showpane 0.4.1 → 0.4.2

package/README.md

@@ -11,12 +11,25 @@ npx showpane
 ## Commands
 
 ### `npx showpane` (default)
-Scaffold a new Showpane portal project. Sets up Next.js, Prisma, and example portal.
+Scaffold a new Showpane portal project. Unpacks a version-pinned scaffold, installs the global Showpane toolchain, sets up Prisma, and starts the local app.
+
+Flags:
+
+- `--name <company>` — provide the company name non-interactively
+- `--yes` — skip prompts when paired with `--name`
+- `--no-open` — do not open the local app in the browser
+- `--verbose` — stream raw install logs instead of the quiet installer view
 
 ### `showpane login`
 Authenticate with Showpane Cloud for hosted portal deployment.
 This is auth only — org creation and billing happen in the Showpane Cloud web app.
 
+### `showpane sync`
+Install or refresh the global Showpane toolchain and Claude Code skills for the current CLI version.
+
+### `showpane upgrade`
+Upgrade a generated Showpane project using packaged scaffold assets instead of upstream git history.
+
 ## Requirements
 
 - Node.js 20+

package/bundle/meta/scaffold-manifest.json

@@ -0,0 +1,73 @@
+{
+  "schemaVersion": 1,
+  "generatedAt": "2026-04-09T11:11:24.207Z",
+  "scaffoldVersion": "0.2.0",
+  "files": {
+    ".env.example": "0dd692f1c7e6bcabdf5dbdfe9abb73797d79d8e90da150d6098b63ddc695dc29",
+    ".gitignore": "998e5f43865ea56ac79a05acfd5d4b0d696f310bd5325a1ed458c3d40154d437",
+    "VERSION": "1f930dd1f133c1f97a94fe3acb8db34372cf4c01ffdb2b3ff4ca72f9494121e9",
+    "docker-compose.yml": "420fd123da019c22f03662933537e24779b4c2c91f90c23abfec5965cd0f35ce",
+    "docker/Caddyfile": "d9c58086986795f5b3e42ff9b5942e60b8df946a1a0c40351381616c0b4d2bed",
+    "docker/Dockerfile": "340470e3735ea53b2c03003a13a91361652291add33c40a2bf13e6af2a8cb73a",
+    "next.config.ts": "cf27999cc274cce79bc4c8df11789807719abf40752b60e4b4967a3d2f0ed013",
+    "package-lock.json": "d8e30eb86f08e70787d4459a084b4ab2a9f119696bbd3146ec4ba5675fffd3c2",
+    "package.json": "f5ee82c0447ee17c3bd4094f8c5c83b6d7f173b407458908d453e94664e6f41b",
+    "postcss.config.js": "fa650b380adfabb151a0b352f7135e107e6352345f899060f1c5c231228f94bf",
+    "prisma/migrations/20260408000000_init/migration.sql": "a637c252920b45c7dd3e8225c939da373bbaeeccc6f208f9e52c3ff0133a3438",
+    "prisma/migrations/20260408010000_add_visitor_tracking/migration.sql": "a4432b5d037f069e97ed1765a5bf5a4f3b502e29af1a05406b2aa42bde735e28",
+    "prisma/migrations/20260409040000_add_portal_file_checksum/migration.sql": "bbfad517dea1257f40e5a0d7807677452fb893a34afbc6d81a3d2bbabc5932af",
+    "prisma/migrations/migration_lock.toml": "99836963713b4f5b269ad49af0ed3d7b0b2e336115c2f92dc9ac683d139d0900",
