@shapio/cms 0.5.0 → 0.5.2

package/dist/admin/index.html

@@ -17,75 +17,75 @@
          API serves it (empty without extension themes); `vite-ignore` keeps Vite from bundling it. -->
     <link rel="stylesheet" href="../api/admin/extensions/themes.css"  />
     <script type="importmap">{"imports":{"react":"./assets/shared-react-KADNSNpb.js","react/jsx-runtime":"./assets/shared-react-jsx-runtime-CU_Fm1m8.js","react-dom":"./assets/shared-react-dom-BpneAejY.js","react-dom/client":"./assets/shared-react-dom-client-CnpZTXxo.js","@shapio/editor-sdk":"./assets/shared-shapio-editor-sdk-9ANIbEN0.js"}}</script>
-    <script type="module" crossorigin src="./assets/index-DHmfMpqz.js"></script>
+    <script type="module" crossorigin src="./assets/index-cpiZvLck.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-Dd_uD5pT.js">
     <link rel="modulepreload" crossorigin href="./assets/react-CQOZoUwg.js">
     <link rel="modulepreload" crossorigin href="./assets/react-dom-pEVw9mjF.js">
     <link rel="modulepreload" crossorigin href="./assets/client-C8vMCv-p.js">
     <link rel="modulepreload" crossorigin href="./assets/jsx-runtime-DREnUpxT.js">
-    <link rel="modulepreload" crossorigin href="./assets/cn-h5ORT3LK.js">
-    <link rel="modulepreload" crossorigin href="./assets/auth-BzCgJtgr.js">
-    <link rel="modulepreload" crossorigin href="./assets/skeleton-DJVukcn6.js">
-    <link rel="modulepreload" crossorigin href="./assets/badge-DBoaS0nQ.js">
+    <link rel="modulepreload" crossorigin href="./assets/cn-CEPUgFbZ.js">
+    <link rel="modulepreload" crossorigin href="./assets/auth-cXFFyABE.js">
+    <link rel="modulepreload" crossorigin href="./assets/skeleton-BPLAzyDo.js">
+    <link rel="modulepreload" crossorigin href="./assets/badge-DrPwivGk.js">
     <link rel="modulepreload" crossorigin href="./assets/root-CDpNo7ef.js">
-    <link rel="modulepreload" crossorigin href="./assets/Match-CgfZTzqs.js">
-    <link rel="modulepreload" crossorigin href="./assets/RowTitle-mkKp4yfl.js">
+    <link rel="modulepreload" crossorigin href="./assets/Match-CvpSNEfi.js">
+    <link rel="modulepreload" crossorigin href="./assets/RowTitle-Cted2GP8.js">
     <link rel="modulepreload" crossorigin href="./assets/src-Be3Ds5Dc.js">
-    <link rel="modulepreload" crossorigin href="./assets/theme-RHTVnR9j.js">
-    <link rel="modulepreload" crossorigin href="./assets/table-BMbbRUK9.js">
-    <link rel="modulepreload" crossorigin href="./assets/coerce-DDQ1vGLx.js">
-    <link rel="modulepreload" crossorigin href="./assets/useResolvedScheme-DHD-zisP.js">
-    <link rel="modulepreload" crossorigin href="./assets/InfoHint-D3uwei-E.js">
-    <link rel="modulepreload" crossorigin href="./assets/ConfirmDialog-BW-l3Whg.js">
+    <link rel="modulepreload" crossorigin href="./assets/theme-CnSar6tt.js">
+    <link rel="modulepreload" crossorigin href="./assets/table-CLVW6uJB.js">
+    <link rel="modulepreload" crossorigin href="./assets/coerce-BxuBjZdf.js">
+    <link rel="modulepreload" crossorigin href="./assets/useResolvedScheme-SoI-2Faf.js">
+    <link rel="modulepreload" crossorigin href="./assets/InfoHint-BdAadb9U.js">
+    <link rel="modulepreload" crossorigin href="./assets/ConfirmDialog-DVN-n-tE.js">
     <link rel="modulepreload" crossorigin href="./assets/settle-LRKtTN_e.js">
-    <link rel="modulepreload" crossorigin href="./assets/HintedLabel-BGidukgy.js">
-    <link rel="modulepreload" crossorigin href="./assets/zod-Dcwk-m8X.js">
-    <link rel="modulepreload" crossorigin href="./assets/FormCheckboxGroup-JP1xzReQ.js">
-    <link rel="modulepreload" crossorigin href="./assets/useSchemaScopeAccess-BNeVslcv.js">
-    <link rel="modulepreload" crossorigin href="./assets/calendar-clock-BEA3tG17.js">
