create-zerotal 1.3.0 → 1.5.0

package/CHANGELOG.md

@@ -8,6 +8,26 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.5.0] — 2026-08-15
+
+### Changed
+
+- **Scaffolded apps no longer default CORS to `"*"`.** Every template shipped
+  `cors: { origin: env("CORS_ORIGIN", "*") }`, so a new app opted out of the
+  framework's own safe default — an empty list, meaning same-origin — without ever
+  being asked. `"*"` lets any website read the app's responses out of a visitor's
+  browser, and it survived to production in anything that never set `CORS_ORIGIN`.
+  The default is now same-origin; name your origins when you need them.
+- **Templates declare `secureHeaders.secure`**, the setting that gates HSTS, so
+  turning it on for a deployment is a visible one-line change rather than a
+  discovery. `zt doctor` fails on a production-like deployment that leaves it off.
+
+- **The `api` template registers `StorageProvider`.** Its absence is invisible until the
+  first upload: a `Storage.disk(...)` call usually sits behind auth, a permission check
+  and a multipart parse, so every simpler probe returns 401/403 long before reaching the
+  line that would fail — and that line is often first reached in production. It costs
+  nothing when unused. The `flow`, `react`, `vue` and `admin` templates already had it.
+
 ## [1.3.0] — 2026-08-09
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-zerotal",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Create a new Zerotal application",
   "license": "MIT",
   "maturity": "stable",

package/src/scaffold.ts

@@ -13,7 +13,7 @@ export type Template = 'minimal' | 'api' | 'admin' | 'flow' | 'react' | 'vue';
 // "^1.1.0" found for specifier "zerotal"` — the first thing anyone trying the
 // framework saw. `scaffold.test.ts` now asserts the two agree, so CI fails rather
 // than the user's install.
-export const ZT_VERSION = '^1.3.0';
+export const ZT_VERSION = '^1.5.0';
 
 export interface ScaffoldOptions {
   name:     string;

package/templates/admin/config/app.ts

@@ -10,11 +10,18 @@ export default AppConfig({
    */
   key: requireEnv("APP_KEY"),
 
+  // Same-origin unless CORS_ORIGIN names somewhere else. `"*"` would let any
+  // website read this app's responses out of a visitor's browser.
   cors: {
-    origin: env("CORS_ORIGIN", "*"),
+    origin: env("CORS_ORIGIN", ""),
     credentials: false,
   },
 
+  // HSTS, once you are serving over HTTPS.
+  secureHeaders: {
+    secure: env("APP_SECURE", false),
+  },
+
   throttle: {
     maxAttempts: 120,
     windowSeconds: 60,

package/templates/admin/tsconfig.json

@@ -18,6 +18,7 @@
       ]
     }
   },
+  "include": ["**/*"],
   "exclude": [
     "node_modules",
     ".zerotal"

package/templates/api/bootstrap/app.ts

@@ -5,6 +5,7 @@ import { AuthProvider } from 'zerotal/auth';
 import { NotificationProvider } from '@zerotal/notifications';
 import { QueueProvider } from 'zerotal/queue';
 import { LogProvider } from 'zerotal/logger';
+import { StorageProvider } from 'zerotal/storage';
 import { DevtoolsProvider } from '@zerotal/devtools';
 
 // `DevtoolsProvider` needs no configuration. It activates only when APP_ENV is
@@ -27,6 +28,12 @@ export default Application.create({
     NotificationProvider,
     QueueProvider,
     LogProvider,
+    // Registered up front because its absence is invisible until the first
+    // upload. A `Storage.disk(...)` call usually sits behind auth, a permission
+    // check and a multipart parse, so every simpler probe returns 401/403 long
+    // before reaching the line that would fail — and the line that would fail
+    // is usually first reached in production. It costs nothing when unused.
+    StorageProvider,
     DevtoolsProvider,
   ],
 })

package/templates/api/tsconfig.json

@@ -11,6 +11,7 @@
     "noEmit": true,
     "allowImportingTsExtensions": true
   },
+  "include": ["**/*"],
   "exclude": [
     "node_modules",
     ".zerotal"

package/templates/flow/config/app.ts

@@ -10,11 +10,18 @@ export default AppConfig({
    */
   key: requireEnv("APP_KEY"),
 
