sproutkit-code 0.9.0 → 0.11.0

package/dist/index.js

@@ -187,6 +187,10 @@ var require_db = __commonJS({
         db2.exec("ALTER TABLE leads ADD COLUMN dead_at TEXT");
       } catch {
       }
+      try {
+        db2.exec("ALTER TABLE leads ADD COLUMN site_uid TEXT");
+      } catch {
+      }
     }
     function getDb2() {
       return db2;
@@ -32728,6 +32732,12 @@ var require_cms_runtime = __commonJS({
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
     exports2.API_CONTENT_JS = `import { list, put } from "@vercel/blob";
+
+// Per-site Blob namespace so many CMS sites share one store (one token per
+// agency) without overwriting each other's content. Empty when SITE_ID unset \u2192
+// legacy sites keep the flat content.json key, so nothing deployed breaks.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const CONTENT_KEY = PFX + "content.json";
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 // Runs on Node.js (not Edge) because @vercel/blob's undici dependency
@@ -32795,8 +32805,8 @@ function sanitise(raw) {
 
 async function readContent() {
   try {
-    const { blobs } = await list({ prefix: "content.json", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "content.json");
+    const { blobs } = await list({ prefix: CONTENT_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === CONTENT_KEY);
     if (!target) return SAFE_DEFAULTS;
     const res = await fetch(target.url);
     if (!res.ok) return SAFE_DEFAULTS;
@@ -32864,7 +32874,7 @@ export default async function handler(req, res) {
         body = raw ? JSON.parse(raw) : null;
       }
       const clean = sanitise(body);
-      await put("content.json", JSON.stringify(clean), {
+      await put(CONTENT_KEY, JSON.stringify(clean), {
         access: "public",
         addRandomSuffix: false,
         allowOverwrite: true,
@@ -32988,6 +32998,10 @@ export default function handler(req, res) {
 
 export const config = { runtime: "nodejs", api: { bodyParser: false } };
 
+// Per-site namespace so uploaded photos don't collide across sites sharing one
+// Blob store. Empty when SITE_ID unset (legacy sites keep flat photos/ path).
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+
 async function verifySession(req) {
   const cookie = req.headers.cookie || "";
   const match = cookie.match(/sk_admin=([^;]+)/);
@@ -33036,7 +33050,7 @@ export default async function handler(req, res) {
       res.status(413).json({ error: "too_large" });
       return;
     }
-    const name = "photos/" + Date.now() + "-" + Math.random().toString(36).slice(2, 8) + ".webp";
+    const name = PFX + "photos/" + Date.now() + "-" + Math.random().toString(36).slice(2, 8) + ".webp";
     const blob = await put(name, buf, {
       access: "public",
       addRandomSuffix: false,
@@ -33804,6 +33818,13 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site Blob namespace: every site isolates its files under sites/<id>/ so
+// many booking sites can share ONE Blob store (one token per agency) without
+// overwriting each other. Empty when SITE_ID is unset \u2192 older sites keep
+// reading/writing the legacy flat keys, so nothing already deployed breaks.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const CONFIG_KEY = PFX + "booking-config.json";
+
 const SAFE_DEFAULTS = {
   archetype: "enquiry",
   services: [],
@@ -33856,8 +33877,8 @@ function sanitise(raw) {
 
 async function readConfig() {
   try {
-    const { blobs } = await list({ prefix: "booking-config.json", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "booking-config.json");
+    const { blobs } = await list({ prefix: CONFIG_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === CONFIG_KEY);
     if (!target) return SAFE_DEFAULTS;
     const res = await fetch(target.url);
     if (!res.ok) return SAFE_DEFAULTS;
@@ -33912,7 +33933,7 @@ export default async function handler(req, res) {
         body = raw ? JSON.parse(raw) : null;
       }
       const clean = sanitise(body);
-      await put("booking-config.json", JSON.stringify(clean), {
+      await put(CONFIG_KEY, JSON.stringify(clean), {
         access: "public", addRandomSuffix: false, allowOverwrite: true,
         contentType: "application/json",
       });
@@ -33930,6 +33951,10 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site namespace (see booking-config.js). Empty when SITE_ID unset.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const BOOKINGS_KEY = PFX + "bookings.jsonl";
+
 function verifySession(req) {
   const cookie = req.headers.cookie || "";
   const match = cookie.match(/sk_admin=([^;]+)/);
@@ -33959,8 +33984,8 @@ function readBody(req) {
 
