@o-a/cms-agent 0.1.0

package/LICENSE

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Scott Gray
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -0,0 +1,132 @@
+# Granite CMS
+
+**Own your content, forever.**
+
+Granite CMS is a self-hosted, git-backed content management system. Every
+page is a plain JSON file. Every publish is a real git commit. There is no
+database standing between you and your own content, and there never will be.
+
+If you've ever had a headless CMS raise its prices, change its export
+format, or go down and take your site's editing with it - this is built to
+make that structurally impossible. Moving away from Granite CMS is
+`git clone`. That's the whole migration story.
+
+## Why this is different
+
+Most self-hosted, code-first CMS options give you an API and a database.
+Most git-based CMS tools give you markdown files and a static-site rebuild.
+Granite CMS is the combination neither of those is:
+
+- **Git-native content.** Pages, posts, menus, and redirects are JSON files
+  in your own git repository. No database is ever the source of truth.
+  History, diffs, and rollback are real git operations, not a bolted-on
+  revisions table.
+- **A real page builder, not just files.** Themes define reusable, schema
+  validated **sections** and **blocks** - a Shopify-style content model - so
+  a non-technical editor arranges and fills in components a developer
+  already built, instead of hand-editing markdown or JSON.
+- **A real versioned HTTP API.** `/v1/...` is the only thing a site exposes.
+  Drafts, publishing, optimistic concurrency (ETags + `If-Match`), batch
+  writes, and git history are all first-class API operations - what a
+  separate admin application (or your own tooling) talks to, never the
+  filesystem directly.
+
+## Two audiences, one engine
+
+- **Developers** build the theme: Liquid layouts, sections, and blocks,
+  each with an embedded JSON Schema for its settings. Start with
+  [`docs/theme-authoring-guide.md`](docs/theme-authoring-guide.md).
+- **Content editors / marketing managers** never touch this repository at
+  all - they work entirely through a separate admin application (see
+  [Companion projects](#companion-projects) below), browsing pages,
+  editing sections, and publishing through the API this package exposes.
+  The content model itself is documented in
+  [`docs/content-authoring-guide.md`](docs/content-authoring-guide.md).
+
+## Quick start
+
+> **Not yet published to npm.** Until it is, install from a local build -
+> see [`docs/hosting.md`](docs/hosting.md#installing-o-acms-agent-today) for
+> the exact steps. Once published, this becomes:
+>
+> ```
+> npx -p @o-a/cms-agent create-site my-site
+> ```
+
+Either way, the result is the same:
+
+```
+cd my-site/vhost
+npm install
+node server.js
+```
+
+Visit `http://localhost:3000`. `create-site` prints a real API token to
+your terminal when it scaffolds the site - that's what a separate admin
+application (or a plain `curl`) uses to authenticate against the site's
+`/v1/` API. Lost it, or need a second one? See the `mint-token` command in
+the same docs page.
+
+## Project layout
+
+A scaffolded site is a thin, four-folder scaffold - everything a content
+editor touches lives under `content/`, everything a developer touches lives
+under `theme/`, uploaded media lives under `media/` (never git-tracked),
+and the site's own serving configuration lives under `vhost/`:
+
+```
+my-site/
+  content/   pages, posts, menus, redirects, drafts
+  theme/     layouts, sections, blocks, snippets, assets, root, templates
+  media/     uploaded files - gitignored, backed up separately
+  vhost/     site.config.json, package.json, server.js
+```
+
+This repository (the agent itself) is developed separately and installed
+as a versioned dependency - see [`docs/cms-build-plan.md`](docs/cms-build-plan.md)
+for the full architecture and the reasoning behind it.
+
+## Tech stack
+
+Node.js 22+ and TypeScript, compiled to plain JavaScript for distribution.
+Fastify, LiquidJS (sandboxed - no dynamically registered tags or filters,
+ever), SQLite via `node:sqlite` for a fully disposable, rebuildable search
+index, and the real `git` binary for every content mutation. Dependencies
+are kept deliberately minimal - this ships as a package other people
+install.
+
+## Documentation
+
+- [`docs/theme-authoring-guide.md`](docs/theme-authoring-guide.md) - building a theme
+- [`docs/content-authoring-guide.md`](docs/content-authoring-guide.md) - the content model
+- [`docs/hosting.md`](docs/hosting.md) - running a site somewhere real
+- [`docs/cms-build-plan.md`](docs/cms-build-plan.md) - full architecture and design rationale
+
+A friendlier, browsable documentation site (covering both this engine and
+the admin application) is also available in source form at
+[o-a-com-au/o-a-com-au-granitecms-docs](https://github.com/o-a-com-au/o-a-com-au-granitecms-docs).
+
+## Companion projects
+
+Granite CMS the engine has no user interface of its own by design - it's an
+API. Day-to-day editing happens through a separate admin application
+(`granitecms-admin`), a control plane that can manage any number of
+independently hosted sites. The two are deliberately separate codebases
+with separate deploy cycles, connected only by the versioned `/v1/` API
+above.
+
+## Project status
+
+This is young, real software - it runs a genuine production site today,
+not just a demo, but it has one tenant so far, not thousands. Expect rough
+edges, expect things to improve in the open rather than arrive finished,
+and please open an issue if something doesn't work the way this README
+says it should.
+
+## License
+
+[Functional Source License, Version 1.1, Apache 2.0 Future Grant](LICENSE)
+(FSL-1.1-ALv2). In short: free to use, modify, and self-host for anything
+except offering it as a competing hosted service. Every version converts
+automatically to the fully permissive Apache License 2.0 two years after
+its own release - this is a head start, not a permanent restriction.

