@saena-io/create 0.1.0

package/dist/index.js

@@ -0,0 +1,313 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { spawnSync } from "child_process";
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+import {
+  cancel,
+  confirm,
+  intro,
+  isCancel,
+  multiselect,
+  note,
+  outro,
+  spinner,
+  text
+} from "@clack/prompts";
+
+// src/generate.ts
+var SAENA_VERSION = "^0.1.1";
+var PLUGINS = [
+  {
+    id: "customers",
+    name: "Customers",
+    hint: "storefront identity (customer accounts + auth)",
+    pkg: "@saena-io/customers",
+    version: SAENA_VERSION,
+    dependsOn: [],
+    serverExport: "customersPlugin",
+    serverImport: "import { customersPlugin } from '@saena-io/customers';"
+  },
+  {
+    id: "ai",
+    name: "AI",
+    hint: "AI capability (models + credentials) other plugins build on",
+    pkg: "@saena-io/ai",
+    version: SAENA_VERSION,
+    dependsOn: [],
+    serverExport: "aiPlugin",
+    serverImport: "import { aiPlugin } from '@saena-io/ai';",
+    adminBuilder: "buildAiAdmin()",
+    adminImport: "import { buildAiAdmin } from '@saena-io/ai/admin';",
+    env: "# Encryption key for stored secrets (AI provider API keys), 32 bytes base64.\n# Generate one: openssl rand -base64 32\nSAENA_MASTER_KEY=\n"
+  },
+  {
+    id: "translation",
+    name: "Translation",
+    hint: "AI machine-translation in the Translations grid (needs AI)",
+    pkg: "@saena-io/translation",
+    version: SAENA_VERSION,
+    dependsOn: ["ai"],
+    serverExport: "translationPlugin",
+    serverImport: "import { translationPlugin } from '@saena-io/translation';",
+    enablesTranslation: true
+  },
+  {
+    id: "content",
+    name: "Content (CMS)",
+    hint: "no-code content editor \u2014 pages, sections, collections",
+    pkg: "@saena-io/content",
+    version: SAENA_VERSION,
+    dependsOn: [],
+    serverExport: "contentPlugin",
+    serverImport: "import { contentPlugin } from '@saena-io/content';",
+    serverSideEffect: "import './content/schema';",
+    adminBuilder: "buildContentAdmin()",
+    adminImport: "import { buildContentAdmin } from '@saena-io/content/admin';",
+    adminSideEffect: "import './content/admin';",
+    addon: "content"
+  }
+];
+var byId = new Map(PLUGINS.map((p) => [p.id, p]));
+function resolveSelection(ids) {
+  const want = new Set(ids);
+  for (const id of ids) for (const dep of byId.get(id)?.dependsOn ?? []) want.add(dep);
+  return PLUGINS.filter((p) => want.has(p.id));
+}
+function normalizeName(input) {
+  return input.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "saena-app";
+}
+function applyMarkers(content, feature, enabled) {
+  const lines = content.split("\n");
+  const out = [];
+  const start = `// SAENA:${feature}:start`;
+  const end = `// SAENA:${feature}:end`;
+  const line = `// SAENA:${feature}:line`;
+  let skipping = false;
+  for (let i = 0; i < lines.length; i++) {
+    const l = lines[i] ?? "";
+    const t = l.trim();
+    if (t === start) {
+      if (!enabled) skipping = true;
+      continue;
+    }
+    if (t === end) {
+      skipping = false;
+      continue;
+    }
+    if (t === line) {
+      if (!enabled) i++;
+      continue;
+    }
+    if (!skipping) out.push(l);
+  }
+  return out.join("\n");
+}
+function generatePluginsTs(selected) {
+  const imports = selected.map((p) => p.serverImport);
+  const sideEffects = selected.flatMap((p) => p.serverSideEffect ? [p.serverSideEffect] : []);
+  const list = selected.map((p) => `  ${p.serverExport},`).join("\n");
+  const head = [...imports, "import type { Plugin } from '@saena-io/plugin-sdk';"].join("\n");
+  return `${head}${sideEffects.length ? `
+${sideEffects.join("\n")}` : ""}
+
+// The SERVER manifest \u2014 the enabled plugins, fed to the plugin host (boot/install) and runPluginMigrations.
+// Add or remove a plugin here, then run \`bun run db:migrate\`. Generated by create-saena; edit freely.
