create-shibumi 0.0.1 → 0.2.0

package/src/templates/static/README.md

@@ -0,0 +1,10 @@
+# Shibumi static site
+
+Committed files in `public/`, served by a 1.4 MB pinned static image on your VPS.
+
+```sh
+bun dev     # preview locally
+bun ship    # deploy
+```
+
+See `agents.md` for the project rules.

package/src/templates/static/agents.md

@@ -0,0 +1,31 @@
+# Agent Notes
+
+Static site generated by create-shibumi. Plain committed files in `public/`, no build step, no framework.
+
+## Commands
+
+```sh
+bun dev          # preview public/ locally (scripts/preview.ts, dev only)
+bun ship:setup   # configure the deploy target (preconfigured: static, public/)
+bun ship         # verify public/, build the static image, upload, deploy
+```
+
+## Routes and templates
+
+Every file in `public/` is a route. `public/index.html` is `/`, `public/404.html` answers unknown paths. There are no templates or generators; add a generator later by pointing its output directory at `bun ship:setup --static --output-dir <dir> --build-script <script>`.
+
+## Trust boundaries and validation
+
+Before every image build, Ship verifies the output directory from a clean checkout of the committed HEAD: inside the project root, non-empty, `index.html` present, no symlinks. The image contains only that verified output plus a pinned BusyBox httpd running as an unprivileged user; there is no runtime code in production.
+
+## Database
+
+None. Static files only.
+
+## Files Ship generates
+
+`bun ship:setup` writes `Dockerfile`, `compose.yaml`, `.dockerignore`, and `shibumi-server.json` (all committed); static settings live as `dev.shibumistack.static.*` labels in `compose.yaml`. SSH targets stay in `~/.config/shibumi/config.json`, never committed.
+
+## Checks required before commit
+
+`public/index.html` must exist; without a build script, `public/` must be committed or `bun ship` refuses to package it.

package/src/templates/static/gitignore

@@ -0,0 +1,2 @@
+node_modules/
+.DS_Store

package/src/templates/static/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "shibumi-static-site",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "bun scripts/preview.ts",
+    "ship": "bun scripts/ship.ts",
+    "ship:setup": "bun scripts/ship.ts --setup --static --output-dir public",
+    "ship:update": "bun scripts/ship.ts --update",
+    "ship:status": "bun scripts/ship.ts --status",
+    "ship:logs": "bun scripts/ship.ts --logs"
+  },
+  "engines": {
+    "bun": ">=1.4.0"
+  }
+}

package/src/templates/static/public/404.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Not found</title>
+    <link rel="stylesheet" href="/style.css" />
+  </head>
+  <body>
+    <main>
+      <h1>Not found.</h1>
+      <p><a href="/">Back to the start.</a></p>
+    </main>
+  </body>
+</html>

package/src/templates/static/public/index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Shibumi static site</title>
+    <link rel="stylesheet" href="/style.css" />
+  </head>
+  <body>
+    <main>
+      <h1>It ships.</h1>
+      <p>To get started, open <code>public/index.html</code>; this page is that file. Edit, commit, run <code>bun ship</code>.</p>
+      <p>Using Astro, Jekyll, Eleventy, or another generator? Point its output here, or run <code>bun ship:setup</code> in that project instead; the Ship client packages any verified build directory.</p>
+    </main>
+  </body>
+</html>

package/src/templates/static/public/style.css

@@ -0,0 +1,50 @@
+:root {
+  color-scheme: light dark;
+  --paper: #f5f0e4;
+  --ink: #1b130f;
+  --accent: #e95f19;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --paper: #1b130f;
+    --ink: #f5f0e4;
+    --accent: #ff8648;
+  }
+}
+
+body {
+  margin: 0;
+  background: var(--paper);
+  color: var(--ink);
+  font-family: system-ui, sans-serif;
+  font-size: 1.125rem;
+  line-height: 1.6;
+}
+
+main {
+  max-width: 40rem;
+  margin: 0 auto;
+  padding: 4rem 1.5rem;
+}
+
+h1 {
+  font-family: Georgia, "Times New Roman", serif;
+  font-weight: 500;
+}
+
+a {
+  color: inherit;
+  text-decoration: underline;
+  text-decoration-color: color-mix(in srgb, var(--accent) 30%, transparent);
+  text-underline-offset: 0.18em;
+}
+
+a:hover {
+  text-decoration-color: var(--accent);
+}
+
+code {
+  font-family: ui-monospace, monospace;
+  font-size: 0.9em;
+}

