@shapio/cms 0.2.1 → 0.3.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { A as update, B as parseLockFile, C as BEFORE_EVENTS, D as listForAssets, E as buildEditorManifest, F as RESERVED_FIELD_API_KEYS, G as validateSchema, H as serializeLockFile, I as RESERVED_TYPE_NAMES, J as createStableId, K as RICHTEXT_FORMAT, L as foldApiKey, M as describeError, O as listLiveByDriver, P as RESERVED_DEFINITION_API_KEYS, R as hashDefinition, S as AFTER_EVENTS, T as EXTENSION_ROUTE_ROOT, U as suggestPlural, V as serializeDefinition, W as toTypeName, X as createDb, Y as validateRichText, Z as sqliteDriverOf, _ as createLogger, a as loadConfig, b as SITE_KEY_PATTERN, c as getPendingMigrations, d as createMediaStorage, f as createSite, g as generateToken, h as SYSTEM_CLI_ACTOR, i as assertDatabaseReachable, j as STORAGE_DRIVERS, k as lockById, l as migrateToLatest, m as createAdminDirect, n as startServer, o as loadEnvFileIfPresent, p as listAllSites, q as SAFE_LINK_PATTERN, r as copyObjectVerified, t as startDedicatedWorker, u as SHAPIO_VERSION, v as createUrlBuilder, w as EXTENSION_JOB_PREFIX, x as loadProjectConfig, y as loopbackUrl, z as parseDefinition } from "./worker-C-MSYr4l.js";
+import { $ as validateSchema, A as update, B as hashDefinition, C as BEFORE_EVENTS, D as listForAssets, E as buildEditorManifest, F as RESERVED_FIELD_API_KEYS, G as parseLockFile, H as lockEntriesForSite, I as RESERVED_TYPE_NAMES, J as serializeDefinition, K as schemaFilePath, L as SCHEMA_KIND_DIRECTORIES, M as describeError, O as listLiveByDriver, P as RESERVED_DEFINITION_API_KEYS, Q as upgradeLockFile, R as SITES_DIRECTORY, S as AFTER_EVENTS, T as EXTENSION_ROUTE_ROOT, U as mergePulledLock, V as lockCoversSite, W as parseDefinition, X as suggestPlural, Y as serializeLockFile, Z as toTypeName, _ as createLogger, a as loadConfig, at as createDb, b as SITE_KEY_PATTERN, c as getPendingMigrations, d as createMediaStorage, et as withSiteCovered, f as createSite, g as generateToken, h as SYSTEM_CLI_ACTOR, i as assertDatabaseReachable, it as validateRichText, j as STORAGE_DRIVERS, k as lockById, l as migrateToLatest, m as createAdminDirect, n as startServer, nt as SAFE_LINK_PATTERN, o as loadEnvFileIfPresent, ot as sqliteDriverOf, p as listAllSites, q as scopeDirectory, r as copyObjectVerified, rt as createStableId, t as startDedicatedWorker, tt as RICHTEXT_FORMAT, u as SHAPIO_VERSION, v as createUrlBuilder, w as EXTENSION_JOB_PREFIX, x as loadProjectConfig, y as loopbackUrl, z as foldApiKey } from "./worker-BLXy8aRW.js";
 import { createDecipheriv, createHash, scryptSync } from "node:crypto";
 import { createReadStream, createWriteStream, existsSync, openAsBlob } from "node:fs";
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve } from "node:path";
@@ -472,7 +472,8 @@ const DEFINITION_PATHS = {
 const createDefinitionApi = (request, category) => {
 	const base = DEFINITION_PATHS[category];
 	return {
-		list: async () => (await request(base)).items,
+		/** The site's view (shared definitions and its own); `{ scope: 'network' }` lists the shared ones. */
+		list: async (options = {}) => (await request(`${base}${toQueryString(options)}`)).items,
 		get: (id) => request(withId(base, id)),
 		/** Creates and activates a definition (`pending` when prerequisites must run first). */
 		create: (body) => request(base, {
@@ -480,9 +481,17 @@ const createDefinitionApi = (request, category) => {
 			body
 		}),
 		/** Plan preview of a create: classification and impact, nothing written. */
-		planCreate: (definition) => request(`${base}/plan`, {
+		planCreate: (definition, scope) => request(`${base}/plan`, {
 			method: "POST",
-			body: { definition }
+			body: scope ? {
+				definition,
+				scope
+			} : { definition }
+		}),
+		/** Shares a definition with all sites, or keeps it on one (needs schema.create on every site). */
+		changeScope: (id, body) => request(`${withId(base, id)}/scope`, {
+			method: "PUT",
+			body
 		}),
 		/** Changes a definition; 409 SCHEMA_VERSION_CONFLICT when `expectedVersion` is stale. */
 		update: (id, body) => request(withId(base, id), {
@@ -508,7 +517,7 @@ const createSchemaApi = (request) => ({
 		summary: () => request(ADMIN_PATHS.schema),
 		change: (changeId) => request(withId(ADMIN_PATHS.schemaChanges, changeId)),
 		/** Every definition in the pull format, with the schema version they come from (`shapio schema pull`). */
-		export: () => request(ADMIN_PATHS.schemaExport),
+		export: (options = {}) => request(`${ADMIN_PATHS.schemaExport}${toQueryString(options)}`),
 		/** Applies definition files live through the change planner; refuses when the base moved (409). */
 		apply: (body) => request(ADMIN_PATHS.schemaApply, {
 			method: "POST",
@@ -2802,41 +2811,48 @@ const writeOrder = (entries) => {
 		deferred
 	};
 };
-/** Schema files: one canonical JSON file per definition, `models/<apiKey>.json` or `components/<apiKey>.json`. */
-const KIND_DIRECTORIES = ["models", "components"];
