@cparkerwebm/webmonterey 1.0.0

package/dist/webm.mjs

@@ -0,0 +1,2381 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/cli/package-root.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+function isOurs(manifest2) {
+  try {
+    const pkg2 = JSON.parse(readFileSync(manifest2, "utf8"));
+    return typeof pkg2.bin?.webm === "string";
+  } catch {
+    return false;
+  }
+}
+function findRoot() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 8; i++) {
+    const manifest2 = join(dir, "package.json");
+    if (existsSync(manifest2) && isOurs(manifest2)) return dir;
+    const up = dirname(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  throw new Error(
+    `webm: cannot locate the package root from ${fileURLToPath(import.meta.url)}. This usually means the CLI was moved out of the installed package.`
+  );
+}
+function manifest() {
+  return JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"));
+}
+function packageVersion() {
+  return manifest().version;
+}
+function packageName() {
+  return manifest().name;
+}
+var PACKAGE_ROOT;
+var init_package_root = __esm({
+  "src/cli/package-root.ts"() {
+    "use strict";
+    PACKAGE_ROOT = findRoot();
+  }
+});
+
+// src/cli/slug.ts
+function normalizeDomain(input) {
+  const cleaned = input.trim().toLowerCase().replace(/^[a-z]+:\/\//, "").replace(/\/.*$/, "").replace(/^www\./, "").replace(/\.+$/, "");
+  if (!cleaned || !cleaned.includes(".")) {
+    throw new DomainError(`"${input}" is not a domain. Expected something like example.com.`);
+  }
+  if (!/^[a-z0-9.-]+$/.test(cleaned)) {
+    throw new DomainError(`"${input}" contains characters a hostname cannot.`);
+  }
+  return cleaned;
+}
+function repoName(domain) {
+  return normalizeDomain(domain).replace(/\./g, "_");
+}
+function slugFor(domain) {
+  const clean = normalizeDomain(domain);
+  const parts = clean.split(".");
+  const lastTwo = parts.slice(-2).join(".");
+  const drop = TWO_PART_SUFFIXES.has(lastTwo) ? 2 : 1;
+  const kept = parts.slice(0, Math.max(1, parts.length - drop));
+  return kept.join("-");
+}
+function resourceNames(domain) {
+  const slug = slugFor(domain);
+  return {
+    slug,
+    repo: repoName(domain),
+    worker: `webm-${slug}`,
+    d1: `webm-${slug}-db`,
+    r2Media: `webm-${slug}-media`,
+    r2App: `webm-${slug}-app`
+  };
+}
+var TWO_PART_SUFFIXES, DomainError;
+var init_slug = __esm({
+  "src/cli/slug.ts"() {
+    "use strict";
+    TWO_PART_SUFFIXES = /* @__PURE__ */ new Set([
+      "co.uk",
+      "org.uk",
+      "ac.uk",
+      "gov.uk",
+      "me.uk",
+      "net.uk",
+      "sch.uk",
+      "com.au",
+      "net.au",
+      "org.au",
+      "edu.au",
+      "gov.au",
+      "co.nz",
+      "net.nz",
+      "org.nz",
+      "com.br",
+      "com.mx",
+      "co.za",
+      "co.jp",
+      "co.in",
+      "com.sg"
+    ]);
+    DomainError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "DomainError";
+      }
+    };
+  }
+});
+
+// src/cli/mcp.ts
+function mcpConfig() {
+  return {
+    mcpServers: Object.fromEntries(
+      Object.entries(MCP_SERVERS).map(([name, s]) => [name, { type: s.type, url: s.url }])
+    )
+  };
+}
+function mcpGaps(declared, enabled) {
+  const d = declared ?? {};
+  const e = new Set(enabled ?? []);
+  const undeclared = MCP_NAMES.filter((n) => !(n in d));
+  return {
+    undeclared,
+    unapproved: MCP_NAMES.filter((n) => n in d && !e.has(n)),
+    wrongUrl: MCP_NAMES.filter((n) => n in d && d[n]?.url !== MCP_SERVERS[n].url)
+  };
+}
+var MCP_SERVERS, MCP_NAMES;
+var init_mcp = __esm({
+  "src/cli/mcp.ts"() {
+    "use strict";
+    MCP_SERVERS = {
+      /*
+       * Astro's own, from docs.astro.build/en/guides/build-with-ai. Free, open source, and the
+       * documented way to give a tool current Astro knowledge.
