create-sonicjs 3.0.0-beta.2 → 3.0.0-beta.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-sonicjs",
-  "version": "3.0.0-beta.2",
+  "version": "3.0.0-beta.21",
   "description": "Create a new SonicJS application with zero configuration",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -3,6 +3,7 @@
 import fs from 'fs-extra'
 import path from 'path'
 import { fileURLToPath } from 'url'
+import { randomBytes } from 'crypto'
 import prompts from 'prompts'
 import kleur from 'kleur'
 import ora from 'ora'
@@ -50,7 +51,9 @@ const flags = {
   databaseName: args.find(arg => arg.startsWith('--database='))?.split('=')[1],
   bucketName: args.find(arg => arg.startsWith('--bucket='))?.split('=')[1],
   skipExample: args.includes('--skip-example'),
-  includeExample: args.includes('--include-example')
+  includeExample: args.includes('--include-example'),
+  adminEmail: args.find(arg => arg.startsWith('--admin-email='))?.split('=')[1],
+  adminPassword: args.find(arg => arg.startsWith('--admin-password='))?.split('=')[1],
 }
 
 async function main() {
@@ -171,48 +174,39 @@ async function getProjectDetails(initialName) {
     })
   }
 
-  // Seed admin user
-  questions.push({
-    type: 'confirm',
-    name: 'seedAdmin',
-    message: 'Create admin user?',
-    initial: true
-  })
-
-  // Admin email (only if seeding)
-  questions.push({
-    type: (prev, values) => values.seedAdmin ? 'text' : null,
-    name: 'adminEmail',
-    message: 'Admin email:',
-    validate: (value) => {
-      if (!value) return 'Admin email is required'
-      // Basic email validation
-      const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
-      if (!emailRegex.test(value)) return 'Please enter a valid email address'
-      return true
-    }
-  })
-
-  // Admin password (only if seeding)
-  questions.push({
-    type: (prev, values) => values.seedAdmin ? 'password' : null,
-    name: 'adminPassword',
-    message: 'Admin password:',
-    validate: (value) => {
-      if (!value) return 'Admin password is required'
-      if (value.length < 8) return 'Password must be at least 8 characters'
-      return true
-    }
-  })
-
-  // Include example collection (only ask if neither flag is set)
-  if (!flags.skipExample && !flags.includeExample) {
+  // Seed admin user (skip prompt if credentials provided via flags)
+  if (!flags.adminEmail || !flags.adminPassword) {
     questions.push({
       type: 'confirm',
-      name: 'includeExample',
-      message: 'Include example blog collection?',
+      name: 'seedAdmin',
+      message: 'Create admin user?',
       initial: true
     })
+
+    // Admin email (only if seeding)
+    questions.push({
+      type: (prev, values) => values.seedAdmin ? 'text' : null,
+      name: 'adminEmail',
+      message: 'Admin email:',
+      validate: (value) => {
+        if (!value) return 'Admin email is required'
+        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+        if (!emailRegex.test(value)) return 'Please enter a valid email address'
+        return true
+      }
+    })
+
+    // Admin password (only if seeding)
+    questions.push({
+      type: (prev, values) => values.seedAdmin ? 'password' : null,
+      name: 'adminPassword',
+      message: 'Admin password:',
+      validate: (value) => {
+        if (!value) return 'Admin password is required'
+        if (value.length < 8) return 'Password must be at least 8 characters'
+        return true
+      }
+    })
   }
 
