create-grocms 0.1.0

package/LICENSE.txt

@@ -0,0 +1,23 @@
+GroCMS Installer CLI Notice
+Copyright (c) 2026 Mix Reality PTY LTD.
+All rights reserved.
+
+This tool ('create-grocms') is provided by Mix Reality PTY LTD for authorized
+customers, evaluators, and partners to scaffold, configure, and initialize
+installations of GroCMS.
+
+Use of this installer to download, extract, deploy, or run the GroCMS core
+platform requires a valid, active commercial license or authorized evaluation
+access granted by Mix Reality PTY LTD.
+
+Downloading or running the GroCMS core software without an authorized commercial
+license agreement is strictly prohibited. The core platform is proprietary,
+closed-source commercial software.
+
+For full terms and conditions governing the GroCMS platform, refer to the
+canonical LICENSE.txt included with the GroCMS release and visit:
+https://grocms.com
+
+Direct commercial licensing inquiries to:
+Mix Reality PTY LTD
+Email: get@grocms.com

package/README.md

@@ -0,0 +1,141 @@
+# create-grocms
+
+The official scaffolding CLI for [GroCMS](https://grocms.com) — structured content and visual website publishing.
+
+## Usage
+
+Install Node.js **24.x** and npm first. To scaffold a new GroCMS installation
+using the published installer:
+
+```bash
+npx create-grocms@latest my-website
+```
+
+Or run interactively:
+
+```bash
+npx create-grocms@latest
+```
+
+Enter your commercial download key at the masked prompt. npm supplies this
+small installer; it then downloads the separate GroCMS application from
+`https://download.grocms.com`. npm access alone does not grant access to the
+application. The installer version and downloaded CMS release are independent.
+
+Docker Engine with Compose v2 is required for the setup commands printed after
+scaffolding. Git is optional. Choose a new or empty project directory; this
+command creates an installation and is not an updater for an existing site.
+
+### Options
+
+| Option | Description |
+|---|---|
+| `[target-directory]` | Directory to create project in (e.g. `my-website`) |
+| `--url <url>` | Configured public site URL (default: `http://localhost:3100`) |
+| `--key, -k <license>` | Commercial license key or download token |
+| `--release-url <url>` | Custom release server endpoint |
+| `--local-archive <path>` | Install directly from a local release ZIP file |
+| `--skip-install` | Do not run `npm ci` automatically |
+| `--demo` | Show first-setup instructions for the optional reference demo |
+| `--no-demo` | Explicitly select the minimal starter (the default) |
+
+### What this tool does
+
+1. Connects to your release server or uses a verified release archive.
+2. Extracts the clean GroCMS codebase into your chosen directory.
+3. Automatically generates cryptographically strong `BETTER_AUTH_SECRET` and database passwords.
+4. Generates `.env.local`, `.env.infrastructure.local`, and `.env.production.local`.
+5. Initializes a fresh Git repository.
+6. Installs all pinned dependencies with `npm ci`.
+
+The CLI prints the remaining setup commands; it does not initialize the database or publish content. Following the default commands creates a minimal website with one **Hello world!** Post, one **Welcome** homepage, official **GroCMS** branding, a basic content template and settings. It includes no sample images, authors or marketing layouts. Repeat setup preserves existing authored content.
+
+Choose `--demo` only for a fresh demonstration installation. Its local instructions use `npm run setup -- --design-only && npm run seed:demo` to prepare untouched design drafts before publishing the richer reference site. For production, add `--demo true` to the initial operations setup command below. Demo seeding refuses to replace an initialized minimal site or other authored content.
+
+The target must be new or empty, including when entered interactively. Links,
+nonempty folders and existing environment files are refused. Files are validated
+and prepared in private staging, then moved together into the final destination.
+The installer never merges files into an existing website or replaces secrets.
+If dependency installation fails, keep the scaffold, correct the reported npm
+problem and run `npm ci` in that folder. Do not rerun the scaffolder over it.
+
+Source archives are limited to 64 MiB compressed, 256 MiB expanded, 32 MiB per
+file and 10,000 entries. Unsafe paths, links, special files, duplicate names,
+case collisions and inconsistent file/directory paths are rejected before
+extraction. Download credentials use the Bearer header. The masked interactive