-    <link rel="modulepreload" crossorigin href="./assets/clock-BKNNASKp.js">
-    <link rel="modulepreload" crossorigin href="./assets/search-Dy2dtwyR.js">
-    <link rel="modulepreload" crossorigin href="./assets/image-D9p_gGE2.js">
-    <link rel="modulepreload" crossorigin href="./assets/layers-CkZyCaeb.js">
-    <link rel="modulepreload" crossorigin href="./assets/link-Bvqcg7db.js">
-    <link rel="modulepreload" crossorigin href="./assets/dropdown-menu-DGSMTf23.js">
-    <link rel="modulepreload" crossorigin href="./assets/constants-DH7oqfO_.js">
-    <link rel="modulepreload" crossorigin href="./assets/boxes-DhN0ctLo.js">
-    <link rel="modulepreload" crossorigin href="./assets/chevron-left-BeJdUVAX.js">
-    <link rel="modulepreload" crossorigin href="./assets/CursorPager-BW2Dl_hn.js">
-    <link rel="modulepreload" crossorigin href="./assets/preload-helper-DEbJbZwX.js">
-    <link rel="modulepreload" crossorigin href="./assets/circle-check-ktACw37r.js">
-    <link rel="modulepreload" crossorigin href="./assets/ellipsis-BMP-j3yO.js">
-    <link rel="modulepreload" crossorigin href="./assets/schema-CWHuez0q.js">
+    <link rel="modulepreload" crossorigin href="./assets/HintedLabel-DIEBvftx.js">
+    <link rel="modulepreload" crossorigin href="./assets/zod-cTJwCa4E.js">
+    <link rel="modulepreload" crossorigin href="./assets/FormCheckboxGroup-DAeuGKAU.js">
+    <link rel="modulepreload" crossorigin href="./assets/useSchemaScopeAccess-B4-31q7m.js">
+    <link rel="modulepreload" crossorigin href="./assets/calendar-clock-DPyjti63.js">
+    <link rel="modulepreload" crossorigin href="./assets/clock-DNhupIko.js">
+    <link rel="modulepreload" crossorigin href="./assets/search-D3GGSaSL.js">
+    <link rel="modulepreload" crossorigin href="./assets/image-4itB4TLl.js">
+    <link rel="modulepreload" crossorigin href="./assets/layers-ZPmcbieN.js">
+    <link rel="modulepreload" crossorigin href="./assets/link-BnDFFyvi.js">
+    <link rel="modulepreload" crossorigin href="./assets/dropdown-menu-BG1rctRQ.js">
+    <link rel="modulepreload" crossorigin href="./assets/constants-B9cNrCXV.js">
+    <link rel="modulepreload" crossorigin href="./assets/boxes-CKJ6P9VA.js">
+    <link rel="modulepreload" crossorigin href="./assets/chevron-left-DIp5sJuv.js">
+    <link rel="modulepreload" crossorigin href="./assets/CursorPager-Cb94mITn.js">
+    <link rel="modulepreload" crossorigin href="./assets/preload-helper-pwSesV5P.js">
+    <link rel="modulepreload" crossorigin href="./assets/circle-check-VXPKg4cE.js">
+    <link rel="modulepreload" crossorigin href="./assets/ellipsis-DHfP1Ah2.js">
+    <link rel="modulepreload" crossorigin href="./assets/schema-BJHcYshf.js">
     <link rel="modulepreload" crossorigin href="./assets/modelPermissions-DZ1lWfQZ.js">
-    <link rel="modulepreload" crossorigin href="./assets/contentCounts-BpGlmyeZ.js">
-    <link rel="modulepreload" crossorigin href="./assets/usePlaces-Cj5PljTy.js">
-    <link rel="modulepreload" crossorigin href="./assets/globe-DOoGBy23.js">
-    <link rel="modulepreload" crossorigin href="./assets/inbox-CMzYVMZo.js">
-    <link rel="modulepreload" crossorigin href="./assets/key-round-HBvMrmMo.js">
-    <link rel="modulepreload" crossorigin href="./assets/sparkles-Dd6S_roX.js">
-    <link rel="modulepreload" crossorigin href="./assets/sections-BfG6DTFr.js">
-    <link rel="modulepreload" crossorigin href="./assets/plus-BXMBYPoB.js">
-    <link rel="modulepreload" crossorigin href="./assets/scroll-text-DlcDEi2k.js">
-    <link rel="modulepreload" crossorigin href="./assets/send-DVgq5Iwg.js">
-    <link rel="modulepreload" crossorigin href="./assets/UserAvatar-BHNWHDVb.js">
+    <link rel="modulepreload" crossorigin href="./assets/contentCounts-CX15iYcR.js">
