policy are
+named there by variable and never by value, and the schema has nowhere to put
+them. Change the slug, display name, version or description there and package
+names, process names, MCP/OpenAPI identity, UI copy and SEO follow.
+
+Three files are **generated** from it — `ecosystem.config.cjs`,
+`ecosystem.dev.config.cjs` and the `env.variables` block of the declaration
+itself. Run `bun run gen:declaration` after changing a role; the test suite
+refuses a stale copy.
 
 ## Start
 
@@ -35,6 +47,27 @@ Configure it with `GITHUB_REPOSITORY`; `GITHUB_TOKEN` is optional.
 Repository visibility then demonstrates the canonical Prisma enum → shared Zod schema
 → HTTP/UI path without duplicating its allowed values.
 
+**How the browser reaches the API, and what each shape costs.** By default it
+does not reach it at all: the browser calls its own origin (`/api/…`), the web
+role forwards to the API role (`packages/frontend/src/app/api/[...path]/route.ts`),
+and the client is a plain module constant — no address to wait for, no lazy
+accessor, nothing to order relative to `<Providers>`. A single-origin deployment
+supplies only `INTERNAL_API_URL`.
+
+Two things can pull a deployment out of that, and they are separate questions,
+so they have separate variables. **`PUBLIC_REALTIME_ORIGIN`** is the socket: a
+WebSocket upgrade does not survive the route handler that forwards `/api`, so
+two roles on two ports with nothing in front of them must name the socket's
+origin even though their HTTP is already same-origin. Behind one routing layer
+that forwards `/socket.io`, leave it unset. **`PUBLIC_API_ORIGIN`** is HTTP, for
+a frontend that genuinely dials the API role itself — and setting it changes
+nothing on its own: switching is one import in
+`packages/frontend/src/lib/api/queries.ts`, documented in
+`packages/frontend/src/lib/api/cross-origin.ts`. That variant costs a
+server-delivered address, a client built on first use (hence the parentheses),
+an ordering requirement relative to `<Providers>`, and `CORS_ORIGIN` on the API
+role.
+
 The `/en/ui` catalogue is isolated under
 `packages/frontend/src/app/[locale]/ui` and can be removed as one directory;
 reusable primitives remain in `components/ui`. It renders the complete
@@ -63,16 +96,28 @@ bun run e2e
 Provide a production `.env`, then:
 
 ```bash
-bun run db:deploy
 bun run build
 bun run pm2:prod
 ```
 
-The Next.js frontend and Stitchkit API are separate processes and can also be
-deployed independently.
+`pm2:prod` is the release: it checks every artifact `build.artifacts` declares,
+applies the migrations `release.migrations` declares, and only then starts the
+roles from the generated supervision file. There is no separate `db:deploy`
+step to remember — the declaration already says the migrations exist, and one
+place saying it is the point.
+
+The roles are separate processes and can also be deployed independently.
 
 PostgreSQL is external infrastructure in development and production. The
 application owns its schema and migrations; the environment owns the database
 process and supplies its connection through `DATABASE_URL`.
 
+Both processes bind `BIND_HOST` (default `127.0.0.1`, loopback only). Set
+`BIND_HOST=0.0.0.0` in `.env` to expose the app on every network interface —
+that is a conscious opt-in, typically behind a reverse proxy or firewall.
+
+Always drive Prisma through the root `bun run db:*` scripts — invoking the
+`prisma` CLI directly fails because the datasource URL is wired through the
+`@app/db` package environment, not a static config.
+
 `bun run dev` and `bun run pm2:dev` use the same direct PM2 development path.

package/template/_env.example

@@ -1,9 +1,15 @@
 NODE_ENV=development
 DATABASE_URL=postgresql://USER:PASSWORD@127.0.0.1:5432/stitchkit_starter
+# 0.0.0.0 exposes the app to every network interface — opt in consciously.
+BIND_HOST=127.0.0.1
 API_PORT=3211
 WEB_PORT=3210
-NEXT_PUBLIC_API_URL=http://127.0.0.1:3211
-INTERNAL_API_URL=http://127.0.0.1:3211
-NEXT_PUBLIC_WEB_URL=http://127.0.0.1:3210
+SMOKE_API_ORIGIN=http://127.0.0.1:3211
+SMOKE_WEB_ORIGIN=http://127.0.0.1:3210
+# Hosts this deployment answers for, comma-separated. One built artifact can
+# serve several addresses; a forwarded host outside this list is refused rather
+# than believed. Leave unset and set PUBLIC_WEB_ORIGIN instead for a single one.
+PUBLIC_WEB_HOSTS=127.0.0.1:3210
 LOG_FORMAT=pretty
-CORS_ORIGIN=http://127.0.0.1:3210
+# CORS_ORIGIN is only needed for a genuinely cross-origin browser.
+# CORS_ORIGIN=http://127.0.0.1:3210