-const definitionPath = (dir, definition) => join(dir, definition.kind === "component" ? "components" : "models", `${definition.apiKey}.json`);
+/** The file of a definition in a scope (`site`: its site key, null when shared). */
+const definitionPath = (dir, definition, site) => join(dir, ...schemaFilePath(definition, site).split("/"));
 const isMissing = (error) => error.code === "ENOENT";
-/** Every schema file under `dir`, with its ID and canonical hash when it parses. */
-const readLocalFiles = async (dir) => {
-	const files = [];
-	for (const kindDir of KIND_DIRECTORIES) {
-		let names;
-		try {
-			names = (await readdir(join(dir, kindDir))).filter((name) => name.endsWith(".json")).sort();
-		} catch (error) {
-			if (isMissing(error)) continue;
-			throw error;
-		}
-		for (const name of names) {
-			const path = join(dir, kindDir, name);
-			let raw;
-			try {
-				raw = JSON.parse(await readFile(path, "utf8"));
-			} catch (error) {
-				throw new Error(`${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-			}
-			const parsed = parseDefinition(raw);
-			files.push(parsed.ok ? {
-				path,
-				raw,
-				id: parsed.definition.id,
-				hash: await hashDefinition(parsed.definition)
-			} : {
-				path,
-				raw
-			});
-		}
+const listNames = async (path, filter) => {
+	try {
+		return (await readdir(path, { withFileTypes: true })).filter(filter).map((entry) => entry.name).sort();
+	} catch (error) {
+		if (isMissing(error)) return [];
+		throw error;
 	}
+};
+const readLocalFile = async (path, site) => {
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(path, "utf8"));
+	} catch (error) {
+		throw new Error(`${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	const parsed = parseDefinition(raw);
+	return parsed.ok ? {
+		path,
+		raw,
+		site,
+		id: parsed.definition.id,
+		hash: await hashDefinition(parsed.definition)
+	} : {
+		path,
+		raw,
+		site
+	};
+};
+/** The files of one scope's folder (`models/` and `components/` under it). */
+const readScopeFiles = async (dir, site) => {
+	const base = join(dir, ...scopeDirectory(site).split("/").filter(Boolean));
+	const files = [];
+	for (const kindDir of SCHEMA_KIND_DIRECTORIES) for (const name of await listNames(join(base, kindDir), (entry) => entry.isFile() && entry.name.endsWith(".json"))) files.push(await readLocalFile(join(base, kindDir, name), site));
+	return files;
+};
+/** Every schema file under `dir`: the shared folders first, then each site folder by key. */
+const readLocalFiles = async (dir) => {
+	const files = await readScopeFiles(dir, null);
+	for (const siteKey of await listNames(join(dir, SITES_DIRECTORY), (entry) => entry.isDirectory() && !entry.name.startsWith("."))) files.push(...await readScopeFiles(dir, siteKey));
 	return files;
 };
 const readLockFile = async (path) => {
@@ -2851,8 +2867,8 @@ const writeLockFile = async (path, lock) => {
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, serializeLockFile(lock));
 };
-const writeDefinitionFile = async (dir, definition) => {
-	const path = definitionPath(dir, definition);
+const writeDefinitionFile = async (dir, definition, site) => {
+	const path = definitionPath(dir, definition, site);
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, serializeDefinition(definition));
 	return path;
@@ -2905,23 +2921,103 @@ const formatItem = (item, names) => {
 	].filter(Boolean);
 	return [`${item.kind === "component" ? "component" : "model"} ${item.apiKey}: ${describeDecision(item)}${flags.length ? ` [${flags.join(", ")}]` : ""}`, ...item.changes.map((change) => `    ${formatChange(change, names)}`)].join("\n");
 };
-/** Explains a refused apply: conflicts with diffs, invalid files, missing acknowledgements. */
+const FOLDER_OF = {
+	network: "the shared folders",
+	site: "the site’s folder"
+};
+const PLACE_OF = {
+	network: "shared",
+	site: "on one site"
+};
+const SCOPE_OF = {
+	network: "shared",
+	site: "site"
+};
+/** One line per item of a scope refusal (`SCOPE_MISMATCH`, `FORBIDDEN_SCOPE`). */
+const scopeItemLines = (code, items) => items.map((item) => {
+	const name = item.apiKey ?? item.definitionId ?? "?";
+	return code === "SCOPE_MISMATCH" ? `  ${name}: its file is in ${FOLDER_OF[item.local ?? ""] ?? "?"}, but on the instance it is ${PLACE_OF[item.remote ?? ""] ?? "?"}` : `  ${name} (${SCOPE_OF[item.scope ?? ""] ?? item.scope ?? "?"}): ${item.message ?? "not allowed"}`;
+});
+/** What to do next, per refusal. */
+const HINTS = {
+	SCHEMA_CHANGE_NOT_ACKNOWLEDGED: "Review the changes with `shapio schema diff`, then re-run with --allow-breaking and/or --allow-destructive.",
+	SCHEMA_SYNC_CONFLICT: "Commit your files, run `shapio schema pull --force`, reconcile with git, then apply again.",
+	SCOPE_MISMATCH: "Sync never moves a definition between sites: run `shapio schema pull` to get the instance’s layout, or change the scope with `shapio schema scope`.",
+	FORBIDDEN_SCOPE: "Shared definitions (in models/ and components/) need schema permission on every site: apply with a network token, or leave those files unchanged."