+    <link rel="modulepreload" crossorigin href="./assets/usePlaces-o4Os5Nbv.js">
+    <link rel="modulepreload" crossorigin href="./assets/globe-RjXj4P-A.js">
+    <link rel="modulepreload" crossorigin href="./assets/inbox-97pzmuus.js">
+    <link rel="modulepreload" crossorigin href="./assets/key-round-Dc4_SOi-.js">
+    <link rel="modulepreload" crossorigin href="./assets/sparkles-CykwtKTd.js">
+    <link rel="modulepreload" crossorigin href="./assets/sections-BWoTaw2B.js">
+    <link rel="modulepreload" crossorigin href="./assets/plus-yxvf4aAT.js">
+    <link rel="modulepreload" crossorigin href="./assets/scroll-text-BHLmZpBB.js">
+    <link rel="modulepreload" crossorigin href="./assets/send-Bqhmg9HP.js">
+    <link rel="modulepreload" crossorigin href="./assets/UserAvatar-W-S3st7E.js">
     <link rel="modulepreload" crossorigin href="./assets/constants-DUBUgzpU.js">
     <link rel="modulepreload" crossorigin href="./assets/constants-DCtq_UOe.js">
-    <link rel="modulepreload" crossorigin href="./assets/searchSchemas-Cz4P1iku.js">
-    <link rel="modulepreload" crossorigin href="./assets/users-CppI8ctO.js">
-    <link rel="modulepreload" crossorigin href="./assets/sections-EgXyXN3-.js">
-    <link rel="modulepreload" crossorigin href="./assets/tooltip-BfSF6EyR.js">
-    <link rel="modulepreload" crossorigin href="./assets/TextLink-DzNaAft6.js">
+    <link rel="modulepreload" crossorigin href="./assets/searchSchemas-C4dnYI9a.js">
+    <link rel="modulepreload" crossorigin href="./assets/users-Oj5V5za_.js">
+    <link rel="modulepreload" crossorigin href="./assets/sections-eeTU636D.js">
+    <link rel="modulepreload" crossorigin href="./assets/tooltip-xfZn0Fla.js">
+    <link rel="modulepreload" crossorigin href="./assets/TextLink-BPLbXw2n.js">
     <link rel="modulepreload" crossorigin href="./assets/sites-C6_THCVK.js">
-    <link rel="modulepreload" crossorigin href="./assets/store-BP-xStwU.js">
-    <link rel="modulepreload" crossorigin href="./assets/usePaletteItems-D3PZsW0Q.js">
-    <link rel="modulepreload" crossorigin href="./assets/SharedGlyph-CuDT7OUU.js">
-    <link rel="modulepreload" crossorigin href="./assets/QueryView-C2d392ly.js">
+    <link rel="modulepreload" crossorigin href="./assets/store-GOGeP63I.js">
+    <link rel="modulepreload" crossorigin href="./assets/usePaletteItems-CqcKndUT.js">
+    <link rel="modulepreload" crossorigin href="./assets/SharedGlyph-BrLi3Hug.js">
+    <link rel="modulepreload" crossorigin href="./assets/QueryView-Bbw1eiV2.js">
     <link rel="modulepreload" crossorigin href="./assets/useDebouncedValue-Dqs3wwhn.js">
     <link rel="modulepreload" crossorigin href="./assets/useSearchInput-1fDoEtXe.js">
-    <link rel="modulepreload" crossorigin href="./assets/radio-group-BIhT_uEK.js">
-    <link rel="modulepreload" crossorigin href="./assets/FormRadioGroup-BvSC8SRm.js">
-    <link rel="modulepreload" crossorigin href="./assets/useDiscardGuard-Dhbif7VL.js">
+    <link rel="modulepreload" crossorigin href="./assets/radio-group-Fc2ENIMO.js">
+    <link rel="modulepreload" crossorigin href="./assets/FormRadioGroup--xx08rw6.js">
+    <link rel="modulepreload" crossorigin href="./assets/useDiscardGuard-CSkPw8iq.js">
     <link rel="stylesheet" crossorigin href="./assets/index-6iVBpUhu.css">
   </head>
   <body>