+       */
+      "astro-docs": {
+        type: "http",
+        url: "https://mcp.docs.astro.build/mcp",
+        purpose: "Current Astro documentation. Consult before using any Astro API."
+      },
+      /*
+       * Mozilla's, from developer.mozilla.org/en-US/mcp. Search, reference and - the part no model
+       * has current - browser compatibility data.
+       *
+       * EXPERIMENTAL, AND MOZILLA SAYS SO: it may be withdrawn at any time, and queries are logged
+       * while the experiment runs. It is a docs lookup, so nothing confidential should reach it in
+       * the first place; the rule in CLAUDE.md is what keeps it that way. If it disappears, the
+       * failure is a session that cannot reach it, not a build that breaks.
+       */
+      mdn: {
+        type: "http",
+        url: "https://mcp.mdn.mozilla.net/",
+        purpose: "MDN reference and browser-compat data. Consult before using a web platform API."
+      },
+      /*
+       * The Website Specification and The Email Specification - Joost de Valk and contributors,
+       * MIT/CC BY. Search, per-topic pages and, the useful part here, generated checklists across
+       * SEO, accessibility, performance, privacy, security and i18n.
+       *
+       * GUIDANCE, NOT A STANDARD, WHATEVER THE NAME SAYS. These are opinionated best-practice
+       * documents, not normative specs, and they are at 0.2.0 and 0.1.0. They must never outrank MDN
+       * or the Astro docs on what an API does; they answer a different question - what a good site or
+       * a good email does. CLAUDE.md states that precedence, because a server called
+       * "specification" invites exactly the wrong assumption.
+       */
+      "website-spec": {
+        type: "http",
+        url: "https://mcp.specification.website/mcp",
+        purpose: "Site-quality guidance: SEO, accessibility, performance, privacy, security, i18n."
+      },
+      /*
+       * Email is a SEPARATE server from the website one - the Website Specification excludes it by
+       * design. It earns its place because src/emails/ is where recall is worst: client rendering
+       * quirks and deliverability rules move, and a template that looks right in a browser is not
+       * evidence of anything.
+       */
+      "email-spec": {
+        type: "http",
+        url: "https://mcp.specification.email/mcp",
+        purpose: "Email guidance: rendering, deliverability, accessibility. For src/emails/ work."
+      }
+    };
+    MCP_NAMES = Object.keys(MCP_SERVERS);
+  }
+});
+
+// src/cli/scaffold.ts
+function shiftDays(date, days) {
+  const shifted = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
+  shifted.setUTCDate(shifted.getUTCDate() + days);
+  return shifted.toISOString().slice(0, 10);
+}
+function scaffold(options) {
+  const { domain, packageVersion: packageVersion2 } = options;
+  const n = resourceNames(domain);
+  const client = options.client ?? "CHANGEME";
+  const org = options.org ?? "webmonterey";
+  const { today } = options;
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(today)) {
+    throw new Error(`scaffold: today must be YYYY-MM-DD, got ${JSON.stringify(today)}`);
+  }
+  const RUNTIME_LAG_DAYS = 14;
+  const compatibilityDate = shiftDays(today, -RUNTIME_LAG_DAYS);
+  const files = {};
+  files["package.json"] = JSON.stringify(
+    {
+      name: n.worker,
+      private: true,
+      type: "module",
+      engines: { node: ">=22.18.0" },
+      scripts: {
+        /*
+         * preinstall runs BEFORE node_modules exists, so it cannot call a bin from the package.
