@shapio/cms 0.5.4 → 0.5.5

package/dist/admin/index.html

@@ -17,82 +17,83 @@
          API serves it (empty without extension themes); `vite-ignore` keeps Vite from bundling it. -->
     <link rel="stylesheet" href="../api/admin/extensions/themes.css"  />
     <script type="importmap">{"imports":{"react":"./assets/shared-react-KADNSNpb.js","react/jsx-runtime":"./assets/shared-react-jsx-runtime-CU_Fm1m8.js","react-dom":"./assets/shared-react-dom-BpneAejY.js","react-dom/client":"./assets/shared-react-dom-client-CnpZTXxo.js","@shapio/editor-sdk":"./assets/shared-shapio-editor-sdk-9ANIbEN0.js"}}</script>
-    <script type="module" crossorigin src="./assets/index-BF63XIym.js"></script>
+    <script type="module" crossorigin src="./assets/index-D03RZB7e.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-Dd_uD5pT.js">
     <link rel="modulepreload" crossorigin href="./assets/react-CQOZoUwg.js">
     <link rel="modulepreload" crossorigin href="./assets/react-dom-pEVw9mjF.js">
     <link rel="modulepreload" crossorigin href="./assets/client-C8vMCv-p.js">
     <link rel="modulepreload" crossorigin href="./assets/jsx-runtime-DREnUpxT.js">
-    <link rel="modulepreload" crossorigin href="./assets/createLucideIcon-CJwW5JJW.js">
-    <link rel="modulepreload" crossorigin href="./assets/loader-circle-BaUsKfL8.js">
-    <link rel="modulepreload" crossorigin href="./assets/auth-kvLrpCst.js">
-    <link rel="modulepreload" crossorigin href="./assets/es2015-DgNe6MPq.js">
+    <link rel="modulepreload" crossorigin href="./assets/createLucideIcon-CqygG5K6.js">
+    <link rel="modulepreload" crossorigin href="./assets/loader-circle-C-9trZPI.js">
+    <link rel="modulepreload" crossorigin href="./assets/auth-C4fHG9Iu.js">
+    <link rel="modulepreload" crossorigin href="./assets/es2015-DrAA1N2V.js">
     <link rel="modulepreload" crossorigin href="./assets/cn-DVhJ55Mo.js">
-    <link rel="modulepreload" crossorigin href="./assets/skeleton-BUvrrXQ7.js">
-    <link rel="modulepreload" crossorigin href="./assets/badge-CB016qlm.js">
+    <link rel="modulepreload" crossorigin href="./assets/skeleton-Dyi_b1wq.js">
+    <link rel="modulepreload" crossorigin href="./assets/badge-ydvfgE8a.js">
     <link rel="modulepreload" crossorigin href="./assets/root-CDpNo7ef.js">
-    <link rel="modulepreload" crossorigin href="./assets/Match-CH4OI7xo.js">
-    <link rel="modulepreload" crossorigin href="./assets/RowTitle-DuN-jQxy.js">
-    <link rel="modulepreload" crossorigin href="./assets/src-CeOxD_sk.js">
-    <link rel="modulepreload" crossorigin href="./assets/theme-xFjfWxsg.js">
+    <link rel="modulepreload" crossorigin href="./assets/Match-GDx_orOH.js">
+    <link rel="modulepreload" crossorigin href="./assets/RowTitle-DoxDM1XL.js">
+    <link rel="modulepreload" crossorigin href="./assets/src-BcLeD2-K.js">
+    <link rel="modulepreload" crossorigin href="./assets/theme-DPe080iG.js">
     <link rel="modulepreload" crossorigin href="./assets/table-zG68ipQc.js">
     <link rel="modulepreload" crossorigin href="./assets/coerce-DSIVtcR-.js">
-    <link rel="modulepreload" crossorigin href="./assets/useResolvedScheme-O1g9lYxQ.js">
-    <link rel="modulepreload" crossorigin href="./assets/InfoHint-2HZJCzwW.js">
-    <link rel="modulepreload" crossorigin href="./assets/field-DkUe0lrH.js">
-    <link rel="modulepreload" crossorigin href="./assets/ConfirmDialog-Dq6IrmS9.js">
