Package map — every app and package in Ortha

Two apps, two test suites, and a lockstep package set: one version number across all of them.

	Count at 0.13.1
Published packages	71 — 70 under `@orthacms`, plus the unscoped `create-orthacms-app`
Private, never published	2 — `nx` (repository tooling), `copilot-provider-fake` (e2e model fixture)

The set has not changed since 0.8.0, which added three: the schema builder’s domain, server and admin packages. create-orthacms-app is unscoped so both npx create-orthacms-app and npm create orthacms-app work.

# Every @orthacms package in an app shares one version
npm install @orthacms/media-provider-s3@0.13.1

Apps

Project	What it is
`admin`	React 19 + Vite SPA. Composes admin plugins via `createAdmin`.
`server`	NestJS API. Composes server plugins via `createServer`. Owns your content types.
`admin-e2e`	Playwright page-object suite for the admin, with `/api` mocked.
`server-e2e`	In-process testcontainer and supertest suite for the API.

Hosts and infrastructure

Package	Role
`bootstrap-admin`	Host. `createAdmin({ plugins })` — React root, router, providers.
`bootstrap-server`	Host. `createServer({ plugins })` — Nest app, `/api` prefix, validation, API reference.
`database`	Plugin. One Drizzle connection, the unit of work, and the transactional outbox. Owns one table, `outbox_events`.
`utils-server`, `utils-admin`	Shared plumbing. The admin’s `apiClient`, query client, slots and error handling.
`design-system`	shadcn/ui component library and Tailwind tokens.
`nx`	Nx plugin. Infers the `db:generate`, `db:migrate` and `db:studio` targets, and the release targets.
`cli`	The `orthacms` binary — build, run and migrate an installed app, and regenerate its content manifest.
`create-orthacms-app`	The scaffolder. Unscoped, so `npx create-orthacms-app` works.

cli and nx are two adapters over one implementation — cli for installed apps, nx for the monorepo. See the CLI reference.

Content

Package	Role
`content-domain`	The framework-free kernel: validation, the publish gate, rich-text rules.
`content-server`	Plugin. The registry, the DSL, entries, revisions, the public API.
`content-admin`	Plugin. The content library, the records table, the entry editor.
`content-graphql`	Plugin. GraphQL as a protocol adapter over the public API.
`alarms-server`	Plugin. Content rules and findings. Two tables; never blocks a write.
`alarms-admin`	Plugin. The Alarms page, the entry’s Checks block and header status item, an optional Checks column, “Save as alarm”, a Home card.
`segments-domain`	The framework-free entitlement kernel: the `canRead` rules.
`segments-server`	Plugin. Audiences, per-entry access, and the public read predicate.
`segments-admin`	Plugin. The audience directory, each audience’s page with where it is used and a reader tester, and the entry’s access controls.
`protection-domain`	The framework-free kernel: `evaluateProtection`, which counts approvals against a rule.
`protection-server`	Plugin. Three tables, the publish guard, `/api/protection`.
`protection-admin`	Plugin. The entry’s Review block and publish verdict, the Publishing section of workspace settings, the Reviews page and its review panel, a records column and filter, a Needs attention line in Insights, a Home card.

Schema builder

Package	Role
`schema-builder-domain`	The framework-free kernel: the schema document, the diff, the change verdicts, the code generator, and the manifest renderer `orthacms content sync` uses too.
`schema-builder-server`	Plugin. Reads the registry; in development, plans and applies a change as type files and a drizzle-kit migration. Owns no tables.
`schema-builder-admin`	Plugin. The Content Model page at `/content-model`: the type list, the fields-first type page, the kind picker and field panel, type templates, the one-page review, the grant card.

See the schema builder.

Webhooks

Package	Role
`webhooks-domain`	The framework-free kernel: the event catalogue, the envelope, the signature, the retry ladder, the URL policy.
`webhooks-server`	Plugin. Three tables, the outbox fan-out subscriber, the delivery worker, `/api/webhooks`.
`webhooks-admin`	Plugin. The global `/webhooks` pages in the directory group: endpoints, the delivery log, redeliver, rotate, test, a Home card for a stopped endpoint.

A receiver can import webhooks-domain to verify a signature with the code that produced it. See webhooks.

Mail

Package	Role
`mail-domain`	The framework-free kernel: the provider port, the rendered message, the four templates, the retry schedule. Ships with every app.
`mail-server`	Plugin. One table, the queue, the delivery worker. Installed with `--mail mail-smtp`.
`mail-provider-smtp`	The backend a deployment runs, over any SMTP relay. Installed with `--mail mail-smtp`.
`mail-provider-console`	Writes messages to the log. Ships with every app, offered by no picker.
`mail-provider-testkit`	Captures messages, and can be told to fail. Same install rule.

No mail-admin: the flows mail changes live in users-admin. See mail.

