create-shapio 0.2.0 → 0.3.0

package/dist/index.js

@@ -17,10 +17,10 @@ const packageJson = ({ projectName, shapioSpec }) => `${JSON.stringify({
 		worker: "shapio worker",
 		status: "shapio status"
 	},
-	dependencies: { shapio: shapioSpec }
+	dependencies: { "@shapio/cms": shapioSpec }
 }, null, 2)}\n`;
 const env = ({ databaseUrl, sessionSecret }) => [
-	"# Shapio configuration. Every setting is an environment variable; `shapio` loads this file.",
+	"# Shapio configuration. Every setting is an environment variable; the `shapio` command loads this file.",
 	"# Real environment variables override values here.",
 	"NODE_ENV=production",
 	"HOST=127.0.0.1",
@@ -58,7 +58,7 @@ const shapioConfig = () => `// Project configuration for Shapio: code extensions
 // with \`shapio schema pull\` / \`shapio schema apply\`. This file is code: changing it, or anything in
 // ./extensions, needs a restart (never a rebuild). Check it with \`npx shapio extensions check\`.
 // TypeScript works as is (erasable syntax only: no enums or namespaces). Guide: documentation/extensions.md in Shapio's repository.
-import { defineConfig } from 'shapio/config';
+import { defineConfig } from '@shapio/cms/config';
 