package/dist/boot.d.ts

@@ -0,0 +1,15 @@
+import type { Liquid } from 'liquidjs';
+import type { SiteConfig } from './config.ts';
+import type { ThemeTemplates } from './renderer/theme-templates.ts';
+import type { StartupCheckOptions } from './services/startup-checks.ts';
+import type { ThemeSchemas } from './services/validation.ts';
+import type { PageTemplate } from './services/theme-page-templates.ts';
+export interface BootedSite {
+    config: SiteConfig;
+    themeSchemas: ThemeSchemas;
+    themeTemplates: ThemeTemplates;
+    layouts: Record<string, string>;
+    pageTemplates: PageTemplate[];
+    engine: Liquid;
+}
+export declare function bootSite(siteRoot: string, options?: StartupCheckOptions): BootedSite;

package/dist/boot.js

@@ -0,0 +1,33 @@
+import { loadSiteConfig } from "./config.js";
+import { createEngine } from "./renderer/engine.js";
+import { loadLayouts, loadSnippets, loadThemeTemplates } from "./renderer/theme-templates.js";
+import { runStartupChecks } from "./services/startup-checks.js";
+import { loadThemeSchemas } from "./services/theme-schemas.js";
+import { loadPageTemplates } from "./services/theme-page-templates.js";
+// The composition root: startup checks, config, and theme loading, in
+// that order, taking nothing but a site root path (checklist H1: "the
+// agent boots against it... with no steps beyond config"). This is
+// what a future Phase 2 server.js will call before starting the
+// Fastify listener.
+//
+// Deliberately does NOT run migrations here: migration is a
+// git-committing operation requiring an author identity, and what the
+// real default identity should be when this runs unattended at boot
+// is a genuine open question already deferred to Phase 2 wiring (see
+// migration-runner.ts's commit message) - silently inventing one here
+// to wire it into boot would quietly resolve that same open question
+// a second time, inconsistently.
+export function bootSite(siteRoot, options) {
+    runStartupChecks(siteRoot, options);
+    const config = loadSiteConfig(siteRoot);
+    const themeSchemas = loadThemeSchemas(config.themeRoot);
+    const themeTemplates = loadThemeTemplates(config.themeRoot);
+    const layouts = loadLayouts(config.themeRoot);
+    const snippets = loadSnippets(config.themeRoot);
+    // After themeSchemas - a template's own sections/blocks are validated
+    // against the theme's real section/block schemas, same as any real
+    // page.
+    const pageTemplates = loadPageTemplates(config.templatesRoot, themeSchemas);
+    const engine = createEngine(snippets);
+    return { config, themeSchemas, themeTemplates, layouts, pageTemplates, engine };
+}