   // Create Cloudflare resources
@@ -246,10 +240,10 @@ async function getProjectDetails(initialName) {
     template: flags.template || 'starter', // Always default to starter template
     databaseName: flags.databaseName || answers.databaseName || `${initialName || answers.projectName}-db`,
     bucketName: flags.bucketName || answers.bucketName || `${initialName || answers.projectName}-media`,
-    seedAdmin: answers.seedAdmin !== undefined ? answers.seedAdmin : true,
-    adminEmail: answers.adminEmail,
-    adminPassword: answers.adminPassword,
-    includeExample: flags.skipExample ? false : (flags.includeExample ? true : (answers.includeExample !== undefined ? answers.includeExample : true)),
+    seedAdmin: (flags.adminEmail && flags.adminPassword) ? true : (answers.seedAdmin !== undefined ? answers.seedAdmin : true),
+    adminEmail: flags.adminEmail || answers.adminEmail,
+    adminPassword: flags.adminPassword || answers.adminPassword,
+    includeExample: true,
     createResources: flags.skipCloudflare ? false : answers.createResources,
     runMigrations: true, // Always run migrations automatically
     initGit: flags.skipGit ? false : answers.initGit,
@@ -415,7 +409,7 @@ async function copyTemplate(templateName, targetDir, options) {
 
   // Add @sonicjs-cms/core dependency
   packageJson.dependencies = {
-    '@sonicjs-cms/core': '^3.0.0-beta.2',
+    '@sonicjs-cms/core': '^3.0.0-beta.21',
     ...packageJson.dependencies
   }
 
@@ -454,100 +448,88 @@ async function copyTemplate(templateName, targetDir, options) {
       password: options.adminPassword
     })
   }
+
+  // Generate .dev.vars with a random BETTER_AUTH_SECRET for local dev
+  const devVarsPath = path.join(targetDir, '.dev.vars')
+  if (!fs.existsSync(devVarsPath)) {
+    const secret = randomBytes(32).toString('hex')
+    await fs.writeFile(devVarsPath, `BETTER_AUTH_SECRET="${secret}"\n`)
+  }
 }
 
 async function createAdminSeedScript(targetDir, { email, password }) {
-  const seedScriptContent = `import { createDb, users } from '@sonicjs-cms/core'
-import { eq } from 'drizzle-orm'
-import * as crypto from 'crypto'
+  const seedScriptContent = `import { bootstrapDocumentTypes, RbacService } from '@sonicjs-cms/core'
 import { getPlatformProxy } from 'wrangler'
 
 /**
  * Seed script to create initial admin user
  *
- * Run this script after migrations:
- * npm run db:migrate:local
- * npm run seed
- *
  * Admin credentials:
  * Email: ${email}
  * Password: [as entered during setup]
  */
 
+async function hashPassword(password) {
+  const iterations = 100000
+  const salt = new Uint8Array(16)
+  crypto.getRandomValues(salt)
+  const encoder = new TextEncoder()
+  const keyMaterial = await crypto.subtle.importKey('raw', encoder.encode(password), 'PBKDF2', false, ['deriveBits'])
+  const hashBuffer = await crypto.subtle.deriveBits({ name: 'PBKDF2', salt, iterations, hash: 'SHA-256' }, keyMaterial, 256)
+  const saltHex = Array.from(salt).map(b => b.toString(16).padStart(2, '0')).join('')
+  const hashHex = Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('')
+  return \`pbkdf2:\${iterations}:\${saltHex}:\${hashHex}\`
+}
+
 async function seed() {
-  // Get D1 database from Cloudflare environment using wrangler's getPlatformProxy
   const { env, dispose } = await getPlatformProxy()
 
   if (!env?.DB) {
-    console.error('❌ Error: DB binding not found')
-    console.error('')
-    console.error('Make sure you have:')
-    console.error('1. Created your D1 database: wrangler d1 create <database-name>')
-    console.error('2. Updated wrangler.toml with the database_id')
-    console.error('3. Run migrations: npm run db:migrate:local')
-    console.error('')
+    console.error('❌ Error: DB binding not found. Run migrations first: npm run db:migrate:local')
     process.exit(1)
   }
 
-  const db = createDb(env.DB)
-
   try {
     // Check if admin user already exists
-    const existingUser = await db
-      .select()
-      .from(users)
-      .where(eq(users.email, '${email}'))
-      .get()
-
-    if (existingUser) {
+    const existing = await env.DB.prepare('SELECT id FROM auth_user WHERE email = ?').bind('${email}').first()
+    if (existing) {
       console.log('✓ Admin user already exists')
-      console.log(\`  Email: ${email}\`)
-      console.log(\`  Role: \${existingUser.role}\`)
+      await dispose()
       return
     }
 