+};
+const issueWhere = (found, filePaths) => {
+	const match = /^\/definitions\/(\d+)(.*)$/.exec(found.path ?? "");
+	const where = match ? `${filePaths[Number(match[1])] ?? `definition ${match[1]}`} ${match[2] || "/"}` : found.path ?? "";
+	return found.siteKey ? `${where} (site ${found.siteKey})` : where;
+};
+const siteCountLines = (sites) => (sites ?? []).flatMap((site) => typeof site === "object" && site.entries !== void 0 ? [`  site ${site.key ?? site.siteId ?? "?"}: ${site.entries} entr${site.entries === 1 ? "y" : "ies"}`] : []);
+/** Explains a refused request: conflicts with diffs, invalid files, scope refusals, missing acknowledgements. */
 const formatApiError = (error, filePaths, names) => {
 	const details = error.details ?? {};
 	const lines = [`${error.code}: ${error.message}`];
 	for (const conflict of details.conflicts ?? []) lines.push(formatItem(conflict, names));
-	for (const found of details.issues ?? []) {
-		const match = /^\/definitions\/(\d+)(.*)$/.exec(found.path ?? "");
-		const where = match ? `${filePaths[Number(match[1])] ?? `definition ${match[1]}`} ${match[2] || "/"}` : found.path ?? "";
-		lines.push(`  ${where}: ${found.message ?? ""}`);
-	}
-	if (error.code === "SCHEMA_CHANGE_NOT_ACKNOWLEDGED") lines.push("Review the changes with `shapio schema diff`, then re-run with --allow-breaking and/or --allow-destructive.");
-	if (error.code === "SCHEMA_SYNC_CONFLICT") lines.push("Commit your files, run `shapio schema pull --force`, reconcile with git, then apply again.");
+	for (const found of details.issues ?? []) lines.push(`  ${issueWhere(found, filePaths)}: ${found.message ?? ""}`);
+	lines.push(...scopeItemLines(error.code, details.items ?? []));
+	if (error.code === "SCOPE_IN_USE") lines.push(...siteCountLines(details.sites));
+	const hint = HINTS[error.code];
+	if (hint) lines.push(hint);
 	return `${lines.join("\n")}\n`;
 };
+/**
+* Which part of a schema tree one site's sync is about (plan site-schema): the shared folders and that site's
+* own folder. One tree may hold several sites (`sites/<key>/`); a pull or apply for one never reads, sends,
+* rewrites or removes another site's files or lock entries.
+*/
+const inView = (site, siteKey) => site === null || site === siteKey;
+/** The files an apply for `siteKey` sends: the shared ones and that site's. */
+const filesForSite = (files, siteKey) => files.filter((file) => inView(file.site, siteKey));
+/** Each sent file's scope, parallel to the files: its folder decides (only creates use it). */
+const scopesOf = (files) => files.map((file) => file.site === null ? "network" : "site");
+/**
+* The base an apply for `siteKey` sends: the lock in format 2 with only the shared entries and that site's,
+* so neither the three-way decision nor `--prune` can ever see another site's IDs. `sites` is kept: the
+* server refuses a tree that covers other sites only.
+*/
+const baseForSite = (lock, siteKey) => {
+	const upgraded = upgradeLockFile(lock);
+	return {
+		...upgraded,
+		definitions: lockEntriesForSite(upgraded, siteKey)
+	};
+};
+/** Files in the site's view that differ from what was last pulled (or were never pulled). */
+const editedFilesForSite = (files, lock, siteKey) => {
+	const base = lockEntriesForSite(lock, siteKey);
+	if (Object.keys(base).length === 0) return [];
+	return filesForSite(files, siteKey).filter((file) => {
+		const entry = file.id ? base[file.id] : void 0;
+		return !entry || file.hash !== entry.hash;
+	});
+};
+/**
+* Files a pull of `siteKey` leaves stale: in the pulled scopes and not written (deleted or renamed on the
+* instance), plus any other file of a definition that was just written elsewhere (its scope changed on the
+* instance: it is the same definition, and two files with one ID would make the next apply fail).
+*/
+const staleFilesAfterPull = (files, siteKey, written) => {
+	const writtenPaths = new Set(written.values());
+	return files.filter((file) => {
+		if (writtenPaths.has(file.path)) return false;
+		return inView(file.site, siteKey) || file.id !== void 0 && written.has(file.id);
+	});
+};
+/**
+* The lock after an apply for `siteKey` recorded its entries: the tree covers the site once it holds one of
+* the site's own definitions. A shared-only tree stays uncovered, so it still applies to every site.
+*/
+const coverSiteIfHeld = (lock, siteKey) => Object.values(lock.definitions).some((entry) => entry.site === siteKey) ? {
+	...lock,
+	sites: withSiteCovered(lock.sites, siteKey)
+} : lock;
 const EMPTY_LOCK = {
-	formatVersion: 1,
+	formatVersion: 2,
 	schemaVersion: 0,
+	sites: [],
 	definitions: {}
 };
 /** Field and definition names by ID from the local files, for readable diffs. */
@@ -2942,17 +3038,45 @@ const readLocalState = async (options) => {
 		names: collectNames(files)
 	};
 };
-/** The schema sync endpoints (`export`, `apply`, `change`) of @shapio/client. */
-const apiFor = (options) => createClient({
+/** The admin client for the command's site (`--site`, else the token's site, else the primary). */
+const clientFor = (options) => createClient({
 	baseUrl: options.baseUrl,
-	token: options.token
-}).admin.schema;
-/** Sends the local files with their lock-file bases; the server decides per definition (three-way). */
+	token: options.token,
+	...options.site ? { site: options.site } : {}
+});
+/** The schema sync endpoints (`export`, `apply`, `change`) of @shapio/client. */
+const apiFor = (options) => clientFor(options).admin.schema;
+/** The key of the site the command works on, as the instance resolved it (an unnamed site is the default). */
+const resolveSiteKey = async (options) => {
+	if (options.site) return options.site;
+	const { site } = await apiFor(options).export({ scope: "network" });
+	if (!site) throw new Error("The instance did not say which site this token works on; pass --site <key>");
+	return site.key;
+};
+/**
+* The local tree narrowed to one site (shared files and `sites/<key>/`), or undefined (after explaining)
+* when the tree was pulled for other sites only.