+    <link rel="modulepreload" crossorigin href="./assets/useResolvedScheme-aV0QDPi3.js">
+    <link rel="modulepreload" crossorigin href="./assets/InfoHint-bYMd_t0J.js">
+    <link rel="modulepreload" crossorigin href="./assets/field-W1dB_h6d.js">
+    <link rel="modulepreload" crossorigin href="./assets/ConfirmDialog-DZRJfdvH.js">
     <link rel="modulepreload" crossorigin href="./assets/settle-LRKtTN_e.js">
-    <link rel="modulepreload" crossorigin href="./assets/HintedLabel-BPZ7Qd6n.js">
-    <link rel="modulepreload" crossorigin href="./assets/zod-DtMsJRUH.js">
-    <link rel="modulepreload" crossorigin href="./assets/FormCheckboxGroup-CNexUHvc.js">
-    <link rel="modulepreload" crossorigin href="./assets/useSchemaScopeAccess-DJo7rYB7.js">
-    <link rel="modulepreload" crossorigin href="./assets/calendar-clock-BJHRssUa.js">
-    <link rel="modulepreload" crossorigin href="./assets/clock-BJiK6mtP.js">
-    <link rel="modulepreload" crossorigin href="./assets/link-BGUl1m0y.js">
-    <link rel="modulepreload" crossorigin href="./assets/search-JRmBbB7P.js">
-    <link rel="modulepreload" crossorigin href="./assets/image-BImUdARR.js">
-    <link rel="modulepreload" crossorigin href="./assets/layers-BGHZayyB.js">
-    <link rel="modulepreload" crossorigin href="./assets/dropdown-menu-jrFjkuhR.js">
-    <link rel="modulepreload" crossorigin href="./assets/constants-DgCYLdxl.js">
-    <link rel="modulepreload" crossorigin href="./assets/boxes-CYCCewHl.js">
-    <link rel="modulepreload" crossorigin href="./assets/chevron-left-uCIwt51T.js">
-    <link rel="modulepreload" crossorigin href="./assets/CursorPager-CXI-RhTJ.js">
-    <link rel="modulepreload" crossorigin href="./assets/file-stack-DV3BHV7A.js">
-    <link rel="modulepreload" crossorigin href="./assets/circle-check-nVBFETQc.js">
-    <link rel="modulepreload" crossorigin href="./assets/ellipsis-D304Uu9C.js">
-    <link rel="modulepreload" crossorigin href="./assets/schema-BzJ3fK72.js">
+    <link rel="modulepreload" crossorigin href="./assets/HintedLabel-BlLtqVVz.js">
+    <link rel="modulepreload" crossorigin href="./assets/zod-C-k48Hnc.js">
+    <link rel="modulepreload" crossorigin href="./assets/FormCheckboxGroup-V3IKrvzc.js">
+    <link rel="modulepreload" crossorigin href="./assets/useSchemaScopeAccess-DyfiZnzs.js">
+    <link rel="modulepreload" crossorigin href="./assets/calendar-clock-DFUgXWXg.js">
+    <link rel="modulepreload" crossorigin href="./assets/clock-BGAXsuo4.js">
+    <link rel="modulepreload" crossorigin href="./assets/link-B3O0VUVT.js">
+    <link rel="modulepreload" crossorigin href="./assets/search-CW3iBC4k.js">
+    <link rel="modulepreload" crossorigin href="./assets/image-B6aL7hP8.js">
+    <link rel="modulepreload" crossorigin href="./assets/layers-B0jT4rc4.js">
+    <link rel="modulepreload" crossorigin href="./assets/dropdown-menu-C53v9ioW.js">
+    <link rel="modulepreload" crossorigin href="./assets/constants-esJAnNTh.js">
+    <link rel="modulepreload" crossorigin href="./assets/boxes-D6Y4Cenx.js">
+    <link rel="modulepreload" crossorigin href="./assets/chevron-left-CZXrLV99.js">
+    <link rel="modulepreload" crossorigin href="./assets/CursorPager-H4SpVYw7.js">
+    <link rel="modulepreload" crossorigin href="./assets/file-stack-8rRouTJj.js">
+    <link rel="modulepreload" crossorigin href="./assets/circle-check-De27poaB.js">