 export const config = defineConfig({
   // Lifecycle hooks by model API ID ('*' = every model). before* hooks run inside the write's transaction
@@ -97,7 +97,7 @@ module.exports = {
   apps: [
     {
       name: ${JSON.stringify(projectName)},
-      script: 'node_modules/shapio/dist/cli.js',
+      script: 'node_modules/@shapio/cms/dist/cli.js',
       args: 'start',
       exec_mode: 'fork',
       instances: 1,
@@ -105,7 +105,7 @@ module.exports = {
       env: { NODE_ENV: 'production' },
     },
     // Cluster variant (replace the app above): two processes sharing the port, each with its inline worker.
-    // { name: ${JSON.stringify(projectName)}, script: 'node_modules/shapio/dist/cli.js', args: 'start', exec_mode: 'cluster', instances: 2, kill_timeout: 20000, env: { NODE_ENV: 'production' } },
+    // { name: ${JSON.stringify(projectName)}, script: 'node_modules/@shapio/cms/dist/cli.js', args: 'start', exec_mode: 'cluster', instances: 2, kill_timeout: 20000, env: { NODE_ENV: 'production' } },
   ],
 };
 `;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/templates.ts","../src/scaffold.ts","../src/starters.ts","../src/site.ts","../src/main.ts","../src/index.ts"],"sourcesContent":["export type TemplateInput = {\n  projectName: string;\n  shapioSpec: string;\n  databaseUrl: string;\n  sessionSecret: string;\n};\n\nconst packageJson = ({ projectName, shapioSpec }: TemplateInput) =>\n  `${JSON.stringify(\n    {\n      name: projectName,\n      private: true,\n      type: 'module',\n      engines: { node: '>=24' },\n      scripts: {\n        start: 'shapio start',\n        migrate: 'shapio migrate',\n        worker: 'shapio worker',\n        status: 'shapio status',\n      },\n      dependencies: { shapio: shapioSpec },\n    },\n    null,\n    2,\n  )}\\n`;\n\nconst env = ({ databaseUrl, sessionSecret }: TemplateInput) =>\n  [\n    '# Shapio configuration. Every setting is an environment variable; `shapio` loads this file.',\n    '# Real environment variables override values here.',\n    'NODE_ENV=production',\n    'HOST=127.0.0.1',\n    'PORT=4300',\n    'LOG_LEVEL=info',\n    '',\n    '# The origin people reach Shapio at; every absolute URL is built from it. Change it when you deploy.',\n    'PUBLIC_URL=http://localhost:4300',\n    '# BASE_PATH=/cms',\n    '',\n    '# HTTPS without a reverse proxy: set PUBLIC_URL=https://your.domain and PORT=443, and point these at your',\n    '# certificate and key (PEM). Renewed files are picked up without a restart. HTTP_PORT=80 redirects to HTTPS.',\n    '# TLS_CERT_FILE=/etc/shapio/tls/fullchain.pem',\n    '# TLS_KEY_FILE=/etc/shapio/tls/privkey.pem',\n    '# HTTP_PORT=80',\n    '',\n    '# PostgreSQL >= 16, or sqlite:<path> for a single-process install',\n    `DATABASE_URL=${databaseUrl}`,\n    'MIGRATE_ON_START=true',\n    '',\n    '# Signs preview links, private-media URLs and app-user tokens, and encrypts stored secrets.',\n    '# Generated for this project; keep it secret, and back it up with the database.',\n    `SESSION_SECRET=${sessionSecret}`,\n    '',\n    '# SETUP_REQUIRE_TOKEN=true  # require the logged one-time token for first-run setup (for installs exposed before setup)',\n    '',\n    '# inline: jobs run inside the server process. dedicated: run `npm run worker` as a second process.',\n    'WORKER_MODE=inline',\n    '',\n    'MEDIA_PATH=./media',\n    '',\n  ].join('\\n');\n\nconst shapioConfig =\n  () => `// Project configuration for Shapio: code extensions (hooks, custom routes, services, jobs) and custom\n// field editors. Content models are NOT configured here; they are created live in the admin UI and synced\n// with \\`shapio schema pull\\` / \\`shapio schema apply\\`. This file is code: changing it, or anything in\n// ./extensions, needs a restart (never a rebuild). Check it with \\`npx shapio extensions check\\`.\n// TypeScript works as is (erasable syntax only: no enums or namespaces). Guide: documentation/extensions.md in Shapio's repository.\nimport { defineConfig } from 'shapio/config';\n\nexport const config = defineConfig({\n  // Lifecycle hooks by model API ID ('*' = every model). before* hooks run inside the write's transaction\n  // and may reject it (422 HOOK_REJECTED); after* hooks run after commit, as retried jobs.\n  hooks: {\n    // article: {\n    //   beforePublish: ({ data, reject }) => {\n    //     if (!data?.cover) reject('An article needs a cover image');\n    //   },\n    // },\n  },\n\n  // Custom React field editors: file names of ES modules built into ./extensions/editors/, e.g.\n  // ['star-rating.js']. The admin loads them at runtime; installing one is a file copy plus a restart.\n  editors: [],\n\n  // Custom Fastify routes, mounted at /api/ext/<prefix>. Mutating routes must declare config.audit.\n  // routes: [{ prefix: 'acme', plugin: async (app) => { app.get('/ping', async () => ({ ok: true })); } }],\n\n  // Services constructed once at startup and shared by hooks, routes and jobs.\n  // services: { stats: ({ services }) => ({ articles: () => services.content.count('article') }) },\n\n  // Background jobs, registered as ext.<name>; enqueue with services.jobs.enqueue('<name>', payload).\n  // jobs: { nightlyReport: async ({ services, logger }) => { logger.info('report'); } },\n});\n`;\n\nconst gitignore = () => `node_modules/\n.env\nmedia/*\n!media/.gitkeep\n`;\n\nconst pm2Ecosystem = ({ projectName }: TemplateInput) => `// PM2 process file: pm2 start ecosystem.config.cjs\n// One instance in fork mode, the simplest setup. Several instances on one database are supported too: use the\n// cluster variant below.\nmodule.exports = {\n  apps: [\n    {\n      name: ${JSON.stringify(projectName)},\n      script: 'node_modules/shapio/dist/cli.js',\n      args: 'start',\n      exec_mode: 'fork',\n      instances: 1,\n      kill_timeout: 20000,\n      env: { NODE_ENV: 'production' },\n    },\n    // Cluster variant (replace the app above): two processes sharing the port, each with its inline worker.\n    // { name: ${JSON.stringify(projectName)}, script: 'node_modules/shapio/dist/cli.js', args: 'start', exec_mode: 'cluster', instances: 2, kill_timeout: 20000, env: { NODE_ENV: 'production' } },\n  ],\n};\n`;\n\nconst readme = ({ projectName }: TemplateInput) =>\n  `# ${projectName}\n\nA [Shapio](https://github.com/mybrokengnome/shapio) project.\n\n1. Set \\`DATABASE_URL\\` in \\`.env\\` to a PostgreSQL (>= 16) database, or to \\`sqlite:<path>\\` for a\n   single-process install.\n2. \\`npm run start\\`. Migrations run on start. The first boot logs where to create the owner account: open\n   \\`/admin/\\`; the first person to complete Setup becomes the owner.\n3. Under PM2: \\`pm2 start ecosystem.config.cjs\\`.\n\nContent models are edited live in the admin; no restart is needed for modelling. Changing \\`shapio.config.ts\\`\nor \\`extensions/\\` (code) needs a restart; \\`npx shapio extensions check\\` validates them.\n`;\n\n/** Files to write, relative to the project directory. */\nexport const renderTemplates = (input: TemplateInput): ReadonlyArray<[path: string, content: string]> => [\n  ['package.json', packageJson(input)],\n  ['.env', env(input)],\n  [\n    '.env.example',\n    env({ ...input, databaseUrl: 'postgres://user:password@localhost:5432/shapio', sessionSecret: '' }),\n  ],\n  ['shapio.config.ts', shapioConfig()],\n  ['.gitignore', gitignore()],\n  ['ecosystem.config.cjs', pm2Ecosystem(input)],\n  ['README.md', readme(input)],\n  ['extensions/.gitkeep', ''],\n  ['extensions/editors/.gitkeep', ''],\n  ['media/.gitkeep', ''],\n];\n","import { randomBytes } from 'node:crypto';\nimport { existsSync, mkdirSync, readdirSync, writeFileSync } from 'node:fs';\nimport { basename, dirname, join, resolve } from 'node:path';\nimport { renderTemplates } from './templates.js';\n\nexport type ScaffoldOptions = {\n  directory: string;\n  shapioSpec: string;\n  databaseUrl?: string;\n};\n\nexport class ScaffoldError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ScaffoldError';\n  }\n}\n\n/** npm package names: lowercase, URL-safe. Derived from the directory name. */\nexport const toPackageName = (directory: string): string =>\n  basename(resolve(directory))\n    .toLowerCase()\n    .replace(/[^a-z0-9._-]+/g, '-')\n    .replace(/^[._-]+|[-.]+$/g, '') || 'shapio-project';\n\n/** Writes the project files. Refuses to touch a non-empty directory. Returns the absolute project path. */\nexport const scaffoldProject = ({ directory, shapioSpec, databaseUrl }: ScaffoldOptions): string => {\n  const root = resolve(directory);\n  if (existsSync(root) && readdirSync(root).length > 0) {\n    throw new ScaffoldError(`${root} exists and is not empty`);\n  }\n  const projectName = toPackageName(root);\n  const files = renderTemplates({\n    projectName,\n    shapioSpec,\n    databaseUrl:\n      databaseUrl ?? `postgres://postgres:postgres@localhost:5432/${projectName.replace(/[^a-z0-9_]/g, '_')}`,\n    sessionSecret: randomBytes(32).toString('base64url'),\n  });\n  for (const [path, content] of files) {\n    const target = join(root, path);\n    mkdirSync(dirname(target), { recursive: true });\n    writeFileSync(target, content, { flag: 'wx' });\n  }\n  return root;\n};\n","/** The site starters `create-shapio --site` scaffolds (examples/<name> in the repository). */\nexport const SITE_STARTERS = ['astro', 'next', 'sveltekit'] as const;\n\nexport type SiteStarter = (typeof SITE_STARTERS)[number];\n\nexport const isSiteStarter = (value: string): value is SiteStarter =>\n  (SITE_STARTERS as readonly string[]).includes(value);\n\n/** npm leaves `.gitignore` out of published packages, so templates carry it under this name. */\nexport const PACKED_GITIGNORE = 'gitignore';\n","import { cpSync, existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { ScaffoldError, toPackageName } from './scaffold.js';\nimport { PACKED_GITIGNORE, type SiteStarter } from './starters.js';\n\nexport type ScaffoldSiteOptions = {\n  directory: string;\n  site: SiteStarter;\n  /** The packed templates (templates/ next to dist/ in the published package). */\n  templatesDir: string;\n};\n\n/**\n * Writes a standalone site project from a starter template: the framework app, the blog's model files in\n * shapio/, and the seed and smoke scripts. Refuses to touch a non-empty directory. Returns the project path.