create-avocado-site 0.10.0 → 0.11.0

package/dist/prompts.js

@@ -20,6 +20,7 @@ export async function demoConfig(dirName) {
         sitePort,
         editorPort,
         draftSecret: randomBytes(24).toString("hex"),
+        publishToken: randomBytes(24).toString("hex"),
     };
 }
 /**
@@ -115,5 +116,6 @@ async function integratePrompts(cwd) {
         // telling the reader to replace it with a long random string, and a value
         // that already looks filled in is a step nobody performs.
         draftSecret: randomBytes(24).toString("hex"),
+        publishToken: randomBytes(24).toString("hex"),
     };
 }

package/dist/templates/common.js

@@ -183,8 +183,12 @@ EDITOR_CORS_ORIGINS=http://localhost:${config.editorPort}
 # your edits.
 DRAFT_MODE_SECRET=${config.draftSecret}
 
-# Optional: protects the publish endpoint.
-# PUBLISH_TOKEN=
+# Guards POST /api/editor/publish, which overwrites this site's content. Not
+# optional: without it that route is refused outright under NODE_ENV=production,
+# because the alternative — what shipped before — was an unauthenticated write
+# endpoint on every deployed site. Whatever publishes to this app (the
+# orchestrator, CI) must send the same value as \`x-publish-token\`.
+PUBLISH_TOKEN=${config.publishToken}
 `;
     return c.envVars ? `${c.envVars}\n\n${common}` : common;
 }

package/dist/templates/demo-app.js

@@ -186,6 +186,13 @@ NEXT_PUBLIC_SITE_URL=http://localhost:${config.sitePort}
 # quietly renders the published page instead of your edits.
 DRAFT_MODE_SECRET=${config.draftSecret}
 
+# Guards POST /api/editor/publish, which rewrites content/pages.json. Generated
+# rather than left blank: that route used to read a variable no scaffold wrote,
+# so its token check never ran and any caller could replace the whole site.
+# Nothing here needs it — the editor publishes through the orchestrator's
+# adapter, not this route — but it ships mounted, so it ships guarded.
+PUBLISH_TOKEN=${config.publishToken}
+
 # ---------------------------------------------------------------------------
 # Production only. \`npm run dev\` needs none of this.
 #
@@ -411,7 +418,14 @@ const handler = createOrchestrator({
   // first-run suggestions on the answer; without it they fall back to the
   // generic list written for a site nobody has seen.
   demoContent: true,
-  adapter: jsonFileAdapter({ path: resolve(process.cwd(), "content/pages.json") }),
+  // \`writeOnPublish\` defaults to false, which made Publish a no-op that still
+  // reported success — and the README next to it promised the file was
+  // rewritten. A demo whose content lives in a writable file on your own
+  // machine is exactly the case the default is wrong for.
+  adapter: jsonFileAdapter({
+    path: resolve(process.cwd(), "content/pages.json"),
+    writeOnPublish: true,
+  }),
   previewUrl: "http://localhost:${config.sitePort}",
 })
 
@@ -484,6 +498,18 @@ sessions can reuse them. \`auth: () => true\` runs it open, if that is what you
 want — it is one line you type on purpose rather than a default you reach by
 forgetting.
 
+That gate covers \`/api/avocado/*\`. \`/api/editor/*\` is a second, separate
+handler, and \`POST /api/editor/publish\` overwrites your content — so it is
+guarded by its own \`PUBLISH_TOKEN\`, generated into \`.env.local\` for you and
+required in production. Carry it into the deployment's environment along with
+the variable above; without it that one route answers 401 and says so.
+
+One thing publishing cannot do in production: rewrite \`content/pages.json\`.
+Most hosts (Vercel, and every container built from this image) give you a
+read-only filesystem at runtime, so \`writeOnPublish\` works on your machine and
+fails on theirs. A deployed site publishes into something that persists —
+a CMS adapter, a database, or a commit back to the repo.
+
 ## What is where
 
 | Path | What it is |

package/dist/types.d.ts

@@ -33,6 +33,13 @@ export type ScaffoldConfig = {
      * fixed, so two demos on one machine do not share a draft cookie secret.
      */
     draftSecret: string;
+    /**
+     * Value written as `PUBLISH_TOKEN`. Generated, not left blank: the publish
+     * route was scaffolded as `publishSecret: process.env.PUBLISH_TOKEN || undefined`
+     * against a variable no scaffold ever wrote, so the guard was dead code and
+     * `POST /api/editor/publish` took content from anyone who asked.
+     */
+    publishToken: string;
 };
 export type GeneratedFile = {
     path: string;

package/dist/versions.d.ts

@@ -17,7 +17,7 @@
  * `@avocadostudio-ai/orchestrator-core`, already pinned there; naming it again
  * here is how a project ends up with two.
  */
-export declare const AVOCADO = "0.10.0";
+export declare const AVOCADO = "0.11.0";
 /**
  * Next 15.5.15 rather than 16, because that is the version every example app
  * and the demo site in this repository build and test against. The SDK

package/dist/versions.js

@@ -17,7 +17,7 @@
  * `@avocadostudio-ai/orchestrator-core`, already pinned there; naming it again
  * here is how a project ends up with two.
  */
-export const AVOCADO = "0.10.0";
+export const AVOCADO = "0.11.0";
 /**
  * Next 15.5.15 rather than 16, because that is the version every example app
  * and the demo site in this repository build and test against. The SDK

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-avocado-site",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Bootstrap a runnable Avocado Studio demo site, or wire Avocado into an existing Next.js project",
   "type": "module",
   "bin": {
@@ -34,8 +34,8 @@
     "@types/node": "^22.13.10",
     "tsx": "^4.19.0",
     "typescript": "^5.7.3",
-    "@avocadostudio-ai/shared": "0.10.0",
-    "@avocadostudio-ai/site-sdk": "0.10.0"
+    "@avocadostudio-ai/shared": "0.11.0",
+    "@avocadostudio-ai/site-sdk": "0.11.0"
   },
   "license": "Apache-2.0",
   "homepage": "https://docs.avocadostudio.dev",