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as parseLockFile, A as buildEditorManifest, B as RESERVED_DEFINITION_API_KEYS, C as loopbackUrl, D as BEFORE_EVENTS, E as AFTER_EVENTS, F as lockById, G as THEME_VARIANTS, H as RESERVED_TYPE_NAMES, I as update, J as hashDefinition, K as checkThemeContrast, L as STORAGE_DRIVERS, N as listForAssets, O as EXTENSION_JOB_PREFIX, P as listLiveByDriver, Q as parseDefinition, R as describeError, S as createUrlBuilder, T as loadProjectConfig, U as SCHEMA_KIND_DIRECTORIES, V as RESERVED_FIELD_API_KEYS, W as SITES_DIRECTORY, X as lockEntriesForSite, Y as lockCoversSite, Z as mergePulledLock, _ as listAllSites, a as loadConfig, at as toTypeName, b as generateToken, ct as withSiteCovered, d as migrateToLatest, dt as createStableId, et as schemaFilePath, f as SHAPIO_VERSION, ft as validateRichText, g as createSite, i as assertDatabaseReachable, it as suggestPlural, k as EXTENSION_ROUTE_ROOT, lt as RICHTEXT_FORMAT, mt as sqliteDriverOf, n as startServer, nt as serializeDefinition, o as loadEnvFileIfPresent, ot as upgradeLockFile, p as createMediaStorage, pt as createDb, q as foldApiKey, r as copyObjectVerified, rt as serializeLockFile, st as validateSchema, t as startDedicatedWorker, tt as scopeDirectory, u as getPendingMigrations, ut as SAFE_LINK_PATTERN, v as createAdminDirect, w as SITE_KEY_PATTERN, x as createLogger, y as SYSTEM_CLI_ACTOR } from "./worker-jz_0yAmS.js";
+import { $ as parseLockFile, A as buildEditorManifest, B as RESERVED_DEFINITION_API_KEYS, C as loopbackUrl, D as BEFORE_EVENTS, E as AFTER_EVENTS, F as lockById, G as THEME_VARIANTS, H as RESERVED_TYPE_NAMES, I as update, J as hashDefinition, K as checkThemeContrast, L as STORAGE_DRIVERS, N as listForAssets, O as EXTENSION_JOB_PREFIX, P as listLiveByDriver, Q as parseDefinition, R as describeError, S as createUrlBuilder, T as loadProjectConfig, U as SCHEMA_KIND_DIRECTORIES, V as RESERVED_FIELD_API_KEYS, W as SITES_DIRECTORY, X as lockEntriesForSite, Y as lockCoversSite, Z as mergePulledLock, _ as listAllSites, a as loadConfig, at as toTypeName, b as generateToken, ct as withSiteCovered, d as migrateToLatest, dt as createStableId, et as schemaFilePath, f as SHAPIO_VERSION, ft as validateRichText, g as createSite, i as assertDatabaseReachable, it as suggestPlural, k as EXTENSION_ROUTE_ROOT, lt as RICHTEXT_FORMAT, mt as sqliteDriverOf, n as startServer, nt as serializeDefinition, o as loadEnvFileIfPresent, ot as upgradeLockFile, p as createMediaStorage, pt as createDb, q as foldApiKey, r as copyObjectVerified, rt as serializeLockFile, st as validateSchema, t as startDedicatedWorker, tt as scopeDirectory, u as getPendingMigrations, ut as SAFE_LINK_PATTERN, v as createAdminDirect, w as SITE_KEY_PATTERN, x as createLogger, y as SYSTEM_CLI_ACTOR } from "./worker-W5eY5lSj.js";
 import { createDecipheriv, createHash, scryptSync } from "node:crypto";
 import { createReadStream, createWriteStream, existsSync, openAsBlob } from "node:fs";
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve } from "node:path";
@@ -800,7 +800,8 @@ const isNextRuntime = () => {
 	}
 };
 /** The `cache` and `next` fetch options of one delivery read; empty outside Next unless asked for. */
-const nextFetchInit = ({ client, read, tags, pinned }) => {
+const nextFetchInit = ({ client, read, tags, pinned, drafts = false }) => {
+	if (drafts) return client !== void 0 && client !== false || read !== void 0 && read !== false || isNextRuntime() ? { cache: "no-store" } : {};
 	if (read === false || read === void 0 && client === false) return {};
 	const configured = client === false ? read : read === void 0 ? client : {
 		...client,
@@ -823,51 +824,63 @@ const nextFetchInit = ({ client, read, tags, pinned }) => {
 };
 const DELIVERY_PATH = "/api/content";
 const routePath = (routeKey) => `${DELIVERY_PATH}/${encodeURIComponent(routeKey)}`;
-/** The content query string plus `snapshot`, `richText` and `seo`, which only delivery reads take. */
-const deliveryQueryString = ({ snapshot, richText, seo, ...query }) => {
+/**
+* The content query string plus `snapshot`, `richText` and `seo`, which only delivery reads take, and
+* `publicationState=draft` in drafts mode.