+    <link rel="modulepreload" crossorigin href="./assets/ellipsis-BHtU4ov6.js">
+    <link rel="modulepreload" crossorigin href="./assets/schema-D9BgCVzZ.js">
     <link rel="modulepreload" crossorigin href="./assets/modelPermissions-DZ1lWfQZ.js">
-    <link rel="modulepreload" crossorigin href="./assets/contentCounts-K6UCGeqH.js">
-    <link rel="modulepreload" crossorigin href="./assets/usePlaces-CdX6q9xt.js">
-    <link rel="modulepreload" crossorigin href="./assets/globe-DXrE-_sR.js">
-    <link rel="modulepreload" crossorigin href="./assets/inbox-BQ_HOjFd.js">
-    <link rel="modulepreload" crossorigin href="./assets/key-round-BJTVRy3_.js">
-    <link rel="modulepreload" crossorigin href="./assets/sparkles-DSj-egu-.js">
-    <link rel="modulepreload" crossorigin href="./assets/sections-CbJVJmgY.js">
-    <link rel="modulepreload" crossorigin href="./assets/plus-BYBGXiDV.js">
-    <link rel="modulepreload" crossorigin href="./assets/scroll-text-DdRRr86a.js">
-    <link rel="modulepreload" crossorigin href="./assets/send-BcDsf__t.js">
-    <link rel="modulepreload" crossorigin href="./assets/UserAvatar-C-_SZaBb.js">
+    <link rel="modulepreload" crossorigin href="./assets/contentCounts-DknqJ4kh.js">
+    <link rel="modulepreload" crossorigin href="./assets/usePlaces-CAXr-IO9.js">
+    <link rel="modulepreload" crossorigin href="./assets/globe-DKkjr9MZ.js">
+    <link rel="modulepreload" crossorigin href="./assets/inbox-BKqu1EfP.js">
+    <link rel="modulepreload" crossorigin href="./assets/key-round-Dmdr1vP5.js">
+    <link rel="modulepreload" crossorigin href="./assets/sparkles-DCRAqbqD.js">
+    <link rel="modulepreload" crossorigin href="./assets/sections-C7Z6Xd8r.js">
+    <link rel="modulepreload" crossorigin href="./assets/plus-WfYKHW7G.js">
+    <link rel="modulepreload" crossorigin href="./assets/scroll-text-gKYBbibb.js">
+    <link rel="modulepreload" crossorigin href="./assets/send-DRA-Pe46.js">
+    <link rel="modulepreload" crossorigin href="./assets/UserAvatar-Bl32IpG_.js">
     <link rel="modulepreload" crossorigin href="./assets/constants-DUBUgzpU.js">
     <link rel="modulepreload" crossorigin href="./assets/constants-DCtq_UOe.js">
-    <link rel="modulepreload" crossorigin href="./assets/searchSchemas-VaNHAlfp.js">
-    <link rel="modulepreload" crossorigin href="./assets/users-sDlmJ2ml.js">
-    <link rel="modulepreload" crossorigin href="./assets/sections-BsLTv5pq.js">
-    <link rel="modulepreload" crossorigin href="./assets/tooltip-B_8HZ1Wu.js">
-    <link rel="modulepreload" crossorigin href="./assets/TextLink-_2c_cSwP.js">
+    <link rel="modulepreload" crossorigin href="./assets/searchSchemas-C4qp-vCa.js">
+    <link rel="modulepreload" crossorigin href="./assets/users-ohHZnBJW.js">
+    <link rel="modulepreload" crossorigin href="./assets/sections-CN5fIoAr.js">
+    <link rel="modulepreload" crossorigin href="./assets/tooltip-BEaZkRPK.js">
+    <link rel="modulepreload" crossorigin href="./assets/TextLink-DnrMaF2F.js">
     <link rel="modulepreload" crossorigin href="./assets/sites-C6_THCVK.js">
-    <link rel="modulepreload" crossorigin href="./assets/store-Rdj8W9EY.js">
-    <link rel="modulepreload" crossorigin href="./assets/usePaletteItems-B3OEkGXv.js">
-    <link rel="modulepreload" crossorigin href="./assets/SharedGlyph-DcbEGwSL.js">