 async function readAllBookings() {
   try {
-    const { blobs } = await list({ prefix: "bookings.jsonl", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "bookings.jsonl");
+    const { blobs } = await list({ prefix: BOOKINGS_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === BOOKINGS_KEY);
     if (!target) return [];
     const res = await fetch(target.url);
     if (!res.ok) return [];
@@ -33975,7 +34000,7 @@ async function readAllBookings() {
 
 async function writeAllBookings(bookings) {
   const text = bookings.map((b) => JSON.stringify(b)).join("\\n");
-  await put("bookings.jsonl", text, {
+  await put(BOOKINGS_KEY, text, {
     access: "public", addRandomSuffix: false, allowOverwrite: true,
     contentType: "application/x-ndjson",
   });
@@ -79485,7 +79510,9 @@ var require_builder = __commonJS({
     exports2.deployStandaloneBooking = deployStandaloneBooking2;
     var sdk_1 = __importDefault(require_sdk());
     var axios_1 = __importDefault(require_axios());
+    var crypto_1 = require("crypto");
     var runtime_1 = require_runtime();
+    var db_1 = require_db();
     var llm_1 = require_llm();
     var fs3 = __importStar(require("fs"));
     var path3 = __importStar(require("path"));
@@ -79493,6 +79520,15 @@ var require_builder = __commonJS({
     var cms_template_1 = require_cms_template();
     var cms_runtime_1 = require_cms_runtime();
     var booking_runtime_1 = require_booking_runtime();
+    function siteUidFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT site_uid FROM leads WHERE id = ?", [leadId]);
+      if (row?.site_uid)
+        return row.site_uid;
+      const uid = (0, crypto_1.randomUUID)();
+      db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
+      return uid;
+    }
     var STOCK_HOSTS = [
       "unsplash.com",
       "images.unsplash.com",
@@ -80058,6 +80094,7 @@ export default defineConfig({ plugins: [react()] });`;
         devDependencies: { "@vitejs/plugin-react": "^4.3.1", vite: "^5.4.2" }
       }) : packageJson;
       if (includeCms) {
+        const cmsSiteUid = siteUidFor(lead.id);
         onProgress(reuseAdminPassword ? "Reusing existing credentials\u2026" : "Generating admin credentials\u2026");
         const adminPassword = reuseAdminPassword ?? (0, cms_runtime_1.generateFriendlyPassword)();
         const adminHash = await (0, cms_runtime_1.hashPassword)(adminPassword);
@@ -80092,7 +80129,7 @@ export default defineConfig({ plugins: [react()] });`;
           onProgress("Seeding CMS content\u2026");
           try {
             const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-            await put("content.json", JSON.stringify(initialContent), {
+            await put(`sites/${cmsSiteUid}/content.json`, JSON.stringify(initialContent), {
               access: "public",
               addRandomSuffix: false,
               allowOverwrite: true,
@@ -80107,6 +80144,9 @@ export default defineConfig({ plugins: [react()] });`;
         onProgress("Setting CMS env vars\u2026");
         await setProjectEnv(projectName, vercelToken, {
           BLOB_READ_WRITE_TOKEN: blobToken,
+          // Namespaces this site's Blob files so it never collides with other
+          // sites sharing the same store/token.
+          SITE_ID: cmsSiteUid,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
           BUSINESS_NAME: lead.name
@@ -80224,12 +80264,16 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
       onProgress("Refreshing CMS env vars\u2026");
-      await setProjectEnv(projectName, vercelToken, {
+      const existingUid = (0, db_1.getDb)().get("SELECT site_uid FROM leads WHERE id = ?", [lead.id])?.site_uid;
+      const cmsEnv = {
         BLOB_READ_WRITE_TOKEN: blobToken,
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
         BUSINESS_NAME: lead.name
-      });
+      };
+      if (existingUid)
+        cmsEnv.SITE_ID = existingUid;
+      await setProjectEnv(projectName, vercelToken, cmsEnv);
       onProgress("Deploying\u2026");
       const res = await postVercelDeployment({
         name: projectName,
@@ -80293,10 +80337,12 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
       files.push({ file: "index.html", data: indexHtml, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsx, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfig, encoding: "utf-8" });
+      const bookingExistingUid = (0, db_1.getDb)().get("SELECT site_uid FROM leads WHERE id = ?", [lead.id])?.site_uid;
+      const bookingKey = bookingExistingUid ? `sites/${bookingExistingUid}/booking-config.json` : "booking-config.json";
       onProgress("Seeding booking config into Blob\u2026");
       try {
         const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-        await put("booking-config.json", JSON.stringify(bookingConfig), {
+        await put(bookingKey, JSON.stringify(bookingConfig), {
           access: "public",
           addRandomSuffix: false,
           allowOverwrite: true,
@@ -80307,19 +80353,25 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error(`Failed to seed booking config: ${e.message}`);
       }
       onProgress("Setting booking env vars\u2026");
-      await setProjectEnv(projectName, vercelToken, {
+      const bookingEnv = {
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name
-      });
+      };
+      if (bookingExistingUid)
+        bookingEnv.SITE_ID = bookingExistingUid;
+      await setProjectEnv(projectName, vercelToken, bookingEnv);
       if (lead.admin_password) {
         onProgress("Refreshing admin session env\u2026");
         const adminHash = await (0, cms_runtime_1.hashPassword)(lead.admin_password);
-        await setProjectEnv(projectName, vercelToken, {
+        const adminEnv = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
-        });
+        };
+        if (bookingExistingUid)
+          adminEnv.SITE_ID = bookingExistingUid;
+        await setProjectEnv(projectName, vercelToken, adminEnv);
       }
       const packageJsonBooking = JSON.stringify({
         name: "sprout-site",
@@ -80378,9 +80430,10 @@ export default defineConfig({ plugins: [react()] });`;
       const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
       const projectName = `sprout-book-${lead.id}-${slug}`;
       onProgress("Seeding booking config\u2026");
+      const standaloneSiteUid = siteUidFor(lead.id);
       try {
         const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-        await put("booking-config.json", JSON.stringify(bookingConfig), {
+        await put(`sites/${standaloneSiteUid}/booking-config.json`, JSON.stringify(bookingConfig), {
           access: "public",
           addRandomSuffix: false,
           allowOverwrite: true,
@@ -80395,7 +80448,8 @@ export default defineConfig({ plugins: [react()] });`;
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name,
-        BLOB_READ_WRITE_TOKEN: blobToken
+        BLOB_READ_WRITE_TOKEN: blobToken,
+        SITE_ID: standaloneSiteUid
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -82451,12 +82505,53 @@ Return this exact shape:
   }
 });
 