+export const serverPlugins: Plugin[] = [${selected.length ? `
+${list}
+` : ""}];
+`;
+}
+function generatePluginsAdminTs(selected) {
+  const sideEffects = selected.flatMap((p) => p.adminSideEffect ? [p.adminSideEffect] : []);
+  const withAdmin = selected.filter((p) => p.adminBuilder);
+  const imports = withAdmin.flatMap((p) => p.adminImport ? [p.adminImport] : []);
+  const builders = withAdmin.map((p) => `  ${p.adminBuilder},`).join("\n");
+  const header = [
+    ...sideEffects,
+    // side-effect registrations must run before the builders read them
+    ...imports,
+    "import type { AdminExtension } from '@saena-io/ui/admin';"
+  ].join("\n");
+  return `${header}
+
+// The ADMIN manifest \u2014 the client half. Composed into the admin shell via buildAdminRegistry. Kept separate
+// from src/plugins.ts so the server graph stays React-free. Generated by create-saena; edit freely.
+export const adminExtensions: AdminExtension[] = [${withAdmin.length ? `
+${builders}
+` : ""}];
+`;
+}
+function parseArgs(argv) {
+  let dir;
+  let plugins;
+  let install;
+  let git;
+  let yes = false;
+  for (const arg of argv) {
+    if (arg === "--no-install") install = false;
+    else if (arg === "--no-git") git = false;
+    else if (arg === "-y" || arg === "--yes") yes = true;
+    else if (arg.startsWith("--plugins="))
+      plugins = arg.slice("--plugins=".length).split(",").map((s) => s.trim()).filter(Boolean);
+    else if (!arg.startsWith("-") && !dir) dir = arg;
+  }
+  return { dir, plugins, install, git, yes };
+}
+function pmRun(pm) {
+  return pm === "npm" ? "npm run" : pm;
+}
+
+// src/index.ts
+function replacePlaceholders(dir, name) {
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) replacePlaceholders(full, name);
+    else {
+      const before = readFileSync(full, "utf8");
+      const after = before.replaceAll("{{PROJECT_NAME}}", name);
+      if (after !== before) writeFileSync(full, after);
+    }
+  }
+}
+function detectPackageManager() {
+  const ua = process.env.npm_config_user_agent ?? "";
+  if (ua.startsWith("bun")) return "bun";
+  if (ua.startsWith("pnpm")) return "pnpm";
+  if (ua.startsWith("yarn")) return "yarn";
+  return "npm";
+}
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  intro("create-saena");
+  let dir = args.dir;
+  if (!dir) {
+    const res = await text({
+      message: "Where should we create your app?",
+      placeholder: "./my-saena-app",
+      defaultValue: "./my-saena-app"
+    });
+    if (isCancel(res)) return cancel("Cancelled.");
+    dir = res || "./my-saena-app";
+  }
+  const targetDir = resolve(process.cwd(), dir);
+  const projectName = normalizeName(dir.replace(/^.*[/\\]/, ""));
+  if (existsSync(targetDir) && readdirSync(targetDir).length > 0) {
+    return cancel(`Directory "${dir}" already exists and is not empty.`);
+  }
+  let selectedIds = args.plugins;
+  if (!selectedIds) {
+    if (args.yes) {
+      selectedIds = ["content", "ai", "translation"];
+    } else {
+      const res = await multiselect({
+        message: "Which plugins? (Core already includes auth, RBAC, settings, the translations grid, and Help)",
+        options: PLUGINS.map((p) => ({ value: p.id, label: p.name, hint: p.hint })),
+        required: false,
+        initialValues: ["content", "ai", "translation"]
+      });
+      if (isCancel(res)) return cancel("Cancelled.");
+      selectedIds = res;
+    }
+  }
+  const selected = resolveSelection(selectedIds ?? []);
+  const added = selected.filter((p) => !(selectedIds ?? []).includes(p.id));
+  if (added.length)
+    note(`Added required dependencies: ${added.map((p) => p.name).join(", ")}`, "Dependencies");
+  let doInstall = args.install;
+  let doGit = args.git;
+  if (!args.yes) {
+    if (doInstall === void 0) {