package/src/templates/static/scripts/preview.ts

@@ -0,0 +1,42 @@
+// Local preview of public/. Production serving is the pinned static image
+// that bun ship builds; this file never ships.
+import { realpathSync } from "node:fs";
+import { join, normalize } from "node:path";
+
+const ROOT = join(import.meta.dir, "..", "public");
+function withHeaders(res: Response): Response {
+  res.headers.set("X-Content-Type-Options", "nosniff");
+  res.headers.set("X-Frame-Options", "DENY");
+  res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+  return res;
+}
+const server = Bun.serve({
+  port: Number(process.env.PORT) || 4173,
+  async fetch(request) {
+    if (request.method !== "GET" && request.method !== "HEAD") return withHeaders(new Response("Not found", { status: 404 }));
+    let pathname;
+    try {
+      pathname = decodeURIComponent(new URL(request.url).pathname);
+    } catch {
+      return withHeaders(new Response("Bad request", { status: 400 }));
+    }
+    const safe = normalize(pathname).replaceAll("\\", "/");
+    if (safe.includes("..")) return withHeaders(new Response("Not found", { status: 404 }));
+    const candidate = safe.endsWith("/") ? join(ROOT, safe, "index.html") : join(ROOT, safe);
+    if (!candidate.startsWith(ROOT)) return withHeaders(new Response("Not found", { status: 404 }));
+    let resolved;
+    try {
+      resolved = realpathSync(candidate);
+    } catch {
+      resolved = undefined;
+    }
+    // realpath containment: a symlink inside public/ must not escape it.
+    if (resolved && (resolved === realpathSync(ROOT) || resolved.startsWith(realpathSync(ROOT) + "/"))) {
+      const file = Bun.file(resolved);
+      if (await file.exists()) return withHeaders(new Response(file));
+    }
+    const notFound = Bun.file(join(ROOT, "404.html"));
+    return withHeaders(new Response((await notFound.exists()) ? notFound : "Not found", { status: 404 }));
+  },
+});
+console.log(`Previewing public/ on http://localhost:${server.port}`);

package/src/templates/web/.dockerignore

@@ -0,0 +1,12 @@
+.git
+node_modules
+dist
+test
+scripts
+.env
+.env.*
+*.md
+.gitignore
+.dockerignore
+compose.yaml
+shibumi-server.json

package/src/templates/web/Dockerfile

@@ -0,0 +1,24 @@
+FROM oven/bun:1-alpine AS deps
+WORKDIR /app
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile --production
+
+# Major-pinned: minors and patches flow, a future Bun 2 cannot break deploys.
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+COPY tsconfig.json ./
+COPY src ./src
+RUN bun run build
+
+FROM oven/bun:1-alpine
+WORKDIR /app
+COPY --from=build /app/dist ./dist
+COPY public ./public
+COPY package.json ./
+# Production mode: extensions gate security behavior on this. Never unset it.
+ENV NODE_ENV=production
+USER bun
+EXPOSE 3000
+CMD ["bun", "dist/server.js"]

package/src/templates/web/README.md

@@ -0,0 +1,10 @@
+# Shibumi web app
+
+Bun, Hono, Zod, and Alpine. Everything here is your source.
+
+```sh
+bun install
+bun dev
+```
+
+Deploy to your VPS with `bun ship:setup`, then `bun ship`. See `agents.md` for the project map and the rules tests enforce.

package/src/templates/web/agents.md

@@ -0,0 +1,54 @@
+# Agent Notes
+
+Bun web app generated by create-shibumi. Hono routes, Zod validation, Alpine behavior, no framework runtime. All source is owned by this project; edit anything.
+
+## Commands
+
+```sh
+bun dev          # Ship wrapper starts hot reload on the configured app port
+bun dev:app      # plain watch mode on PORT (default 3000)
+bun test         # route and security-header tests
+bun run check    # TypeScript check
+bun run build    # bundle src/server.ts to dist/server.js
+bun ship         # build image, upload, deploy via shibumi-server
+bun ship:setup   # configure the deploy target
+bun run shibumi add <name>  # install an extension (auth, email); --dry-run previews
+```
+
+## Routes and templates
+
+- `src/app.ts`: all routes and the HTML page. `src/server.ts`: startup and graceful shutdown. `src/env.ts`: environment schema.
+- Static assets under `public/`, served at `/public/*`.
+- Alpine is the vendored CSP build (`public/vendor/alpine-csp-*.min.js`): register components with `Alpine.data()` in `public/app.js` and reference methods by name in markup; inline expressions do not evaluate.
+
+## Trust boundaries and validation
+
+- Every environment variable goes through the Zod schema in `src/env.ts`; the app never reads `process.env` elsewhere.
+- Every request input (query, params, body) is validated with Zod at the route before use; `/api/hello` is the pattern.
+- The response header set in `SECURITY_HEADERS` (`src/app.ts`) is asserted verbatim by tests on success, error, API, and static responses; change both together. The CSP allows no inline or eval'd script.
+- Add no unauthenticated mutation endpoints (POST/PUT/PATCH/DELETE); tests fail if a route registers one. Add authentication first.
+
+## Database
+
+This template has no database. The full-stack template adds Drizzle and SQLite under `/data`.
+
+## Files Ship generates
+
+`bun ship:setup` writes `shibumi-server.json` (committed) and stores SSH targets in `~/.config/shibumi/config.json` (never committed). `scripts/ship.ts` is owned source, vendored at generation time; update it with `bun ship:update`.
+
+## Secrets and runtime config
+
+Set production env vars (secrets, per-deploy config) on the server, never in git or the image:
+
+```sh
+bun ship:env set KEY=VALUE      # one or more
+bun ship:env import .env.production  # bulk from a local file
+bun ship:env list               # names only
+bun ship:env rm KEY
+```
+
+Values are stored per-app on the server and injected at deploy; run `bun ship` to apply. Non-secret tunables that belong in git live in `src/config/*.yaml` instead.
+
+## Checks required before commit
+
+`bun test` and `bun run check` must pass. The Docker image copies only `dist/`, `public/`, and `package.json`; if you add runtime files elsewhere, update the Dockerfile and `.dockerignore` together.