+    "prisma/schema.local.prisma": "4b36b52ef0ccfd5980f05ab97e821001a0f4bb658f13d693a6e3422233399eb8",
+    "prisma/schema.prisma": "904e517e8956e1b61534d18db6a27c104008ec1d57d474e22e67946c9a1f60ca",
+    "prisma/seed.ts": "1dea3de4b36263e6172817508e113ba416fbcd8caff80bc190f35cd3b4b3e2c5",
+    "public/example-avatar.svg": "0edeb0d3fbefa89cc27ffe6564d20e3ee0fd073cb6d9f2a025248ef3b3f277fd",
+    "public/example-logo.svg": "bc5cd933aff2a17698dee66a7b4ea940ad12238e9d813474d643b459b1e8d6da",
+    "public/robots.txt": "331ea9090db0c9f6f597bd9840fd5b171830f6e0b3ba1cb24dfa91f0c95aedc1",
+    "scripts/backup.sh": "7d94758c5f1b0d3a722ec8a1a0b819f1a5f480b762790cf4eeccdd6fda46d11b",
+    "scripts/e2e-verify.sh": "48c5983b8f2facc228bb4ea1ac0998064268f0fdb0088208dcb12bb1e48c3244",
+    "scripts/prisma-db-push.mjs": "76ac85fe65b5dc3d9cc7432e44618fcc84b7443574c8d88198d01f13ac23c040",
+    "scripts/prisma-generate.mjs": "d371e63388fa39f963b7c3c7cb8f87e0d9cd43cbf69d254b999108e29b8738c8",
+    "scripts/prisma-schema.mjs": "4c502f640a24558b8000613a06cc956b2253849e3cd8e71849a48db9a94ed435",
+    "scripts/restore.sh": "4c1be4f0d19aa4572842981e818684349dacbb4ae319ad75ef2b03ee63f0cf98",
+    "src/__tests__/client-portals.test.ts": "c6999300e9289333c72cc4493dd13a2b344794839ee76232fc9ebdd08f021b89",
+    "src/__tests__/portal-contracts.test.ts": "80066377d3281786c2bb9ecc857514124e094a2e66dca2fb08ded994c25fa2bc",
+    "src/app/(portal)/client/[slug]/page.tsx": "4f2f9253b2ad5d37a0f13759db52c786ae9c401f50fae9431da1417e9736e000",
+    "src/app/(portal)/client/[slug]/s/[token]/route.ts": "a445e54b9139e40dfe0bc039e34e6af224a27f75a614741ab224d317ad4d3ec9",
+    "src/app/(portal)/client/example/example-client.tsx": "b9b744f0358b7773f319757157598fc69059eb38e0eaa1c09cb5fc10cfc3894b",
+    "src/app/(portal)/client/example/page.tsx": "f330864f63c9feea76c8a62c3eba3ce57578627e0d4abd929fd7fefdfc7af058",
+    "src/app/(portal)/client/layout.tsx": "4f43871510408a81da229d48ae316ec1d1c1beda93121922246300a2c8fd0999",
+    "src/app/(portal)/client/page.tsx": "af36f1a6f359d6a7bd4a6ac550058c9d9c107e9885bb238b4c06ec26700e23e3",
+    "src/app/api/client-auth/route.ts": "46508351fce1902c1878efce86b5d4ebdd28a4977941100fdc77a48d79c5d765",
+    "src/app/api/client-auth/share/route.ts": "ed82414212dcd26af8c6c0f2bd44d9d79a727ed35cfedbac8c4077a6220aad14",
+    "src/app/api/client-events/route.ts": "13d545537b7e8ce421e6169d25c105adf2a2de3d978ae0a2c6751ff5f7d2eb33",
+    "src/app/api/client-files/[...path]/route.ts": "d6279a8eab48aa82d07ac8d467276968898c0d426eeec0a7d1fba1fa754ef405",
+    "src/app/api/client-files/client-upload/route.ts": "c0b63a4b0e84093e0eaee4d8e0b06ee7281daa72279a455e56c56985e404a9cf",