+*/
+const readSiteState = async (options, io) => {
+	const siteKey = await resolveSiteKey(options);
+	const state = await readLocalState(options);
+	if (!lockCoversSite(state.lock, siteKey)) {
+		io.stderr(`${displayPath(options.lockPath)} covers the site(s) ${(state.lock.sites ?? []).join(", ")}, not "${siteKey}".\nApply it with --site <one of those>, or pull "${siteKey}" into this tree first: shapio schema pull --site ${siteKey}\n`);
+		return;
+	}
+	return {
+		...state,
+		siteKey,
+		sent: filesForSite(state.files, siteKey)
+	};
+};
+/** Sends the site's files with their lock-file bases; the server decides per definition (three-way). */
 const sendApply = async (options, state, dryRun, io) => {
 	try {
 		return await apiFor(options).apply({
-			definitions: state.files.map((file) => file.raw),
-			base: state.lock,
+			definitions: state.sent.map((file) => file.raw),
+			scopes: scopesOf(state.sent),
+			base: baseForSite(state.lock, state.siteKey),
 			prune: options.prune,
 			dryRun,
 			acknowledgeBreaking: options.allowBreaking,
@@ -2960,7 +3084,7 @@ const sendApply = async (options, state, dryRun, io) => {
 		});
 	} catch (error) {
 		if (error instanceof ShapioApiError) {
-			io.stderr(formatApiError(error, state.files.map((file) => file.path), state.names));
+			io.stderr(formatApiError(error, state.sent.map((file) => displayPath(file.path)), state.names));
 			return;
 		}
 		throw error;
@@ -3048,11 +3172,12 @@ const checkPlanDirectory = async (dir, force) => {
 	if (Object.keys(previous.state.entries).length > 0 || Object.keys(previous.state.media).length > 0) throw new Error(`${dir} holds an import that has started (${Object.keys(previous.state.entries).length} entries created): re-run --map to continue it, or plan into a new directory`);
 	if (!force) throw new Error(`${dir} already holds a plan: pass --force to replace it (new IDs), or use another directory`);
 };
-const plannedMap = (source, info, ids) => ({
+const plannedMap = (source, info, ids, site) => ({
 	format: IMPORT_MAP_FORMAT,
 	formatVersion: 1,
 	source: info,
 	plannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+	site: site ?? null,
 	definitions: ids,
 	media: Object.fromEntries(source.media.map((media) => [media.sourceId, {
 		filename: media.filename,
@@ -3070,9 +3195,11 @@ const plannedMap = (source, info, ids) => ({
 /**
 * `--plan`: writes one pull-format schema file per planned definition under `<dir>/schema`, an empty lock file
 * beside them (so `schema apply` treats every definition as new and leaves the project's own lock alone), and
-* `import-map.json`. Nothing is sent to an instance.
+* `import-map.json`. Nothing is sent to an instance. With `site` (`--site` / SHAPIO_SITE) the files go under
+* `schema/sites/<site>/`, so `schema apply --site <site>` creates them on that site; without one they go in
+* the shared folders and are created shared with all sites.
 */
-const writePlan = async (dir, source, info, { force = false } = {}) => {
+const writePlan = async (dir, source, info, { force = false, site } = {}) => {
 	await checkPlanDirectory(dir, force);
 	const ids = assignIds(source.definitions);
 	const definitions = buildDefinitions(source, ids);
@@ -3081,9 +3208,9 @@ const writePlan = async (dir, source, info, { force = false } = {}) => {
 		recursive: true,
 		force: true
 	});
-	for (const definition of definitions) await writeDefinitionFile(schemaDir, definition);
+	for (const definition of definitions) await writeDefinitionFile(schemaDir, definition, site ?? null);
 	await writeLockFile(join(dir, PLAN_LOCK_FILE), EMPTY_LOCK);
-	const map = plannedMap(source, info, ids);
+	const map = plannedMap(source, info, ids, site);
 	await writeImportMap(dir, map);
 	return {
 		definitions,
@@ -3198,17 +3325,27 @@ var ImportRefusedError = class extends Error {
 		this.name = "ImportRefusedError";
 	}
 };
+/**
+* The site `--map` writes to: `--site` (or SHAPIO_SITE), else the site the plan was made for. A requested site
+* that disagrees with the planned one is refused: the planned models exist on that site only.
+*/
+const resolveMapSite = (map, requested) => {
+	const planned = map.site ?? void 0;
+	if (requested !== void 0 && planned !== void 0 && requested !== planned) throw new ImportRefusedError(`This import was planned for site "${planned}", not "${requested}": run --map with --site ${planned}, or plan again with --site ${requested}`);
+	return requested ?? planned;
+};
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
-const checkSourceAndSite = async (map, options) => {
+const checkSourceAndSite = async (map, site) => {
 	if (await sha256File(map.source.path).catch((error) => {
 		throw new ImportRefusedError(`The source ${map.source.path} cannot be read: ${messageOf(error)}`);
 	}) !== map.source.sha256) throw new ImportRefusedError(`${map.source.path} changed since it was planned: plan again into a new directory`);
-	if ((Object.keys(map.state.entries).length > 0 || Object.keys(map.state.media).length > 0) && (map.state.site ?? null) !== (options.site ?? null)) throw new ImportRefusedError(`This import was started on site ${map.state.site ?? "(default)"}: re-run it with the same --site`);
+	if ((Object.keys(map.state.entries).length > 0 || Object.keys(map.state.media).length > 0) && (map.state.site ?? null) !== (site ?? null)) throw new ImportRefusedError(`This import was started on site ${map.state.site ?? "(default)"}: re-run it with the same --site`);
 };
-const loadLiveSchema = async (client, map, dir) => {
+/** The target site's view (the client names the site): its own definitions and the shared ones. */
+const loadLiveSchema = async (client, map, dir, site) => {
 	const exported = await client.admin.schema.export();
 	const live = resolveLiveSchema(map, exported.definitions.map((entry) => entry.definition));
-	if (live.missing.length > 0) throw new ImportRefusedError(`The instance does not have the planned models yet: ${live.missing.join(", ")}.\nApply them first: shapio schema apply --dir ${join(dir, PLAN_SCHEMA_DIR)} --lock ${join(dir, PLAN_LOCK_FILE)}`);
+	if (live.missing.length > 0) throw new ImportRefusedError(`The instance does not have the planned models yet: ${live.missing.join(", ")}.\nApply them first: shapio schema apply --dir ${join(dir, PLAN_SCHEMA_DIR)} --lock ${join(dir, PLAN_LOCK_FILE)}${site ? ` --site ${site}` : ""}`);