+      const r = await confirm({ message: "Install dependencies now?", initialValue: true });
+      if (isCancel(r)) return cancel("Cancelled.");
+      doInstall = r;
+    }
+    if (doGit === void 0) {
+      const r = await confirm({ message: "Initialize a git repository?", initialValue: true });
+      if (isCancel(r)) return cancel("Cancelled.");
+      doGit = r;
+    }
+  }
+  doInstall = doInstall ?? true;
+  doGit = doGit ?? true;
+  const here = dirname(fileURLToPath(import.meta.url));
+  const templateRoot = join(here, "..", "template");
+  const base = join(templateRoot, "base");
+  mkdirSync(targetDir, { recursive: true });
+  cpSync(base, targetDir, { recursive: true });
+  renameSync(join(targetDir, "gitignore"), join(targetDir, ".gitignore"));
+  for (const p of selected) {
+    if (p.addon) {
+      const addonDir = join(templateRoot, "addons", p.addon);
+      if (existsSync(addonDir)) cpSync(addonDir, targetDir, { recursive: true });
+    }
+  }
+  writeFileSync(join(targetDir, "src", "plugins.ts"), generatePluginsTs(selected));
+  writeFileSync(join(targetDir, "src", "plugins-admin.ts"), generatePluginsAdminTs(selected));
+  const dataPath = join(targetDir, "src", "admin", "data.ts");
+  const translationOn = selected.some((p) => p.enablesTranslation);
+  writeFileSync(
+    dataPath,
+    applyMarkers(readFileSync(dataPath, "utf8"), "translation", translationOn)
+  );
+  const pkgPath = join(targetDir, "package.json");
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  for (const p of selected) pkg.dependencies[p.pkg] = p.version;
+  pkg.dependencies = Object.fromEntries(
+    Object.entries(pkg.dependencies).sort(([a], [b]) => a.localeCompare(b))
+  );
+  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+  const envExtra = [...new Set(selected.flatMap((p) => p.env ? [p.env] : []))];
+  if (envExtra.length) {
+    const envPath = join(targetDir, ".env.example");
+    writeFileSync(envPath, `${readFileSync(envPath, "utf8").trimEnd()}
+
+${envExtra.join("\n")}`);
+  }
+  replacePlaceholders(targetDir, projectName);
+  if (doGit) {
+    const r = spawnSync("git", ["init", "-q"], { cwd: targetDir, stdio: "ignore" });
+    if (r.status !== 0) note("git init failed (is git installed?) \u2014 skipped.", "Warning");
+  }
+  if (doInstall) {
+    const pm2 = detectPackageManager();
+    const s = spinner();
+    s.start(`Installing dependencies with ${pm2}`);
+    const r = spawnSync(pm2, ["install"], {
+      cwd: targetDir,
+      stdio: "ignore",
+      shell: process.platform === "win32"
+    });
+    if (r.status === 0) s.stop("Dependencies installed.");
+    else s.stop("Install failed \u2014 run it yourself after fixing the error.");
+  }
+  const pm = detectPackageManager();
+  const steps = [
+    `cd ${dir}`,
+    ...doInstall ? [] : [`${pm} install`],
+    "cp .env.example .env   # then set DATABASE_URL",
+    `${pmRun(pm)} db:migrate`,
+    `${pmRun(pm)} db:seed     # creates your admin (prints the generated password once)`,
+    `${pmRun(pm)} dev`
+  ];
+  note(steps.join("\n"), "Next steps");
+  outro(
+    `Created ${projectName} with: ${selected.map((p) => p.name).join(", ") || "core only"}. Admin at /admin.`
+  );
+}
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@saena-io/create",
+  "version": "0.1.0",
+  "description": "Scaffold a SAENA app (admin + plugins) from the published @saena-io packages.",
+  "type": "module",
+  "bin": {
+    "create-saena": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "files": ["dist", "template"],
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --clean",
+    "test": "vitest run --passWithNoTests",
+    "lint": "biome check src",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist .turbo"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.11.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/template/addons/content/src/content/Hero.tsx