\n */\nexport const scaffoldSite = ({ directory, site, templatesDir }: ScaffoldSiteOptions): string => {\n  const root = resolve(directory);\n  if (existsSync(root) && readdirSync(root).length > 0) {\n    throw new ScaffoldError(`${root} exists and is not empty`);\n  }\n  const template = join(templatesDir, site);\n  if (!existsSync(join(template, 'package.json'))) {\n    throw new ScaffoldError(\n      `The ${site} template is missing from ${templatesDir}; build create-shapio first`,\n    );\n  }\n  cpSync(template, root, { recursive: true });\n  if (existsSync(join(root, PACKED_GITIGNORE))) {\n    renameSync(join(root, PACKED_GITIGNORE), join(root, '.gitignore'));\n  }\n  const packagePath = join(root, 'package.json');\n  const packageJson = JSON.parse(readFileSync(packagePath, 'utf8')) as Record<string, unknown>;\n  writeFileSync(\n    packagePath,\n    `${JSON.stringify({ ...packageJson, name: toPackageName(root), version: '0.1.0' }, null, 2)}\\n`,\n  );\n  return root;\n};\n","import { spawnSync } from 'node:child_process';\nimport { readFileSync } from 'node:fs';\nimport { fileURLToPath } from 'node:url';\nimport { parseArgs } from 'node:util';\nimport { scaffoldProject, ScaffoldError } from './scaffold.js';\nimport { scaffoldSite } from './site.js';\nimport { isSiteStarter, SITE_STARTERS, type SiteStarter } from './starters.js';\n\nconst USAGE = `Usage: npx create-shapio <directory> [options]\n\nWithout --site: a Shapio project (the CMS server). With --site: a website that reads content from Shapio.\n\nOptions:\n  --site <${SITE_STARTERS.join('|')}>  Create a site starter instead (a blog: pages, articles, authors)\n  --database-url <url>   Database URL to put in .env (PostgreSQL, or sqlite:<path> for a single-process\n                         install; CMS project only)\n  --shapio-spec <spec>   Dependency spec for shapio (default: ^<this version>; a tarball path works too)\n  --no-install           Skip npm install\n  -h, --help             Show this help\n`;\n\n/** Packed from the repository's examples/ when create-shapio is built (templates/ beside dist/). */\nconst TEMPLATES_DIR = fileURLToPath(new URL('../templates/', import.meta.url));\n\nconst ownVersion = (): string => {\n  const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as {\n    version: string;\n  };\n  return packageJson.version;\n};\n\ntype Output = { out: (text: string) => void; err: (text: string) => void };\n\n/** Returns the exit code. */\nexport const main = (argv: readonly string[], { out, err }: Output): number => {\n  const { values, positionals } = parseArgs({\n    args: [...argv],\n    allowPositionals: true,\n    allowNegative: true,\n    options: {\n      'database-url': { type: 'string' },\n      'shapio-spec': { type: 'string' },\n      site: { type: 'string' },\n      install: { type: 'boolean', default: true },\n      help: { type: 'boolean', short: 'h' },\n    },\n  });\n  const [directory] = positionals;\n  if (values.help || !directory) {\n    (directory ? out : err)(USAGE);\n    return values.help ? 0 : 1;\n  }\n  const site = values.site;\n  if (site !== undefined && !isSiteStarter(site)) {\n    err(`create-shapio: --site must be one of ${SITE_STARTERS.join(', ')}\\n`);\n    return 1;\n  }\n  if (site !== undefined && (values['database-url'] || values['shapio-spec'])) {\n    err('create-shapio: --database-url and --shapio-spec are for a CMS project, not --site\\n');\n    return 1;\n  }\n  let root: string;\n  try {\n    root = site\n      ? scaffoldSite({ directory, site, templatesDir: TEMPLATES_DIR })\n      : scaffoldProject({\n          directory,\n          shapioSpec: values['shapio-spec'] ?? `^${ownVersion()}`,\n          ...(values['database-url'] ? { databaseUrl: values['database-url'] } : {}),\n        });\n  } catch (error) {\n    if (error instanceof ScaffoldError) {\n      err(`create-shapio: ${error.message}\\n`);\n      return 1;\n    }\n    throw error;\n  }\n  out(`Created a ${site ? `${site} site` : 'Shapio project'} in ${root}\\n`);\n  if (values.install) {\n    out('Installing dependencies with npm...\\n');\n    const result = spawnSync('npm', ['install'], { cwd: root, stdio: 'inherit' });\n    if (result.status !== 0) {\n      err('create-shapio: npm install failed; run it yourself in the project directory\\n');\n      return 1;\n    }\n  }\n  out(\n    site\n      ? siteNextSteps(directory, site)\n      : `\\nNext:\\n  cd ${directory}\\n  edit .env (DATABASE_URL)\\n  npm run start\\n`,\n  );\n  return 0;\n};\n\nconst SERVE_COMMAND: Record<SiteStarter, string> = {\n  astro: 'npm run preview',\n  next: 'npm run start',\n  sveltekit: 'npm run preview',\n};\n\nconst siteNextSteps = (directory: string, site: SiteStarter) =>\n  [\n    '',\n    'Next (with a running Shapio; README.md has the details):',\n    `  cd ${directory}`,\n    '  SHAPIO_URL=http://localhost:4300 SHAPIO_ADMIN_EMAIL=you@example.com SHAPIO_ADMIN_PASSWORD=... npm run seed',\n    '  npm run build',\n    `  ${SERVE_COMMAND[site]}`,\n    '',\n  ].join('\\n');\n","#!/usr/bin/env node\nimport { main } from './main.js';\n\nprocess.exitCode = main(process.argv.slice(2), {\n  out: (text) => process.stdout.write(text),\n  err: (text) => process.stderr.write(text),\n});\n"],"mappings":";;;;;;;;AAOA,MAAM,eAAe,EAAE,aAAa,iBAClC,GAAG,KAAK,UACN;CACE,MAAM;CACN,SAAS;CACT,MAAM;CACN,SAAS,EAAE,MAAM,OAAO;CACxB,SAAS;EACP,OAAO;EACP,SAAS;EACT,QAAQ;EACR,QAAQ;CACV;CACA,cAAc,EAAE,QAAQ,WAAW;AACrC,GACA,MACA,CACF,EAAE;AAEJ,MAAM,OAAO,EAAE,aAAa,oBAC1B;CACE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,gBAAgB;CAChB;CACA;CACA;CACA;CACA,kBAAkB;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,IAAI;AAEb,MAAM,qBACE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCR,MAAM,kBAAkB;;;;;AAMxB,MAAM,gBAAgB,EAAE,kBAAiC;;;;;;cAM3C,KAAK,UAAU,WAAW,EAAE;;;;;;;;;iBASzB,KAAK,UAAU,WAAW,EAAE;;;;AAK7C,MAAM,UAAU,EAAE,kBAChB,KAAK,YAAY;;;;;;;;;;;;;;AAenB,MAAa,mBAAmB,UAAyE;CACvG,CAAC,gBAAgB,YAAY,KAAK,CAAC;CACnC,CAAC,QAAQ,IAAI,KAAK,CAAC;CACnB,CACE,gBACA,IAAI;EAAE,GAAG;EAAO,aAAa;EAAkD,eAAe;CAAG,CAAC,CACpG;CACA,CAAC,oBAAoB,aAAa,CAAC;CACnC,CAAC,cAAc,UAAU,CAAC;CAC1B,CAAC,wBAAwB,aAAa,KAAK,CAAC;CAC5C,CAAC,aAAa,OAAO,KAAK,CAAC;CAC3B,CAAC,uBAAuB,EAAE;CAC1B,CAAC,+BAA+B,EAAE;CAClC,CAAC,kBAAkB,EAAE;AACvB;;;AC7IA,IAAa,gBAAb,cAAmC,MAAM;CACvC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;AAGA,MAAa,iBAAiB,cAC5B,SAAS,QAAQ,SAAS,CAAC,CAAC,CACzB,YAAY,CAAC,CACb,QAAQ,kBAAkB,GAAG,CAAC,CAC9B,QAAQ,mBAAmB,EAAE,KAAK;;AAGvC,MAAa,mBAAmB,EAAE,WAAW,YAAY,kBAA2C;CAClG,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI,WAAW,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,GACjD,MAAM,IAAI,cAAc,GAAG,KAAK,yBAAyB;CAE3D,MAAM,cAAc,cAAc,IAAI;CACtC,MAAM,QAAQ,gBAAgB;EAC5B;EACA;EACA,aACE,eAAe,+CAA+C,YAAY,QAAQ,eAAe,GAAG;EACtG,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACrD,CAAC;CACD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO;EACnC,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,UAAU,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;EAC9C,cAAc,QAAQ,SAAS,EAAE,MAAM,KAAK,CAAC;CAC/C;CACA,OAAO;AACT;;;;AC5CA,MAAa,gBAAgB;CAAC;CAAS;CAAQ;AAAW;AAI1D,MAAa,iBAAiB,UAC3B,cAAoC,SAAS,KAAK;;AAGrD,MAAa,mBAAmB;;;;;;;ACOhC,MAAa,gBAAgB,EAAE,WAAW,MAAM,mBAAgD;CAC9F,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI,WAAW,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,GACjD,MAAM,IAAI,cAAc,GAAG,KAAK,yBAAyB;CAE3D,MAAM,WAAW,KAAK,cAAc,IAAI;CACxC,IAAI,CAAC,WAAW,KAAK,UAAU,cAAc,CAAC,GAC5C,MAAM,IAAI,cACR,OAAO,KAAK,4BAA4B,aAAa,4BACvD;CAEF,OAAO,UAAU,MAAM,EAAE,WAAW,KAAK,CAAC;CAC1C,IAAI,WAAW,KAAK,MAAA,WAAsB,CAAC,GACzC,WAAW,KAAK,MAAM,gBAAgB,GAAG,KAAK,MAAM,YAAY,CAAC;CAEnE,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,cAAc,KAAK,MAAM,aAAa,aAAa,MAAM,CAAC;CAChE,cACE,aACA,GAAG,KAAK,UAAU;EAAE,GAAG;EAAa,MAAM,cAAc,IAAI;EAAG,SAAS;CAAQ,GAAG,MAAM,CAAC,EAAE,GAC9F;CACA,OAAO;AACT;;;AC9BA,MAAM,QAAQ;;;;;YAKF,cAAc,KAAK,GAAG,EAAE;;;;;;;;AASpC,MAAM,gBAAgB,cAAc,IAAI,IAAI,iBAAiB,YAAY,GAAG,CAAC;AAE7E,MAAM,mBAA2B;CAI/B,OAHoB,KAAK,MAAM,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAG9E,CAAC,CAAC;AACrB;;AAKA,MAAa,QAAQ,MAAyB,EAAE,KAAK,UAA0B;CAC7E,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,MAAM,CAAC,GAAG,IAAI;EACd,kBAAkB;EAClB,eAAe;EACf,SAAS;GACP,gBAAgB,EAAE,MAAM,SAAS;GACjC,eAAe,EAAE,MAAM,SAAS;GAChC,MAAM,EAAE,MAAM,SAAS;GACvB,SAAS;IAAE,MAAM;IAAW,SAAS;GAAK;GAC1C,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;EACtC;CACF,CAAC;CACD,MAAM,CAAC,aAAa;CACpB,IAAI,OAAO,QAAQ,CAAC,WAAW;EAC7B,CAAC,YAAY,MAAM,IAAA,CAAK,KAAK;EAC7B,OAAO,OAAO,OAAO,IAAI;CAC3B;CACA,MAAM,OAAO,OAAO;CACpB,IAAI,SAAS,KAAA,KAAa,CAAC,cAAc,IAAI,GAAG;EAC9C,IAAI,wCAAwC,cAAc,KAAK,IAAI,EAAE,GAAG;EACxE,OAAO;CACT;CACA,IAAI,SAAS,KAAA,MAAc,OAAO,mBAAmB,OAAO,iBAAiB;EAC3E,IAAI,qFAAqF;EACzF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,OAAO,OACH,aAAa;GAAE;GAAW;GAAM,cAAc;EAAc,CAAC,IAC7D,gBAAgB;GACd;GACA,YAAY,OAAO,kBAAkB,IAAI,WAAW;GACpD,GAAI,OAAO,kBAAkB,EAAE,aAAa,OAAO,gBAAgB,IAAI,CAAC;EAC1E,CAAC;CACP,SAAS,OAAO;EACd,IAAI,iBAAiB,eAAe;GAClC,IAAI,kBAAkB,MAAM,QAAQ,GAAG;GACvC,OAAO;EACT;EACA,MAAM;CACR;CACA,IAAI,aAAa,OAAO,GAAG,KAAK,SAAS,iBAAiB,MAAM,KAAK,GAAG;CACxE,IAAI,OAAO,SAAS;EAClB,IAAI,uCAAuC;EAE3C,IADe,UAAU,OAAO,CAAC,SAAS,GAAG;GAAE,KAAK;GAAM,OAAO;EAAU,CAClE,CAAC,CAAC,WAAW,GAAG;GACvB,IAAI,+EAA+E;GACnF,OAAO;EACT;CACF;CACA,IACE,OACI,cAAc,WAAW,IAAI,IAC7B,iBAAiB,UAAU,gDACjC;CACA,OAAO;AACT;AAEA,MAAM,gBAA6C;CACjD,OAAO;CACP,MAAM;CACN,WAAW;AACb;AAEA,MAAM,iBAAiB,WAAmB,SACxC;CACE;CACA;CACA,QAAQ;CACR;CACA;CACA,KAAK,cAAc;CACnB;AACF,CAAC,CAAC,KAAK,IAAI;;;AC1Gb,QAAQ,WAAW,KAAK,QAAQ,KAAK,MAAM,CAAC,GAAG;CAC7C,MAAM,SAAS,QAAQ,OAAO,MAAM,IAAI;CACxC,MAAM,SAAS,QAAQ,OAAO,MAAM,IAAI;AAC1C,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/templates.ts","../src/scaffold.ts","../src/starters.ts","../src/site.ts","../src/main.ts","../src/index.ts"],"sourcesContent":["export