+         * scripts/check-node.mjs is on disk for exactly that reason and `webm sync` refreshes it.
+         */
+        preinstall: "node scripts/check-node.mjs",
+        postinstall: "webm sync",
+        dev: "wrangler types && astro dev",
+        build: "wrangler types && astro check && astro build",
+        preview: "astro preview",
+        check: "wrangler types && astro check",
+        doctor: "webm doctor",
+        format: "prettier --write .",
+        /*
+         * Component tests. --import scripts/test-hooks.mjs is what lets a test import './thing'
+         * without an extension and a .json without an import attribute, the way Astro and Vite
+         * do - so a test file reads like the app code it covers.
+         */
+        test: 'node --import ./scripts/test-hooks.mjs --test "src/**/*.test.ts"'
+      },
+      dependencies: { "@cparkerwebm/webmonterey": `^${packageVersion2}`, astro: "^7.1.6" },
+      devDependencies: {
+        "@astrojs/check": "^0.9.10",
+        prettier: "^3.9.6",
+        typescript: "^6.0.3",
+        wrangler: "^4.118.0"
+      }
+    },
+    null,
+    2
+  ) + "\n";
+  files["astro.config.mjs"] = `// @ts-check
+import { defineConfig } from 'astro/config';
+import webmonterey, { adapter } from '@cparkerwebm/webmonterey';
+
+/*
+ * Two lines of configuration. Everything else - imageService, the sitemap, deriving site
+ * from webmonterey.json, the noindex routes, the virtual modules - is decided inside the
+ * integration, so a fix propagates on npm update rather than never.
+ *
+ * THE ADAPTER IS NAMED HERE AND NOT SET BY THE INTEGRATION. An adapter registered through
+ * updateConfig does not run its own hooks, and the build then fails on the first on-demand
+ * route with an error naming nothing you wrote. adapter() is the package's own, already
+ * configured - the site takes no direct dependency on @astrojs/cloudflare.
+ */
+export default defineConfig({
+  adapter: adapter(),
+  integrations: [webmonterey()],
+});
+`;
+  files["webmonterey.json"] = JSON.stringify(
+    {
+      "//": "Site identity. READ BY THE BUILD - editing this changes output, it is not documentation.",
+      client,
+      domain,
+      repo: `${org}/${n.repo}`,
+      worker: n.worker,
+      slug: n.slug,
+      launched: null,
+      "//environment": "What this deployment is FOR. 'staging' redirects EVERY email the site sends to stagingEmail below, so testing a form on a preview cannot reach the client's real contacts. A new site starts here; /webm:launch flips it to 'production'. Anything served from workers.dev is treated as staging regardless, so a branch preview of a live site is covered too.",
+      environment: "staging",
+      "//stagingEmail": "Where staging email goes instead of its real recipients. REQUIRED while environment is staging - a staging site with nowhere to send refuses to send rather than guessing. webm doctor checks.",
+      stagingEmail: options.stagingEmail ?? "",
+      "//gtmId": "Google Tag Manager container, GTM-XXXXXXX. PUBLIC by design - it is in the source of every page - so it is tracked here rather than in .env, which is gitignored and therefore absent on Workers Builds: a container id set only in the environment works locally and silently loads nothing in production. PUBLIC_GTM_ID in the environment overrides this, for pointing a branch at a different container. Leave empty and no GTM renders at all.",
+      gtmId: "",
+      "//locale": "IANA zone and locale for every client-facing date. D1 stores UTC, so nothing reaches a person without passing through these. There is no Pacific/LA.",
+      timeZone: "America/Los_Angeles",
+      locale: "en-US",
+      "//organization": "Feeds the JSON-LD graph. EVERY empty field is omitted from output - never guess one, because wrong opening hours in structured data is worse than none.",
+      organization: {
+        type: "Organization",