+    <link rel="modulepreload" crossorigin href="./assets/store-DknnssoQ.js">
+    <link rel="modulepreload" crossorigin href="./assets/usePaletteItems-B3y2t7Ly.js">
+    <link rel="modulepreload" crossorigin href="./assets/SharedGlyph-D1OMHXPf.js">
     <link rel="modulepreload" crossorigin href="./assets/useShortcutLabel-BJMslX8p.js">
     <link rel="modulepreload" crossorigin href="./assets/preload-helper-BaNbYf_w.js">
-    <link rel="modulepreload" crossorigin href="./assets/QueryView-UMDuxj-g.js">
+    <link rel="modulepreload" crossorigin href="./assets/QueryView-UBO-U5Wo.js">
     <link rel="modulepreload" crossorigin href="./assets/useDebouncedValue-Dqs3wwhn.js">
     <link rel="modulepreload" crossorigin href="./assets/useSearchInput-1fDoEtXe.js">
-    <link rel="modulepreload" crossorigin href="./assets/radio-group-szmd95N4.js">
-    <link rel="modulepreload" crossorigin href="./assets/FormRadioGroup-Bz09LqOn.js">
-    <link rel="modulepreload" crossorigin href="./assets/useDiscardGuard-B8dlCh6M.js">
-    <link rel="stylesheet" crossorigin href="./assets/index-DJe1l94K.css">
+    <link rel="modulepreload" crossorigin href="./assets/radio-group-rFxn7cz2.js">
+    <link rel="modulepreload" crossorigin href="./assets/FormRadioGroup-DIv-MYgn.js">
+    <link rel="modulepreload" crossorigin href="./assets/useDiscardGuard-WTUINqD5.js">
+    <link rel="modulepreload" crossorigin href="./assets/useNetworkPermission-CegwqQXR.js">
+    <link rel="stylesheet" crossorigin href="./assets/index-BEM45u2w.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as parseLockFile, A as buildEditorManifest, B as RESERVED_DEFINITION_API_KEYS, C as loopbackUrl, D as BEFORE_EVENTS, E as AFTER_EVENTS, F as lockById, G as THEME_VARIANTS, H as RESERVED_TYPE_NAMES, I as update, J as hashDefinition, K as checkThemeContrast, L as STORAGE_DRIVERS, N as listForAssets, O as EXTENSION_JOB_PREFIX, P as listLiveByDriver, Q as parseDefinition, R as describeError, S as createUrlBuilder, T as loadProjectConfig, U as SCHEMA_KIND_DIRECTORIES, V as RESERVED_FIELD_API_KEYS, W as SITES_DIRECTORY, X as lockEntriesForSite, Y as lockCoversSite, Z as mergePulledLock, _ as listAllSites, a as loadConfig, at as toTypeName, b as generateToken, ct as withSiteCovered, d as migrateToLatest, dt as createStableId, et as schemaFilePath, f as SHAPIO_VERSION, ft as validateRichText, g as createSite, i as assertDatabaseReachable, it as suggestPlural, k as EXTENSION_ROUTE_ROOT, lt as RICHTEXT_FORMAT, mt as sqliteDriverOf, n as startServer, nt as serializeDefinition, o as loadEnvFileIfPresent, ot as upgradeLockFile, p as createMediaStorage, pt as createDb, q as foldApiKey, r as copyObjectVerified, rt as serializeLockFile, st as validateSchema, t as startDedicatedWorker, tt as scopeDirectory, u as getPendingMigrations, ut as SAFE_LINK_PATTERN, v as createAdminDirect, w as SITE_KEY_PATTERN, x as createLogger, y as SYSTEM_CLI_ACTOR } from "./worker-CFEk-WtR.js";
