@cparkerwebm/webmonterey 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,56 @@
+# @cparkerwebm/webmonterey
+
+Every published version, what changed, and whether it asks anything of you.
+
+Entries answer one question: **should I move a site onto this, and does anything need doing
+afterwards?** Versions are tagged in git — `git checkout v1.0.0` is the code inside that release —
+and each has a [GitHub release](https://github.com/cparkerwebm/webmonterey/releases).
+
+Upgrade a site with `npx webm upgrade`, then build and `npx webm compare` against the previous
+build. See `/webm:upgrade`.
+
+---
+
+## 1.0.0 — 2026-09-02
+
+The first public release, on npmjs. This is the framework as it stands after two private
+generations and an ownership audit — not a rewrite, and not the same package renamed.
+
+### What a site gets
+
+- **The integration.** One call in `astro.config.mjs` derives `site` from `webmonterey.json`,
+  sets static output, wires the sitemap with noindex filtering, and provides the virtual modules
+  a package needs to read files in the repo it is installed into.
+- **The design system as data.** `design.json` carries ~15 brand values over a 124-token
+  system; the compiler emits CSS custom properties, email-safe literals and brand context from
+  one file.
+- **The cascade.** Eight layers in a fixed order, emitted inline ahead of every stylesheet
+  because a bare `@layer` statement does not survive bundling. Reset, base, layout and
+  utilities, with `src/styles/custom/` as the client's override seam.
+- **The form pipeline.** Validate → honeypot → Turnstile (per-form opt-out) → D1 → notify →
+  autoresponse. Store before send. A form with nowhere to deliver refuses rather than saying
+  thank you.
+- **Consent.** Consent Mode v2 defaults before GTM loads, GPC honored, a native `<dialog>`
+  whose decline buttons never leave the fold, and `whenConsented()` for every third party.
+- **Staging never mails a real person.** `environment: "staging"` and any `workers.dev`
+  hostname redirect every recipient to `stagingEmail`. There is no default inbox in the package;
+  a staging site without one refuses to send and fails `webm doctor`.
+- **The web app namespace, reserved.** `src/pages/webapp/` on every site; `app.path` in
+  `webmonterey.json` is the public URL, rewritten onto the folder by injected middleware when
+  it differs. Off by default; nothing runs until it is switched on.
+- **Structured data as parts, not a verdict.** The package emits no JSON-LD of its own. A site
+  composes its graph from the builders in `@cparkerwebm/webmonterey/structured-data` and exports
+  it as `structuredData` from its registry; `/webm:launch` is where that gets written.
+- **`webm` CLI:** `new`, `sync`, `doctor` (21 checks, each for a failure that stays silent),
+  `upgrade` (branch, install, codemods, resync), `compare` (text, head, JSON-LD and CSS of two
+  builds), `design:extract`.
+- **Five skills**, materialized into `.claude/skills/webm/` on every install: `/webm:start`,
+  `/webm:launch`, `/webm:upgrade`, `/webm:new-component`, `/webm:traps`. A client's own skills
+  and agents sit beside the plugin folder and are never touched.
+
+### What is deliberately absent
+
+- **No registry credential anywhere.** Not in the scaffold, not in CI, not in Workers Builds.
+- **No visible components.** Every block a visitor sees is built per client.
+- **No `/webm` scratch page in a production build.** It exists in `astro dev` and nowhere else.
+- **No default JSON-LD, no default inbox, no plan or tier anywhere in config.**

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carl Parker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,104 @@
+# webmonterey
+
+The Astro framework behind WebMonterey client sites, for Cloudflare Workers with D1, R2 and
+Turnstile. Plumbing, the design system, and the Claude Code skills — everything that is the same
+on every site, in one upgradable package.
+
+Published as [`@cparkerwebm/webmonterey`](https://www.npmjs.com/package/@cparkerwebm/webmonterey)
+on npmjs, MIT. It is an agency framework, published so the sites built on it are cleanly their
+owners' and so a fix propagates on `npm update`. It is not a community project and is not
+supported as one.
