create-shibumi 0.0.1 → 0.2.0

package/src/templates/blog/gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+.astro/
+.DS_Store

package/src/templates/blog/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "shibumi-blog",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "astro dev",
+    "build": "astro build",
+    "check": "astro check",
+    "preview": "astro preview",
+    "ship": "bun scripts/ship.ts",
+    "ship:setup": "bun scripts/ship.ts --setup --static --output-dir dist --build-script build",
+    "ship:update": "bun scripts/ship.ts --update",
+    "ship:status": "bun scripts/ship.ts --status",
+    "ship:logs": "bun scripts/ship.ts --logs"
+  },
+  "dependencies": {
+    "@astrojs/rss": "4.0.19",
+    "@astrojs/sitemap": "3.7.3",
+    "astro": "7.2.4"
+  },
+  "devDependencies": {
+    "@astrojs/check": "0.9.10",
+    "typescript": "5.9.2"
+  },
+  "engines": {
+    "bun": ">=1.4.0"
+  }
+}

package/src/templates/blog/public/style.css

@@ -0,0 +1,147 @@
+/* One small stylesheet: shibumi tokens on a Nue-style semantic skeleton. */
+@layer base, components;
+
+@layer base {
+  *, *::before, *::after {
+    box-sizing: border-box;
+  }
+
+  :root {
+    color-scheme: light dark;
+    --paper: #f5f0e4;
+    --ink: #1b130f;
+    --muted: #6e6259;
+    --hairline: #e3dbc9;
+    --accent: #e95f19;
+    --font-serif: Georgia, "Times New Roman", serif;
+  }
+
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --paper: #1b130f;
+      --ink: #f5f0e4;
+      --muted: #a2968c;
+      --hairline: #372a22;
+      --accent: #ff8648;
+    }
+  }
+
+  body {
+    margin: 0;
+    padding: 1rem 1.5rem;
+    background: var(--paper);
+    color: var(--ink);
+    font-family: system-ui, sans-serif;
+    font-size: 1.125rem;
+    line-height: 1.6;
+
+    > header {
+      border-bottom: 1px solid var(--hairline);
+      padding-bottom: 1rem;
+
+      a {
+        color: var(--ink);
+        font-weight: 600;
+        text-decoration: none;
+      }
+    }
+
+    > main {
+      max-width: 40.5rem;
+      margin: 6rem auto;
+      min-height: 60vh;
+    }
+
+    > footer {
+      border-top: 1px solid var(--hairline);
+      padding-block: 4rem;
+      text-align: center;
+      color: var(--muted);
+      font-size: 0.875rem;
+    }
+  }
+
+  h1, h2, h3 {
+    font-family: var(--font-serif);
+    font-weight: 500;
+    line-height: 1.15;
+    color: var(--ink);
+  }
+
+  h1 {
+    font-size: 2.5rem;
+    letter-spacing: -0.02em;
+    margin-block: 0.25em;
+  }
+
+  p {
+    text-wrap: pretty;
+  }
+
+  a {
+    color: inherit;
+    text-decoration: underline;
+    text-decoration-color: color-mix(in srgb, var(--accent) 30%, transparent);
+    text-underline-offset: 0.18em;
+  }
+
+  a:hover {
+    text-decoration-color: var(--accent);
+  }
+
+  time {
+    color: var(--muted);
+    font-size: 0.875rem;
+  }
+
+  code {
+    font-family: ui-monospace, monospace;
+    font-size: 0.9em;
+  }
+
+  pre {
+    padding: 1rem 1.25rem;
+    overflow-x: auto;
+    border: 1px solid var(--hairline);
+    border-radius: 4px;
+  }
+}
+
+@layer components {
+  /* Post list: whole-block links, hierarchy from type alone. */
+  .posts {
+    list-style: none;
+    margin: 3rem 0 0;
+    padding: 0;
+
+    li + li {
+      margin-top: 3rem;
+    }
+
+    a {
+      display: block;
+      text-decoration: none;
+      color: inherit;
+
+      h3 {
+        margin-block: 0.25rem;
+        font-size: 1.375rem;
+      }
+
+      p {
+        margin: 0;
+        color: var(--muted);
+      }
+    }
+
+    a:hover h3 {
+      color: var(--accent);
+    }
+  }
+
+  .lede {
+    font-size: 1.25rem;
+    color: var(--muted);
+    margin-top: 0;
+  }
+}