+import { $ as parseDefinition, A as buildEditorManifest, B as RESERVED_DEFINITION_API_KEYS, C as loopbackUrl, D as BEFORE_EVENTS, E as AFTER_EVENTS, F as lockById, G as THEME_VARIANTS, H as RESERVED_TYPE_NAMES, I as update, J as generatedNames, K as checkThemeContrast, L as STORAGE_DRIVERS, N as listForAssets, O as EXTENSION_JOB_PREFIX, P as listLiveByDriver, Q as mergePulledLock, R as describeError, S as createUrlBuilder, T as loadProjectConfig, U as SCHEMA_KIND_DIRECTORIES, V as RESERVED_FIELD_API_KEYS, W as SITES_DIRECTORY, X as lockCoversSite, Y as hashDefinition, Z as lockEntriesForSite, _ as listAllSites, a as loadConfig, at as serializeLockFile, b as generateToken, ct as upgradeLockFile, d as migrateToLatest, dt as RICHTEXT_FORMAT, et as parseLockFile, f as SHAPIO_VERSION, ft as SAFE_LINK_PATTERN, g as createSite, gt as sqliteDriverOf, ht as createDb, i as assertDatabaseReachable, it as serializeDefinition, k as EXTENSION_ROUTE_ROOT, lt as validateSchema, mt as validateRichText, n as startServer, nt as schemaFilePath, o as loadEnvFileIfPresent, ot as suggestPlural, p as createMediaStorage, pt as createStableId, q as foldApiKey, r as copyObjectVerified, rt as scopeDirectory, st as toTypeName, t as startDedicatedWorker, tt as routeKeyOf, u as getPendingMigrations, ut as withSiteCovered, v as createAdminDirect, w as SITE_KEY_PATTERN, x as createLogger, y as SYSTEM_CLI_ACTOR } from "./worker-DMES6pqh.js";
 import { createDecipheriv, createHash, scryptSync } from "node:crypto";
 import { createReadStream, createWriteStream, existsSync, openAsBlob } from "node:fs";
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve } from "node:path";
@@ -2023,6 +2023,7 @@ const toCamelCase = (value) => {
 	const joined = value.split(/[^A-Za-z0-9]+/).filter((word) => word.length > 0).map((word, index) => index === 0 ? word.charAt(0).toLowerCase() + word.slice(1) : word.charAt(0).toUpperCase() + word.slice(1)).join("");
 	return ((/^[0-9]/.test(joined) ? `n${joined}` : joined) || "item").slice(0, 64);
 };
+/** `key` with `suffix`, shortened so the result stays within the API ID length limit. */
 const withSuffix = (key, suffix) => `${key.slice(0, 64 - suffix.length)}${suffix}`;
 /** Makes `candidate` unique within `taken` (case-folded), numbering repeats; records the result in `taken`. */
 const claim = (candidate, taken) => {
@@ -3229,6 +3230,7 @@ const printResults = (response, state, io, verbose) => {
 /** Where `--plan` puts the schema files and their (empty) lock file inside the plan directory. */
 const PLAN_SCHEMA_DIR = "schema";
 const PLAN_LOCK_FILE = "schema-lock.json";
+/** Fresh stable IDs for every planned definition and field (a new plan, or a throwaway build). */
 const assignIds = (definitions) => Object.fromEntries(definitions.map((definition) => [definition.key, {
 	id: createStableId(),
 	kind: definition.kind,
@@ -3709,6 +3711,112 @@ const formatPlanSummary = (source, definitions, dir, command, { site, explicit }
 	lines.push("Next:", "  1. Review the files: rename API IDs or delete fields you do not want (entries follow the stable IDs).", `  2. shapio schema apply --dir ${display(`${dir}/${PLAN_SCHEMA_DIR}`)} --lock ${display(`${dir}/${PLAN_LOCK_FILE}`)}${siteFlag}`, `  3. shapio import ${command} --map ${display(dir)}${siteFlag}`);
 	return `${lines.join("\n")}\n`;
 };
+/**
+* `--plan --url <instance>`: planned API IDs and the GraphQL names they generate are checked against the
+* definitions the planned site can already see, so `schema apply` does not refuse the plan with
+* `API_KEY_COLLISION` or `GENERATED_NAME_COLLISION`. A planned definition that clashes is renamed (`seo` →
+* `seoItem`, then `seoItem2`, ...) and the plan output says so. Without a URL the plan stays offline and says the
+* names were not checked.