+*/
+const deliveryQueryString = ({ snapshot, richText, seo, ...query }, drafts) => {
 	const extra = [
 		...snapshot === void 0 ? [] : [`snapshot=${encodeURIComponent(String(snapshot))}`],
 		...richText === void 0 ? [] : [`richText=${encodeURIComponent(richText)}`],
-		...seo === void 0 ? [] : [`seo=${encodeURIComponent(seo)}`]
+		...seo === void 0 ? [] : [`seo=${encodeURIComponent(seo)}`],
+		...drafts ? ["publicationState=draft"] : []
 	];
 	const base = toContentQueryString(query);
 	if (extra.length === 0) return base;
 	return base ? `${base}&${extra.join("&")}` : `?${extra.join("&")}`;
 };
+/** Drafts cannot be pinned: the server refuses `snapshot` with drafts, and so does the client, before sending. */
+const draftsPinned = () => Promise.reject(/* @__PURE__ */ new Error("Drafts mode reads saved drafts, which have no publication snapshot: leave `snapshot` out when the client has `drafts: true`"));
 /**
 * Published content, typed by the caller (`delivery.list<Article>('articles', { locale: 'fr', snapshot })`).
 * A collection is read with `list` (a page) and `get` (one entry); a singleton with `singleton`. Each read
 * takes Next.js cache options last and is tagged for `revalidateTag` (nextCache.ts): lists and singletons with
-* the site and model tags, `get` with the entry's tag too.
+* the site and model tags, `get` with the entry's tag too. In drafts mode (`drafts: true`) every read asks for
+* drafts (`publicationState=draft`), is never cached or tagged under Next, and refuses a pinned snapshot.
 */
 const createDeliveryApi = (request, cacheContext) => {
+	const { drafts } = cacheContext;
 	const fetchInit = (tags, query, { next }) => nextFetchInit({
 		client: cacheContext.next,
 		read: next,
 		tags,
-		pinned: query.snapshot !== void 0
+		pinned: query.snapshot !== void 0,
+		drafts
 	});
+	const read = (path, tags, query, options) => drafts && query.snapshot !== void 0 ? draftsPinned() : request(`${path}${deliveryQueryString(query, drafts)}`, fetchInit(tags, query, options));
 	const siteTag = shapioTags.site(cacheContext.site);
 	return {
-		list: (routeKey, query = {}, options = {}) => request(`${routePath(routeKey)}${deliveryQueryString(query)}`, fetchInit([siteTag, shapioTags.model(routeKey)], query, options)),
-		singleton: (apiKey, query = {}, options = {}) => request(`${routePath(apiKey)}${deliveryQueryString(query)}`, fetchInit([siteTag, shapioTags.model(apiKey)], query, options)),
-		get: (routeKey, id, query = {}, options = {}) => request(`${routePath(routeKey)}/${encodeURIComponent(id)}${deliveryQueryString(query)}`, fetchInit([
+		list: (routeKey, query = {}, options = {}) => read(routePath(routeKey), [siteTag, shapioTags.model(routeKey)], query, options),
+		singleton: (apiKey, query = {}, options = {}) => read(routePath(apiKey), [siteTag, shapioTags.model(apiKey)], query, options),
+		get: (routeKey, id, query = {}, options = {}) => read(`${routePath(routeKey)}/${encodeURIComponent(id)}`, [
 			siteTag,
 			shapioTags.model(routeKey),
 			shapioTags.entry(routeKey, id)
-		], query, options))
+		], query, options)
 	};
 };
 const DELIVERY_SITE_PATH = "/api/site";
 /**
 * The request's site as delivery sees it (key, name, SEO defaults), with the client's token and site. Under
-* Next.js the read carries the site tag (nextCache.ts).
+* Next.js the read carries the site tag (nextCache.ts); in drafts mode it is `no-store` and untagged instead
+* (the site has no draft state, so no `publicationState` is sent).
 */
 const createSiteApi = (request, cacheContext) => ({ get: ({ next } = {}) => request(DELIVERY_SITE_PATH, nextFetchInit({
 	client: cacheContext.next,
 	read: next,
 	tags: [shapioTags.site(cacheContext.site)],
-	pinned: false
+	pinned: false,
+	drafts: cacheContext.drafts
 })) });
 const SNAPSHOT_PATHS = {
 	current: "/api/snapshots/current",
@@ -906,13 +919,14 @@ const createSnapshotsApi = (request) => {
 * publication snapshots (`snapshots`). `createClient` builds it over HTTP; `@shapio/local` over the delivery
 * API running in the same process. The transport receives exactly the paths the HTTP client sends.