package/dist/config.d.ts

@@ -0,0 +1,19 @@
+export declare const VHOST_DIR_NAME = "vhost";
+export interface SiteConfig {
+    siteRoot: string;
+    contentRoot: string;
+    draftsRoot: string;
+    themeRoot: string;
+    assetsRoot: string;
+    rootMirrorRoot: string;
+    templatesRoot: string;
+    pagesRoot: string;
+    postsRoot: string;
+    menusRoot: string;
+    redirectsPath: string;
+    vhostRoot: string;
+    dataRoot: string;
+    searchIndexPath: string;
+    mediaRoot: string;
+}
+export declare function loadSiteConfig(siteRoot: string): SiteConfig;

package/dist/config.js

@@ -0,0 +1,45 @@
+import { isAbsolute, join, resolve } from 'node:path';
+// Single source of truth for the runtime/serving folder's name, reused
+// by server-config.ts (site.config.json lives inside it) rather than a
+// second hardcoded literal. A real vhost, in hosting terms (Apache/
+// nginx/CyberPanel): the per-site serving configuration, not a
+// multi-tenancy concept - this folder holds exactly that (package.json,
+// server.js, site.config.json's access-control/serving parameters).
+export const VHOST_DIR_NAME = 'vhost';
+// Pure path derivation, no fs calls. siteRoot must be supplied by the
+// caller (agent configuration) and must already be absolute: the agent
+// never assumes it lives inside the site repo, and never falls back to
+// resolving against its own module location or process.cwd().
+export function loadSiteConfig(siteRoot) {
+    if (!isAbsolute(siteRoot)) {
+        throw new Error(`siteRoot must be an absolute path, got "${siteRoot}"`);
+    }
+    const normalisedRoot = resolve(siteRoot);
+    const contentRoot = join(normalisedRoot, 'content');
+    const themeRoot = join(normalisedRoot, 'theme');
+    const vhostRoot = join(normalisedRoot, VHOST_DIR_NAME);
+    const dataRoot = join(vhostRoot, 'data');
+    return {
+        siteRoot: normalisedRoot,
+        contentRoot,
+        // Nested inside contentRoot (content/drafts), not a sibling of it -
+        // marketing-manager-managed content lives entirely under content/.
+        // See content-read.ts/migration-runner.ts for the inclusion-based
+        // walk fix this requires, and checkpoint.ts for the derived (not
+        // hardcoded) pathspec fix.
+        draftsRoot: join(contentRoot, 'drafts'),
+        themeRoot,
+        assetsRoot: join(themeRoot, 'assets'),
+        rootMirrorRoot: join(themeRoot, 'root'),
+        templatesRoot: join(themeRoot, 'templates'),
+        pagesRoot: join(contentRoot, 'pages'),
+        postsRoot: join(contentRoot, 'posts'),
+        menusRoot: join(contentRoot, 'menus'),
+        // Also nested inside contentRoot, for the same reason.
+        redirectsPath: join(contentRoot, 'redirects.json'),
+        vhostRoot,
+        dataRoot,
+        searchIndexPath: join(dataRoot, 'search-index.sqlite'),
+        mediaRoot: join(normalisedRoot, 'media'),
+    };
+}