type TemplateInput = {\n  projectName: string;\n  shapioSpec: string;\n  databaseUrl: string;\n  sessionSecret: string;\n};\n\nconst packageJson = ({ projectName, shapioSpec }: TemplateInput) =>\n  `${JSON.stringify(\n    {\n      name: projectName,\n      private: true,\n      type: 'module',\n      engines: { node: '>=24' },\n      scripts: {\n        start: 'shapio start',\n        migrate: 'shapio migrate',\n        worker: 'shapio worker',\n        status: 'shapio status',\n      },\n      dependencies: { '@shapio/cms': shapioSpec },\n    },\n    null,\n    2,\n  )}\\n`;\n\nconst env = ({ databaseUrl, sessionSecret }: TemplateInput) =>\n  [\n    '# Shapio configuration. Every setting is an environment variable; the `shapio` command loads this file.',\n    '# Real environment variables override values here.',\n    'NODE_ENV=production',\n    'HOST=127.0.0.1',\n    'PORT=4300',\n    'LOG_LEVEL=info',\n    '',\n    '# The origin people reach Shapio at; every absolute URL is built from it. Change it when you deploy.',\n    'PUBLIC_URL=http://localhost:4300',\n    '# BASE_PATH=/cms',\n    '',\n    '# HTTPS without a reverse proxy: set PUBLIC_URL=https://your.domain and PORT=443, and point these at your',\n    '# certificate and key (PEM). Renewed files are picked up without a restart. HTTP_PORT=80 redirects to HTTPS.',\n    '# TLS_CERT_FILE=/etc/shapio/tls/fullchain.pem',\n    '# TLS_KEY_FILE=/etc/shapio/tls/privkey.pem',\n    '# HTTP_PORT=80',\n    '',\n    '# PostgreSQL >= 16, or sqlite:<path> for a single-process install',\n    `DATABASE_URL=${databaseUrl}`,\n    'MIGRATE_ON_START=true',\n    '',\n    '# Signs preview links, private-media URLs and app-user tokens, and encrypts stored secrets.',\n    '# Generated for this project; keep it secret, and back it up with the database.',\n    `SESSION_SECRET=${sessionSecret}`,\n    '',\n    '# SETUP_REQUIRE_TOKEN=true  # require the logged one-time token for first-run setup (for installs exposed before setup)',\n    '',\n    '# inline: jobs run inside the server process. dedicated: run `npm run worker` as a second process.',\n    'WORKER_MODE=inline',\n    '',\n    'MEDIA_PATH=./media',\n    '',\n  ].join('\\n');\n\nconst shapioConfig =\n  () => `// Project configuration for Shapio: code extensions (hooks, custom routes, services, jobs) and custom\n// field editors. Content models are NOT configured here; they are created live in the admin UI and synced\n// with \\`shapio schema pull\\` / \\`shapio schema apply\\`. This file is code: changing it, or anything in\n// ./extensions, needs a restart (never a rebuild). Check it with \\`npx shapio extensions check\\`.\n// TypeScript works as is (erasable syntax only: no enums or namespaces). Guide: documentation/extensions.md in Shapio's repository.\nimport { defineConfig } from '@shapio/cms/config';\n\nexport const config = defineConfig({\n  // Lifecycle hooks by model API ID ('*' = every model). before* hooks run inside the write's transaction\n  // and may reject it (422 HOOK_REJECTED); after* hooks run after commit, as retried jobs.\n  hooks: {\n    // article: {\n    //   beforePublish: ({ data, reject }) => {\n    //     if (!data?.cover) reject('An article needs a cover image');\n    //   },\n    // },\n  },\n\n  // Custom React field editors: file names of ES modules built into ./extensions/editors/, e.g.\n  // ['star-rating.js']. The admin loads them at runtime; installing one is a file copy plus a restart.\n  editors: [],\n\n  // Custom Fastify routes, mounted at /api/ext/<prefix>. Mutating routes must declare config.audit.\n  // routes: [{ prefix: 'acme', plugin: async (app) => { app.get('/ping', async () => ({ ok: true })); } }],\n\n  // Services constructed once at startup and shared by hooks, routes and jobs.\n  // services: { stats: ({ services }) => ({ articles: () => services.content.count('article') }) },\n\n  // Background jobs, registered as ext.<name>; enqueue with services.jobs.enqueue('<name>', payload).\n  // jobs: { nightlyReport: async ({ services, logger }) => { logger.info('report'); } },\n});\n`;\n\nconst gitignore = () => `node_modules/\n.env\nmedia/*\n!media/.gitkeep\n`;\n\nconst pm2Ecosystem = ({ projectName }: TemplateInput) => `// PM2 process file: pm2 start ecosystem.config.cjs\n// One instance in fork mode, the simplest setup. Several instances on one database are supported too: use the\n// cluster variant below.\nmodule.exports = {\n  apps: [\n    {\n      name: ${JSON.stringify(projectName)},\n      script: 'node_modules/@shapio/cms/dist/cli.js',\n      args: 'start',\n      exec_mode: 'fork',\n      instances: 1,\n      kill_timeout: 20000,\n      env: { NODE_ENV: 'production' },\n    },\n    // Cluster variant (replace the app above): two processes sharing the port, each with its inline worker.\n    // { name: ${JSON.stringify(projectName)}, script: 'node_modules/@shapio/cms/dist/cli.js', args: 'start', exec_mode: 'cluster', instances: 2, kill_timeout: 20000, env: { NODE_ENV: 'production' } },\n  ],\n};\n`;\n\nconst readme = ({ projectName }: TemplateInput) =>\n  `# ${projectName}\n\nA [Shapio](https://github.com/mybrokengnome/shapio) project.\n\n1. Set \\`DATABASE_URL\\` in \\`.env\\` to a PostgreSQL (>= 16) database, or to \\`sqlite:<path>\\` for a\n   single-process install.\n2. \\`npm run start\\`. Migrations run on start. The first boot logs where to create the owner account: open\n   \\`/admin/\\`; the first person to complete Setup becomes the owner.\n3. Under PM2: \\`pm2 start ecosystem.config.cjs\\`.\n\nContent models are edited live in the admin; no restart is needed for modelling. Changing \\`shapio.config.ts\\`\nor \\`extensions/\\` (code) needs a restart; \\`npx shapio extensions check\\` validates them.\n`;\n\n/** Files to write, relative to the project directory. */\nexport const renderTemplates = (input: TemplateInput): ReadonlyArray<[path: string, content: string]> => [\n  ['package.json', packageJson(input)],\n  ['.env', env(input)],\n  [\n    '.env.example',\n    env({ ...input, databaseUrl: 'postgres://user:password@localhost:5432/shapio', sessionSecret: '' }),\n  ],\n  ['shapio.config.ts', shapioConfig()],\n  ['.gitignore', gitignore()],\n  ['ecosystem.config.cjs', pm2Ecosystem(input)],\n  ['README.md', readme(input)],\n  ['extensions/.gitkeep', ''],\n  ['extensions/editors/.gitkeep', ''],\n  ['media/.gitkeep', ''],\n];\n","import { randomBytes } from 'node:crypto';\nimport { existsSync, mkdirSync, readdirSync, writeFileSync } from 'node:fs';\nimport { basename, dirname, join, resolve } from 'node:path';\nimport { renderTemplates } from './templates.js';\n\nexport type ScaffoldOptions = {\n  directory: string;\n  shapioSpec: string;\n  databaseUrl?: string;\n};\n\nexport class ScaffoldError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ScaffoldError';\n  }\n}\n\n/** npm package names: lowercase, URL-safe. Derived from the directory name. */\nexport const toPackageName = (directory: string): string =>\n  basename(resolve(directory))\n    .toLowerCase()\n    .replace(/[^a-z0-9._-]+/g, '-')\n    .replace(/^[._-]+|[-.]+$/g, '') || 'shapio-project';\n\n/** Writes the project files. Refuses to touch a non-empty directory. Returns the absolute project path. */\nexport const scaffoldProject = ({ directory, shapioSpec, databaseUrl }: ScaffoldOptions): string => {\n  const root = resolve(directory);\n  if (existsSync(root) && readdirSync(root).length > 0) {\n    throw new ScaffoldError(`${root} exists and is not empty`);\n  }\n  const projectName = toPackageName(root);\n  const files = renderTemplates({\n    projectName,\n    shapioSpec,\n    databaseUrl:\n      databaseUrl ?? `postgres://postgres:postgres@localhost:5432/${projectName.replace(/[^a-z0-9_]/g, '_')}`,\n    sessionSecret: randomBytes(32).toString('base64url'),\n  });\n  for (const [path, content] of files) {\n    const target = join(root, path);\n    mkdirSync(dirname(target), { recursive: true });\n    writeFileSync(target, content, { flag: 'wx' });\n  }\n  return root;\n};\n","/** The site starters `create-shapio --site` scaffolds (examples/<name> in the repository). */\nexport const SITE_STARTERS = ['astro', 'next', 'sveltekit'] as const;\n\nexport type SiteStarter = (typeof SITE_STARTERS)[number];\n\nexport const isSiteStarter = (value: string): value is SiteStarter =>\n  (SITE_STARTERS as readonly string[]).includes(value);\n\n/** npm leaves `.gitignore` out of published packages, so templates carry it under this name. */\nexport const PACKED_GITIGNORE = 'gitignore';\n","import { cpSync, existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { ScaffoldError, toPackageName } from './scaffold.js';\nimport { PACKED_GITIGNORE, type SiteStarter } from './starters.js';\n\nexport type ScaffoldSiteOptions = {\n  directory: string;\n  site: SiteStarter;\n  /** The packed templates (templates/ next to dist/ in the published package). */\n  templatesDir: string;\n};\n\n/**\n * Writes a standalone site project from a starter template: the framework app, the blog's model files in\n * shapio/, and the seed and smoke scripts. Refuses to touch a non-empty directory. Returns the project path.