+// ../desktop/dist/main/lib/vercel-store.js
+var require_vercel_store = __commonJS({
+  "../desktop/dist/main/lib/vercel-store.js"(exports2) {
+    "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createBlobStore = createBlobStore2;
+    var axios_1 = __importDefault(require_axios());
+    async function createBlobStore2(args) {
+      const name = (args.name || "sproutkit").slice(0, 70);
+      const url = "https://api.vercel.com/storage/stores/blob" + (args.teamId ? `?teamId=${encodeURIComponent(args.teamId)}` : "");
+      try {
+        const res = await axios_1.default.post(url, { name }, {
+          headers: {
+            Authorization: `Bearer ${args.vercelToken}`,
+            "Content-Type": "application/json"
+          },
+          timeout: 3e4
+        });
+        const store = res.data?.store ?? {};
+        const storeId = store.id || store.storeId;
+        return {
+          ok: true,
+          storeId,
+          dashboardUrl: "https://vercel.com/dashboard/stores"
+        };
+      } catch (e) {
+        const err = e;
+        const status = err.response?.status;
+        const msg = err.response?.data?.error?.message ?? err.message;
+        if (status === 409 || /already|exists|conflict/i.test(msg)) {
+          return { ok: false, alreadyExists: true, error: msg };
+        }
+        return { ok: false, error: msg };
+      }
+    }
+  }
+});
+
 // package.json
 var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "0.9.0",
+      version: "0.11.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -82503,6 +82598,7 @@ var autoMode = require_auto_mode();
 var cms = require_cms_provision();
 var bookingPreset = require_booking_preset();
 var builder = require_builder();
+var vercelStore = require_vercel_store();
 var models = require_models();
 var llm = require_llm();
 var initDatabase = db.initDatabase;
@@ -82514,6 +82610,7 @@ var provisionCmsForLead = cms.provisionCmsForLead;
 var generatePreset = bookingPreset.generatePreset;
 var deployBookingOnly = builder.deployBookingOnly;
 var deployStandaloneBooking = builder.deployStandaloneBooking;
+var createBlobStore = vercelStore.createBlobStore;
 var refreshModels = models.refreshModels;
 var refreshIfStale = models.refreshIfStale;
 var listCachedModels = models.listCachedModels;
@@ -82975,6 +83072,25 @@ async function runOnboarding(force = false) {
 }
 