 */
-const createDeliveryClient = (request, { site, next } = {}) => {
+const createDeliveryClient = (request, { site, next, drafts = false } = {}) => {
 	const cacheContext = {
 		site,
-		next
+		next,
+		drafts
 	};
 	return {
-		/** Published content (the delivery API), typed by the caller. */
+		/** Published content (the delivery API; drafts in drafts mode), typed by the caller. */
 		delivery: createDeliveryApi(request, cacheContext),
 		/** The site as delivery sees it: key, name and SEO defaults (`GET /api/site`). */
 		site: createSiteApi(request, cacheContext),
@@ -992,7 +1006,7 @@ const createRequest = ({ baseUrl, token, fetch, credentials, headers, site }) =>
 		return parsed;
 	};
 };
-const createClient = ({ baseUrl, token, fetch = globalThis.fetch, credentials, headers, site, next }) => {
+const createClient = ({ baseUrl, token, fetch = globalThis.fetch, credentials, headers, site, next, drafts }) => {
 	const request = createRequest({
 		baseUrl,
 		token,
@@ -1003,7 +1017,8 @@ const createClient = ({ baseUrl, token, fetch = globalThis.fetch, credentials, h
 	});
 	const reads = createDeliveryClient(request, {
 		site,
-		next
+		next,
+		...drafts !== void 0 ? { drafts } : {}
 	});
 	return {
 		/**
@@ -2275,12 +2290,18 @@ const planStrapiSchema = (schemas) => {
 	};
 	const taken = /* @__PURE__ */ new Set();
 	const plans = /* @__PURE__ */ new Map();
+	/** The API ID for `name`; a reserved or repeated name gets a suffix, which the plan lists. */
+	const claimApiKey = (schema, name) => {
+		const apiKey = definitionApiKey(name, taken);
+		if (apiKey !== toCamelCase(name)) context.notes.push(`${schema.uid} is named ${apiKey} (the name is reserved or already taken).`);
+		return apiKey;
+	};
 	for (const schema of contentTypes) {
-		const apiKey = definitionApiKey(schema.info?.singularName ?? schema.uid.split(".").at(-1) ?? "model", taken);
-		plans.set(schema.uid, planDefinition(schema, apiKey, context));
+		const name = schema.info?.singularName ?? schema.uid.split(".").at(-1) ?? "model";
+		plans.set(schema.uid, planDefinition(schema, claimApiKey(schema, name), context));
 	}
 	const baseName = componentBaseNames(components);
-	for (const schema of components) plans.set(schema.uid, planDefinition(schema, definitionApiKey(baseName(schema), taken), context));
+	for (const schema of components) plans.set(schema.uid, planDefinition(schema, claimApiKey(schema, baseName(schema)), context));
 	if (contentTypes.some((schema) => schema.options?.draftAndPublish === false)) context.notes.push(`Draft and publish is turned on for ${contentTypes.filter((schema) => schema.options?.draftAndPublish === false).map((schema) => plans.get(schema.uid)?.definition.apiKey).join(", ")} (off in Strapi), so imported entries are reviewed before they go live.`);
 	return {
 		plans,
@@ -2322,6 +2343,8 @@ const indexLinks = (links) => {
 const stringOf = (value) => typeof value === "string" ? value : void 0;
 /** Strapi IDs and numeric scalars as text (objects are not scalars and give undefined). */
 const textOf = (value) => typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : void 0;
+/** Strapi's `name` may lack the extension (its example project's names do); `ext` always has it. */
+const withExtension = (name, ext) => name.toLowerCase().endsWith(ext.toLowerCase()) ? name : `${name}${ext}`;
 const fileMedia = (data, root) => {
 	const hash = stringOf(data.hash);
 	const ext = stringOf(data.ext) ?? "";
@@ -2330,9 +2353,10 @@ const fileMedia = (data, root) => {
 	const alt = stringOf(data.alternativeText);
 	const caption = stringOf(data.caption);
 	const mimeType = stringOf(data.mime);
+	const name = stringOf(data.name);
 	return {
 		sourceId: `file:${id}`,
-		filename: stringOf(data.name) ?? `${hash}${ext}`,
+		filename: name ? withExtension(name, ext) : `${hash}${ext}`,
 		path: join(root, "assets", "uploads", `${hash}${ext}`),
 		...mimeType ? { mimeType } : {},
 		...alt ? { alt } : {},
@@ -3634,13 +3658,39 @@ const runMap = async (options, io) => {
 	for (const failure of changeSets.failed) io.stderr(`  ! change set item ${failure.key}: ${failure.message}\n`);
 	return printSummary(run, source, changeSets.failed.length);
 };
+/**
+* The site a `--plan` writes its models for. `--plan` runs offline (no URL or token), so it cannot ask the
+* instance which site a token works on: it takes `--site`, else `SHAPIO_SITE`, else the primary site, whose key
+* is always `default`. On a single-site instance that is the only site, so the planned models apply with an
+* ordinary admin token. `--shared` plans models shared with all sites instead (applying them needs a network
+* admin token).