\n */\nexport const scaffoldSite = ({ directory, site, templatesDir }: ScaffoldSiteOptions): string => {\n  const root = resolve(directory);\n  if (existsSync(root) && readdirSync(root).length > 0) {\n    throw new ScaffoldError(`${root} exists and is not empty`);\n  }\n  const template = join(templatesDir, site);\n  if (!existsSync(join(template, 'package.json'))) {\n    throw new ScaffoldError(\n      `The ${site} template is missing from ${templatesDir}; build create-shapio first`,\n    );\n  }\n  cpSync(template, root, { recursive: true });\n  if (existsSync(join(root, PACKED_GITIGNORE))) {\n    renameSync(join(root, PACKED_GITIGNORE), join(root, '.gitignore'));\n  }\n  const packagePath = join(root, 'package.json');\n  const packageJson = JSON.parse(readFileSync(packagePath, 'utf8')) as Record<string, unknown>;\n  writeFileSync(\n    packagePath,\n    `${JSON.stringify({ ...packageJson, name: toPackageName(root), version: '0.1.0' }, null, 2)}\\n`,\n  );\n  return root;\n};\n","import { spawnSync } from 'node:child_process';\nimport { readFileSync } from 'node:fs';\nimport { fileURLToPath } from 'node:url';\nimport { parseArgs } from 'node:util';\nimport { scaffoldProject, ScaffoldError } from './scaffold.js';\nimport { scaffoldSite } from './site.js';\nimport { isSiteStarter, SITE_STARTERS, type SiteStarter } from './starters.js';\n\nconst USAGE = `Usage: npx create-shapio <directory> [options]\n\nWithout --site: a Shapio project (the CMS server). With --site: a website that reads content from Shapio.\n\nOptions:\n  --site <${SITE_STARTERS.join('|')}>  Create a site starter instead (a blog: pages, articles, authors)\n  --database-url <url>   Database URL to put in .env (PostgreSQL, or sqlite:<path> for a single-process\n                         install; CMS project only)\n  --shapio-spec <spec>   Dependency spec for shapio (default: ^<this version>; a tarball path works too)\n  --no-install           Skip npm install\n  -h, --help             Show this help\n`;\n\n/** Packed from the repository's examples/ when create-shapio is built (templates/ beside dist/). */\nconst TEMPLATES_DIR = fileURLToPath(new URL('../templates/', import.meta.url));\n\nconst ownVersion = (): string => {\n  const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as {\n    version: string;\n  };\n  return packageJson.version;\n};\n\ntype Output = { out: (text: string) => void; err: (text: string) => void };\n\n/** Returns the exit code. */\nexport const main = (argv: readonly string[], { out, err }: Output): number => {\n  const { values, positionals } = parseArgs({\n    args: [...argv],\n    allowPositionals: true,\n    allowNegative: true,\n    options: {\n      'database-url': { type: 'string' },\n      'shapio-spec': { type: 'string' },\n      site: { type: 'string' },\n      install: { type: 'boolean', default: true },\n      help: { type: 'boolean', short: 'h' },\n    },\n  });\n  const [directory] = positionals;\n  if (values.help || !directory) {\n    (directory ? out : err)(USAGE);\n    return values.help ? 0 : 1;\n  }\n  const site = values.site;\n  if (site !== undefined && !isSiteStarter(site)) {\n    err(`create-shapio: --site must be one of ${SITE_STARTERS.join(', ')}\\n`);\n    return 1;\n  }\n  if (site !== undefined && (values['database-url'] || values['shapio-spec'])) {\n    err('create-shapio: --database-url and --shapio-spec are for a CMS project, not --site\\n');\n    return 1;\n  }\n  let root: string;\n  try {\n    root = site\n      ? scaffoldSite({ directory, site, templatesDir: TEMPLATES_DIR })\n      : scaffoldProject({\n          directory,\n          shapioSpec: values['shapio-spec'] ?? `^${ownVersion()}`,\n          ...(values['database-url'] ? { databaseUrl: values['database-url'] } : {}),\n        });\n  } catch (error) {\n    if (error instanceof ScaffoldError) {\n      err(`create-shapio: ${error.message}\\n`);\n      return 1;\n    }\n    throw error;\n  }\n  out(`Created a ${site ? `${site} site` : 'Shapio project'} in ${root}\\n`);\n  if (values.install) {\n    out('Installing dependencies with npm...\\n');\n    const result = spawnSync('npm', ['install'], { cwd: root, stdio: 'inherit' });\n    if (result.status !== 0) {\n      err('create-shapio: npm install failed; run it yourself in the project directory\\n');\n      return 1;\n    }\n  }\n  out(\n    site\n      ? siteNextSteps(directory, site)\n      : `\\nNext:\\n  cd ${directory}\\n  edit .env (DATABASE_URL)\\n  npm run start\\n`,\n  );\n  return 0;\n};\n\nconst SERVE_COMMAND: Record<SiteStarter, string> = {\n  astro: 'npm run preview',\n  next: 'npm run start',\n  sveltekit: 'npm run preview',\n};\n\nconst siteNextSteps = (directory: string, site: SiteStarter) =>\n  [\n    '',\n    'Next (with a running Shapio; README.md has the details):',\n    `  cd ${directory}`,\n    '  SHAPIO_URL=http://localhost:4300 SHAPIO_ADMIN_EMAIL=you@example.com SHAPIO_ADMIN_PASSWORD=... npm run seed',\n    '  npm run build',\n    `  ${SERVE_COMMAND[site]}`,\n    '',\n  ].join('\\n');\n","#!/usr/bin/env node\nimport { main } from './main.js';\n\nprocess.exitCode = main(process.argv.slice(2), {\n  out: (text) => process.stdout.write(text),\n  err: (text) => process.stderr.write(text),\n});\n"],"mappings":";;;;;;;;AAOA,MAAM,eAAe,EAAE,aAAa,iBAClC,GAAG,KAAK,UACN;CACE,MAAM;CACN,SAAS;CACT,MAAM;CACN,SAAS,EAAE,MAAM,OAAO;CACxB,SAAS;EACP,OAAO;EACP,SAAS;EACT,QAAQ;EACR,QAAQ;CACV;CACA,cAAc,EAAE,eAAe,WAAW;AAC5C,GACA,MACA,CACF,EAAE;AAEJ,MAAM,OAAO,EAAE,aAAa,oBAC1B;CACE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,gBAAgB;CAChB;CACA;CACA;CACA;CACA,kBAAkB;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,IAAI;AAEb,MAAM,qBACE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCR,MAAM,kBAAkB;;;;;AAMxB,MAAM,gBAAgB,EAAE,kBAAiC;;;;;;cAM3C,KAAK,UAAU,WAAW,EAAE;;;;;;;;;iBASzB,KAAK,UAAU,WAAW,EAAE;;;;AAK7C,MAAM,UAAU,EAAE,kBAChB,KAAK,YAAY;;;;;;;;;;;;;;AAenB,MAAa,mBAAmB,UAAyE;CACvG,CAAC,gBAAgB,YAAY,KAAK,CAAC;CACnC,CAAC,QAAQ,IAAI,KAAK,CAAC;CACnB,CACE,gBACA,IAAI;EAAE,GAAG;EAAO,aAAa;EAAkD,eAAe;CAAG,CAAC,CACpG;CACA,CAAC,oBAAoB,aAAa,CAAC;CACnC,CAAC,cAAc,UAAU,CAAC;CAC1B,CAAC,wBAAwB,aAAa,KAAK,CAAC;CAC5C,CAAC,aAAa,OAAO,KAAK,CAAC;CAC3B,CAAC,uBAAuB,EAAE;CAC1B,CAAC,+BAA+B,EAAE;CAClC,CAAC,kBAAkB,EAAE;AACvB;;;AC7IA,IAAa,gBAAb,cAAmC,MAAM;CACvC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;AAGA,MAAa,iBAAiB,cAC5B,SAAS,QAAQ,SAAS,CAAC,CAAC,CACzB,YAAY,CAAC,CACb,QAAQ,kBAAkB,GAAG,CAAC,CAC9B,QAAQ,mBAAmB,EAAE,KAAK;;AAGvC,MAAa,mBAAmB,EAAE,WAAW,YAAY,kBAA2C;CAClG,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI,WAAW,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,GACjD,MAAM,IAAI,cAAc,GAAG,KAAK,yBAAyB;CAE3D,MAAM,cAAc,cAAc,IAAI;CACtC,MAAM,QAAQ,gBAAgB;EAC5B;EACA;EACA,aACE,eAAe,+CAA+C,YAAY,QAAQ,eAAe,GAAG;EACtG,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACrD,CAAC;CACD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO;EACnC,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,UAAU,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;EAC9C,cAAc,QAAQ,SAAS,EAAE,MAAM,KAAK,CAAC;CAC/C;CACA,OAAO;AACT;;;;AC5CA,MAAa,gBAAgB;CAAC;CAAS;CAAQ;AAAW;AAI1D,MAAa,iBAAiB,UAC3B,cAAoC,SAAS,KAAK;;AAGrD,MAAa,mBAAmB;;;;;;;ACOhC,MAAa,gBAAgB,EAAE,WAAW,MAAM,mBAAgD;CAC9F,MAAM,OAAO,QAAQ,SAAS;CAC9B,IAAI,WAAW,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,GACjD,MAAM,IAAI,cAAc,GAAG,KAAK,yBAAyB;CAE3D,MAAM,WAAW,KAAK,cAAc,IAAI;CACxC,IAAI,CAAC,WAAW,KAAK,UAAU,cAAc,CAAC,GAC5C,MAAM,IAAI,cACR,OAAO,KAAK,4BAA4B,aAAa,4BACvD;CAEF,OAAO,UAAU,MAAM,EAAE,WAAW,KAAK,CAAC;CAC1C,IAAI,WAAW,KAAK,MAAA,WAAsB,CAAC,GACzC,WAAW,KAAK,MAAM,gBAAgB,GAAG,KAAK,MAAM,YAAY,CAAC;CAEnE,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,cAAc,KAAK,MAAM,aAAa,aAAa,MAAM,CAAC;CAChE,cACE,aACA,GAAG,KAAK,UAAU;EAAE,GAAG;EAAa,MAAM,cAAc,IAAI;EAAG,SAAS;CAAQ,GAAG,MAAM,CAAC,EAAE,GAC9F;CACA,OAAO;AACT;;;AC9BA,MAAM,QAAQ;;;;;YAKF,cAAc,KAAK,GAAG,EAAE;;;;;;;;AASpC,MAAM,gBAAgB,cAAc,IAAI,IAAI,iBAAiB,YAAY,GAAG,CAAC;AAE7E,MAAM,mBAA2B;CAI/B,OAHoB,KAAK,MAAM,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAG9E,CAAC,CAAC;AACrB;;AAKA,MAAa,QAAQ,MAAyB,EAAE,KAAK,UAA0B;CAC7E,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,MAAM,CAAC,GAAG,IAAI;EACd,kBAAkB;EAClB,eAAe;EACf,SAAS;GACP,gBAAgB,EAAE,MAAM,SAAS;GACjC,eAAe,EAAE,MAAM,SAAS;GAChC,MAAM,EAAE,MAAM,SAAS;GACvB,SAAS;IAAE,MAAM;IAAW,SAAS;GAAK;GAC1C,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;EACtC;CACF,CAAC;CACD,MAAM,CAAC,aAAa;CACpB,IAAI,OAAO,QAAQ,CAAC,WAAW;EAC7B,CAAC,YAAY,MAAM,IAAA,CAAK,KAAK;EAC7B,OAAO,OAAO,OAAO,IAAI;CAC3B;CACA,MAAM,OAAO,OAAO;CACpB,IAAI,SAAS,KAAA,KAAa,CAAC,cAAc,IAAI,GAAG;EAC9C,IAAI,wCAAwC,cAAc,KAAK,IAAI,EAAE,GAAG;EACxE,OAAO;CACT;CACA,IAAI,SAAS,KAAA,MAAc,OAAO,mBAAmB,OAAO,iBAAiB;EAC3E,IAAI,qFAAqF;EACzF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,OAAO,OACH,aAAa;GAAE;GAAW;GAAM,cAAc;EAAc,CAAC,IAC7D,gBAAgB;GACd;GACA,YAAY,OAAO,kBAAkB,IAAI,WAAW;GACpD,GAAI,OAAO,kBAAkB,EAAE,aAAa,OAAO,gBAAgB,IAAI,CAAC;EAC1E,CAAC;CACP,SAAS,OAAO;EACd,IAAI,iBAAiB,eAAe;GAClC,IAAI,kBAAkB,MAAM,QAAQ,GAAG;GACvC,OAAO;EACT;EACA,MAAM;CACR;CACA,IAAI,aAAa,OAAO,GAAG,KAAK,SAAS,iBAAiB,MAAM,KAAK,GAAG;CACxE,IAAI,OAAO,SAAS;EAClB,IAAI,uCAAuC;EAE3C,IADe,UAAU,OAAO,CAAC,SAAS,GAAG;GAAE,KAAK;GAAM,OAAO;EAAU,CAClE,CAAC,CAAC,WAAW,GAAG;GACvB,IAAI,+EAA+E;GACnF,OAAO;EACT;CACF;CACA,IACE,OACI,cAAc,WAAW,IAAI,IAC7B,iBAAiB,UAAU,gDACjC;CACA,OAAO;AACT;AAEA,MAAM,gBAA6C;CACjD,OAAO;CACP,MAAM;CACN,WAAW;AACb;AAEA,MAAM,iBAAiB,WAAmB,SACxC;CACE;CACA;CACA,QAAQ;CACR;CACA;CACA,KAAK,cAAc;CACnB;AACF,CAAC,CAAC,KAAK,IAAI;;;AC1Gb,QAAQ,WAAW,KAAK,QAAQ,KAAK,MAAM,CAAC,GAAG;CAC7C,MAAM,SAAS,QAAQ,OAAO,MAAM,IAAI;CACxC,MAAM,SAAS,QAAQ,OAAO,MAAM,IAAI;AAC1C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-shapio",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Scaffold a new Shapio project (npx create-shapio my-cms) or a site starter (--site astro|next|sveltekit)",
   "license": "Apache-2.0",
   "homepage": "https://shapio.dev",