+    "src/app/api/client-files/route.ts": "b8897673fd7578d3c2ad3b7f78ccd64f99413eb4181f82b90009913377dadbdb",
+    "src/app/api/client-files/upload/route.ts": "70e97bccd950953106261da1daa0381ac72778113129b718cf87d1078ca77b5f",
+    "src/app/api/health/route.ts": "78fff55707372ce0cd6e9e49ef4f049622bc43cc42916d3f83e0162409d678b1",
+    "src/app/globals.css": "28dcda76006d0e6af01b6dcf1a315dc5b5b6931c880fc53fd6565ff09d5dd13a",
+    "src/app/layout.tsx": "c17aabeb2b486f023e777230343ace6cc06840f641a10b9dd9f65e092018f82f",
+    "src/app/page.tsx": "f5c88e28ee73acfdde347ceae6602717923a01357f56375a66e9cdd403b06992",
+    "src/components/portal-login.tsx": "8b0d91bb28674e1102fd2e5b5ddcc3a93755dd806fbd3d1b2dbea2646cffca5e",
+    "src/components/portal-shell.tsx": "a4e16e118ef93f79e71fb69e80f1fac6e6fff90f0fbdacdf8deb821a57656877",
+    "src/lib/abuse-controls.ts": "d79d58d93267aca48ad0b7b9b91f753c9a3c27263e4e98daf768a950c44a6fc6",
+    "src/lib/branding.ts": "cc55f40e02bc3e486b227988f95739ca1cda8012c97b591295995eb4465efd57",
+    "src/lib/client-auth.ts": "b9bdfe77dbe5d6ec6c6a930627fc43d3253f0d76fd8fc4093af5a75742bebe42",
+    "src/lib/client-portals.ts": "0a2c1ed8890bee35cd5f582554ede7da8a51466aec052395e44810198e6d48e2",
+    "src/lib/control-plane.ts": "e0cf39f28ec7de715fd5cfbb5f4240773fcd3d775cd1677588dd749fff740a0e",
+    "src/lib/db.ts": "65fb87fde5a05fa033234f3a976f6730d99fab7982a83821c792d09fc659e439",
+    "src/lib/files.ts": "24fd8d1d53c180d62441019395fb140ba3baa28311918ac488284adcdda8eb9a",
+    "src/lib/load-app-env.ts": "78b80e17d896885f0d72315ee9a6cf7a0a8c6c08171f26e3d599bb9b2e8afeee",
+    "src/lib/portal-contracts.ts": "5e9f5c747eb911a056bb5626d0710c37dbc8aba02a8e054203f736d13511bef7",
+    "src/lib/prisma-client.ts": "28cd100129a0178a6c8fdfe49e6997b19983fcc427b9fa7caee3ac26226e5eb3",
+    "src/lib/runtime-state.ts": "2bbd9c2d9e963e544a52ac04cc7c5651558cc8b7efd45e179b4eb72d8a640122",
+    "src/lib/storage.ts": "ae3b85fc6cccd39d4174a391dcbe6e91fb9460eb407ec9dbfedd63594a441d08",
+    "src/lib/token.ts": "518898ca3cbba069f507f736ed80f5afa0c5af07b0b02fdd2d682e466598c803",
+    "src/lib/utils.ts": "d1f1e0d62cb8d8d1e04c26e14de842d8a151f75812d81b046c65b5d1fe8e4b27",
+    "src/middleware.ts": "5623ef170d9327e47373943eae33a8b07a6dda970525d0833e0865e4429df094",
+    "tailwind.config.ts": "dc0dec22249b290b857190495ce7140327a6f4d94fedd5dffcdb298fa3928071",
+    "tests/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "tsconfig.json": "1b12f56ab16430b64622ff8512cb05b06cf633060dbec6ebad6f9e792a6dc2a0",
+    "vitest.config.ts": "783bfc08b3becc5d8ab0c100700f5c53255d860f9aecb489aedc8eb945f60037"
+  }
+}

