sproutkit-code 0.9.0 → 0.10.0

package/dist/index.js

@@ -187,6 +187,10 @@ var require_db = __commonJS({
         db2.exec("ALTER TABLE leads ADD COLUMN dead_at TEXT");
       } catch {
       }
+      try {
+        db2.exec("ALTER TABLE leads ADD COLUMN site_uid TEXT");
+      } catch {
+      }
     }
     function getDb2() {
       return db2;
@@ -32728,6 +32732,12 @@ var require_cms_runtime = __commonJS({
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
     exports2.API_CONTENT_JS = `import { list, put } from "@vercel/blob";
+
+// Per-site Blob namespace so many CMS sites share one store (one token per
+// agency) without overwriting each other's content. Empty when SITE_ID unset \u2192
+// legacy sites keep the flat content.json key, so nothing deployed breaks.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const CONTENT_KEY = PFX + "content.json";
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 // Runs on Node.js (not Edge) because @vercel/blob's undici dependency
@@ -32795,8 +32805,8 @@ function sanitise(raw) {
 
 async function readContent() {
   try {
-    const { blobs } = await list({ prefix: "content.json", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "content.json");
+    const { blobs } = await list({ prefix: CONTENT_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === CONTENT_KEY);
     if (!target) return SAFE_DEFAULTS;
     const res = await fetch(target.url);
     if (!res.ok) return SAFE_DEFAULTS;
@@ -32864,7 +32874,7 @@ export default async function handler(req, res) {
         body = raw ? JSON.parse(raw) : null;
       }
       const clean = sanitise(body);
-      await put("content.json", JSON.stringify(clean), {
+      await put(CONTENT_KEY, JSON.stringify(clean), {
         access: "public",
         addRandomSuffix: false,
         allowOverwrite: true,
@@ -32988,6 +32998,10 @@ export default function handler(req, res) {
 
 export const config = { runtime: "nodejs", api: { bodyParser: false } };
 
+// Per-site namespace so uploaded photos don't collide across sites sharing one
+// Blob store. Empty when SITE_ID unset (legacy sites keep flat photos/ path).
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+
 async function verifySession(req) {
   const cookie = req.headers.cookie || "";
   const match = cookie.match(/sk_admin=([^;]+)/);
@@ -33036,7 +33050,7 @@ export default async function handler(req, res) {
       res.status(413).json({ error: "too_large" });
       return;
     }
-    const name = "photos/" + Date.now() + "-" + Math.random().toString(36).slice(2, 8) + ".webp";
+    const name = PFX + "photos/" + Date.now() + "-" + Math.random().toString(36).slice(2, 8) + ".webp";
     const blob = await put(name, buf, {
       access: "public",
       addRandomSuffix: false,
@@ -33804,6 +33818,13 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site Blob namespace: every site isolates its files under sites/<id>/ so
+// many booking sites can share ONE Blob store (one token per agency) without
+// overwriting each other. Empty when SITE_ID is unset \u2192 older sites keep
+// reading/writing the legacy flat keys, so nothing already deployed breaks.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const CONFIG_KEY = PFX + "booking-config.json";
+
 const SAFE_DEFAULTS = {
   archetype: "enquiry",
   services: [],
@@ -33856,8 +33877,8 @@ function sanitise(raw) {
 
 async function readConfig() {
   try {
-    const { blobs } = await list({ prefix: "booking-config.json", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "booking-config.json");
+    const { blobs } = await list({ prefix: CONFIG_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === CONFIG_KEY);
     if (!target) return SAFE_DEFAULTS;
     const res = await fetch(target.url);
     if (!res.ok) return SAFE_DEFAULTS;
@@ -33912,7 +33933,7 @@ export default async function handler(req, res) {
         body = raw ? JSON.parse(raw) : null;
       }
       const clean = sanitise(body);
-      await put("booking-config.json", JSON.stringify(clean), {
+      await put(CONFIG_KEY, JSON.stringify(clean), {
         access: "public", addRandomSuffix: false, allowOverwrite: true,
         contentType: "application/json",
       });
@@ -33930,6 +33951,10 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site namespace (see booking-config.js). Empty when SITE_ID unset.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const BOOKINGS_KEY = PFX + "bookings.jsonl";
+
 function verifySession(req) {
   const cookie = req.headers.cookie || "";
   const match = cookie.match(/sk_admin=([^;]+)/);
@@ -33959,8 +33984,8 @@ function readBody(req) {
 
 async function readAllBookings() {
   try {
-    const { blobs } = await list({ prefix: "bookings.jsonl", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "bookings.jsonl");
+    const { blobs } = await list({ prefix: BOOKINGS_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === BOOKINGS_KEY);
     if (!target) return [];
     const res = await fetch(target.url);
     if (!res.ok) return [];
@@ -33975,7 +34000,7 @@ async function readAllBookings() {
 