package/templates/astro/package.json

@@ -19,8 +19,8 @@
     "typecheck": "tsc -p tsconfig.json"
   },
   "dependencies": {
-    "@shapio/client": "^0.2.0",
-    "@shapio/visual": "^0.2.0",
+    "@shapio/client": "^0.3.0",
+    "@shapio/visual": "^0.3.0",
     "astro": "7.3.5"
   },
   "devDependencies": {

package/templates/astro/scripts/lib/admin.ts

@@ -3,10 +3,13 @@ import { createClient, type ShapioClient } from '@shapio/client';
 /**
  * How the seed talks to Shapio's admin API: with SHAPIO_TOKEN (an admin API token), or with
  * SHAPIO_ADMIN_EMAIL + SHAPIO_ADMIN_PASSWORD, in which case it signs in, creates a one-hour admin API token
- * for itself (the schema CLI needs a bearer token) and revokes it when done.
+ * for itself (the schema CLI needs a bearer token) and revokes it when done. Every request is about the site
+ * in SHAPIO_SITE (the one the starter reads), else the token's site, else the primary site.
  */
 export type AdminConnection = {
   url: string;
+  /** SHAPIO_SITE, if set: the site every request is about. */
+  site: string | undefined;
   token: string;
   client: ShapioClient;
   /** A signed-in admin session (email and password only): preview tokens are issued to people, not API tokens. */
@@ -17,7 +20,7 @@ export type AdminConnection = {
 const SESSION_COOKIE = 'shapio_session';
 const SEED_TOKEN_TTL_MS = 60 * 60 * 1000;
 
-const signIn = async (url: string, email: string, password: string) => {
+const signIn = async (url: string, email: string, password: string, site: string | undefined) => {
   const response = await fetch(`${url.replace(/\/+$/, '')}/api/admin/auth/login`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
@@ -34,16 +37,20 @@ const signIn = async (url: string, email: string, password: string) => {
   return createClient({
     baseUrl: url,
     headers: () => ({ cookie: cookie.split(';')[0] ?? '', 'x-csrf-token': csrfToken }),
+    ...(site ? { site } : {}),
   });
 };
 
 export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnection> => {
   const url = env.SHAPIO_URL ?? 'http://localhost:4300';
+  const site = env.SHAPIO_SITE?.trim() || undefined;
+  const siteOption = site ? { site } : {};
   if (env.SHAPIO_TOKEN) {
     return {
       url,
+      site,
       token: env.SHAPIO_TOKEN,
-      client: createClient({ baseUrl: url, token: env.SHAPIO_TOKEN }),
+      client: createClient({ baseUrl: url, token: env.SHAPIO_TOKEN, ...siteOption }),
       session: undefined,
       close: async () => undefined,
     };
@@ -53,7 +60,7 @@ export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnect
   if (!email || !password) {
     throw new Error('Set SHAPIO_TOKEN (an admin API token), or SHAPIO_ADMIN_EMAIL and SHAPIO_ADMIN_PASSWORD');
   }
-  const session = await signIn(url, email, password);
+  const session = await signIn(url, email, password, site);
   const roles = await session.admin.roles.list();
   const admin = roles.find((role) => role.key === 'admin');
   if (!admin) {
@@ -68,8 +75,9 @@ export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnect
   });
   return {
     url,
+    site,
     token: created.token,
-    client: createClient({ baseUrl: url, token: created.token }),
+    client: createClient({ baseUrl: url, token: created.token, ...siteOption }),
     session,
     close: () => session.admin.tokens.revoke(created.apiToken.id),
   };

package/templates/astro/scripts/seed.ts

@@ -27,7 +27,8 @@ import { createPng } from './lib/png.js';
  * content to the seed):
  * 1. the `fr` locale;
  * 2. the models and components in shapio/ through the schema apply API (live, no restart; the same planner
- *    as `shapio schema apply` and the admin);
+ *    as `shapio schema apply` and the admin), as the site's own (SHAPIO_SITE, else the token's site, else the
+ *    primary): a starter's schema belongs to the first site it is seeded on;
  * 3. placeholder images, an author, the site settings, pages and articles in English and French, published
  *    per locale;
  * 4. a deployment connection named "Preview" whose preview URL opens this starter's /preview/ page (the
@@ -64,7 +65,12 @@ const MEDIA_READY_TIMEOUT_MS = 120_000;
 const SCHEMA_CHANGE_TIMEOUT_MS = 120_000;
 const POLL_INTERVAL_MS = 500;
 /** No lock file: a first apply. Definitions that already match are skipped by the server. */
-const FIRST_APPLY_BASE: SchemaApplyInput['base'] = { formatVersion: 1, schemaVersion: 0, definitions: {} };
+const FIRST_APPLY_BASE: SchemaApplyInput['base'] = {
+  formatVersion: 2,
+  schemaVersion: 0,
+  sites: [],
+  definitions: {},
+};
 
 const log = (line: string) => process.stdout.write(`${line}\n`);
 
@@ -106,15 +112,43 @@ const waitForChange = async (client: ShapioClient, item: SchemaSyncResult) => {
   }
 };
 
+/** A refusal the seed explains itself: printed without a stack. */
+class SeedRefusedError extends Error {}
+
+/** The schema files' IDs already belong to another site's definitions (the starter was seeded there first). */
+const isSeededElsewhere = (error: unknown) =>
+  error instanceof ShapioApiError &&
+  error.code === 'SCHEMA_INVALID' &&
+  ((error.details as { issues?: Array<{ code?: string }> } | undefined)?.issues ?? []).some(
+    (issue) => issue.code === 'DUPLICATE_ID',
+  );
+
 const applySchema = async (client: ShapioClient) => {
-  const response = await client.admin.schema.apply({
-    definitions: await readDefinitions(),
-    base: FIRST_APPLY_BASE,
-    prune: false,
-    dryRun: false,
-    acknowledgeBreaking: false,
-    acknowledgeDestructive: false,
-  });
+  const definitions = await readDefinitions();
+  let response;
+  try {
+    response = await client.admin.schema.apply({
+      definitions,
+      // Every definition is the site's own (sites/<key>/ in a pulled tree), never shared by default.
+      scopes: definitions.map(() => 'site' as const),
+      base: FIRST_APPLY_BASE,
+      prune: false,
+      dryRun: false,
+      acknowledgeBreaking: false,
+      acknowledgeDestructive: false,
+    });
+  } catch (error) {
+    if (isSeededElsewhere(error)) {
+      throw new SeedRefusedError(
+        "This starter's schema already belongs to another site of this instance: a starter's schema belongs " +
+          'to the first site it is seeded on. To reuse it on this site, share it with all sites ' +
+          'with a network admin token (`shapio schema scope <apiKey> --shared --site <that site>` for each ' +
+          'component, then author, page, article and siteSettings) and seed again, or seed a separate instance.',
+        { cause: error },
+      );
+    }
+    throw error;
+  }
   for (const item of response.results) {
     if (item.outcome === 'pending') {
       await waitForChange(client, item);
@@ -347,17 +381,24 @@ const tryRevalidateWebhook = async (client: ShapioClient, siteUrl: string, path:
   }
 };
 
-const writeEnv = async (url: string, deliveryToken: string, webhookSecret: string | undefined) => {
+const writeEnv = async (
+  url: string,
+  site: string | undefined,
+  deliveryToken: string,
+  webhookSecret: string | undefined,
+) => {
   const path = resolve('.env');
   const lines = [
     '# Written by the seed. The delivery token is read-only; keep this file out of git.',
     `SHAPIO_URL=${url}`,
     `SHAPIO_DELIVERY_TOKEN=${deliveryToken}`,
+    // The site the content was seeded on: the starter reads the same one.
+    ...(site ? [`SHAPIO_SITE=${site}`] : []),
     ...(webhookSecret ? [`SHAPIO_WEBHOOK_SECRET=${webhookSecret}`] : []),
   ];
   await writeFile(path, `${lines.join('\n')}\n`, { mode: 0o600 });
   log(
-    `Wrote SHAPIO_URL, SHAPIO_DELIVERY_TOKEN${webhookSecret ? ' and SHAPIO_WEBHOOK_SECRET' : ''} to ${path}`,
+    `Wrote SHAPIO_URL, ${site ? 'SHAPIO_SITE, ' : ''}SHAPIO_DELIVERY_TOKEN${webhookSecret ? ' and SHAPIO_WEBHOOK_SECRET' : ''} to ${path}`,
   );
 };
 
@@ -381,16 +422,24 @@ const main = async () => {
     const webhookSecret = revalidatePath
       ? await tryRevalidateWebhook(admin.client, siteUrl, revalidatePath)
       : undefined;
-    await writeEnv(admin.url, await createDeliveryToken(admin.client), webhookSecret);
+    await writeEnv(admin.url, admin.site, await createDeliveryToken(admin.client), webhookSecret);
     log('Seeded. Build the site with: npm run build');
   } finally {
     await admin.close();
   }
 };
 