-    // Hash password using SHA-256 (same as SonicJS auth system)
-    const data = '${password}' + 'salt-change-in-production'
-    const passwordHash = crypto.createHash('sha256').update(data).digest('hex')
-    const now = Date.now()
-    const odid = \`admin-\${now}-\${Math.random().toString(36).substr(2, 9)}\`
-
-    // Create admin user
-    await db
-      .insert(users)
-      .values({
-        id: odid,
-        email: '${email}',
-        username: '${email.split('@')[0]}',
-        firstName: 'Admin',
-        lastName: 'User',
-        passwordHash: passwordHash,
-        role: 'admin',
-        isActive: true,
-        createdAt: now,
-        updatedAt: now
-      })
-      .run()
+    const passwordHash = await hashPassword('${password}')
+    const nowMs = Date.now()
+    const odid = \`admin-\${nowMs}-\${Math.random().toString(36).substr(2, 9)}\`
+
+    await env.DB.batch([
+      env.DB.prepare(
+        'INSERT INTO auth_user (id, email, first_name, last_name, role, is_active, created_at, updated_at, name) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)'
+      ).bind(odid, '${email}', 'Admin', 'User', 'admin', 1, nowMs, nowMs, 'Admin User'),
+      env.DB.prepare(
+        'INSERT INTO auth_account (id, user_id, account_id, provider_id, password, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)'
+      ).bind(crypto.randomUUID(), odid, odid, 'credential', passwordHash, nowMs, nowMs),
+    ])
+
+    await bootstrapDocumentTypes(env.DB)
+    const rbac = new RbacService(env.DB)
+    await rbac.ensureSystemRbacSeed()
+    await rbac.addUserRoleByName(odid, 'admin')
 
     console.log('✓ Admin user created successfully')
     console.log(\`  Email: ${email}\`)
     console.log(\`  Role: admin\`)
-    console.log('')
-    console.log('You can now login at: http://localhost:8787/auth/login')
   } catch (error) {
     console.error('❌ Error creating admin user:', error)
     await dispose()
     process.exit(1)
   }
 
-  // Clean up the platform proxy
   await dispose()
 }
 
-// Run seed
 seed()
   .then(() => {
-    console.log('')
     console.log('✓ Seeding complete')
     process.exit(0)
   })
@@ -607,11 +589,19 @@ Or they should be automatically available after installation.
 }
 
 async function createCloudflareResources(databaseName, bucketName, targetDir) {
-  // Check if wrangler is installed
+  // Resolve wrangler binary — prefer global, fall back to npx
+  let wranglerCmd = 'wrangler'
+  let wranglerArgs = []
   try {
     await execa('wrangler', ['--version'], { cwd: targetDir })
   } catch {
-    throw new Error('wrangler is not installed. Install with: npm install -g wrangler')
+    try {
+      await execa('npx', ['--yes', 'wrangler', '--version'], { cwd: targetDir })
+      wranglerCmd = 'npx'
+      wranglerArgs = ['wrangler']
+    } catch {
+      throw new Error('wrangler is not installed. Install with: npm install -g wrangler')
+    }
   }
 
   let databaseId
@@ -620,7 +610,7 @@ async function createCloudflareResources(databaseName, bucketName, targetDir) {
 
   // Create D1 database
   try {
-    const { stdout, stderr } = await execa('wrangler', ['d1', 'create', databaseName], {
+    const { stdout, stderr } = await execa(wranglerCmd, [...wranglerArgs, 'd1', 'create', databaseName], {
       cwd: targetDir
     })
 
@@ -648,7 +638,7 @@ async function createCloudflareResources(databaseName, bucketName, targetDir) {
 