 async function writeAllBookings(bookings) {
   const text = bookings.map((b) => JSON.stringify(b)).join("\\n");
-  await put("bookings.jsonl", text, {
+  await put(BOOKINGS_KEY, text, {
     access: "public", addRandomSuffix: false, allowOverwrite: true,
     contentType: "application/x-ndjson",
   });
@@ -79485,7 +79510,9 @@ var require_builder = __commonJS({
     exports2.deployStandaloneBooking = deployStandaloneBooking2;
     var sdk_1 = __importDefault(require_sdk());
     var axios_1 = __importDefault(require_axios());
+    var crypto_1 = require("crypto");
     var runtime_1 = require_runtime();
+    var db_1 = require_db();
     var llm_1 = require_llm();
     var fs3 = __importStar(require("fs"));
     var path3 = __importStar(require("path"));
@@ -79493,6 +79520,15 @@ var require_builder = __commonJS({
     var cms_template_1 = require_cms_template();
     var cms_runtime_1 = require_cms_runtime();
     var booking_runtime_1 = require_booking_runtime();
+    function siteUidFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT site_uid FROM leads WHERE id = ?", [leadId]);
+      if (row?.site_uid)
+        return row.site_uid;
+      const uid = (0, crypto_1.randomUUID)();
+      db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
+      return uid;
+    }
     var STOCK_HOSTS = [
       "unsplash.com",
       "images.unsplash.com",
@@ -80058,6 +80094,7 @@ export default defineConfig({ plugins: [react()] });`;
         devDependencies: { "@vitejs/plugin-react": "^4.3.1", vite: "^5.4.2" }
       }) : packageJson;
       if (includeCms) {
+        const cmsSiteUid = siteUidFor(lead.id);
         onProgress(reuseAdminPassword ? "Reusing existing credentials\u2026" : "Generating admin credentials\u2026");
         const adminPassword = reuseAdminPassword ?? (0, cms_runtime_1.generateFriendlyPassword)();
         const adminHash = await (0, cms_runtime_1.hashPassword)(adminPassword);
@@ -80092,7 +80129,7 @@ export default defineConfig({ plugins: [react()] });`;
           onProgress("Seeding CMS content\u2026");
           try {
             const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-            await put("content.json", JSON.stringify(initialContent), {
+            await put(`sites/${cmsSiteUid}/content.json`, JSON.stringify(initialContent), {
               access: "public",
               addRandomSuffix: false,
               allowOverwrite: true,
@@ -80107,6 +80144,9 @@ export default defineConfig({ plugins: [react()] });`;
         onProgress("Setting CMS env vars\u2026");
         await setProjectEnv(projectName, vercelToken, {
           BLOB_READ_WRITE_TOKEN: blobToken,
+          // Namespaces this site's Blob files so it never collides with other
+          // sites sharing the same store/token.
+          SITE_ID: cmsSiteUid,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
           BUSINESS_NAME: lead.name
@@ -80224,12 +80264,16 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
       onProgress("Refreshing CMS env vars\u2026");
-      await setProjectEnv(projectName, vercelToken, {
+      const existingUid = (0, db_1.getDb)().get("SELECT site_uid FROM leads WHERE id = ?", [lead.id])?.site_uid;
+      const cmsEnv = {
         BLOB_READ_WRITE_TOKEN: blobToken,
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
         BUSINESS_NAME: lead.name
-      });
+      };
+      if (existingUid)
+        cmsEnv.SITE_ID = existingUid;
+      await setProjectEnv(projectName, vercelToken, cmsEnv);
       onProgress("Deploying\u2026");
       const res = await postVercelDeployment({
         name: projectName,
@@ -80293,10 +80337,12 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
       files.push({ file: "index.html", data: indexHtml, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsx, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfig, encoding: "utf-8" });
+      const bookingExistingUid = (0, db_1.getDb)().get("SELECT site_uid FROM leads WHERE id = ?", [lead.id])?.site_uid;
+      const bookingKey = bookingExistingUid ? `sites/${bookingExistingUid}/booking-config.json` : "booking-config.json";
       onProgress("Seeding booking config into Blob\u2026");
       try {
         const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-        await put("booking-config.json", JSON.stringify(bookingConfig), {
+        await put(bookingKey, JSON.stringify(bookingConfig), {
           access: "public",
           addRandomSuffix: false,
           allowOverwrite: true,
@@ -80307,19 +80353,25 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error(`Failed to seed booking config: ${e.message}`);
       }
       onProgress("Setting booking env vars\u2026");
-      await setProjectEnv(projectName, vercelToken, {
+      const bookingEnv = {
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name
-      });
+      };
+      if (bookingExistingUid)
+        bookingEnv.SITE_ID = bookingExistingUid;
+      await setProjectEnv(projectName, vercelToken, bookingEnv);
       if (lead.admin_password) {
         onProgress("Refreshing admin session env\u2026");
         const adminHash = await (0, cms_runtime_1.hashPassword)(lead.admin_password);
-        await setProjectEnv(projectName, vercelToken, {
+        const adminEnv = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
-        });
+        };
+        if (bookingExistingUid)
+          adminEnv.SITE_ID = bookingExistingUid;
+        await setProjectEnv(projectName, vercelToken, adminEnv);
       }
       const packageJsonBooking = JSON.stringify({
         name: "sprout-site",
@@ -80378,9 +80430,10 @@ export default defineConfig({ plugins: [react()] });`;
       const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
       const projectName = `sprout-book-${lead.id}-${slug}`;
       onProgress("Seeding booking config\u2026");
+      const standaloneSiteUid = siteUidFor(lead.id);
       try {
         const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-        await put("booking-config.json", JSON.stringify(bookingConfig), {
+        await put(`sites/${standaloneSiteUid}/booking-config.json`, JSON.stringify(bookingConfig), {
           access: "public",
           addRandomSuffix: false,
           allowOverwrite: true,
@@ -80395,7 +80448,8 @@ export default defineConfig({ plugins: [react()] });`;
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name,
-        BLOB_READ_WRITE_TOKEN: blobToken
+        BLOB_READ_WRITE_TOKEN: blobToken,
+        SITE_ID: standaloneSiteUid
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -82456,7 +82510,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "0.9.0",
+      version: "0.10.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"