 	return live;
 };
 const checkLocales = async (client, source) => {
@@ -3362,17 +3499,18 @@ const printSummary = (run, source, changeSetFailures) => {
 };
 const runMap = async (options, io) => {
 	const map = await readImportMap(options.dir);
-	await checkSourceAndSite(map, options);
+	const site = resolveMapSite(map, options.site);
+	await checkSourceAndSite(map, site);
 	const client = createClient({
 		baseUrl: options.baseUrl,
 		token: options.token,
 		fetch: createRateLimitedFetch(options.fetch),
-		...options.site ? { site: options.site } : {}
+		...site ? { site } : {}
 	});
-	const live = await loadLiveSchema(client, map, options.dir);
+	const live = await loadLiveSchema(client, map, options.dir, site);
 	const source = await options.load(map);
 	await checkLocales(client, source);
-	map.state.site = options.site ?? null;
+	map.state.site = site ?? null;
 	map.state.baseUrl = options.baseUrl;
 	const run = {
 		options,
@@ -3396,7 +3534,7 @@ const display = (path) => {
 	return !shown ? "." : shown.startsWith("..") || isAbsolute(shown) ? path : shown;
 };
 /** What `--plan` wrote and what to do next. */
-const formatPlanSummary = (source, definitions, dir, command) => {
+const formatPlanSummary = (source, definitions, dir, command, site) => {
 	const keyOf = new Map(source.definitions.map((definition) => [definition.apiKey, definition.key]));
 	const lines = [`Planned ${definitions.length} definition(s) in ${display(`${dir}/${PLAN_SCHEMA_DIR}`)}:`];
 	for (const definition of definitions) {
@@ -3407,7 +3545,9 @@ const formatPlanSummary = (source, definitions, dir, command) => {
 	lines.push(`Media: ${source.media.length} file(s) to import.`);
 	lines.push("Every model has draft and publish on: nothing goes live until you ship the change set(s) the import opens.");
 	lines.push(...source.notes);
-	lines.push("Next:", "  1. Review the files: rename API IDs or delete fields you do not want (entries follow the stable IDs).", `  2. shapio schema apply --dir ${display(`${dir}/${PLAN_SCHEMA_DIR}`)} --lock ${display(`${dir}/${PLAN_LOCK_FILE}`)}`, `  3. shapio import ${command} --map ${display(dir)}`);
+	lines.push(site ? `The models and components will belong to site "${site}".` : "No --site given: the models and components will be shared with all sites. Plan again with --site <key> to keep them on one site.");
+	const siteFlag = site ? ` --site ${site}` : "";
+	lines.push("Next:", "  1. Review the files: rename API IDs or delete fields you do not want (entries follow the stable IDs).", `  2. shapio schema apply --dir ${display(`${dir}/${PLAN_SCHEMA_DIR}`)} --lock ${display(`${dir}/${PLAN_LOCK_FILE}`)}${siteFlag}`, `  3. shapio import ${command} --map ${display(dir)}${siteFlag}`);
 	return `${lines.join("\n")}\n`;
 };
 const parse = (args, spec) => {
@@ -3436,24 +3576,30 @@ const parse = (args, spec) => {
 		file: positionals[0]
 	};
 };
+/** `--site`, else SHAPIO_SITE: the site the plan's schema belongs to and the map step writes to. */
+const siteOf = (values, io) => (values.site ?? io.env.SHAPIO_SITE)?.trim() || void 0;
 const runPlan = async (spec, file, values, io) => {
 	const dir = resolve(String(values.plan));
 	const path = resolve(file);
 	await checkPlanDirectory(dir, values.force === true);
 	const source = await spec.plan(path, dir, values);
+	const site = siteOf(values, io);
 	const { definitions } = await writePlan(dir, source, {
 		kind: source.kind,
 		path,
 		sha256: await sha256File(path)
-	}, { force: values.force === true });
-	io.stdout(formatPlanSummary(source, definitions, dir, spec.name));
+	}, {
+		force: values.force === true,
+		site
+	});
+	io.stdout(formatPlanSummary(source, definitions, dir, spec.name, site));
 	return 0;
 };
 const runMapStep = (spec, values, io) => {
 	const token = values.token ?? io.env.SHAPIO_TOKEN;
 	if (!token) throw new UsageError$1("An admin API token is required: pass --token or set SHAPIO_TOKEN");
 	const dir = resolve(String(values.map));
-	const site = values.site ?? io.env.SHAPIO_SITE;
+	const site = siteOf(values, io);
 	return runMap({
 		dir,
 		baseUrl: values.url ?? io.env.SHAPIO_URL ?? "http://localhost:4300",
@@ -3492,7 +3638,7 @@ const importStrapiCommand = createImporterCommand({
 	name: "strapi",
 	label: "Strapi",
 	summary: "Import a Strapi 5 export: --plan writes schema files, --map creates drafts and change sets",
-	usage: "shapio import strapi <export.tar.gz[.enc]> --plan <dir> [--key <encryption key>] [--force]\n       shapio import strapi --map <dir> [--url <origin>] [--token <admin token>] [--site <key>]\n  --plan unpacks the export into <dir>/source (--key for an encrypted export) and writes the planned models\n  and components (<dir>/schema) and <dir>/import-map.json; it sends nothing. Apply the schema with\n  `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json`, then run --map: it uploads the\n  media, creates every document as a draft and opens change sets with the published ones. Strapi 5 only.",
+	usage: "shapio import strapi <export.tar.gz[.enc]> --plan <dir> [--key <encryption key>] [--site <key>] [--force]\n       shapio import strapi --map <dir> [--url <origin>] [--token <admin token>] [--site <key>]\n  --plan unpacks the export into <dir>/source (--key for an encrypted export) and writes the planned models\n  and components (<dir>/schema) and <dir>/import-map.json; it sends nothing. With --site (or SHAPIO_SITE)\n  they belong to that site (<dir>/schema/sites/<key>/); without, they are shared (--map\n  without --site imports into the planned site). Apply the schema with\n  `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media, creates every document as a draft and opens change sets with the published ones.\n  Strapi 5 only.",
 	options: ["key"],
 	plan: async (file, dir, values) => {
 		await extractStrapiExport(file, sourceDir(dir), typeof values.key === "string" ? values.key : void 0);
@@ -4086,7 +4232,7 @@ const importWordPressCommand = createImporterCommand({
 	name: "wordpress",
 	label: "WordPress",
 	summary: "Import a WordPress export (WXR): --plan writes schema files, --map creates drafts and change sets",