package/bundle/scaffold/VERSION

@@ -0,0 +1 @@
+0.2.0

package/bundle/scaffold/__dot__env.example

@@ -0,0 +1,24 @@
+# Database
+# Local development (SQLite, zero config):
+DATABASE_URL="file:./dev.db"
+# Production (PostgreSQL):
+# DATABASE_URL="postgresql://portal:change-me-in-.env@db:5432/portal"
+# POSTGRES_USER="portal"
+# POSTGRES_PASSWORD="change-me-in-.env"
+# POSTGRES_DB="portal"
+
+# Auth — generate with: openssl rand -base64 32
+AUTH_SECRET=""
+
+# Storage provider: "local" | "s3" | "r2"
+STORAGE_PROVIDER="local"
+
+# S3/R2 storage (only needed if STORAGE_PROVIDER is "s3" or "r2")
+# S3_BUCKET=""
+# S3_REGION=""
+# S3_ACCESS_KEY=""
+# S3_SECRET_KEY=""
+# S3_ENDPOINT=""  # Required for R2
+
+# Public URL (used for share links)
+# NEXT_PUBLIC_APP_URL="https://portal.example.com"

package/bundle/scaffold/__dot__gitignore

@@ -0,0 +1,41 @@
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+*.db
+*.db-journal
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env*.local
+.env
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+/src/generated/
+
+# uploads
+/uploads/
+/private/

package/bundle/scaffold/docker/Caddyfile

@@ -0,0 +1,3 @@
+{$DOMAIN:localhost} {
+    reverse_proxy localhost:3000
+}

package/bundle/scaffold/docker/Dockerfile

@@ -0,0 +1,30 @@
+# Multi-stage: build Next.js, copy standalone output, add Caddy
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package.json package-lock.json* ./
+COPY prisma ./prisma
+RUN npm ci
+COPY . .
+RUN npx prisma generate && npm run build
+
+FROM node:20-alpine AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Copy Prisma engine, CLI, and schema for migrations
+COPY --from=builder /app/node_modules/.prisma /app/node_modules/.prisma
+COPY --from=builder /app/node_modules/@prisma /app/node_modules/@prisma
+COPY --from=builder /app/node_modules/prisma /app/node_modules/prisma
+COPY --from=builder /app/node_modules/.bin/prisma /app/node_modules/.bin/prisma
+COPY --from=builder /app/prisma /app/prisma
+
+# Copy standalone Next.js output
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+COPY --from=builder /app/public ./public
+
+EXPOSE 3000
+
+CMD ["sh", "-c", "node node_modules/prisma/build/index.js migrate deploy && node server.js"]

package/bundle/scaffold/docker-compose.yml

@@ -0,0 +1,53 @@
+services:
+  portal:
+    build:
+      context: .
+      dockerfile: docker/Dockerfile
+    ports:
+      - "3000:3000"
+    environment:
+      DATABASE_URL: ${DATABASE_URL:-postgresql://${POSTGRES_USER:-portal}:${POSTGRES_PASSWORD:-change-me-in-.env}@db:5432/${POSTGRES_DB:-portal}}
+      AUTH_SECRET: ${AUTH_SECRET}
+      STORAGE_PROVIDER: ${STORAGE_PROVIDER:-local}
+    volumes:
+      - uploads:/app/uploads
+    depends_on:
+      db:
+        condition: service_healthy
+    restart: unless-stopped
+
+  caddy:
+    image: caddy:2-alpine
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./docker/Caddyfile:/etc/caddy/Caddyfile
+      - caddy_data:/data
+      - caddy_config:/config
+    environment:
+      DOMAIN: ${DOMAIN:-localhost}
+    depends_on:
+      - portal
+    restart: unless-stopped
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-portal}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-change-me-in-.env}
+      POSTGRES_DB: ${POSTGRES_DB:-portal}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U portal"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+volumes:
+  pgdata:
+  uploads:
+  caddy_data:
+  caddy_config:

package/bundle/scaffold/next.config.ts

@@ -0,0 +1,20 @@
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  output: "standalone",
+  serverExternalPackages: ["@aws-sdk/client-s3"],
+  async headers() {
+    return [
+      {
+        source: "/:path*",
+        headers: [
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "X-Frame-Options", value: "DENY" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+        ],
+      },
+    ];
+  },
+};
+
+export default nextConfig;