Identity, users and workspaces

Package	Role
`identity-domain`	The framework-free SSO seam: the provider port, the profile, the conformance kit.
`identity-server`	Plugin. Auth, sessions, RBAC, API tokens, preferences, SSO, and password recovery when mail is configured.
`identity-admin`	Plugin. The public pages — sign in, forgot password, reset password, accept invite — and auth state.
`identity-provider-oidc`	Generic OpenID Connect, plus presets for five named vendors.
`identity-provider-github`	GitHub and GitHub Enterprise. OAuth2, so not a preset.
`identity-provider-saml`	SAML 2.0 — a POST binding and XML signatures.
`identity-provider-fake`	Scripted and offline. Published and installed everywhere, registered nowhere.
`users-server`	Plugin. Member management — list, invite (one or several at once), edit, disable, sessions, and `/api/users/:id/reveal-link`.
`users-admin`	Plugin. The members roster and its quick filters, the invite page, the member page, preferences, Home’s Invite member button.
`workspaces-server`	Plugin. Workspaces, memberships, content grants — own and, since 0.7.0, shared grants from shared workspaces.
`workspaces-admin`	Plugin. The workspace cards, the three-step create and its ready page, the archive confirmation, workspace settings and workspace shell.
`api-tokens-admin`	Plugin. The API Tokens page.
`activity-server`	Plugin. The audit schema, the read API and its CSV export.
`activity-admin`	Plugin. Activity logs with search, an event panel and Export CSV, an entry’s activity in its History timeline, and Home’s recent-activity panel and dead-letter card.

Media, localization and editing

Package	Role
`media-domain`	The storage port every adapter speaks, and the one error `get` rejects with. No dependencies at all.
`media-server`	Plugin. Assets, folders, derivatives, the public media API.
`media-admin`	Plugin. The media library, and the media field’s control in the entry form.
`media-provider-local`	Local filesystem storage adapter. The default install.
`media-provider-s3`	S3-compatible: AWS, R2, MinIO, Spaces, B2, Wasabi.
`media-provider-azure`	Azure Blob Storage — the one store with no S3 compatibility.
`media-provider-gcs`	Google Cloud Storage, with native Google auth.
`media-provider-vercel-blob`	Vercel Blob. Every blob is world-readable.
`media-provider-memory`	In-memory. For tests and offline development, never a deployment.
`media-provider-testkit`	The contract suite a storage provider is written against.
`transfer-domain`	The transfer kernel: the document contract, the four formats, identity.
`transfer-server`	Plugin. One-hop export, two-phase import. Owns no tables; imports `media-server` directly for asset rows and storage.
`transfer-admin`	Plugin. Export and import in the Content Library’s menus.
`i18n-server`	Plugin. Locale policy, bound to content’s entry-extension port, plus the translation coverage aggregate. Owns no tables.
`i18n-admin`	Plugin. The records list’s locale switcher, the Locales column, the editor’s locale switcher and menu, the translation-group Details row, coverage card. No routes.
`wysiwyg-admin`	Plugin. The rich-text control. Fills the editor’s field-control slot and defines `WYSIWYG_MEDIA_SLOT` for media sources. No routes.
`query-builder-admin`	The filter and query-builder UI.
`shell-admin`	Plugin. The authenticated chrome — sidebar, layout, right panel, home.
`insights-admin`	Plugin. The Insights dashboard frame: the section tabs, the Needs attention card and its drill-down panel. Ships no widgets and no lines.

AI and agents

Package	Role
`copilot-domain`	The framework-free core: the model port, tool contracts, the untrusted-content fence.
`copilot-server`	Plugin. The run engine, the SSE route, the write path, skills. Off unless enabled.
`copilot-admin`	Plugin. The chat windows, opened from the Ask Ortha AI launcher (or `⌘J`), and the full-page Agents view, whose chats take over the workspace sidebar.
`copilot-provider-anthropic`	Native Claude adapter; a generated app registers it as `claude`. The only one that imports a vendor SDK.
`copilot-provider-openai`	Any OpenAI-compatible endpoint; a generated app registers it as `openai` — Ollama, vLLM, llama.cpp, LM Studio, LiteLLM, OpenRouter, Azure, OpenAI.
`copilot-provider-fake`	Scripted and deterministic. Private and unpublished — the e2e fixture.
`tools-server`	The shared, transport-neutral agent tool registry.
`mcp-server`	Plugin. The Model Context Protocol endpoint, `POST /api/v1/mcp`. Owns no tools; off unless `MCP_ENABLED=true`.

How they resolve

Inside the monorepo, packages are consumed from source: exports point at ./src/index.ts, resolved by a custom TypeScript condition — no build step. Publishing runs a pack step that rewrites each manifest for consumers outside the workspace.

npx nx sync    # after changing cross-project dependencies
npx nx graph   # see the dependency graph