package/dist/create-site/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/create-site/cli.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { resolve } from 'node:path';
+import { ScaffoldError, scaffoldSite } from "./generate-site.js";
+const targetArg = process.argv[2];
+if (!targetArg) {
+    console.error('Usage: create-site <directory>');
+    process.exit(1);
+}
+try {
+    const targetDir = resolve(process.cwd(), targetArg);
+    const { raw } = scaffoldSite(targetDir);
+    console.log(`Created a new site at ${targetDir}`);
+    console.log('');
+    console.log('Your API token (save this now - it will not be shown again):');
+    console.log(`  ${raw}`);
+    console.log('');
+    console.log('Next steps:');
+    console.log(`  cd ${targetArg}/vhost`);
+    console.log('  npm install');
+    console.log('  node server.js');
+    console.log('');
+    console.log('Want to edit this site from a hosted admin while developing locally?');
+    console.log('  node server.js --tunnel');
+}
+catch (error) {
+    if (error instanceof ScaffoldError) {
+        console.error(error.message);
+        process.exit(1);
+    }
+    throw error;
+}

package/dist/create-site/generate-site.d.ts

@@ -0,0 +1,9 @@
+export declare function generateToken(): {
+    raw: string;
+    hash: string;
+};
+export declare class ScaffoldError extends Error {
+}
+export declare function scaffoldSite(targetDir: string): {
+    raw: string;
+};