+*/
+const NAMES_NOT_CHECKED_NOTE = "Names were not checked against a target: pass --url and --token to --plan, or rename clashes in the schema files before applying.";
+const SHARED_PLAN_NOTE = "Names were checked against the primary site's view: other sites' own definitions were not checked.";
+/** The definitions the site can see: the same export `--map` reads. */
+const fetchTargetDefinitions = async ({ baseUrl, token, site, fetch }) => {
+	return (await createClient({
+		baseUrl,
+		token,
+		site,
+		fetch: createRateLimitedFetch(fetch)
+	}).admin.schema.export()).definitions.map((entry) => entry.definition);
+};
+/**
+* Every folded name a definition holds: its API ID and plural API ID (one shared namespace, `key:`), and each
+* generated GraphQL name in its own namespace (`type:`, `query:`, `mutation:`). `owner` is what a note names.
+*/
+const claimsOf = (definition) => {
+	const keys = [definition.apiKey];
+	if (definition.kind === "collection") keys.push(routeKeyOf(definition));
+	return [...keys.map((key) => ({
+		claim: `key:${foldApiKey(key)}`,
+		owner: key
+	})), ...generatedNames(definition).map((name) => ({
+		claim: `${name.namespace}:${foldApiKey(name.name)}`,
+		owner: definition.apiKey
+	}))];
+};
+const renamed = (definition, apiKey) => definition.kind === "collection" ? {
+	...definition,
+	apiKey,
+	pluralApiKey: suggestPlural(apiKey)
+} : {
+	...definition,
+	apiKey
+};
+/** `seoItem`, `seoItem2`, ...: the first whose names are free among `taken`. */
+const freeApiKey = (definition, taken) => {
+	const base = withSuffix(definition.apiKey, "Item");
+	for (let n = 1;; n += 1) {
+		const candidate = n === 1 ? base : withSuffix(base, String(n));
+		if (!claimsOf(renamed(definition, candidate)).some(({ claim }) => taken.has(claim))) return candidate;
+	}
+};
+const KIND_LABEL = {
+	collection: "Model",
+	singleton: "Model",
+	component: "Component"
+};
+/**
+* Renames the planned definitions whose names the target already holds, one at a time (a rename changes the
+* names the next check sees), until the plan fits. A renamed definition loses its planned plural API ID, so it
+* is derived from the new API ID. Entries address definitions by source key, so they follow.