package/src/templates/blog/src/components/BaseHead.astro

@@ -0,0 +1,37 @@
+---
+import { SITE } from "../site";
+
+interface Props {
+  title: string;
+  description: string;
+  ogImage?: string;
+  publishedTime?: Date;
+  markdownPath?: string;
+}
+
+const { title, description, ogImage, publishedTime, markdownPath } = Astro.props;
+const canonical = new URL(Astro.url.pathname, Astro.site);
+const image = new URL(ogImage ?? "/og-default.png", Astro.site);
+const isArticle = Boolean(publishedTime);
+---
+
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>{title}</title>
+<meta name="description" content={description} />
+<meta name="author" content={SITE.author} />
+<link rel="canonical" href={canonical} />
+<link rel="stylesheet" href="/style.css" />
+<link rel="alternate" type="application/rss+xml" title={SITE.name} href="/rss.xml" />
+{markdownPath && <link rel="alternate" type="text/markdown" href={markdownPath} />}
+<meta property="og:title" content={title} />
+<meta property="og:description" content={description} />
+<meta property="og:type" content={isArticle ? "article" : "website"} />
+<meta property="og:url" content={canonical} />
+<meta property="og:image" content={image} />
+<meta property="og:site_name" content={SITE.name} />
+{publishedTime && <meta property="article:published_time" content={publishedTime.toISOString()} />}
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:title" content={title} />
+<meta name="twitter:description" content={description} />
+<meta name="twitter:image" content={image} />

package/src/templates/blog/src/content/blog/one-vps-is-plenty.md

@@ -0,0 +1,13 @@
+---
+title: One VPS is plenty
+description: A five-euro server runs more blogs than most of us will ever write. The hard part was never capacity; it was confidence.
+date: 2026-07-15
+---
+
+This site is static files behind a 1.4 MB container on a small VPS. It could serve every reader I will ever have from a machine that also runs four other projects.
+
+What kept people off their own servers was never capacity. It was the deploy story: what happens when the build breaks, how you roll back, whether the thing you tested is the thing that shipped. Platforms answered those questions and charged rent on the answer.
+
+The answers turn out to be portable. Build the exact commit, verify the output, ship the image, health-check before cutover, keep the previous image for rollback. None of that requires a platform; it requires a script you can read.
+
+Rent is fine. Owning is calmer.

package/src/templates/blog/src/content/blog/own-your-source.md

@@ -0,0 +1,13 @@
+---
+title: Own your source
+description: Frameworks lend you abstractions and charge interest. Generated code you can read is a debt-free way to start a project.
+date: 2026-08-01
+---
+
+Most starters hand you a dependency. This one hands you files.
+
+The difference shows up six months in. When behavior lives in a package, changing it means reading someone else's issue tracker. When behavior lives in your repository, changing it means editing a file you have already read.
+
+Generated code has a bad reputation because generators used to produce piles you could not maintain. The fix is not less generation; it is generating less. A route file, a layout, a stylesheet with five variables. Small enough to read in one sitting, which means small enough to own.
+
+There is a test for this: delete the tool that made the project. If the project still builds, still deploys, and still makes sense, you own it. If not, you rented it.

package/src/templates/blog/src/content/blog/writing-for-agents.md

@@ -0,0 +1,13 @@
+---
+title: Writing for readers who curl
+description: Half your readers are now programs. Serving markdown alternates and an llms.txt costs one endpoint and respects both audiences.
+date: 2026-06-20
+---
+
+Someone will read this post in a browser. Something will read it with an HTTP client and a token budget.
+
+The polite response is to serve both well. Every post here exists twice: the HTML you may be reading, and a plain markdown file at the same path with `.md` on the end. An `llms.txt` at the root lists them all with one-line summaries, so an agent can survey the whole site in a single small request instead of scraping navigation markup.
+
+This is not much work. The markdown already exists; the build just refrains from destroying it. One endpoint, a dozen lines.
+
+Formats are a courtesy. HTML for eyes, markdown for context windows, RSS for the patient. The content is the same; only the reader changes.