+
+**[ARCHITECTURE.md](ARCHITECTURE.md) is the design and the reasoning.** Read it before changing
+anything structural; most of what looks like an odd choice is a documented one.
+
+## What the package owns, and what it does not
+
+The package owns anything where a bug is the _same_ bug on every site: the cascade layer order,
+the reset, the Cloudflare includes, the consent system, the form pipeline, the router.
+
+It ships **zero visible components**. Every block a visitor sees is built per client, in that
+client's repo. Every default has a documented way to opt out of it.
+
+## Creating a client site
+
+```sh
+npx @cparkerwebm/webmonterey new example.com --client="Example Co"
+cd example_com
+claude          # then /webm:start
+```
+
+`webm new` writes the identity and design files, a working contact form, a home page and the
+fleet skills, then runs `git init` and `npm install`. It touches nothing outside the directory.
+`/webm:start` takes it from there: the GitHub repo, Cloudflare resources, Workers Builds, the
+first deploy. Start Claude from the repo root — project skills load from the directory you start
+in.
+
+Then `/webm:new-component` per block, and `/webm:launch` when the site is approved on a preview.
+
+## Layout
+
+```
+src/
+  design/        design.json -> CSS, email literals, brand context. No Astro imports.
+  integration/   the Astro integration, the virtual modules, the app-path middleware
+  styles/        reset, base, layout, utilities - and layers.ts, the one layer-order list
+  includes/      plumbing, grouped by vendor first
+  layouts/       base.astro
+  pages/         the block router, robots.txt, the 404, the dev-only /webm scratch page
+  actions/       the form pipeline
+  emails/        transactional templates
+  cli/           the webm command
+skills/          the fleet skills, materialized into client repos by `webm sync`
+agents/ hooks/   ride along with the skills when the package ships any
+template/        what `webm new` seeds and what `webm sync` refreshes
+schema/          JSON Schema for design.json
+examples/minimal a real site CI builds on every PR
+```
+
+## Commands
+
+| Command            | Runs                                                             |
+| ------------------ | ---------------------------------------------------------------- |
+| `npm test`         | `node --test` over `src/**/*.test.ts` and `scripts/**/*.test.mjs` |
+| `npm run check`    | `tsc --noEmit`                                                   |
+| `npm run format`   | prettier                                                         |
+| `npm run test:e2e` | pack a tarball, scaffold a site with it, build, assert on the HTML |
+
+**No test framework and no test dependency.** Node's runner needs nothing installed and strips
+TypeScript on its own.
+
+## The pattern to follow when adding code
+
+**Pure logic goes in a file with no virtual-module imports; the config binding goes beside it.**
+`r2/url.ts` and `r2/media.ts` are the example. Anything importing `virtual:webm/site`
+transitively only resolves inside an Astro build, so a test touching it cannot run.
+
+## Node
+
+`.nvmrc` pins 24, which is what Workers Builds runs. `engines` is `>=22.18.0`, the first release
+with unflagged type stripping, which the CLI needs.
+
+## Releasing
+
+```sh
+# 1. write the entry first - it is the release notes, not a chore afterwards
+#    add "## 1.1.0 — YYYY-MM-DD" to CHANGELOG.md, then commit and push
+npm login                       # once per machine
+npm run release minor           # or patch, major, or an explicit 1.1.0
+```
+
+One command, in the order that makes each step safe: clean tree on `main` in sync with origin →
+the changelog entry must exist → format, types and tests → `npm version` (which commits **and**
+tags) → `npm publish --provenance` → push commit and tag and read both back off origin → GitHub
+release from the changelog section → install the published tarball the way a client would.
+
+`--dry-run` runs every check and prints the plan without changing anything. `prepublishOnly`
+runs the same guard, so a bare `npm publish` still refuses to ship a version that is
+undocumented, untagged, or built from a dirty tree.
+
+|         |                                                  |
+| ------- | ------------------------------------------------ |
+| `patch` | a fix that asks nothing of any site              |
+| `minor` | new capability, or a fix a site may want to know about |
+| `major` | something a site must change to take — and it ships a codemod |