package/dist/create-site/generate-site.js

@@ -0,0 +1,109 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { CHECKPOINT_AUTHOR } from "../services/checkpoint.js";
+import { commitPaths } from "../services/git.js";
+// This file's own bundled template (dist/create-site/template, copied
+// there by `npm run build`'s cp step) - the agent's own asset, not
+// site data, matching validation.ts's/capabilities.ts's existing
+// import.meta.dirname-relative pattern for the agent's own bundled
+// files (see test/static/static-analysis.test.ts's B1 allowlist).
+const TEMPLATE_ROOT = join(import.meta.dirname, 'template');
+// The agent's own bundled package.json, reused for the exact version
+// to pin the scaffold's dependency to - never a second hardcoded
+// literal, same reasoning as capabilities.ts's readAgentVersion.
+function readAgentVersion() {
+    const packageJsonPath = join(import.meta.dirname, '..', '..', 'package.json');
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+    return packageJson.version ?? '0.0.0';
+}
+function sanitisePackageName(dirName) {
+    const cleaned = dirName.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '');
+    return cleaned.length > 0 ? cleaned : 'my-site';
+}
+export function generateToken() {
+    const raw = randomBytes(32).toString('hex');
+    const hash = createHash('sha256').update(raw).digest('hex');
+    return { raw, hash };
+}
+// server.js lives in vhost/, one level below the real site root - it
+// states its own fixed, known relationship to its sibling directory
+// rather than the agent inferring anything (constraint 2 stays intact:
+// the site root is always explicit, never assumed from the agent's own
+// location).
+const SERVER_JS = `import { startServer } from '@o-a/cms-agent';
+import { join } from 'node:path';
+
+await startServer(join(import.meta.dirname, '..'), { tunnel: process.argv.includes('--tunnel') });
+`;
+export class ScaffoldError extends Error {
+}
+// A standalone, one-shot CLI operation - no running server exists yet
+// for enqueue()'s serialisation to matter, and this whole function
+// runs synchronously start to finish, so there's no concurrent-write
+// hazard to guard against.
+export function scaffoldSite(targetDir) {
+    if (existsSync(targetDir) && readdirSync(targetDir).length > 0) {
+        throw new ScaffoldError(`"${targetDir}" already exists and is not empty`);
+    }
+    mkdirSync(targetDir, { recursive: true });
+    // The static theme/content template, copied verbatim except its own
+    // "gitignore"/"dockerignore" (no leading dot - a literal .gitignore
+    // or .dockerignore inside the template tree would be silently
+    // dropped by npm pack's own packlist logic, verified empirically
+    // before this was written).
+    cpSync(TEMPLATE_ROOT, targetDir, {
+        recursive: true,
+        filter: (source) => basename(source) !== 'gitignore' && basename(source) !== 'dockerignore',
+    });
+    cpSync(join(TEMPLATE_ROOT, 'gitignore'), join(targetDir, '.gitignore'));
+    cpSync(join(TEMPLATE_ROOT, 'dockerignore'), join(targetDir, '.dockerignore'));
+    // content/drafts/ starts empty - not part of the static template
+    // (nothing to copy), created directly so a fresh site has somewhere
+    // to write its first draft immediately. Nested inside content/, not
+    // a sibling of it - see config.ts's own comment for why.
+    mkdirSync(join(targetDir, 'content', 'drafts'), { recursive: true });
+    // media/ also starts empty, also created directly (no template
+    // content to copy - see config.ts's own comment for why this is a
+    // sibling of content/theme/vhost, not nested under content/). Not
+    // passed to commitPaths below: media is never git-tracked
+    // (constraint 2), even at scaffold time - an empty directory has
+    // nothing to commit anyway (git doesn't track empty directories), so
+    // this omission is a non-issue mechanically, but it's deliberate,
+    // not an oversight, should anyone go looking for why it's absent
+    // from that list.
+    mkdirSync(join(targetDir, 'media'), { recursive: true });
+    // vhost/: the site's own serving configuration (package.json,
+    // server.js, site.config.json), matching a real vhost's own scope in
+    // hosting terms - never a sibling of content/theme.
+    const vhostDir = join(targetDir, 'vhost');
+    mkdirSync(vhostDir, { recursive: true });
+    // A zero-token site fails closed on every write route (401) - not
+    // usable for editing at all. Generated fresh per scaffold, printed
+    // once, never written to disk - matches every other write-capable
+    // identity in this codebase never depending on a value the operator
+    // could lose or that leaks into version control.
+    const token = generateToken();
+    writeFileSync(join(vhostDir, 'site.config.json'), JSON.stringify({
+        tokens: [{ hash: token.hash, scopes: ['content', 'theme', 'media'] }],
+    }, null, 2));
+    const packageName = sanitisePackageName(basename(targetDir));
+    writeFileSync(join(vhostDir, 'package.json'), JSON.stringify({
+        name: packageName,
+        version: '0.0.0',
+        private: true,
+        type: 'module',
+        dependencies: {
+            // Pinned exact, never a ^range - at v0.x even a minor bump
+            // can be breaking (build plan's own word is "pinned").
+            '@o-a/cms-agent': readAgentVersion(),
+        },
+    }, null, 2));
+    writeFileSync(join(vhostDir, 'server.js'), SERVER_JS);
+    // runStartupChecks hard-fails not-a-git-repo otherwise - a scaffold
+    // without a real git repo cannot boot at all.
+    execFileSync('git', ['init', '--quiet'], { cwd: targetDir });
+    commitPaths(targetDir, ['theme', 'content', 'vhost', '.gitignore', '.dockerignore'], 'chore: initial scaffold', CHECKPOINT_AUTHOR);
+    return { raw: token.raw };
+}

package/dist/create-site/mint-token-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/create-site/mint-token-cli.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { resolve } from 'node:path';
+import { MintTokenError, mintToken, parseScopes } from "./mint-token.js";
+const targetArg = process.argv[2];
+const scopesFlagIndex = process.argv.indexOf('--scopes');
+const scopesArg = scopesFlagIndex !== -1 ? process.argv[scopesFlagIndex + 1] : undefined;
+if (!targetArg) {
+    console.error('Usage: mint-token <site-directory> [--scopes content,theme,media]');
+    process.exit(1);
+}
+try {
+    const scopes = parseScopes(scopesArg);
+    const siteDir = resolve(process.cwd(), targetArg);
+    const { raw } = mintToken(siteDir, scopes);
+    console.log('New API token (save this now - it will not be shown again):');
+    console.log(`  ${raw}`);
+    console.log('');
+    console.log(`Scopes: ${scopes.join(', ')}`);
+}
+catch (error) {
+    if (error instanceof MintTokenError) {
+        console.error(error.message);
+        process.exit(1);
+    }
+    throw error;
+}