package/src/templates/web/bun.lock

@@ -0,0 +1,45 @@
+{
+  "lockfileVersion": 2,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "shibumi-web-app",
+      "dependencies": {
+        "hono": "4.13.3",
+        "zod": "4.4.3",
+      },
+      "devDependencies": {
+        "@clack/prompts": "1.7.0",
+        "@types/bun": "latest",
+        "typescript": "5.9.2",
+      },
+    },
+  },
+  "packages": {
+    "@clack/core": ["@clack/core@1.4.3", "", { "dependencies": { "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-/kr3UWNtdJfxZtPgDqUOmG2pvwlmcLGheex5yiZKdwbzZJxhV+HMNR9QNmyY5cGwTNV6LrR7Jtp+KjhUAP1qBQ=="],
+
+    "@clack/prompts": ["@clack/prompts@1.7.0", "", { "dependencies": { "@clack/core": "1.4.3", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A=="],
+
+    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
+
+    "@types/node": ["@types/node@26.2.0", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg=="],
+
+    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
+
+    "fast-string-truncated-width": ["fast-string-truncated-width@3.0.3", "", {}, "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g=="],
+
+    "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
+
+    "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="],
+
+    "hono": ["hono@4.13.3", "", {}, "sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw=="],
+
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+
+    "typescript": ["typescript@5.9.2", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A=="],
+
+    "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
+
+    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+  }
+}

package/src/templates/web/compose.yaml

@@ -0,0 +1,17 @@
+services:
+  app:
+    build: .
+    ports:
+      - "127.0.0.1:${SHIBUMI_PORT:-9001}:3000"
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-T", "5", "-O", "/dev/null", "http://127.0.0.1:3000/healthz"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M

package/src/templates/web/gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+.env
+.env.*
+.DS_Store

package/src/templates/web/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "shibumi-web-app",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "bun scripts/ship.ts --dev",
+    "dev:app": "bun --watch src/server.ts",
+    "start": "bun dist/server.js",
+    "build": "bun build src/server.ts --outdir dist --target bun",
+    "test": "bun test",
+    "check": "tsc --noEmit",
+    "ship": "bun scripts/ship.ts",
+    "ship:setup": "bun scripts/ship.ts --setup",
+    "ship:update": "bun scripts/ship.ts --update",
+    "ship:status": "bun scripts/ship.ts --status",
+    "ship:logs": "bun scripts/ship.ts --logs",
+    "ship:env": "bun scripts/ship.ts --env",
+    "shibumi": "bun scripts/shibumi.ts"
+  },
+  "dependencies": {
+    "hono": "4.13.3",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@clack/prompts": "1.7.0",
+    "@types/bun": "1.4.0",
+    "typescript": "5.9.2"
+  },
+  "engines": {
+    "bun": ">=1.4.0"
+  }
+}

package/src/templates/web/public/app.js

@@ -0,0 +1,11 @@
+// Alpine behavior lives here. The vendored build is the CSP-safe variant:
+// register components with Alpine.data() and reference methods by name in
+// markup; inline expressions are not evaluated.
+document.addEventListener("alpine:init", () => {
+  Alpine.data("counter", () => ({
+    count: 0,
+    inc() {
+      this.count++;
+    },
+  }));
+});

package/src/templates/web/public/style.css

@@ -0,0 +1,60 @@
+:root {
+  color-scheme: light dark;
+  --paper: #f5f0e4;
+  --ink: #1b130f;
+  --accent: #e95f19;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --paper: #1b130f;
+    --ink: #f5f0e4;
+    --accent: #ff8648;
+  }
+}
+
+body {
+  margin: 0;
+  background: var(--paper);
+  color: var(--ink);
+  font-family: system-ui, sans-serif;
+  font-size: 1.125rem;
+  line-height: 1.6;
+}
+
+main {
+  max-width: 40rem;
+  margin: 0 auto;
+  padding: 4rem 1.5rem;
+}
+
+h1 {
+  font-family: Georgia, "Times New Roman", serif;
+  font-weight: 500;
+}
+
+a {
+  color: inherit;
+  text-decoration: underline;
+  text-decoration-color: color-mix(in srgb, var(--accent) 30%, transparent);
+  text-underline-offset: 0.18em;
+}
+
+a:hover {
+  text-decoration-color: var(--accent);
+}
+
+button {
+  font: inherit;
+  padding: 0.4rem 1rem;
+  border: 1px solid var(--ink);
+  background: transparent;
+  color: inherit;
+  border-radius: 4px;
+  cursor: pointer;
+}
+
+output {
+  margin-left: 0.75rem;
+  font-variant-numeric: tabular-nums;
+}