   // Create R2 bucket
   try {
-    await execa('wrangler', ['r2', 'bucket', 'create', bucketName], {
+    await execa(wranglerCmd, [...wranglerArgs, 'r2', 'bucket', 'create', bucketName], {
       cwd: targetDir
     })
     bucketCreated = true
@@ -774,49 +764,25 @@ function printSuccessMessage(answers) {
   console.log()
   console.log(kleur.bold().green('🎉 Success!'))
   console.log()
-  console.log(kleur.bold('Next steps:'))
+  console.log(kleur.bold('Get started:'))
   console.log()
   console.log(kleur.cyan(`  cd ${projectName}`))
 
   if (skipInstall) {
     console.log(kleur.cyan('  npm install'))
     console.log()
-    console.log(kleur.yellow('⚠ Important: After npm install, copy migrations:'))
+    console.log(kleur.yellow('⚠ After npm install, copy migrations:'))
     console.log(kleur.dim('  cp -r node_modules/@sonicjs-cms/core/migrations ./'))
   }
 
-  // Show resource creation steps if they weren't created or failed
-  if (!createResources || !resourcesCreated) {
-    console.log()
-    console.log(kleur.bold('Create Cloudflare resources:'))
-    if (!databaseIdSet) {
-      console.log(kleur.cyan(`  wrangler d1 create ${answers.databaseName}`))
-      console.log(kleur.dim('  # Copy database_id to wrangler.toml'))
-    }
-    console.log(kleur.cyan(`  wrangler r2 bucket create ${answers.bucketName}`))
+  if (!migrationsRan) {
+    console.log(kleur.cyan('  npm run db:migrate:local'))
   }
 
-  // Only show migration/seed steps if they weren't completed (shouldn't normally happen)
-  const needsMigrations = !migrationsRan
-  const needsSeeding = seedAdmin && !adminSeeded
-
-  if (needsMigrations || needsSeeding) {
-    console.log()
-    console.log(kleur.bold('Complete setup:'))
-    if (needsMigrations) {
-      console.log(kleur.cyan('  npm run db:migrate:local'))
-    }
-    if (needsSeeding) {
-      console.log(kleur.cyan('  npm run seed'))
-    }
+  if (seedAdmin && !adminSeeded) {
+    console.log(kleur.cyan('  npm run seed'))
   }
 
-  console.log()
-  if (migrationsRan && (!seedAdmin || adminSeeded)) {
-    console.log(kleur.bold().green('✓ Database is ready! Start development:'))
-  } else {
-    console.log(kleur.bold('Start development:'))
-  }
   console.log(kleur.cyan('  npm run dev'))
 
   if (seedAdmin && answers.adminEmail) {
@@ -826,15 +792,14 @@ function printSuccessMessage(answers) {
     console.log(kleur.dim(`  Password: [as entered]`))
   }
 
-  if (migrationsRan && (!seedAdmin || adminSeeded)) {
-    console.log()
-    console.log(kleur.green('✓ Everything is set up! Just run npm run dev and login.'))
-  }
-
   console.log()
   console.log(kleur.bold('Visit:'))
   console.log(kleur.cyan('  http://localhost:8787/admin'))
 
+  console.log()
+  console.log(kleur.bold('Deploy to Cloudflare (when ready):'))
+  console.log(kleur.cyan('  npm run deploy'))
+
   console.log()
   console.log(kleur.dim('Need help? Visit https://sonicjs.com'))
   console.log()

package/src/telemetry.js

@@ -76,6 +76,8 @@ async function initTelemetry() {
   }
 }
 
+const pendingRequests = []
+
 /**
  * Track an event using custom SonicJS stats endpoint
  */
@@ -105,12 +107,13 @@ async function track(event, properties = {}) {
       }
     }
 
-    // Fire and forget - don't block on response
-    fetch(`${TELEMETRY_ENDPOINT}/v1/events`, {
+    const req = fetch(`${TELEMETRY_ENDPOINT}/v1/events`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(payload)
-    }).catch(() => {}) // Silent fail
+    }).catch(() => {})
+
+    pendingRequests.push(req)
 
     if (DEBUG) {
       console.log('[Telemetry] Tracked:', event, payload)
@@ -124,10 +127,12 @@ async function track(event, properties = {}) {
 }
 