@@ -0,0 +1,13 @@
+import { ContentRichText } from '@saena-io/content/public';
+import type { Hero } from './schema';
+
+// The Hero section's public component — title + rich description, read from the typed content the SDK
+// hydrates server-side. Design this however you like; the shape comes from the schema.
+export function HeroSection({ content }: { content: Hero }) {
+  return (
+    <section className="mx-auto max-w-2xl px-6 pt-16 pb-4">
+      <h1 className="font-bold text-4xl tracking-tight">{content.title}</h1>
+      <ContentRichText className="mt-3 text-lg text-muted-foreground" value={content.description} />
+    </section>
+  );
+}

package/template/addons/content/src/content/admin.ts

@@ -0,0 +1,5 @@
+// Registers this project's content into the ADMIN bundle: the section/page schemas (so the Content screen's
+// structure tree + generated forms see them) and the section components (so the live preview can render
+// them). Side-effect only; pulled in by the admin manifest (src/plugins-admin.ts).
+import './schema';
+import './sections';

package/template/addons/content/src/content/schema.ts

@@ -0,0 +1,13 @@
+import { definePage, defineSection } from '@saena-io/content/define';
+import { type InferValue, object, richtext, text } from '@saena-io/content/field';
+
+// Starter content schema (React-free) — one "Home" page with a single "Hero" section. This is where you
+// model your content: add sections, pages, and routed collections, then run `bun run db:migrate`.
+const heroSchema = object({
+  title: text({ label: 'Title' }),
+  description: richtext({ label: 'Description' }),
+});
+export const heroSection = defineSection({ id: 'hero', label: 'Hero', schema: heroSchema });
+export type Hero = InferValue<typeof heroSchema>;
+
+export const homePage = definePage({ id: 'home', path: '/', label: 'Home', sections: ['hero'] });

package/template/addons/content/src/content/sections.ts

@@ -0,0 +1,6 @@
+import { registerSectionComponent } from '@saena-io/content/public';
+import { HeroSection } from './Hero';
+
+// Maps section ids → their public components, used by both the public routes and the admin live preview.
+// Registering here (side-effect) is what lets the Content editor preview each section.
+registerSectionComponent('hero', HeroSection);

package/template/addons/content/src/routes/index.tsx

@@ -0,0 +1,21 @@
+import { HeroSection } from '@/content/Hero';
+import type { Hero } from '@/content/schema';
+import { loadPage } from '@/server/content';
+import { createFileRoute } from '@tanstack/react-router';
+
+// Public homepage (ADR-0008): a dev-authored route whose loader hydrates the "home" page's sections SSR.
+// Edit the copy in the admin (Content → Home); own the markup here.
+export const Route = createFileRoute('/')({
+  component: Home,
+  loader: async () => ({ page: await loadPage({ data: { page: 'home' } }) }),
+});
+
+function Home() {
+  const { page } = Route.useLoaderData();
+  const hero = (page?.hero ?? { title: '{{PROJECT_NAME}}', description: '' }) as Hero;
+  return (
+    <main>
+      <HeroSection content={hero} />
+    </main>
+  );
+}

package/template/addons/content/src/server/content.ts

@@ -0,0 +1,25 @@
+import { getPageContent } from '@saena-io/content';
+import { createRequestContext } from '@saena-io/core';
+import { createServerFn } from '@tanstack/react-start';
+import '../content/schema'; // side-effect: registers this project's sections + pages in the server graph
+import { resolveRequestActor } from './auth';
+import { getCoreContext, getCoreDb } from './core';
+
+// Host glue for public content (ADR-0008): the SSR page loader. A public route's loader calls this to
+// hydrate its sections' content server-side (so pages are server-rendered and SEO-friendly). Public
+// requests are anonymous and rendered in the main locale (createRequestContext's default).
+
+/** A JSON value — hydrated content is plain JSON, typed concretely so it crosses the server-fn boundary. */
+type Json = string | number | boolean | null | Json[] | { [key: string]: Json };
+
+export const loadPage = createServerFn({ method: 'GET' })
+  .validator((data: { page: string }) => data)
+  .handler(async ({ data }): Promise<Record<string, Json> | null> => {
+    const ctx = await createRequestContext({
+      core: getCoreContext(),
+      db: getCoreDb(),
+      resolveActor: resolveRequestActor,
+      headers: new Headers(),
+    });
+    return (await getPageContent(ctx, data.page)) as Record<string, Json> | null;
+  });

package/template/base/.env.example

@@ -0,0 +1,15 @@
+# Postgres — SAENA needs Postgres (Drizzle schema + better-auth + pg-boss jobs).
+# Local dev example: createdb {{PROJECT_NAME}} && set the URL below.
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/{{PROJECT_NAME}}
+
+# better-auth secret — 32+ chars. Generate one: openssl rand -hex 32  (CHANGE THIS before deploying).
+BETTER_AUTH_SECRET=dev-secret-change-me-0123456789abcdef0123456789abcdef
+
+# The app's public origin (must match the dev/prod URL for better-auth's CSRF/origin check).
+BETTER_AUTH_URL=http://localhost:3000
+
+# Dev + preview server port.
+PORT=3000
+
+# Local asset storage directory (ADR-0002). In production, point this at a mounted volume.
+SAENA_ASSETS_DIR=.data/assets