package/src/templates/blog/src/content.config.ts

@@ -0,0 +1,17 @@
+import { glob } from "astro/loaders";
+import { defineCollection, z } from "astro:content";
+
+// The schema enforces the SEO contract: every post has a title that fits a
+// tab and a description that fits a search snippet, and both feed the meta
+// tags, RSS, and llms.txt.
+const blog = defineCollection({
+  loader: glob({ pattern: "**/*.md", base: "./src/content/blog" }),
+  schema: z.object({
+    title: z.string().max(60),
+    description: z.string().min(50).max(160),
+    date: z.coerce.date(),
+    ogImage: z.string().optional(),
+  }),
+});
+
+export const collections = { blog };

package/src/templates/blog/src/layouts/Base.astro

@@ -0,0 +1,26 @@
+---
+import BaseHead from "../components/BaseHead.astro";
+import { SITE } from "../site";
+
+interface Props {
+  title: string;
+  description: string;
+  ogImage?: string;
+  publishedTime?: Date;
+  markdownPath?: string;
+}
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <BaseHead {...Astro.props} />
+  </head>
+  <body>
+    <header><a href="/">{SITE.name}</a></header>
+    <main>
+      <slot />
+    </main>
+    <footer>© {new Date().getFullYear()} {SITE.author} · <a href="/rss.xml">RSS</a> · <a href="/llms.txt">llms.txt</a></footer>
+  </body>
+</html>

package/src/templates/blog/src/pages/404.astro

@@ -0,0 +1,11 @@
+---
+import Base from "../layouts/Base.astro";
+import { SITE } from "../site";
+---
+
+<Base title={`Not found · ${SITE.name}`} description={SITE.description}>
+  <article>
+    <h1>Not found.</h1>
+    <p><a href="/">Back to the start.</a></p>
+  </article>
+</Base>

package/src/templates/blog/src/pages/index.astro

@@ -0,0 +1,30 @@
+---
+import { getCollection } from "astro:content";
+import Base from "../layouts/Base.astro";
+import { SITE } from "../site";
+
+const posts = (await getCollection("blog")).sort(
+  (a, b) => b.data.date.valueOf() - a.data.date.valueOf()
+);
+const formatDate = (date: Date) =>
+  date.toLocaleDateString("en-US", { year: "numeric", month: "short", day: "numeric" });
+---
+
+<Base title={SITE.name} description={SITE.description}>
+  <article>
+    <h1>{SITE.name}</h1>
+    <ul class="posts">
+      {
+        posts.map((post) => (
+          <li>
+            <a href={`/posts/${post.id}/`}>
+              <time datetime={post.data.date.toISOString()}>{formatDate(post.data.date)}</time>
+              <h3>{post.data.title}</h3>
+              <p>{post.data.description}</p>
+            </a>
+          </li>
+        ))
+      }
+    </ul>
+  </article>
+</Base>

package/src/templates/blog/src/pages/llms.txt.ts

@@ -0,0 +1,29 @@
+// Agent-facing index. Generated from the content collection, so it is
+// always current; links point at the markdown alternates.
+import type { APIRoute } from "astro";
+import { getCollection } from "astro:content";
+import { SITE } from "../site";
+
+export const GET: APIRoute = async (context) => {
+  const posts = (await getCollection("blog")).sort(
+    (a, b) => b.data.date.valueOf() - a.data.date.valueOf()
+  );
+  const lines = [
+    `# ${SITE.name}`,
+    "",
+    `> ${SITE.description}`,
+    "",
+    "Every post is also available as plain markdown at the .md links below.",
+    "",
+    "## Posts",
+    "",
+    ...posts.map(
+      (post) =>
+        `- [${post.data.title}](${new URL(`/posts/${post.id}.md`, context.site)}): ${post.data.description}`
+    ),
+    "",
+  ];
+  return new Response(lines.join("\n"), {
+    headers: { "Content-Type": "text/plain; charset=utf-8" },
+  });
+};