 /**
- * Shutdown telemetry (no-op for fetch-based telemetry)
+ * Shutdown telemetry — flush pending requests (max 3s wait)
  */
 async function shutdown() {
-  // No-op - fetch requests are fire and forget
+  if (pendingRequests.length === 0) return
+  const timeout = new Promise(resolve => setTimeout(resolve, 3000))
+  await Promise.race([Promise.all(pendingRequests), timeout])
 }
 
 /**

package/templates/starter/package.json

@@ -15,7 +15,8 @@
     "test": "vitest --run",
     "test:watch": "vitest",
     "update": "npm install @sonicjs-cms/core@latest --save",
-    "update:beta": "npm install @sonicjs-cms/core@beta --save"
+    "update:beta": "npm install @sonicjs-cms/core@beta --save",
+    "update:plugin": "tsx scripts/update-plugin.ts"
   },
   "dependencies": {},
   "devDependencies": {

package/templates/starter/scripts/update-plugin.ts

@@ -0,0 +1,101 @@
+/**
+ * update-plugin.ts
+ *
+ * Downloads the latest version of a bundled plugin from the SonicJS starter
+ * template on GitHub and overwrites the local copies.
+ *
+ * Usage:
+ *   npx tsx scripts/update-plugin.ts [plugin-name]
+ *   npx tsx scripts/update-plugin.ts example        # default
+ *   npx tsx scripts/update-plugin.ts example --dry-run
+ *
+ * Why this exists:
+ *   `create-sonicjs` scaffolds plugin source files into your project — they are
+ *   your code, not a package dependency. Running `npm install` updates
+ *   @sonicjs-cms/core but leaves the plugin files untouched. This script pulls
+ *   the latest files from the canonical starter template on GitHub main and
+ *   overwrites your local copies, giving you bug fixes and improvements without
+ *   starting a fresh project.
+ *
+ * Caution:
+ *   This overwrites the plugin files — commit or stash local changes first.
+ *   Custom modifications you've made will be lost.
+ */
+
+import { writeFileSync, mkdirSync } from 'fs'
+import { dirname, join } from 'path'
+import { fileURLToPath } from 'url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const PROJECT_ROOT = join(__dirname, '..')
+
+const GITHUB_RAW_BASE =
+  'https://raw.githubusercontent.com/SonicJs-Org/sonicjs/main/packages/create-app/templates/starter/src/plugins'
+
+// Map of plugin name → files relative to its plugin directory.
+// Add new plugins here as they are added to the starter template.
+const PLUGIN_MANIFEST: Record<string, string[]> = {
+  example: [
+    'index.ts',
+    'routes/api.ts',
+    'routes/admin.ts',
+    'collections/moods.collection.ts',
+  ],
+}
+
+async function fetchText(url: string): Promise<string> {
+  const res = await fetch(url)
+  if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`)
+  return res.text()
+}
+
+async function updatePlugin(pluginName: string, dryRun: boolean) {
+  const files = PLUGIN_MANIFEST[pluginName]
+  if (!files) {
+    console.error(
+      `Unknown plugin "${pluginName}". Available: ${Object.keys(PLUGIN_MANIFEST).join(', ')}`
+    )
+    process.exit(1)
+  }
+
+  console.log(
+    `\n${dryRun ? '[dry-run] ' : ''}Updating plugin: ${pluginName} from SonicJS main branch\n`
+  )
+
+  for (const file of files) {
+    const url = `${GITHUB_RAW_BASE}/${pluginName}/${file}`
+    const localPath = join(PROJECT_ROOT, 'src', 'plugins', pluginName, file)
+
+    process.stdout.write(`  fetching ${file} ... `)
+
+    try {
+      const content = await fetchText(url)
+      if (!dryRun) {
+        mkdirSync(dirname(localPath), { recursive: true })
+        writeFileSync(localPath, content, 'utf8')
+      }
+      console.log('✓')
+    } catch (err) {
+      console.log('✗')
+      console.error(`    Error: ${(err as Error).message}`)
+      process.exit(1)
+    }
+  }
+
+  console.log(
+    `\n${dryRun ? '[dry-run] no files written — ' : ''}Done. ${files.length} file(s) updated.\n`
+  )
+
+  if (!dryRun) {
+    console.log('Next steps:')
+    console.log('  1. Review the changes:  git diff src/plugins/' + pluginName)
+    console.log('  2. Run type check:      npm run type-check')
+    console.log('  3. Commit if happy:     git add src/plugins/' + pluginName + ' && git commit -m "chore(plugins): update ' + pluginName + ' plugin"\n')
+  }
+}
+
+const args = process.argv.slice(2)
+const pluginName = args.find(a => !a.startsWith('--')) ?? 'example'
+const dryRun = args.includes('--dry-run')
+
+updatePlugin(pluginName, dryRun)