+const describeFailure = (error: unknown) => {
+  if (error instanceof SeedRefusedError) {
+    return error.message;
+  }
+  if (error instanceof ShapioApiError) {
+    return `${error.code}: ${error.message} ${JSON.stringify(error.details ?? '')}`;
+  }
+  return error instanceof Error ? (error.stack ?? error.message) : String(error);
+};
+
 main().catch((error: unknown) => {
-  process.stderr.write(
-    `seed failed: ${error instanceof ShapioApiError ? `${error.code}: ${error.message} ${JSON.stringify(error.details ?? '')}` : error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`,
-  );
+  process.stderr.write(`seed failed: ${describeFailure(error)}\n`);
   process.exitCode = 1;
 });

package/templates/next/package.json

@@ -17,8 +17,8 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@shapio/client": "^0.2.0",
-    "@shapio/visual": "^0.2.0",
+    "@shapio/client": "^0.3.0",
+    "@shapio/visual": "^0.3.0",
     "next": "16.3.8",
     "react": "19.3.0",
     "react-dom": "19.3.0"

package/templates/next/scripts/lib/admin.ts

@@ -3,10 +3,13 @@ import { createClient, type ShapioClient } from '@shapio/client';
 /**
  * How the seed talks to Shapio's admin API: with SHAPIO_TOKEN (an admin API token), or with
  * SHAPIO_ADMIN_EMAIL + SHAPIO_ADMIN_PASSWORD, in which case it signs in, creates a one-hour admin API token
- * for itself (the schema CLI needs a bearer token) and revokes it when done.
+ * for itself (the schema CLI needs a bearer token) and revokes it when done. Every request is about the site
+ * in SHAPIO_SITE (the one the starter reads), else the token's site, else the primary site.
  */
 export type AdminConnection = {
   url: string;
+  /** SHAPIO_SITE, if set: the site every request is about. */
+  site: string | undefined;
   token: string;
   client: ShapioClient;
   /** A signed-in admin session (email and password only): preview tokens are issued to people, not API tokens. */
@@ -17,7 +20,7 @@ export type AdminConnection = {
 const SESSION_COOKIE = 'shapio_session';
 const SEED_TOKEN_TTL_MS = 60 * 60 * 1000;
 
-const signIn = async (url: string, email: string, password: string) => {
+const signIn = async (url: string, email: string, password: string, site: string | undefined) => {
   const response = await fetch(`${url.replace(/\/+$/, '')}/api/admin/auth/login`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
@@ -34,16 +37,20 @@ const signIn = async (url: string, email: string, password: string) => {
   return createClient({
     baseUrl: url,
     headers: () => ({ cookie: cookie.split(';')[0] ?? '', 'x-csrf-token': csrfToken }),
+    ...(site ? { site } : {}),
   });
 };
 
 export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnection> => {
   const url = env.SHAPIO_URL ?? 'http://localhost:4300';
+  const site = env.SHAPIO_SITE?.trim() || undefined;
+  const siteOption = site ? { site } : {};
   if (env.SHAPIO_TOKEN) {
     return {
       url,
+      site,
       token: env.SHAPIO_TOKEN,
-      client: createClient({ baseUrl: url, token: env.SHAPIO_TOKEN }),
+      client: createClient({ baseUrl: url, token: env.SHAPIO_TOKEN, ...siteOption }),
       session: undefined,
       close: async () => undefined,
     };
@@ -53,7 +60,7 @@ export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnect
   if (!email || !password) {
     throw new Error('Set SHAPIO_TOKEN (an admin API token), or SHAPIO_ADMIN_EMAIL and SHAPIO_ADMIN_PASSWORD');
   }
-  const session = await signIn(url, email, password);
+  const session = await signIn(url, email, password, site);
   const roles = await session.admin.roles.list();
   const admin = roles.find((role) => role.key === 'admin');
   if (!admin) {
@@ -68,8 +75,9 @@ export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnect
   });
   return {
     url,
+    site,
     token: created.token,
-    client: createClient({ baseUrl: url, token: created.token }),
+    client: createClient({ baseUrl: url, token: created.token, ...siteOption }),
     session,
     close: () => session.admin.tokens.revoke(created.apiToken.id),
   };

package/templates/next/scripts/seed.ts

@@ -27,7 +27,8 @@ import { createPng } from './lib/png.js';
  * content to the seed):
  * 1. the `fr` locale;
  * 2. the models and components in shapio/ through the schema apply API (live, no restart; the same planner
- *    as `shapio schema apply` and the admin);
+ *    as `shapio schema apply` and the admin), as the site's own (SHAPIO_SITE, else the token's site, else the
+ *    primary): a starter's schema belongs to the first site it is seeded on;
  * 3. placeholder images, an author, the site settings, pages and articles in English and French, published
  *    per locale;
  * 4. a deployment connection named "Preview" whose preview URL opens this starter's /preview/ page (the
@@ -64,7 +65,12 @@ const MEDIA_READY_TIMEOUT_MS = 120_000;
 const SCHEMA_CHANGE_TIMEOUT_MS = 120_000;
 const POLL_INTERVAL_MS = 500;
 /** No lock file: a first apply. Definitions that already match are skipped by the server. */
-const FIRST_APPLY_BASE: SchemaApplyInput['base'] = { formatVersion: 1, schemaVersion: 0, definitions: {} };
+const FIRST_APPLY_BASE: SchemaApplyInput['base'] = {
+  formatVersion: 2,
+  schemaVersion: 0,
+  sites: [],
+  definitions: {},
+};
 
 const log = (line: string) => process.stdout.write(`${line}\n`);
 
@@ -106,15 +112,43 @@ const waitForChange = async (client: ShapioClient, item: SchemaSyncResult) => {
   }
 };
 
+/** A refusal the seed explains itself: printed without a stack. */
+class SeedRefusedError extends Error {}
+
+/** The schema files' IDs already belong to another site's definitions (the starter was seeded there first). */
+const isSeededElsewhere = (error: unknown) =>
+  error instanceof ShapioApiError &&
+  error.code === 'SCHEMA_INVALID' &&
+  ((error.details as { issues?: Array<{ code?: string }> } | undefined)?.issues ?? []).some(
+    (issue) => issue.code === 'DUPLICATE_ID',
+  );
+
 const applySchema = async (client: ShapioClient) => {
-  const response = await client.admin.schema.apply({
-    definitions: await readDefinitions(),
-    base: FIRST_APPLY_BASE,
-    prune: false,
-    dryRun: false,
-    acknowledgeBreaking: false,
-    acknowledgeDestructive: false,
-  });
+  const definitions = await readDefinitions();
+  let response;
+  try {
+    response = await client.admin.schema.apply({
+      definitions,
+      // Every definition is the site's own (sites/<key>/ in a pulled tree), never shared by default.
+      scopes: definitions.map(() => 'site' as const),
+      base: FIRST_APPLY_BASE,
+      prune: false,
+      dryRun: false,
+      acknowledgeBreaking: false,
+      acknowledgeDestructive: false,
+    });
+  } catch (error) {
+    if (isSeededElsewhere(error)) {
+      throw new SeedRefusedError(
+        "This starter's schema already belongs to another site of this instance: a starter's schema belongs " +
+          'to the first site it is seeded on. To reuse it on this site, share it with all sites ' +
+          'with a network admin token (`shapio schema scope <apiKey> --shared --site <that site>` for each ' +
+          'component, then author, page, article and siteSettings) and seed again, or seed a separate instance.',
+        { cause: error },
+      );
+    }
+    throw error;
+  }
   for (const item of response.results) {
     if (item.outcome === 'pending') {
       await waitForChange(client, item);
@@ -347,17 +381,24 @@ const tryRevalidateWebhook = async (client: ShapioClient, siteUrl: string, path:
   }
 };
 
-const writeEnv = async (url: string, deliveryToken: string, webhookSecret: string | undefined) => {
+const writeEnv = async (
+  url: string,
+  site: string | undefined,
+  deliveryToken: string,
+  webhookSecret: string | undefined,
+) => {
   const path = resolve('.env');
   const lines = [
     '# Written by the seed. The delivery token is read-only; keep this file out of git.',
     `SHAPIO_URL=${url}`,
     `SHAPIO_DELIVERY_TOKEN=${deliveryToken}`,
+    // The site the content was seeded on: the starter reads the same one.
+    ...(site ? [`SHAPIO_SITE=${site}`] : []),
     ...(webhookSecret ? [`SHAPIO_WEBHOOK_SECRET=${webhookSecret}`] : []),
   ];
   await writeFile(path, `${lines.join('\n')}\n`, { mode: 0o600 });
   log(
-    `Wrote SHAPIO_URL, SHAPIO_DELIVERY_TOKEN${webhookSecret ? ' and SHAPIO_WEBHOOK_SECRET' : ''} to ${path}`,
+    `Wrote SHAPIO_URL, ${site ? 'SHAPIO_SITE, ' : ''}SHAPIO_DELIVERY_TOKEN${webhookSecret ? ' and SHAPIO_WEBHOOK_SECRET' : ''} to ${path}`,
   );
 };
 
@@ -381,16 +422,24 @@ const main = async () => {
     const webhookSecret = revalidatePath
       ? await tryRevalidateWebhook(admin.client, siteUrl, revalidatePath)
       : undefined;
-    await writeEnv(admin.url, await createDeliveryToken(admin.client), webhookSecret);
+    await writeEnv(admin.url, admin.site, await createDeliveryToken(admin.client), webhookSecret);
     log('Seeded. Build the site with: npm run build');
   } finally {
     await admin.close();
   }
 };
 