+*/
+const PRIMARY_SITE_KEY = "default";
+const resolvePlanSite = (options, env) => {
+	const named = options.site?.trim() || void 0;
+	if (options.shared) {
+		if (named) throw new UsageError$1("Pass either --site <key> or --shared, not both");
+		return {
+			site: void 0,
+			explicit: true
+		};
+	}
+	const site = named ?? (env.SHAPIO_SITE?.trim() || void 0);
+	return site ? {
+		site,
+		explicit: true
+	} : {
+		site: PRIMARY_SITE_KEY,
+		explicit: false
+	};
+};
 /** Relative to the working directory when inside it, else absolute (what to paste into the next command). */
 const display = (path) => {
 	const shown = relative(process.cwd(), path);
 	return !shown ? "." : shown.startsWith("..") || isAbsolute(shown) ? path : shown;
 };
 /** What `--plan` wrote and what to do next. */
-const formatPlanSummary = (source, definitions, dir, command, site) => {
+const formatPlanSummary = (source, definitions, dir, command, { site, explicit }) => {
 	const keyOf = new Map(source.definitions.map((definition) => [definition.apiKey, definition.key]));
 	const lines = [`Planned ${definitions.length} definition(s) in ${display(`${dir}/${PLAN_SCHEMA_DIR}`)}:`];
 	for (const definition of definitions) {
@@ -3651,8 +3701,8 @@ const formatPlanSummary = (source, definitions, dir, command, site) => {
 	lines.push(`Media: ${source.media.length} file(s) to import.`);
 	lines.push("Every model has draft and publish on: nothing goes live until you ship the change set(s) the import opens.");
 	lines.push(...source.notes);
-	lines.push(site ? `The models and components will belong to site "${site}".` : "No --site given: the models and components will be shared with all sites. Plan again with --site <key> to keep them on one site.");
-	const siteFlag = site ? ` --site ${site}` : "";
+	lines.push(!site ? "The models and components will be shared with all sites (--shared): applying them needs a network admin token." : explicit ? `The models and components will belong to site "${site}".` : `The models and components will belong to the primary site ("${site}"). Plan with --site <key> for another site, or --shared to share them with all sites.`);
+	const siteFlag = site && explicit ? ` --site ${site}` : "";
 	lines.push("Next:", "  1. Review the files: rename API IDs or delete fields you do not want (entries follow the stable IDs).", `  2. shapio schema apply --dir ${display(`${dir}/${PLAN_SCHEMA_DIR}`)} --lock ${display(`${dir}/${PLAN_LOCK_FILE}`)}${siteFlag}`, `  3. shapio import ${command} --map ${display(dir)}${siteFlag}`);
 	return `${lines.join("\n")}\n`;
 };
@@ -3666,6 +3716,10 @@ const parse = (args, spec) => {
 				type: "boolean",
 				default: false
 			},
+			shared: {
+				type: "boolean",
+				default: false
+			},
 			url: { type: "string" },
 			token: { type: "string" },
 			site: { type: "string" },
@@ -3677,28 +3731,33 @@ const parse = (args, spec) => {
 	if (values.plan === void 0 === (values.map === void 0)) throw new UsageError$1("Pass either --plan <dir> (with the export file) or --map <dir>");
 	if (values.plan !== void 0 && !positionals[0]) throw new UsageError$1("--plan needs the export file");
 	if (values.map !== void 0 && positionals[0]) throw new UsageError$1("--map reads the export recorded in the plan: leave the file out");
+	if (values.map !== void 0 && values.shared) throw new UsageError$1("--shared is a --plan option: --map imports where the plan put the models");
+	if (values.shared && values.site !== void 0) throw new UsageError$1("Pass either --site <key> or --shared, not both");
 	return {
 		values,
 		file: positionals[0]
 	};
 };
-/** `--site`, else SHAPIO_SITE: the site the plan's schema belongs to and the map step writes to. */
+/** `--site`, else SHAPIO_SITE: the site `--map` writes to (else the site the plan recorded). */
 const siteOf = (values, io) => (values.site ?? io.env.SHAPIO_SITE)?.trim() || void 0;
 const runPlan = async (spec, file, values, io) => {
 	const dir = resolve(String(values.plan));
 	const path = resolve(file);
 	await checkPlanDirectory(dir, values.force === true);
+	const planSite = resolvePlanSite({
+		site: values.site,
+		shared: values.shared === true
+	}, io.env);
 	const source = await spec.plan(path, dir, values);
-	const site = siteOf(values, io);
 	const { definitions } = await writePlan(dir, source, {
 		kind: source.kind,
 		path,
 		sha256: await sha256File(path)