package/src/templates/blog/src/pages/posts/[id].astro

@@ -0,0 +1,31 @@
+---
+import { getCollection, render } from "astro:content";
+import Base from "../../layouts/Base.astro";
+
+export async function getStaticPaths() {
+  return (await getCollection("blog")).map((post) => ({
+    params: { id: post.id },
+    props: { post },
+  }));
+}
+
+const { post } = Astro.props;
+const { Content } = await render(post);
+const formatDate = (date: Date) =>
+  date.toLocaleDateString("en-US", { year: "numeric", month: "short", day: "numeric" });
+---
+
+<Base
+  title={post.data.title}
+  description={post.data.description}
+  ogImage={post.data.ogImage}
+  publishedTime={post.data.date}
+  markdownPath={`/posts/${post.id}.md`}
+>
+  <article>
+    <p><time datetime={post.data.date.toISOString()}>{formatDate(post.data.date)}</time></p>
+    <h1>{post.data.title}</h1>
+    <p class="lede">{post.data.description}</p>
+    <Content />
+  </article>
+</Base>

package/src/templates/blog/src/pages/posts/[id].md.ts

@@ -0,0 +1,18 @@
+// Markdown alternates: every post is also served as plain markdown at
+// posts/<id>.md for agents and curl. llms.txt links here.
+import { getCollection, getEntry } from "astro:content";
+import type { APIRoute } from "astro";
+
+export async function getStaticPaths() {
+  return (await getCollection("blog")).map((post) => ({ params: { id: post.id } }));
+}
+
+export const GET: APIRoute = async ({ params }) => {
+  const post = await getEntry("blog", params.id!);
+  if (!post) return new Response("Not found", { status: 404 });
+  const date = post.data.date.toISOString().slice(0, 10);
+  const body = `# ${post.data.title}\n\n${date}\n\n${post.body ?? ""}`;
+  return new Response(body, {
+    headers: { "Content-Type": "text/plain; charset=utf-8" },
+  });
+};

package/src/templates/blog/src/pages/robots.txt.ts

@@ -0,0 +1,6 @@
+import type { APIRoute } from "astro";
+
+export const GET: APIRoute = ({ site }) => {
+  const body = `User-agent: *\nAllow: /\n\nSitemap: ${new URL("sitemap-index.xml", site)}\n`;
+  return new Response(body, { headers: { "Content-Type": "text/plain; charset=utf-8" } });
+};

package/src/templates/blog/src/pages/rss.xml.ts

@@ -0,0 +1,21 @@
+import rss from "@astrojs/rss";
+import type { APIRoute } from "astro";
+import { getCollection } from "astro:content";
+import { SITE } from "../site";
+
+export const GET: APIRoute = async (context) => {
+  const posts = (await getCollection("blog")).sort(
+    (a, b) => b.data.date.valueOf() - a.data.date.valueOf()
+  );
+  return rss({
+    title: SITE.name,
+    description: SITE.description,
+    site: context.site!,
+    items: posts.map((post) => ({
+      title: post.data.title,
+      description: post.data.description,
+      pubDate: post.data.date,
+      link: `/posts/${post.id}/`,
+    })),
+  });
+};

package/src/templates/blog/src/site.ts

@@ -0,0 +1,7 @@
+// One place for site identity. Everything (head tags, RSS, llms.txt,
+// footer) reads from here.
+export const SITE = {
+  name: "Quiet notes",
+  description: "A blog about building calm, owned software.",
+  author: "Your Name",
+};

package/src/templates/blog/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "astro/tsconfigs/strict",
+  "include": [".astro/types.d.ts", "src/**/*"],
+  "exclude": ["dist"]
+}

package/src/templates/full-stack/.dockerignore

@@ -0,0 +1,14 @@
+.git
+node_modules
+dist
+data
+test
+scripts
+drizzle.config.ts
+.env
+.env.*
+*.md
+.gitignore
+.dockerignore
+compose.yaml
+shibumi-server.json

package/src/templates/full-stack/Dockerfile

@@ -0,0 +1,23 @@
+# Major-pinned: minors and patches flow, a future Bun 2 cannot break deploys.
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+COPY tsconfig.json ./
+COPY src ./src
+RUN bun run build
+
+FROM oven/bun:1-alpine
+WORKDIR /app
+COPY --from=build /app/dist ./dist
+COPY src/db/migrations ./dist/migrations
+COPY public ./public
+COPY package.json ./
+RUN mkdir -p /data && chown bun:bun /data
+USER bun
+# Production mode: extensions (auth) gate security behavior on this, e.g.
+# refusing to build login links from the Host header. Never unset it here.
+ENV NODE_ENV=production
+ENV DB_PATH=/data/app.db
+EXPOSE 3000
+CMD ["bun", "dist/server.js"]

package/src/templates/full-stack/README.md

@@ -0,0 +1,10 @@
+# Shibumi full-stack app
+
+Bun, Hono, Zod, Alpine, Drizzle, and SQLite. Everything here is your source, including the migration and backup tooling.
+
+```sh
+bun install
+bun dev
+```
+
+Deploy with `bun ship:setup`, then `bun ship`. Data lives on a persistent volume at `/data`; see `agents.md` for migration, backup, restore, and rollback rules.