+const describeFailure = (error: unknown) => {
+  if (error instanceof SeedRefusedError) {
+    return error.message;
+  }
+  if (error instanceof ShapioApiError) {
+    return `${error.code}: ${error.message} ${JSON.stringify(error.details ?? '')}`;
+  }
+  return error instanceof Error ? (error.stack ?? error.message) : String(error);
+};
+
 main().catch((error: unknown) => {
-  process.stderr.write(
-    `seed failed: ${error instanceof ShapioApiError ? `${error.code}: ${error.message} ${JSON.stringify(error.details ?? '')}` : error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`,
-  );
+  process.stderr.write(`seed failed: ${describeFailure(error)}\n`);
   process.exitCode = 1;
 });

package/templates/sveltekit/package.json

@@ -21,8 +21,8 @@
     "typecheck": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --fail-on-warnings"
   },
   "dependencies": {
-    "@shapio/client": "^0.2.0",
-    "@shapio/visual": "^0.2.0"
+    "@shapio/client": "^0.3.0",
+    "@shapio/visual": "^0.3.0"
   },
   "devDependencies": {
     "@sveltejs/adapter-static": "4.0.0",

package/templates/sveltekit/scripts/lib/admin.ts

@@ -3,10 +3,13 @@ import { createClient, type ShapioClient } from '@shapio/client';
 /**
  * How the seed talks to Shapio's admin API: with SHAPIO_TOKEN (an admin API token), or with
  * SHAPIO_ADMIN_EMAIL + SHAPIO_ADMIN_PASSWORD, in which case it signs in, creates a one-hour admin API token
- * for itself (the schema CLI needs a bearer token) and revokes it when done.
+ * for itself (the schema CLI needs a bearer token) and revokes it when done. Every request is about the site
+ * in SHAPIO_SITE (the one the starter reads), else the token's site, else the primary site.
  */
 export type AdminConnection = {
   url: string;
+  /** SHAPIO_SITE, if set: the site every request is about. */
+  site: string | undefined;
   token: string;
   client: ShapioClient;
   /** A signed-in admin session (email and password only): preview tokens are issued to people, not API tokens. */
@@ -17,7 +20,7 @@ export type AdminConnection = {
 const SESSION_COOKIE = 'shapio_session';
 const SEED_TOKEN_TTL_MS = 60 * 60 * 1000;
 
-const signIn = async (url: string, email: string, password: string) => {
+const signIn = async (url: string, email: string, password: string, site: string | undefined) => {
   const response = await fetch(`${url.replace(/\/+$/, '')}/api/admin/auth/login`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
@@ -34,16 +37,20 @@ const signIn = async (url: string, email: string, password: string) => {
   return createClient({
     baseUrl: url,
     headers: () => ({ cookie: cookie.split(';')[0] ?? '', 'x-csrf-token': csrfToken }),
+    ...(site ? { site } : {}),
   });
 };
 
 export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnection> => {
   const url = env.SHAPIO_URL ?? 'http://localhost:4300';
+  const site = env.SHAPIO_SITE?.trim() || undefined;
+  const siteOption = site ? { site } : {};
   if (env.SHAPIO_TOKEN) {
     return {
       url,
+      site,
       token: env.SHAPIO_TOKEN,
-      client: createClient({ baseUrl: url, token: env.SHAPIO_TOKEN }),
+      client: createClient({ baseUrl: url, token: env.SHAPIO_TOKEN, ...siteOption }),
       session: undefined,
       close: async () => undefined,
     };
@@ -53,7 +60,7 @@ export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnect
   if (!email || !password) {
     throw new Error('Set SHAPIO_TOKEN (an admin API token), or SHAPIO_ADMIN_EMAIL and SHAPIO_ADMIN_PASSWORD');
   }
-  const session = await signIn(url, email, password);
+  const session = await signIn(url, email, password, site);
   const roles = await session.admin.roles.list();
   const admin = roles.find((role) => role.key === 'admin');
   if (!admin) {
@@ -68,8 +75,9 @@ export const connectAdmin = async (env: NodeJS.ProcessEnv): Promise<AdminConnect
   });
   return {
     url,
+    site,
     token: created.token,
-    client: createClient({ baseUrl: url, token: created.token }),
+    client: createClient({ baseUrl: url, token: created.token, ...siteOption }),
     session,
     close: () => session.admin.tokens.revoke(created.apiToken.id),
   };

package/templates/sveltekit/scripts/seed.ts

@@ -27,7 +27,8 @@ import { createPng } from './lib/png.js';
  * content to the seed):
  * 1. the `fr` locale;
  * 2. the models and components in shapio/ through the schema apply API (live, no restart; the same planner
- *    as `shapio schema apply` and the admin);
+ *    as `shapio schema apply` and the admin), as the site's own (SHAPIO_SITE, else the token's site, else the
+ *    primary): a starter's schema belongs to the first site it is seeded on;
  * 3. placeholder images, an author, the site settings, pages and articles in English and French, published
  *    per locale;
  * 4. a deployment connection named "Preview" whose preview URL opens this starter's /preview/ page (the
@@ -64,7 +65,12 @@ const MEDIA_READY_TIMEOUT_MS = 120_000;
 const SCHEMA_CHANGE_TIMEOUT_MS = 120_000;
 const POLL_INTERVAL_MS = 500;
 /** No lock file: a first apply. Definitions that already match are skipped by the server. */
-const FIRST_APPLY_BASE: SchemaApplyInput['base'] = { formatVersion: 1, schemaVersion: 0, definitions: {} };
+const FIRST_APPLY_BASE: SchemaApplyInput['base'] = {
+  formatVersion: 2,
+  schemaVersion: 0,
+  sites: [],
+  definitions: {},
+};
 
 const log = (line: string) => process.stdout.write(`${line}\n`);
 
@@ -106,15 +112,43 @@ const waitForChange = async (client: ShapioClient, item: SchemaSyncResult) => {
   }
 };
 
+/** A refusal the seed explains itself: printed without a stack. */
+class SeedRefusedError extends Error {}
+
+/** The schema files' IDs already belong to another site's definitions (the starter was seeded there first). */
+const isSeededElsewhere = (error: unknown) =>
+  error instanceof ShapioApiError &&
+  error.code === 'SCHEMA_INVALID' &&
+  ((error.details as { issues?: Array<{ code?: string }> } | undefined)?.issues ?? []).some(
+    (issue) => issue.code === 'DUPLICATE_ID',
+  );
+
 const applySchema = async (client: ShapioClient) => {
-  const response = await client.admin.schema.apply({
-    definitions: await readDefinitions(),
-    base: FIRST_APPLY_BASE,
-    prune: false,
-    dryRun: false,
-    acknowledgeBreaking: false,
-    acknowledgeDestructive: false,
-  });
+  const definitions = await readDefinitions();
+  let response;
+  try {
+    response = await client.admin.schema.apply({
+      definitions,
+      // Every definition is the site's own (sites/<key>/ in a pulled tree), never shared by default.
+      scopes: definitions.map(() => 'site' as const),
+      base: FIRST_APPLY_BASE,
+      prune: false,
+      dryRun: false,
+      acknowledgeBreaking: false,
+      acknowledgeDestructive: false,
+    });
+  } catch (error) {
+    if (isSeededElsewhere(error)) {
+      throw new SeedRefusedError(
+        "This starter's schema already belongs to another site of this instance: a starter's schema belongs " +
+          'to the first site it is seeded on. To reuse it on this site, share it with all sites ' +
+          'with a network admin token (`shapio schema scope <apiKey> --shared --site <that site>` for each ' +
+          'component, then author, page, article and siteSettings) and seed again, or seed a separate instance.',
+        { cause: error },
+      );
+    }
+    throw error;
+  }
   for (const item of response.results) {
     if (item.outcome === 'pending') {
       await waitForChange(client, item);
@@ -347,17 +381,24 @@ const tryRevalidateWebhook = async (client: ShapioClient, siteUrl: string, path:
   }
 };
 
-const writeEnv = async (url: string, deliveryToken: string, webhookSecret: string | undefined) => {
+const writeEnv = async (
+  url: string,
+  site: string | undefined,
+  deliveryToken: string,
+  webhookSecret: string | undefined,
+) => {
   const path = resolve('.env');
   const lines = [
     '# Written by the seed. The delivery token is read-only; keep this file out of git.',
     `SHAPIO_URL=${url}`,
     `SHAPIO_DELIVERY_TOKEN=${deliveryToken}`,
+    // The site the content was seeded on: the starter reads the same one.
+    ...(site ? [`SHAPIO_SITE=${site}`] : []),
     ...(webhookSecret ? [`SHAPIO_WEBHOOK_SECRET=${webhookSecret}`] : []),
   ];
   await writeFile(path, `${lines.join('\n')}\n`, { mode: 0o600 });
   log(
-    `Wrote SHAPIO_URL, SHAPIO_DELIVERY_TOKEN${webhookSecret ? ' and SHAPIO_WEBHOOK_SECRET' : ''} to ${path}`,
+    `Wrote SHAPIO_URL, ${site ? 'SHAPIO_SITE, ' : ''}SHAPIO_DELIVERY_TOKEN${webhookSecret ? ' and SHAPIO_WEBHOOK_SECRET' : ''} to ${path}`,
   );
 };
 
@@ -381,16 +422,24 @@ const main = async () => {
     const webhookSecret = revalidatePath
       ? await tryRevalidateWebhook(admin.client, siteUrl, revalidatePath)
       : undefined;
-    await writeEnv(admin.url, await createDeliveryToken(admin.client), webhookSecret);
+    await writeEnv(admin.url, admin.site, await createDeliveryToken(admin.client), webhookSecret);
     log('Seeded. Build the site with: npm run build');
   } finally {
     await admin.close();
   }
 };
 
+const describeFailure = (error: unknown) => {
+  if (error instanceof SeedRefusedError) {
+    return error.message;
+  }
+  if (error instanceof ShapioApiError) {
+    return `${error.code}: ${error.message} ${JSON.stringify(error.details ?? '')}`;
+  }
+  return error instanceof Error ? (error.stack ?? error.message) : String(error);
+};
+
 main().catch((error: unknown) => {
-  process.stderr.write(
-    `seed failed: ${error instanceof ShapioApiError ? `${error.code}: ${error.message} ${JSON.stringify(error.details ?? '')}` : error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`,
-  );
+  process.stderr.write(`seed failed: ${describeFailure(error)}\n`);
   process.exitCode = 1;
 });