 	}, {
 		force: values.force === true,
-		site
+		site: planSite.site
 	});
-	io.stdout(formatPlanSummary(source, definitions, dir, spec.name, site));
+	io.stdout(formatPlanSummary(source, definitions, dir, spec.name, planSite));
 	return 0;
 };
 const runMapStep = (spec, values, io) => {
@@ -3744,7 +3803,7 @@ const importStrapiCommand = createImporterCommand({
 	name: "strapi",
 	label: "Strapi",
 	summary: "Import a Strapi 5 export: --plan writes schema files, --map creates drafts and change sets",
-	usage: "shapio import strapi <export.tar.gz[.enc]> --plan <dir> [--key <encryption key>] [--site <key>] [--force]\n       shapio import strapi --map <dir> [--url <origin>] [--token <admin token>] [--site <key>]\n  --plan unpacks the export into <dir>/source (--key for an encrypted export) and writes the planned models\n  and components (<dir>/schema) and <dir>/import-map.json; it sends nothing. With --site (or SHAPIO_SITE)\n  they belong to that site (<dir>/schema/sites/<key>/); without, they are shared (--map\n  without --site imports into the planned site). Apply the schema with\n  `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media, creates every document as a draft and opens change sets with the published ones.\n  Strapi 5 only.",
+	usage: "shapio import strapi <export.tar[.gz[.enc]]> --plan <dir> [--key <encryption key>] [--site <key> | --shared] [--force]\n       shapio import strapi --map <dir> [--url <origin>] [--token <admin token>] [--site <key>]\n  --plan unpacks the export into <dir>/source (--key for an encrypted export) and writes the planned models\n  and components (<dir>/schema) and <dir>/import-map.json; it sends nothing. They belong to one site\n  (<dir>/schema/sites/<key>/): --site (or SHAPIO_SITE), else the primary site (\"default\"); --shared shares\n  them with all sites (applying them needs a network admin token). --map without --site imports into the\n  planned site. Apply the schema with\n  `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media, creates every document as a draft and opens change sets with the published ones.\n  Strapi 5 only.",
 	options: ["key"],
 	plan: async (file, dir, values) => {
 		await extractStrapiExport(file, sourceDir(dir), typeof values.key === "string" ? values.key : void 0);
@@ -4338,7 +4397,7 @@ const importWordPressCommand = createImporterCommand({
 	name: "wordpress",
 	label: "WordPress",
 	summary: "Import a WordPress export (WXR): --plan writes schema files, --map creates drafts and change sets",
-	usage: "shapio import wordpress <export.xml> --plan <dir> [--site <key>] [--force]\n       shapio import wordpress --map <dir> [--url <origin>] [--token <admin token>] [--site <key>] [--media-dir <uploads dir>]\n  --plan reads the export and writes the planned models (<dir>/schema) and <dir>/import-map.json; it sends nothing.\n  With --site (or SHAPIO_SITE) the models belong to that site (<dir>/schema/sites/<key>/); without, they are shared;\n  --map without --site then imports into the planned site.\n  Apply the models with `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media (downloaded from the site, or read from --media-dir, a copy of wp-content/uploads),\n  creates every post and page as a draft, and opens change sets with the published ones. Re-run --map to resume.",
+	usage: "shapio import wordpress <export.xml> --plan <dir> [--site <key> | --shared] [--force]\n       shapio import wordpress --map <dir> [--url <origin>] [--token <admin token>] [--site <key>] [--media-dir <uploads dir>]\n  --plan reads the export and writes the planned models (<dir>/schema) and <dir>/import-map.json; it sends nothing.\n  The models belong to one site (<dir>/schema/sites/<key>/): --site (or SHAPIO_SITE), else the primary site\n  (\"default\"); --shared shares them with all sites (applying them needs a network admin token).\n  --map without --site imports into the planned site.\n  Apply the models with `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media (downloaded from the site, or read from --media-dir, a copy of wp-content/uploads),\n  creates every post and page as a draft, and opens change sets with the published ones. Re-run --map to resume.",
 	options: ["media-dir"],
 	plan: async (file) => wordpressSource(await readWxr(file)),
 	load: async (map, _dir, values) => wordpressSource(await readWxr(map.source.path), mediaDirOf(values))