package/src/templates/full-stack/agents.md

@@ -0,0 +1,60 @@
+# Agent Notes
+
+Bun full-stack app generated by create-shibumi. Hono routes, Zod validation, Alpine behavior, Drizzle + SQLite under a persistent volume. All source is owned by this project.
+
+## Commands
+
+```sh
+bun dev          # Ship wrapper starts hot reload on the configured app port
+bun dev:app      # plain watch mode on PORT (default 3000)
+bun test         # route, security-header, migration, backup, restore tests
+bun run check    # TypeScript check
+bun run build    # bundle src/server.ts to dist/server.js
+bun db:status    # applied and pending migrations
+bun db:migrate   # backup (when needed), then apply pending migrations
+bun db:backup    # manual VACUUM INTO backup with sha256 sidecar
+bun db:restore <backup>  # offline restore; stop the app first
+bun ship         # build image, upload, deploy via shibumi-server
+bun run shibumi add <name>  # install an extension (auth, email); --dry-run previews
+```
+
+## Routes and templates
+
+- `src/app.ts`: routes and the HTML page. `src/server.ts`: boot ordering and shutdown. `src/env.ts`: environment schema (`PORT`, `DB_PATH`).
+- `src/db/schema.ts`: Drizzle schema. `src/db/migrations/*.sql`: tracked SQL migrations, applied in filename order by the owned runner. `drizzle-kit generate` may draft a migration from a schema change; review it, then commit both.
+- Static assets under `public/`, served at `/public/*`. Alpine is the vendored CSP build; register components in `public/app.js`.
+
+## Trust boundaries and validation
+
+- Environment goes through `src/env.ts`; request input through Zod at each route.
+- The `SECURITY_HEADERS` set in `src/app.ts` is asserted verbatim by tests on every response class. The CSP allows no inline or eval'd script.
+- Add no unauthenticated mutation endpoints (POST/PUT/PATCH/DELETE); tests fail if a route registers one. Write examples live in tests, which insert through `db` directly.
+
+## Database
+
+- Path: `DB_PATH`, default `data/app.db` locally, `/data/app.db` in the container (persistent named volume `app_data`). WAL, `foreign_keys ON`, `busy_timeout 5000` applied on every open.
+- Boot ordering: pre-migration backup (existing database with pending migrations), apply migrations in `BEGIN IMMEDIATE` transactions, then serve. A failed migration rolls back, the process exits, the health check never passes, and the previous deployment stays live.
+- Backups: `VACUUM INTO` snapshots in `<db-dir>/backups/` with sha256 sidecars; newest 5 kept; refused when free disk is under 2x the database size.
+- Restore: `bun db:restore <backup>` with the app stopped; checksum verified, temp-and-rename swap, stale WAL/SHM removed.
+- Rollback semantics: `bun ship --rollback` reverses the image only. Schema and data changes stay; restore a pre-migration backup for those, then redeploy the matching code.
+
+## Files Ship generates
+
+`bun ship:setup` writes `shibumi-server.json` (committed) and stores SSH targets in `~/.config/shibumi/config.json` (never committed). `scripts/ship.ts` is owned vendored source; update with `bun ship:update`.
+
+## Secrets and runtime config
+
+Set production env vars (secrets, per-deploy config) on the server, never in git or the image:
+
+```sh
+bun ship:env set KEY=VALUE      # one or more
+bun ship:env import .env.production  # bulk from a local file
+bun ship:env list               # names only
+bun ship:env rm KEY
+```
+
+Values are stored per-app on the server and injected at deploy; run `bun ship` to apply. Non-secret tunables that belong in git live in `src/config/*.yaml` instead.
+
+## Checks required before commit
+
+`bun test` and `bun run check` must pass. Schema changes require a matching committed migration. The image copies `dist/`, `dist/migrations/`, `public/`, and `package.json`; update the Dockerfile and `.dockerignore` together if runtime files move.