+*/
+const avoidTargetNames = (source, target) => {
+	const owners = new Map(target.flatMap(claimsOf).map(({ claim, owner }) => [claim, owner]));
+	let definitions = source.definitions;
+	const notes = [];
+	for (let round = 0; round <= source.definitions.length; round += 1) {
+		const ids = assignIds(definitions);
+		const built = buildDefinitions({
+			...source,
+			definitions
+		}, ids);
+		const keyOf = new Map(Object.entries(ids).map(([key, planned]) => [planned.id, key]));
+		const clash = built.map((definition) => ({
+			definition,
+			hit: claimsOf(definition).find(({ claim }) => owners.has(claim))
+		})).find(({ hit }) => hit !== void 0);
+		if (!clash?.hit) return {
+			...source,
+			definitions,
+			notes: [...source.notes, ...notes]
+		};
+		const taken = /* @__PURE__ */ new Set([...owners.keys(), ...built.filter((definition) => definition !== clash.definition).flatMap((definition) => claimsOf(definition).map(({ claim }) => claim))]);
+		const apiKey = freeApiKey(clash.definition, taken);
+		const key = keyOf.get(clash.definition.id);
+		definitions = definitions.map((planned) => {
+			if (planned.key !== key) return planned;
+			const { pluralApiKey: _dropped, ...rest } = planned;
+			return {
+				...rest,
+				apiKey
+			};
+		});
+		notes.push(`${KIND_LABEL[clash.definition.kind]} ${clash.definition.apiKey} is named ${apiKey} (the target already has ${owners.get(clash.hit.claim)}).`);
+	}
+	throw new Error("Import plan bug: renaming planned definitions away from the target did not settle");
+};
+/** The plan step: checks names against the target when one is given, else notes that they were not. */
+const checkTargetNames = async (source, target) => {
+	if (!target) return {
+		...source,
+		notes: [...source.notes, NAMES_NOT_CHECKED_NOTE]
+	};
+	const checked = avoidTargetNames(source, await fetchTargetDefinitions(target));
+	return target.shared ? {
+		...checked,
+		notes: [...checked.notes, SHARED_PLAN_NOTE]
+	} : checked;
+};
 const parse = (args, spec) => {
 	const { values, positionals } = parseArgs({
 		args: [...args],
@@ -3743,6 +3851,22 @@ const parse = (args, spec) => {
 };
 /** `--site`, else SHAPIO_SITE: the site `--map` writes to (else the site the plan recorded). */
 const siteOf = (values, io) => (values.site ?? io.env.SHAPIO_SITE)?.trim() || void 0;
+/**
+* The instance `--plan` checks names against: only with an explicit `--url` (SHAPIO_URL alone keeps the plan
+* offline), with `--token` or SHAPIO_TOKEN. A shared plan is checked against the primary site's view.
+*/
+const planTargetOf = (values, io, planSite) => {
+	const baseUrl = values.url;
+	if (baseUrl === void 0) return;
+	const token = values.token ?? io.env.SHAPIO_TOKEN;
+	if (!token) throw new UsageError$1("--plan --url checks names on that instance and needs an admin API token: pass --token or set SHAPIO_TOKEN");
+	return {
+		baseUrl,
+		token,
+		site: planSite.site ?? "default",
+		shared: planSite.site === void 0
+	};
+};
 const runPlan = async (spec, file, values, io) => {
 	const dir = resolve(String(values.plan));
 	const path = resolve(file);
@@ -3751,7 +3875,8 @@ const runPlan = async (spec, file, values, io) => {
 		site: values.site,
 		shared: values.shared === true
 	}, io.env);
-	const source = await spec.plan(path, dir, values);
+	const target = planTargetOf(values, io, planSite);
+	const source = await checkTargetNames(await spec.plan(path, dir, values), target);
 	const { definitions } = await writePlan(dir, source, {
 		kind: source.kind,
 		path,
@@ -3806,7 +3931,7 @@ const importStrapiCommand = createImporterCommand({
 	name: "strapi",
 	label: "Strapi",
 	summary: "Import a Strapi 5 export: --plan writes schema files, --map creates drafts and change sets",