+  // Same-origin unless CORS_ORIGIN names somewhere else. `"*"` would let any
+  // website read this app's responses out of a visitor's browser.
   cors: {
-    origin: env("CORS_ORIGIN", "*"),
+    origin: env("CORS_ORIGIN", ""),
     credentials: false,
   },
 
+  // HSTS, once you are serving over HTTPS.
+  secureHeaders: {
+    secure: env("APP_SECURE", false),
+  },
+
   throttle: {
     maxAttempts: 120,
     windowSeconds: 60,

package/templates/flow/tsconfig.json

@@ -18,6 +18,7 @@
     "noEmit": true,
     "allowImportingTsExtensions": true
   },
+  "include": ["**/*"],
   "exclude": [
     "node_modules",
     ".zerotal"

package/templates/minimal/config/app.ts

@@ -10,11 +10,18 @@ export default AppConfig({
    */
   key: requireEnv("APP_KEY"),
 
+  // Same-origin unless CORS_ORIGIN names somewhere else. `"*"` would let any
+  // website read this app's responses out of a visitor's browser.
   cors: {
-    origin: env("CORS_ORIGIN", "*"),
+    origin: env("CORS_ORIGIN", ""),
     credentials: false,
   },
 
+  // HSTS, once you are serving over HTTPS.
+  secureHeaders: {
+    secure: env("APP_SECURE", false),
+  },
+
   throttle: {
     maxAttempts: 120,
     windowSeconds: 60,

package/templates/minimal/tsconfig.json

@@ -21,6 +21,7 @@
     "noEmit": true,
     "allowImportingTsExtensions": true
   },
+  "include": ["**/*"],
   "exclude": [
     "node_modules",
     ".zerotal"

package/templates/react/config/app.ts

@@ -10,11 +10,18 @@ export default AppConfig({
    */
   key: requireEnv("APP_KEY"),
 
+  // Same-origin unless CORS_ORIGIN names somewhere else. `"*"` would let any
+  // website read this app's responses out of a visitor's browser.
   cors: {
-    origin: env("CORS_ORIGIN", "*"),
+    origin: env("CORS_ORIGIN", ""),
     credentials: false,
   },
 
+  // HSTS, once you are serving over HTTPS.
+  secureHeaders: {
+    secure: env("APP_SECURE", false),
+  },
+
   throttle: {
     maxAttempts: 120,
     windowSeconds: 60,

package/templates/react/resources/js/app.tsx

@@ -11,7 +11,10 @@ createInertiaApp({
   // Map a component name (e.g. "Users/Index") to its lazily-loaded module.
   // `pages` is generated from the configured pages dir by `inertia:build`.
   resolve: async (name): Promise<ResolvedComponent> => {
-    const page = pages[name];
+    // `pages` is keyed by literal page name (written with `satisfies`, so the
+    // server can check `Inertia.render("Users/Index", …)` against it). The name
+    // Inertia hands us is a runtime string, so this one lookup widens it.
+    const page = (pages as Record<string, () => Promise<{ default: unknown }>>)[name];
     if (!page) throw new Error(`Inertia page not found: "${name}"`);
     return (await page()).default as ResolvedComponent;
   },

package/templates/react/resources/js/pages.generated.ts

@@ -5,7 +5,7 @@
 // Bun.build with splitting:true creates one .js chunk per page.
 // Converting to static imports will bundle ALL pages into app.js.
 
-export const pages: Record<string, () => Promise<{ default: unknown }>> = {
+export const pages = {
   about: () => import("./pages/about.tsx"),
   contact: () => import("./pages/contact.tsx"),
   error: () => import("./pages/error.tsx"),
@@ -15,4 +15,13 @@ export const pages: Record<string, () => Promise<{ default: unknown }>> = {
   profile: () => import("./pages/profile.tsx"),
   register: () => import("./pages/register.tsx"),
   "reset-password": () => import("./pages/reset-password.tsx"),
-};
+} satisfies Record<string, () => Promise<{ default: unknown }>>;
+
+// Type-only: lets a controller's `Inertia.render(name, props)` be checked
+// against the props each page component declares. Erased at runtime — and
+// it is the ONLY place the server side touches the client component graph.
+declare module "@zerotal/inertia" {
+  interface InertiaPageRegistry {
+    pages: typeof pages;
+  }
+}