-	usage: "shapio import wordpress <export.xml> --plan <dir> [--force]\n       shapio import wordpress --map <dir> [--url <origin>] [--token <admin token>] [--site <key>] [--media-dir <uploads dir>]\n  --plan reads the export and writes the planned models (<dir>/schema) and <dir>/import-map.json; it sends nothing.\n  Apply the models with `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json`, then run --map:\n  it uploads the media (downloaded from the site, or read from --media-dir, a copy of wp-content/uploads),\n  creates every post and page as a draft, and opens change sets with the published ones. Re-run --map to resume.",
+	usage: "shapio import wordpress <export.xml> --plan <dir> [--site <key>] [--force]\n       shapio import wordpress --map <dir> [--url <origin>] [--token <admin token>] [--site <key>] [--media-dir <uploads dir>]\n  --plan reads the export and writes the planned models (<dir>/schema) and <dir>/import-map.json; it sends nothing.\n  With --site (or SHAPIO_SITE) the models belong to that site (<dir>/schema/sites/<key>/); without, they are shared;\n  --map without --site then imports into the planned site.\n  Apply the models with `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media (downloaded from the site, or read from --media-dir, a copy of wp-content/uploads),\n  creates every post and page as a draft, and opens change sets with the published ones. Re-run --map to resume.",
 	options: ["media-dir"],
 	plan: async (file) => wordpressSource(await readWxr(file)),
 	load: async (map, _dir, values) => wordpressSource(await readWxr(map.source.path), mediaDirOf(values))
@@ -4268,13 +4414,28 @@ var UsageError = class extends Error {
 		this.name = "UsageError";
 	}
 };
-/** Shared flags of `shapio schema pull|diff|apply`. URL and token also come from SHAPIO_URL / SHAPIO_TOKEN. */
+const CONNECTION_FLAGS = {
+	url: { type: "string" },
+	token: { type: "string" },
+	site: { type: "string" }
+};
+/** URL, token and site from the flags, else SHAPIO_URL / SHAPIO_TOKEN / SHAPIO_SITE. */
+const resolveConnection = (values, io) => {
+	const token = values.token ?? io.env.SHAPIO_TOKEN;
+	if (!token) throw new UsageError("An admin API token is required: pass --token or set SHAPIO_TOKEN");
+	const site = (values.site ?? io.env.SHAPIO_SITE)?.trim() || void 0;
+	return {
+		baseUrl: values.url ?? io.env.SHAPIO_URL ?? "http://localhost:4300",
+		token,
+		...site ? { site } : {}
+	};
+};
+/** Shared flags of `shapio schema pull|diff|apply`. */
 const parseSchemaOptions = (args, io) => {
 	const { values } = parseArgs({
 		args: [...args],
 		options: {
-			url: { type: "string" },
-			token: { type: "string" },
+			...CONNECTION_FLAGS,
 			dir: { type: "string" },
 			lock: { type: "string" },
 			prune: {
@@ -4301,13 +4462,11 @@ const parseSchemaOptions = (args, io) => {
 		},
 		allowPositionals: false
 	});
-	const token = values.token ?? io.env.SHAPIO_TOKEN;
-	if (!token) throw new UsageError("An admin API token is required: pass --token or set SHAPIO_TOKEN");
+	const connection = resolveConnection(values, io);
 	const waitTimeoutSeconds = Number(values["wait-timeout"] ?? 600);
 	if (!Number.isFinite(waitTimeoutSeconds) || waitTimeoutSeconds <= 0) throw new UsageError("--wait-timeout must be a positive number of seconds");
 	return {
-		baseUrl: values.url ?? io.env.SHAPIO_URL ?? "http://localhost:4300",
-		token,
+		...connection,
 		dir: resolve(values.dir ?? "schema"),
 		lockPath: resolve(values.lock ?? ".shapio/schema-lock.json"),
 		prune: values.prune,
@@ -4318,7 +4477,7 @@ const parseSchemaOptions = (args, io) => {
 		waitTimeoutMs: waitTimeoutSeconds * 1e3
 	};
 };
-const COMMON_USAGE = "[--url <origin>] [--token <admin token>] [--dir schema] [--lock .shapio/schema-lock.json]";
+const COMMON_USAGE = `[--url <origin>] [--token <admin token>] [--site <key>] [--dir schema] [--lock .shapio/schema-lock.json]`;
 const POLL_INTERVAL_MS = 500;
 /** Waits for planned changes (prerequisite jobs) to activate or fail. Returns the failed ones. */
 const waitForChanges = async (options, items, io) => {
@@ -4350,16 +4509,18 @@ const waitForChanges = async (options, items, io) => {
 };
 /**
 * Records the new state in the lock file and rewrites the files of applied definitions in canonical form
-* (e.g. with server-assigned field IDs). Definitions skipped because they were unchanged locally keep
-* their old base, so a later apply still treats them as untouched.
+* (e.g. with server-assigned field IDs), in their scope's folder. Definitions skipped because they were
+* unchanged locally keep their old base, so a later apply still treats them as untouched. Other sites'
+* entries are kept as they are.
 */
 const updateLocalState = async (options, state, response) => {
 	const exported = await apiFor(options).export();
 	const remote = new Map(exported.definitions.map((entry) => [entry.definition.id, entry]));
+	const upgraded = upgradeLockFile(state.lock);
 	const lock = {
-		...state.lock,
+		...upgraded,
 		schemaVersion: exported.schemaVersion,
-		definitions: { ...state.lock.definitions }
+		definitions: { ...upgraded.definitions }
 	};
 	for (const item of response.results) {
 		if (!(item.outcome === "activated" || item.decision.action === "skip" && item.decision.reason === "alreadyApplied")) continue;
@@ -4368,97 +4529,152 @@ const updateLocalState = async (options, state, response) => {
 			delete lock.definitions[item.definitionId];
 			continue;
 		}
-		const previous = state.files.find((file) => file.id === item.definitionId);
-		const path = await writeDefinitionFile(options.dir, entry.definition);
+		const previous = state.sent.find((file) => file.id === item.definitionId);
+		const path = await writeDefinitionFile(options.dir, entry.definition, entry.site);
 		if (previous && previous.path !== path) await removeFile(previous.path);
 		lock.definitions[item.definitionId] = {
 			kind: entry.definition.kind,
 			apiKey: entry.definition.apiKey,
 			version: entry.version,
-			hash: entry.hash
+			hash: entry.hash,
+			site: entry.site
 		};
 	}
-	await writeLockFile(options.lockPath, lock);
+	await writeLockFile(options.lockPath, coverSiteIfHeld(lock, state.siteKey));
+};
+/**
+* `shapio schema apply`: applies local schema files to a running instance live, through the same planner as
+* the admin UI. Three-way per definition against the lock file; refuses (and changes nothing) on conflicts.