-	usage: "shapio import strapi <export.tar[.gz[.enc]]> --plan <dir> [--key <encryption key>] [--site <key> | --shared] [--force]\n       shapio import strapi --map <dir> [--url <origin>] [--token <admin token>] [--site <key>]\n  --plan unpacks the export into <dir>/source (--key for an encrypted export) and writes the planned models\n  and components (<dir>/schema) and <dir>/import-map.json; it sends nothing. They belong to one site\n  (<dir>/schema/sites/<key>/): --site (or SHAPIO_SITE), else the primary site (\"default\"); --shared shares\n  them with all sites (applying them needs a network admin token). --map without --site imports into the\n  planned site. Apply the schema with\n  `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media, creates every document as a draft and opens change sets with the published ones.\n  Strapi 5 only.",
+	usage: "shapio import strapi <export.tar[.gz[.enc]]> --plan <dir> [--key <encryption key>] [--site <key> | --shared] [--url <origin> --token <admin token>] [--force]\n       shapio import strapi --map <dir> [--url <origin>] [--token <admin token>] [--site <key>]\n  --plan unpacks the export into <dir>/source (--key for an encrypted export) and writes the planned models\n  and components (<dir>/schema) and <dir>/import-map.json. With --url it checks the planned API IDs against\n  that instance and renames clashes (seo → seoItem); without it, it sends nothing. They belong to one site\n  (<dir>/schema/sites/<key>/): --site (or SHAPIO_SITE), else the primary site (\"default\"); --shared shares\n  them with all sites (applying them needs a network admin token). --map without --site imports into the\n  planned site. Apply the schema with\n  `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media, creates every document as a draft and opens change sets with the published ones.\n  Strapi 5 only.",
 	options: ["key"],
 	plan: async (file, dir, values) => {
 		await extractStrapiExport(file, sourceDir(dir), typeof values.key === "string" ? values.key : void 0);
@@ -4400,7 +4525,7 @@ const importWordPressCommand = createImporterCommand({
 	name: "wordpress",
 	label: "WordPress",
 	summary: "Import a WordPress export (WXR): --plan writes schema files, --map creates drafts and change sets",
-	usage: "shapio import wordpress <export.xml> --plan <dir> [--site <key> | --shared] [--force]\n       shapio import wordpress --map <dir> [--url <origin>] [--token <admin token>] [--site <key>] [--media-dir <uploads dir>]\n  --plan reads the export and writes the planned models (<dir>/schema) and <dir>/import-map.json; it sends nothing.\n  The models belong to one site (<dir>/schema/sites/<key>/): --site (or SHAPIO_SITE), else the primary site\n  (\"default\"); --shared shares them with all sites (applying them needs a network admin token).\n  --map without --site imports into the planned site.\n  Apply the models with `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media (downloaded from the site, or read from --media-dir, a copy of wp-content/uploads),\n  creates every post and page as a draft, and opens change sets with the published ones. Re-run --map to resume.",
+	usage: "shapio import wordpress <export.xml> --plan <dir> [--site <key> | --shared] [--url <origin> --token <admin token>] [--force]\n       shapio import wordpress --map <dir> [--url <origin>] [--token <admin token>] [--site <key>] [--media-dir <uploads dir>]\n  --plan reads the export and writes the planned models (<dir>/schema) and <dir>/import-map.json.\n  With --url it checks the planned API IDs against that instance and renames clashes (tag → tagItem);\n  without it, it sends nothing.\n  The models belong to one site (<dir>/schema/sites/<key>/): --site (or SHAPIO_SITE), else the primary site\n  (\"default\"); --shared shares them with all sites (applying them needs a network admin token).\n  --map without --site imports into the planned site.\n  Apply the models with `shapio schema apply --dir <dir>/schema --lock <dir>/schema-lock.json [--site <key>]`, then run --map:\n  it uploads the media (downloaded from the site, or read from --media-dir, a copy of wp-content/uploads),\n  creates every post and page as a draft, and opens change sets with the published ones. Re-run --map to resume.",
 	options: ["media-dir"],
 	plan: async (file) => wordpressSource(await readWxr(file)),
 	load: async (map, _dir, values) => wordpressSource(await readWxr(map.source.path), mediaDirOf(values))