 // src/invoke-ipc.ts
+async function requireBlobToken(vercelToken, emit, leadId) {
+  const existing = getSetting("blob_token");
+  if (existing) return existing;
+  emit("bookings:progress", { leadId, msg: "No Blob token yet \u2014 creating a Blob store for you\u2026" });
+  const created = await createBlobStore({ vercelToken, name: "sproutkit" });
+  if (created.ok) {
+    throw new Error(
+      "Created a Vercel Blob store for you \u2713 \u2014 one last one-time step: open " + (created.dashboardUrl || "https://vercel.com/dashboard/stores") + " , open the 'sproutkit' store, copy its BLOB_READ_WRITE_TOKEN, then run 'sproutkit setup' and paste it. You only do this once \u2014 it's reused for every booking site."
+    );
+  }
+  if (created.alreadyExists) {
+    throw new Error(
+      "You already have a Blob store. Open https://vercel.com/dashboard/stores , copy its BLOB_READ_WRITE_TOKEN, and run 'sproutkit setup' to paste it (one-time \u2014 reused for all sites)."
+    );
+  }
+  throw new Error(
+    `Booking needs a Vercel Blob token and I couldn't auto-create a store (${created.error ?? "unknown"}). Create one at https://vercel.com/dashboard/stores (Create \u2192 Blob), copy BLOB_READ_WRITE_TOKEN, then 'sproutkit setup'.`
+  );
+}
 function makeInvokeIpc(emit) {
   return async (channel, payload) => {
     if (channel === "auto:build:start") {
@@ -83026,11 +83142,10 @@ function makeInvokeIpc(emit) {
       if (!lead) throw new Error("Lead not found");
       const anthropicKey = getSetting("anthropic_key");
       const vercelToken = getSetting("vercel_token");
-      const blobToken = getSetting("blob_token");
       const resendKey = getSetting("resend_key");
       if (!anthropicKey) throw new Error("Anthropic API key not set");
       if (!vercelToken) throw new Error("Vercel token not set");
-      if (!blobToken) throw new Error("Booking sites need a Vercel Blob token (stores the form config & submissions). Add one with 'sproutkit setup' \u2014 create a Blob store at vercel.com, copy its read-write token.");
+      const blobToken = await requireBlobToken(vercelToken, emit, p.leadId);
       emit("bookings:progress", { leadId: p.leadId, msg: "Designing the booking form\u2026" });
       const leadInfo = lead;
       const config = await generatePreset({
@@ -83068,10 +83183,9 @@ function makeInvokeIpc(emit) {
       const lead = db2.get("SELECT * FROM leads WHERE id = ?", [p.leadId]);
       if (!lead) throw new Error("Lead not found");
       const vercelToken = getSetting("vercel_token");
-      const blobToken = getSetting("blob_token");
       const resendKey = getSetting("resend_key");
       if (!vercelToken) throw new Error("Vercel token not set");
-      if (!blobToken) throw new Error("Booking sites need a Vercel Blob token (stores the form config & submissions). Add one with 'sproutkit setup' \u2014 create a Blob store at vercel.com, copy its read-write token.");
+      const blobToken = await requireBlobToken(vercelToken, emit, p.leadId);
       emit("bookings:progress", { leadId: p.leadId, msg: "Designing the booking form\u2026" });
       const leadInfo = lead;
       const config = await generatePreset({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"