+prompt avoids putting a key in shell history; the existing `--key` argument is
+still supported. Older query-authenticated clients remain compatible with the
+server, but query credentials may appear in third-party proxy logs.
+
+## Production installation sequence
+
+Install Node.js 24, npm, Docker Engine with Compose v2, and Git if desired. The
+download service/registry and dependency registries must be reachable. Use the
+generated `.env.production.local`, which contains separate administrator,
+migrator and runtime passwords. Keep all `.env*` files private and backed up.
+Review the public URL, storage and SMTP configuration before startup. The
+development-only `POSTGRES_PASSWORD` is not the production role contract.
+
+```bash
+cd my-website
+docker compose --env-file .env.production.local -f compose.yaml build web worker
+docker compose --env-file .env.production.local -f compose.yaml up -d --wait db
+docker compose --env-file .env.production.local -f compose.yaml run --rm --no-deps migrate
+```
+
+Create a private `.env.bootstrap.local` containing `GCMS_BOOTSTRAP_EMAIL`,
+`GCMS_BOOTSTRAP_NAME` and a strong `GCMS_BOOTSTRAP_PASSWORD`, then run:
+
+```bash
+node scripts/ops/setup.mjs --env-file .env.production.local --credentials-file .env.bootstrap.local --project gcms
+node scripts/ops/deploy.mjs --env-file .env.production.local --project gcms
+```
+
+`gcms` is the generated Compose project name. If you change it, use that same
+project name consistently. The operations guide included in the release covers
+readiness, captured email for local tests, trusted proxy configuration, backups
+and restoration. Bootstrap never requires elevating the runtime database role.
+
+## Proprietary Commercial Software
+
+Copyright (c) 2026 Mix Reality PTY LTD. All rights reserved.
+
+This tool is provided for authorized customers, evaluators, and partners of GroCMS.
+Downloading and running the GroCMS core platform requires a valid commercial license agreement from Mix Reality PTY LTD.
+
+See [LICENSE.txt](LICENSE.txt) for details. For inquiries, contact `get@grocms.com` or visit [https://grocms.com](https://grocms.com).
+
+## Building the installer package
+
+This section is for maintainers working in the GroCMS source repository. The
+presence of this source does not establish that a given version is available on
+npm. Public publication is a separate, manual release step.
+
+From the repository root, after installing its locked dependencies with
+`npm ci`, create an output directory and pack the installer:
+
+```powershell
+New-Item -ItemType Directory -Force artifacts/installer | Out-Null
+npm pack --workspace=create-grocms --pack-destination artifacts/installer
+```
+
+The workspace's `prepack` runs `build.mjs`. It bundles the CLI, its runtime
+dependencies and the existing private `@grocms/archive` helper into
+`dist/index.js`. The published `bin` and `main` point to that file; customers do
+not need the GroCMS workspace, its private packages, or an installer build step.
+The package retains its proprietary `LICENSE.txt`, dependency notices in
+`dist/THIRD_PARTY_NOTICES.txt`, and corresponding licences in `dist/licenses`.
+It contains no CMS application archive, customer credentials or release ledger.
+
+Before publishing, inspect the exact tarball's inventory and verify its help
+command and synthetic archive installation in a clean directory outside the
+workspace. Complete a licensed download and dependency installation against the
+intended release service, including denial of invalid credentials. Do not use
+live customer sites as installer test destinations. Publishing only a source
+directory or checking the development CLI does not establish that the packaged
+installer works.
+
+Publish only the reviewed tarball after these checks and an authorized release
+decision. Keep the archive and its checksum as the publication evidence; do not
+repack different bytes under the same reviewed identity. No automatic public
+publication is part of this package's build.

package/dist/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,10 @@
+# create-grocms third-party notices
+
+GroCMS installer and archive integration: Copyright (c) 2026 Mix Reality PTY LTD. All rights reserved.
+The following bundled dependencies retain their upstream licenses. These licenses do not apply to GroCMS proprietary code.
+
+@clack/core@0.3.5 (MIT): licenses/@clack__core@0.3.5/LICENSE
+@clack/prompts@0.8.2 (MIT): licenses/@clack__prompts@0.8.2/LICENSE
+adm-zip@0.6.1 (MIT): licenses/adm-zip@0.6.1/LICENSE
+picocolors@1.1.1 (ISC): licenses/picocolors@1.1.1/LICENSE
+sisteransi@1.0.5 (MIT): licenses/sisteransi@1.0.5/license