package/template/base/README.md

@@ -0,0 +1,58 @@
+# {{PROJECT_NAME}}
+
+A [SAENA](https://www.npmjs.com/org/saena-io) app — an admin + plugin platform built on TanStack Start,
+Postgres, and Drizzle. The admin lives at `/admin`; everything else is yours to build.
+
+## Prerequisites
+
+- [Bun](https://bun.sh) ≥ 1.3
+- A Postgres database (local or hosted)
+
+## Getting started
+
+```bash
+# 1. Configure environment
+cp .env.example .env
+#    → edit .env and set DATABASE_URL (+ BETTER_AUTH_SECRET for anything non-local)
+
+# 2. Install dependencies (skip if create-saena already did it)
+bun install
+
+# 3. Create the schema (core + each enabled plugin) and seed predefined roles
+bun run db:migrate
+
+# 4. Seed your first admin login
+bun run db:seed
+#    → admin@example.com + a generated password, printed once (override with STAFF_EMAIL / STAFF_PASSWORD)
+
+# 5. Run it
+bun run dev
+```
+
+Open <http://localhost:3000/admin> and sign in.
+
+## What's included
+
+The core foundation (always present): the admin shell, staff auth + RBAC (Admin / Owner / Editor),
+business profile + branding settings, the translations grid, and the **Help** screen — a catalog of every
+SAENA plugin (installed and available) with install instructions.
+
+Plugins you selected are wired into `src/plugins.ts` (server) and `src/plugins-admin.ts` (admin). Add or
+remove plugins later by editing those two files and running `bun run db:migrate` again.
+
+## Project layout
+
+```
+src/
+  plugins.ts          enabled plugins (server manifest)
+  plugins-admin.ts    enabled plugins (admin manifest)
+  routes/             your public site + the /admin and /api routes
+  admin/data.ts       the admin data layer (server fns → TanStack DB collections)
+  server/             host glue (auth, db, core context, server functions)
+scripts/migrate.ts    deploy-time migration
+```
+
+## Deploying
+
+`bun run build` produces a server you start with `bun run start` (binds `$PORT`). Run
+`bun run db:migrate:deploy` as a release step. See the SAENA deploy docs for a Railway setup.

package/template/base/gitignore

@@ -0,0 +1,14 @@
+node_modules
+dist
+.output
+.tanstack
+.nitro
+.turbo
+.vite
+
+# Local env + data
+.env
+.data
+
+*.log
+.DS_Store

package/template/base/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "{{PROJECT_NAME}}",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build",
+    "start": "vite preview",
+    "typecheck": "tsc --noEmit",
+    "db:migrate": "bun --env-file=.env scripts/migrate.ts",
+    "db:migrate:deploy": "bun scripts/migrate.ts",
+    "db:seed": "bun --env-file=.env scripts/seed-staff.ts"
+  },
+  "dependencies": {
+    "@saena-io/admin": "^0.1.1",
+    "@saena-io/catalog": "^0.1.0",
+    "@saena-io/core": "^0.1.1",
+    "@saena-io/plugin-sdk": "^0.1.0",
+    "@saena-io/ui": "^0.1.1",
+    "@tanstack/db": "^0.6.8",
+    "@tanstack/query-core": "^5.101.0",
+    "@tanstack/query-db-collection": "^1.0.40",
+    "@tanstack/react-router": "^1.170.0",
+    "@tanstack/react-start": "^1.168.0",
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4",
+    "@tanstack/router-plugin": "^1.168.0",
+    "@types/node": "^22",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@vitejs/plugin-react": "^6",
+    "tailwindcss": "^4",
+    "typescript": "^5.7.2",
+    "vite": "^8"
+  }
+}