package/dist/create-site/mint-token.d.ts

@@ -0,0 +1,7 @@
+import type { Scope } from '../server-config.ts';
+export declare class MintTokenError extends Error {
+}
+export declare function parseScopes(raw: string | undefined): Scope[];
+export declare function mintToken(siteDir: string, scopes: Scope[]): {
+    raw: string;
+};

package/dist/create-site/mint-token.js

@@ -0,0 +1,49 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CHECKPOINT_AUTHOR } from "../services/checkpoint.js";
+import { commitPaths } from "../services/git.js";
+import { generateToken } from "./generate-site.js";
+export class MintTokenError extends Error {
+}
+const VALID_SCOPES = new Set(['content', 'theme', 'media']);
+export function parseScopes(raw) {
+    if (!raw) {
+        return ['content', 'theme', 'media'];
+    }
+    const scopes = raw.split(',').map((scope) => scope.trim());
+    for (const scope of scopes) {
+        if (!VALID_SCOPES.has(scope)) {
+            throw new MintTokenError(`Unknown scope "${scope}" - valid scopes are content, theme, media`);
+        }
+    }
+    return scopes;
+}
+// A standalone CLI operation against an operator-supplied site
+// directory, same category as scaffoldSite - not a web request's
+// :path, so sanitisePath's traversal concern doesn't apply here.
+export function mintToken(siteDir, scopes) {
+    const configPath = join(siteDir, 'vhost', 'site.config.json');
+    let raw;
+    try {
+        raw = readFileSync(configPath, 'utf-8');
+    }
+    catch (error) {
+        throw new MintTokenError(`Could not read ${configPath} - is "${siteDir}" a real site created by create-site?`, {
+            cause: error,
+        });
+    }
+    let config;
+    try {
+        config = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new MintTokenError(`${configPath} is not valid JSON`, { cause: error });
+    }
+    const token = generateToken();
+    const tokens = Array.isArray(config.tokens) ? config.tokens : [];
+    tokens.push({ hash: token.hash, scopes });
+    config.tokens = tokens;
+    writeFileSync(configPath, JSON.stringify(config, null, 2));
+    commitPaths(siteDir, ['vhost/site.config.json'], 'chore: mint a new API token', CHECKPOINT_AUTHOR);
+    return { raw: token.raw };
+}

package/dist/create-site/template/content/menus/footerCompany.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "items": [
+    { "label": "About", "url": "/about" },
+    { "label": "Careers", "url": "/careers" },
+    { "label": "Contact", "url": "/contact" },
+    { "label": "GitHub", "url": "https://github.com/granite-cms/granite" }
+  ]
+}

package/dist/create-site/template/content/menus/footerProduct.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "items": [
+    { "label": "Features", "url": "#features" },
+    { "label": "Pricing", "url": "#pricing" },
+    { "label": "Changelog", "url": "/changelog" },
+    { "label": "Docs", "url": "/docs" }
+  ]
+}

package/dist/create-site/template/content/menus/footerResources.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "items": [
+    { "label": "Documentation", "url": "/docs" },
+    { "label": "Theme authoring guide", "url": "/docs/themes" },
+    { "label": "Blog", "url": "/blog" },
+    { "label": "Community", "url": "https://discord.gg/granitecms" }
+  ]
+}

package/dist/create-site/template/content/menus/main.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "items": [
+    { "label": "Features", "url": "#features" },
+    { "label": "How it works", "url": "#how-it-works" },
+    { "label": "Pricing", "url": "#pricing" },
+    { "label": "FAQ", "url": "#faq" }
+  ]
+}