package/templates/starter/src/collections/blog-posts.collection.ts

@@ -4,11 +4,12 @@
  * Example collection configuration for blog posts
  */
 
-import type { CollectionConfig } from '@sonicjs-cms/core'
+import type { CollectionConfig } from '@sonicjs-cms/core';
 
 export default {
-  name: 'blog-posts',
-  displayName: 'Blog Posts',
+  name: 'blog_post',
+  displayName: 'Blog Post',
+  slug: 'blog-posts',
   description: 'Manage your blog posts',
   icon: '📝',
 
@@ -19,57 +20,52 @@ export default {
         type: 'string',
         title: 'Title',
         required: true,
-        maxLength: 200
+        maxLength: 200,
       },
       slug: {
         type: 'slug',
         title: 'URL Slug',
         required: true,
-        maxLength: 200
-      },
-      excerpt: {
-        type: 'textarea',
-        title: 'Excerpt',
-        maxLength: 500,
-        helpText: 'A short summary of the post'
+        maxLength: 200,
       },
       content: {
-        type: 'quill',
+        type: 'lexical',
         title: 'Content',
-        required: true
-      },
-      featuredImage: {
-        type: 'media',
-        title: 'Featured Image'
+        required: true,
       },
       author: {
-        type: 'string',
+        type: 'user',
         title: 'Author',
-        required: true
+        required: true,
       },
       publishedAt: {
         type: 'datetime',
-        title: 'Published Date'
-      },
-      status: {
-        type: 'select',
-        title: 'Status',
-        enum: ['draft', 'published', 'archived'],
-        enumLabels: ['Draft', 'Published', 'Archived'],
-        default: 'draft'
+        title: 'Published Date',
       },
-      tags: {
-        type: 'string',
-        title: 'Tags',
-        helpText: 'Comma-separated tags'
-      }
     },
-    required: ['title', 'slug', 'content', 'author']
+    required: ['title', 'slug', 'content', 'author'],
   },
 
   // List view configuration
   listFields: ['title', 'author', 'status', 'publishedAt'],
-  searchFields: ['title', 'excerpt', 'author'],
+  searchFields: ['title', 'content', 'author'],
   defaultSort: 'createdAt',
-  defaultSortOrder: 'desc'
-} satisfies CollectionConfig
+  defaultSortOrder: 'desc',
+
+  // Mark as config-managed (code-based) collection
+  managed: true,
+  isActive: true,
+
+  // Opt in to public read access. Without this, only authenticated users
+  // (admin/editor) can read content via the API. See docs/authentication.md.
+  access: {
+    public: ['read'],
+  },
+
+  // Per-collection cache override. TTL in seconds; falls back to the cache plugin
+  // default (CACHE_CONFIGS.api.ttl, currently 300s) if unset.
+  cache: {
+    enabled: true,
+    ttl: 5,
+  },
+} satisfies CollectionConfig;