+* It sends the shared files and the site's own (`sites/<key>/`), never another site's.
+*/
+const schemaApplyCommand = {
+	summary: "Apply local schema files to the instance live (three-way, per model; refuses on conflicts)",
+	usage: `shapio schema apply ${COMMON_USAGE} [--prune] [--allow-breaking] [--allow-destructive] [--no-wait] [--wait-timeout <s>]`,
+	run: async (args, io) => {
+		const options = parseSchemaOptions(args, io);
+		const state = await readSiteState(options, io);
+		if (!state) return 1;
+		const response = await sendApply(options, state, false, io);
+		if (!response) return 1;
+		printResults(response, state, io, false);
+		const pending = response.results.filter((item) => item.outcome === "pending");
+		const failed = options.wait ? await waitForChanges(options, pending, io) : [];
+		await updateLocalState(options, state, response);
+		const applied = response.results.filter((item) => item.outcome === "activated").length;
+		io.stdout(`Applied ${applied} definition(s) at schema version ${response.schemaVersion}.\n`);
+		return failed.length > 0 ? 1 : 0;
+	}
+};
+/** `shapio schema diff`: what `apply` would do, per definition, without changing anything. */
+const schemaDiffCommand = {
+	summary: "Show what `shapio schema apply` would change on the instance (dry run)",
+	usage: `shapio schema diff ${COMMON_USAGE} [--prune]`,
+	run: async (args, io) => {
+		const options = parseSchemaOptions(args, io);
+		const state = await readSiteState(options, io);
+		if (!state) return 1;
+		const response = await sendApply(options, state, true, io);
+		if (!response) return 1;
+		printResults(response, state, io, false);
+		const pending = response.results.filter((item) => [
+			"create",
+			"update",
+			"delete"
+		].includes(item.decision.action));
+		io.stdout(pending.length === 0 ? "Nothing to apply.\n" : `${pending.length} definition(s) would change.\n`);
+		return 0;
+	}
+};
+/**
+* `shapio schema pull`: writes one site's view of the instance (the shared definitions in `models/` and
+* `components/`, the site's own under `sites/<key>/`) as canonical JSON, one file per model or component,
+* and records what was pulled in the lock file. Another site's folder and lock entries are left alone, so one
+* tree can hold several sites. Refuses to overwrite local edits in the pulled folders unless --force.
+*/
+const schemaPullCommand = {
+	summary: "Write a site’s models and components (shared and its own) to schema files and the lock file",
+	usage: `shapio schema pull ${COMMON_USAGE} [--force]`,
+	run: async (args, io) => {
+		const options = parseSchemaOptions(args, io);
+		const exported = await apiFor(options).export();
+		if (!exported.site) throw new Error("The instance did not say which site this view is; pass --site <key>");
+		const siteKey = exported.site.key;
+		const state = await readLocalState(options);
+		const edited = editedFilesForSite(state.files, state.lock, siteKey);
+		if (edited.length > 0 && !options.force) {
+			io.stderr(`Local schema files have changes that are not on the instance:\n${edited.map((file) => `  ${displayPath(file.path)}`).join("\n")}\nApply them first, or commit them and re-run with --force to overwrite them with the instance’s schema.
+`);
+			return 1;
+		}
+		const written = /* @__PURE__ */ new Map();
+		for (const { definition, site } of exported.definitions) written.set(definition.id, await writeDefinitionFile(options.dir, definition, site));
+		for (const file of staleFilesAfterPull(state.files, siteKey, written)) await removeFile(file.path);
+		await writeLockFile(options.lockPath, mergePulledLock(state.lock, {
+			schemaVersion: exported.schemaVersion,
+			siteKey,
+			definitions: exported.definitions
+		}));
+		io.stdout(`Pulled ${exported.definitions.length} definition(s) of site "${siteKey}" at schema version ${exported.schemaVersion} into ${displayPath(options.dir)}\n`);
+		return 0;
+	}
+};
+const parseScopeOptions = (args, io) => {
+	const { values, positionals } = parseArgs({
+		args: [...args],
+		options: {
+			...CONNECTION_FLAGS,
+			shared: {
+				type: "boolean",
+				default: false
+			},
+			version: { type: "string" }
+		},
+		allowPositionals: true
+	});
+	const [apiKey, ...extra] = positionals;
+	if (!apiKey || extra.length > 0) throw new UsageError("Name one model or component by its API ID");
+	if (!values.shared && !values.site) throw new UsageError("Pass --site <key> to keep it on that site, or --shared to share it with all sites");
+	const version = values.version === void 0 ? void 0 : Number(values.version);
+	if (version !== void 0 && (!Number.isInteger(version) || version < 1)) throw new UsageError("--version must be a positive integer");
+	return {
+		...resolveConnection(values, io),
+		apiKey,
+		shared: values.shared,
+		version
+	};
 };
 const SUBCOMMANDS$1 = {
-	pull: {
-		summary: "Write the instance’s models and components to schema files and the lock file",
-		usage: `shapio schema pull ${COMMON_USAGE} [--force]`,
+	pull: schemaPullCommand,
+	diff: schemaDiffCommand,
+	apply: schemaApplyCommand,
+	scope: {
+		summary: "Keep a shared model or component on one site (--site), or share a site’s with all sites (--shared)",
+		usage: "shapio schema scope <apiKey> (--site <key> | --shared [--site <key>]) [--url <origin>] [--token <admin token>] [--version <n>]",
 		run: async (args, io) => {
-			const options = parseSchemaOptions(args, io);
-			const state = await readLocalState(options);
-			const edited = state.files.filter((file) => {
-				const base = file.id ? state.lock.definitions[file.id] : void 0;
-				return !base || file.hash !== base.hash;
-			});
-			if (edited.length > 0 && !options.force && Object.keys(state.lock.definitions).length > 0) {
-				io.stderr(`Local schema files have changes that are not on the instance:\n${edited.map((file) => `  ${displayPath(file.path)}`).join("\n")}\nApply them first, or commit them and re-run with --force to overwrite them with the instance’s schema.