package/template/biome.json

@@ -9,7 +9,11 @@
       "!!playwright-report",
       "!!test-results",
       "!!packages/frontend/next-env.d.ts",
-      "!!packages/frontend/public"
+      "!!packages/frontend/public",
+      "!!project.json",
+      "!!ecosystem.config.cjs",
+      "!!ecosystem.dev.config.cjs",
+      "!!packages/config/src/app-identity.generated.ts"
     ]
   },
   "formatter": {

package/template/bun.lock

@@ -138,7 +138,7 @@
     },
   },
   "catalog": {
-    "stitchkit": "^0.50.0",
+    "stitchkit": "^0.60.0",
   },
   "packages": {
     "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.46", "", { "dependencies": { "@ai-sdk/provider": "4.0.7", "@ai-sdk/provider-utils": "5.0.25", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-LIAO6kAG8fpXQb9L0iwPk1FIbXftvqnyC56v5NEAzeWTeL8fUsy/Hx86VPBTWEDFdwbVprjWifJOAqS6AOj3mA=="],
@@ -1117,7 +1117,7 @@
 
     "std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
 
-    "stitchkit": ["stitchkit@0.50.0", "", { "dependencies": { "ky": "^2.0.2" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2", "@modelcontextprotocol/server": "^2.0.0", "@socket.io/bun-engine": "^0.1.1", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.3.14", "ai": "^7.0.0", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5", "zod": "^4.4.3" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"] }, "sha512-lMadqgQ9aryAhULyA0biVjx9bn86HOUhcUj809TyHy2MuUZSnL9qI4fiByQbVAqlxW6i1a1RLAeguEJeu6jwWg=="],
+    "stitchkit": ["stitchkit@0.60.0", "", { "dependencies": { "ky": "^2.0.2" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.0.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.1", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.3.14", "ai": "^7.0.0", "grammy": "^1.45.1", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5", "zod": "^4.4.3" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "grammy", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"] }, "sha512-bP4HUHYG4/0WfF1oFGsRddvu+jHpCNyvL/lPNhWHofb6QrcL0KY1nna72lqg9g59xZKhNMLd8mzRCJkLKvghFg=="],
 
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 

package/template/e2e/starter.spec.ts

@@ -1,4 +1,4 @@
-import { appIdentity } from '@app/config/identity';
+import { appDeclaration } from '@app/config/declaration';
 import { systemContract } from '@app/shared';
 import AxeBuilder from '@axe-core/playwright';
 import { expect, test } from '@playwright/test';
@@ -21,7 +21,7 @@ test('calls the live backend through the typed contract client', async () => {
   const client = createClient(
     systemContract,
     createHttpClient({
-      baseUrl: `${toolingEnv.NEXT_PUBLIC_API_URL}/api`,
+      baseUrl: `${toolingEnv.SMOKE_API_ORIGIN}/api`,
       credentials: 'omit',
     }),
   );
@@ -31,7 +31,7 @@ test('calls the live backend through the typed contract client', async () => {
 
 test('publishes complete page metadata', async ({ page }) => {
   await page.goto('/en/ui/themes');
-  await expect(page).toHaveTitle(`Theme system · ${appIdentity.name}`);
+  await expect(page).toHaveTitle(`Theme system · ${appDeclaration.identity.name}`);
   await expect(page.locator('link[rel="canonical"]')).toHaveAttribute(
     'href',
     /\/en\/ui\/themes$/,
@@ -42,9 +42,7 @@ test('publishes complete page metadata', async ({ page }) => {
   );
 
   const imageUrl = await page.locator('meta[property="og:image"]').getAttribute('content');
-  expect(imageUrl).toBe(
-    new URL('/api/og/en/themes', toolingEnv.NEXT_PUBLIC_WEB_URL).toString(),
-  );
+  expect(imageUrl).toBe(new URL('/api/og/en/themes', toolingEnv.SMOKE_WEB_ORIGIN).toString());
 });
 
 test('switches catalogue sections and component tabs', async ({ page }) => {
@@ -217,7 +215,7 @@ test('provides a server-first synchronized theme system', async ({
   await page.getByRole('button', { name: 'System', exact: true }).click();
   await expect(page.getByTestId('theme-state-selected')).toContainText('system');
   const themeCookie = (await context.cookies()).find(
-    (cookie) => cookie.name === `${appIdentity.slug}-theme`,
+    (cookie) => cookie.name === `${appDeclaration.identity.slug}-theme`,
   );
   expect(themeCookie?.value).toBe('system');
   await page.reload();