package/templates/react/resources/js/types.ts

@@ -15,3 +15,18 @@ export interface SharedProps {
   old: Record<string, unknown>;
   [key: string]: unknown;
 }
+
+/**
+ * The same list, told to the server side. `Inertia.render(page, props)` checks a
+ * controller's props against the page component's own props — so without this,
+ * a page that reads `auth` through `usePage()` would look to the server like a
+ * page whose controller forgot to pass it.
+ *
+ * `share()` is a runtime call in a provider, so nothing can generate this: when
+ * you register a new shared prop, add it in both places.
+ */
+declare module "@zerotal/inertia" {
+  interface SharedProps {
+    auth: { user: { id: number; name: string; email: string } | null };
+  }
+}

package/templates/react/tsconfig.json

@@ -21,6 +21,7 @@
       ]
     }
   },
+  "include": ["**/*"],
   "exclude": [
     "node_modules",
     ".zerotal"

package/templates/vue/config/app.ts

@@ -10,11 +10,18 @@ export default AppConfig({
    */
   key: requireEnv("APP_KEY"),
 
+  // Same-origin unless CORS_ORIGIN names somewhere else. `"*"` would let any
+  // website read this app's responses out of a visitor's browser.
   cors: {
-    origin: env("CORS_ORIGIN", "*"),
+    origin: env("CORS_ORIGIN", ""),
     credentials: false,
   },
 
+  // HSTS, once you are serving over HTTPS.
+  secureHeaders: {
+    secure: env("APP_SECURE", false),
+  },
+
   throttle: {
     maxAttempts: 120,
     windowSeconds: 60,

package/templates/vue/resources/js/app.tsx

@@ -7,7 +7,10 @@ createInertiaApp({
   // Map a component name (e.g. "Users/Index") to its lazily-loaded module.
   // `pages` is generated from the configured pages dir by `inertia:build`.
   resolve: async (name): Promise<DefineComponent> => {
-    const page = pages[name];
+    // `pages` is keyed by literal page name (written with `satisfies`, so the
+    // server can check `Inertia.render("Users/Index", …)` against it). The name
+    // Inertia hands us is a runtime string, so this one lookup widens it.
+    const page = (pages as Record<string, () => Promise<{ default: unknown }>>)[name];
     if (!page) throw new Error(`Inertia page not found: "${name}"`);
     return (await page()).default as DefineComponent;
   },

package/templates/vue/resources/js/pages.generated.ts

@@ -5,7 +5,7 @@
 // Bun.build with splitting:true creates one .js chunk per page.
 // Converting to static imports will bundle ALL pages into app.js.
 
-export const pages: Record<string, () => Promise<{ default: unknown }>> = {
+export const pages = {
   about: () => import("./pages/about.vue"),
   contact: () => import("./pages/contact.vue"),
   error: () => import("./pages/error.vue"),
@@ -15,4 +15,13 @@ export const pages: Record<string, () => Promise<{ default: unknown }>> = {
   profile: () => import("./pages/profile.vue"),
   register: () => import("./pages/register.vue"),
   "reset-password": () => import("./pages/reset-password.vue"),
-};
+} satisfies Record<string, () => Promise<{ default: unknown }>>;
+
+// Type-only: lets a controller's `Inertia.render(name, props)` be checked
+// against the props each page component declares. Erased at runtime — and
+// it is the ONLY place the server side touches the client component graph.
+declare module "@zerotal/inertia" {
+  interface InertiaPageRegistry {
+    pages: typeof pages;
+  }
+}

package/templates/vue/resources/js/types.ts

@@ -15,3 +15,18 @@ export interface SharedProps {
   old: Record<string, unknown>;
   [key: string]: unknown;
 }
+
+/**
+ * The same list, told to the server side. `Inertia.render(page, props)` checks a
+ * controller's props against the page component's own props — so without this,
+ * a page that reads `auth` through `usePage()` would look to the server like a
+ * page whose controller forgot to pass it.
+ *
+ * `share()` is a runtime call in a provider, so nothing can generate this: when
+ * you register a new shared prop, add it in both places.
+ */
+declare module "@zerotal/inertia" {
+  interface SharedProps {
+    auth: { user: { id: number; name: string; email: string } | null };
+  }
+}

package/templates/vue/tsconfig.json

@@ -21,6 +21,7 @@
       ]
     }
   },
+  "include": ["**/*"],
   "exclude": [
     "node_modules",
     ".zerotal"