-`);
+			const options = parseScopeOptions(args, io);
+			const client = clientFor(options);
+			const exported = await client.admin.schema.export();
+			const siteKey = options.site ?? exported.site?.key ?? "(default)";
+			const found = exported.definitions.find(({ definition }) => definition.apiKey === options.apiKey);
+			if (!found) {
+				io.stderr(`Site "${siteKey}" has no model or component with API ID "${options.apiKey}".\n`);
 				return 1;
 			}
-			const exported = await apiFor(options).export();
-			const lock = {
-				formatVersion: 1,
-				schemaVersion: exported.schemaVersion,
-				definitions: {}
-			};
-			const written = /* @__PURE__ */ new Set();
-			for (const { definition, version, hash } of exported.definitions) {
-				written.add(await writeDefinitionFile(options.dir, definition));
-				lock.definitions[definition.id] = {
-					kind: definition.kind,
-					apiKey: definition.apiKey,
-					version,
-					hash
-				};
-			}
-			for (const file of state.files.filter((candidate) => !written.has(candidate.path))) await removeFile(file.path);
-			await writeLockFile(options.lockPath, lock);
-			io.stdout(`Pulled ${exported.definitions.length} definition(s) at schema version ${exported.schemaVersion} into ${displayPath(options.dir)}\n`);
-			return 0;
-		}
-	},
-	diff: {
-		summary: "Show what `shapio schema apply` would change on the instance (dry run)",
-		usage: `shapio schema diff ${COMMON_USAGE} [--prune]`,
-		run: async (args, io) => {
-			const options = parseSchemaOptions(args, io);
-			const state = await readLocalState(options);
-			const response = await sendApply(options, state, true, io);
-			if (!response) return 1;
-			printResults(response, state, io, false);
-			const pending = response.results.filter((item) => [
-				"create",
-				"update",
-				"delete"
-			].includes(item.decision.action));
-			io.stdout(pending.length === 0 ? "Nothing to apply.\n" : `${pending.length} definition(s) would change.\n`);
+			const outcome = await (found.definition.kind === "component" ? client.admin.components : client.admin.models).changeScope(found.definition.id, {
+				scope: options.shared ? "network" : "site",
+				version: options.version ?? found.version
+			});
+			const where = outcome.scope === "network" ? "shared with all sites" : `on site "${siteKey}" only`;
+			io.stdout(outcome.status === "unchanged" ? `${options.apiKey} is already ${where}.\n` : `${options.apiKey} is now ${where} (version ${outcome.version}, schema version ${outcome.schemaVersion}).\nPull to move its file: shapio schema pull --site ${siteKey}\n`);
 			return 0;
 		}
-	},
-	apply: {
-		summary: "Apply local schema files to the instance live (three-way, per model; refuses on conflicts)",
-		usage: `shapio schema apply ${COMMON_USAGE} [--prune] [--allow-breaking] [--allow-destructive] [--no-wait] [--wait-timeout <s>]`,
-		run: async (args, io) => {
-			const options = parseSchemaOptions(args, io);
-			const state = await readLocalState(options);
-			const response = await sendApply(options, state, false, io);
-			if (!response) return 1;
-			printResults(response, state, io, false);
-			const pending = response.results.filter((item) => item.outcome === "pending");
-			const failed = options.wait ? await waitForChanges(options, pending, io) : [];
-			await updateLocalState(options, state, response);
-			const applied = response.results.filter((item) => item.outcome === "activated").length;
-			io.stdout(`Applied ${applied} definition(s) at schema version ${response.schemaVersion}.\n`);
-			return failed.length > 0 ? 1 : 0;
-		}
 	}
 };
 const help$1 = () => `Usage:\n${Object.values(SUBCOMMANDS$1).map((command) => `  ${command.usage}\n      ${command.summary}`).join("\n")}\n`;
-/** `shapio schema <pull|diff|apply>`: git-like schema sync over HTTP with an admin API token. */
+/** `shapio schema <pull|diff|apply|scope>`: git-like schema sync over HTTP with an admin API token. */
 const schemaCommand = {
-	summary: "Sync models and components with schema files: pull | diff | apply",
-	usage: "shapio schema <pull|diff|apply> [options]",
+	summary: "Sync models and components with schema files: pull | diff | apply | scope",
+	usage: "shapio schema <pull|diff|apply|scope> [options]",
 	run: async (args, io) => {
 		const [name, ...rest] = args;
 		const command = name ? SUBCOMMANDS$1[name] : void 0;
@@ -4473,6 +4689,10 @@ const schemaCommand = {
 				io.stderr(`shapio schema ${name}: ${error.message}\n`);
 				return 1;
 			}
+			if (error instanceof ShapioApiError) {
+				io.stderr(formatApiError(error, [], /* @__PURE__ */ new Map()));
+				return 1;
+			}
 			throw error;
 		}
 	}
@@ -5050,7 +5270,7 @@ const adminCommand = {
 		}
 	}
 };
-const SITES_USAGE = "shapio sites list\nshapio sites create --key <key> --name <name>\n  Lists or creates sites directly in the database (sites share the schema, admins and roles; each has its\n  own content, media, tokens and snapshots). Keys are lower case and fixed once created.";
+const SITES_USAGE = "shapio sites list\nshapio sites create --key <key> --name <name>\n  Lists or creates sites directly in the database (sites share the admins, roles and shared content types;\n  each has its own content types, content, media, tokens and snapshots). Keys are lower case and fixed once\n  created.";
 const SITE_KEY_RE = new RegExp(SITE_KEY_PATTERN);
 const runSites = async (subcommand, options, io) => {
 	const config = loadConfig();