package/template/base/scripts/migrate.ts

@@ -0,0 +1,43 @@
+import {
+  createCoreContext,
+  createDb,
+  createPluginHost,
+  ensureRoles,
+  migrateCore,
+  runPluginMigrations,
+} from '@saena-io/core';
+import { serverPlugins } from '../src/plugins';
+
+// Deploy-time migration for the web app: apply the core schema, then each enabled plugin's migrations (in
+// dependsOn order, isolated history tables — runPluginMigrations), then run plugin install() hooks. This is
+// the project's pinned-manifest + ordered-migration step (ADR-0006); it must run at deploy time, not in a
+// request. Run with `bun --filter @saena-io/web db:migrate` (loads ../../.env).
+async function main(): Promise<void> {
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error('DATABASE_URL is not set — migration needs Postgres (see .env).');
+  }
+  const db = createDb(url);
+  const ctx = createCoreContext({ db });
+
+  ctx.logger.info('migrate: core schema');
+  await migrateCore(db);
+
+  ctx.logger.info(
+    `migrate: plugin migrations (${serverPlugins.map((p) => p.id).join(', ') || 'none'})`,
+  );
+  await runPluginMigrations(db, serverPlugins);
+
+  ctx.logger.info('migrate: plugin install hooks');
+  const host = createPluginHost(serverPlugins, ctx);
+  await host.install();
+
+  // Seed the predefined roles (Admin/Owner/Editor) from the catalogue by tier + bootstrap an Admin (ADR-0012).
+  const pluginPermissions = serverPlugins.flatMap((p) => p.permissions ?? []);
+  await ensureRoles(db, pluginPermissions);
+
+  ctx.logger.info('migrate: complete');
+  process.exit(0);
+}
+
+void main();

package/template/base/scripts/seed-staff.ts

@@ -0,0 +1,68 @@
+import { randomBytes } from 'node:crypto';
+import {
+  createDb,
+  createStaffAuth,
+  createStaffMember,
+  ensureRoles,
+  getBusinessProfile,
+  listStaff,
+  upsertBusinessProfile,
+} from '@saena-io/core';
+import { serverPlugins } from '../src/plugins';
+
+// Seed the first staff login into DATABASE_URL — run once after `db:migrate` on a fresh database.
+// Creates one staff user via better-auth (password hashed there) and runs `ensureRoles`, which seeds the
+// predefined Admin/Owner/Editor roles and bootstraps this user as Admin (ADR-0012). Staff self-sign-up is
+// disabled, so this is how you get your first login. Idempotent: re-running is a no-op if the user exists.
+// Override defaults with STAFF_EMAIL / STAFF_PASSWORD / STAFF_NAME.
+const url = process.env.DATABASE_URL;
+if (!url) {
+  console.error('DATABASE_URL is not set — see .env');
+  process.exit(1);
+}
+
+// Roles grant the enabled plugins' permissions too (e.g. content.manage), so seed with them — exactly like
+// db:migrate. Calling ensureRoles WITHOUT these would rebuild the roles with core permissions only and strip
+// the plugin permissions a prior db:migrate granted.
+const pluginPermissions = serverPlugins.flatMap((p) => p.permissions ?? []);
+
+const name = process.env.STAFF_NAME ?? 'Admin';
+const email = process.env.STAFF_EMAIL ?? 'admin@example.com';
+
+const db = createDb(url);
+const staffAuth = createStaffAuth(db, {
+  secret: process.env.BETTER_AUTH_SECRET ?? 'dev-secret-change-me-0123456789abcdef',
+  basePath: '/api/auth/staff',
+});
+
+const existing = await listStaff(db);
+if (existing.some((s) => s.email === email)) {
+  await ensureRoles(db, pluginPermissions);
+  console.log(`staff "${email}" already exists — roles ensured.`);
+} else {
+  // No known default password (security): use STAFF_PASSWORD if given, else a random one printed once below.
+  const password = process.env.STAFF_PASSWORD ?? randomBytes(12).toString('base64url');
+  await createStaffMember(db, staffAuth, { name, email, password });
+  await ensureRoles(db, pluginPermissions);
+  console.log(`Seeded staff "${email}" as Admin.`);
+  console.log(`  email:    ${email}`);
+  console.log(
+    `  password: ${password}${process.env.STAFF_PASSWORD ? '' : '  (randomly generated — save it now)'}`,
+  );
+}
+
+// Seed a starter business profile (edit in Settings → Business profile) so the admin brand shows your
+// project name on first boot instead of the SAENA placeholder. Idempotent; country is a placeholder.
+if (!(await getBusinessProfile(db))) {
+  const brandName = '{{PROJECT_NAME}}'.replace(/[-_]+/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+  await upsertBusinessProfile(db, {
+    name: brandName,
+    legalName: '',
+    country: 'US',
+    vatNumber: '',
+    registrationNumber: '',
+  });
+  console.log(`Seeded business profile "${brandName}" (edit it in Settings).`);
+}
+
+process.exit(0);