+        legalName: "",
+        telephone: "",
+        email: "",
+        streetAddress: "",
+        addressLocality: "",
+        addressRegion: "",
+        postalCode: "",
+        addressCountry: "",
+        sameAs: []
+      },
+      "//features": "Technical switches for what is WIRED on this site - not a commercial plan. Nothing here reads a tier. `platform` is reserved and inert until the platform mail relay ships.",
+      features: { compliance: true, d1: false, turnstile: false, platform: false },
+      "//app": "The web app namespace, reserved on every site. The folder is ALWAYS src/pages/webapp/; `path` is the public URL segment - set `portal`, `members` or `account` for a client whose customers log in, and the framework rewrites it onto the folder. Everything else derives from this field. Every page under the folder must be `prerender = false`.",
+      app: { enabled: false, path: "webapp", label: "Portal" }
+    },
+    null,
+    2
+  ) + "\n";
+  files["design.json"] = JSON.stringify(
+    {
+      $schema: "./node_modules/@cparkerwebm/webmonterey/schema/design.json",
+      version: 1,
+      brand: {
+        name: client === "CHANGEME" ? "" : client,
+        voice: "",
+        rules: []
+      }
+    },
+    null,
+    2
+  ) + "\n";
+  files["wrangler.jsonc"] = `{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+
+  // MUST match the Worker name in the Cloudflare dashboard, or Workers Builds fails.
+  "name": "${n.worker}",
+
+  // The date this Worker was created, set a fortnight behind the scaffold so it cannot be newer
+  // than the runtime the installed wrangler bundles - a compatibility_date in the future of that
+  // binary refuses to build at all. Do not bump it casually; it pins runtime behavior.
+  // Do not let it go stale either: a date a few months behind the installed workerd renders
+  // every page as "[object Object]", with no error and a successful build. \`webm doctor\` checks.
+  "compatibility_date": "${compatibilityDate}",
+  "compatibility_flags": ["nodejs_compat"],
+
+  // Astro's adapter builds static assets into dist/client, NOT dist.
+  "assets": {
+    "directory": "./dist/client",
+    "not_found_handling": "404-page",
+
+    /*
+     * NOT REDUNDANT. Do not remove an entry because the path "already works" in curl.
+     *
+     * "404-page" intercepts NAVIGATION requests that match no static asset and serves
+     * 404.html, so they never reach the Worker. Every \`prerender = false\` route is such a
+     * path. The interception keys off \`Sec-Fetch-Dest: document\`, which a browser sends and
+     * curl does not - so the same URL returns 200 to curl and the 404 page to Chrome.
+     *
+     * >> ADD EVERY ROUTE YOU GIVE \`prerender = false\`, IN BOTH SLASH FORMS. <<
+     * \`npx webm doctor\` checks this.
+     */
+    "run_worker_first": ["/_actions/*"]
+  },
+
+  "observability": { "enabled": true },
+
+  // Set BOTH explicitly. Toggling previews in the dashboard without updating this file
+  // silently reverts it on the next deploy.
+  "workers_dev": true,
+  "preview_urls": true
+}
+`;
+  files["tsconfig.json"] = JSON.stringify(
+    {
+      extends: "astro/tsconfigs/strict",
+      include: [".astro/types.d.ts", "**/*", "worker-configuration.d.ts"],
+      exclude: ["dist", "node_modules"]
+    },
+    null,
+    2
+  ) + "\n";
+  files[".claude/settings.json"] = JSON.stringify(
+    {
+      "//": `Project settings for ${n.repo}.`,
+      "//mcp": "A server declared in .mcp.json is INERT until approved on each machine. Without this line the rules that say consult the Astro and MDN docs before using an API would depend on whoever cloned the repo happening to hit Approve.",
+      includeCoAuthoredBy: false,
+      enabledMcpjsonServers: MCP_NAMES,
+      permissions: {
+        deny: [
+          "Read(**/.dev.vars)",
+          "Read(**/.dev.vars.*)",
+          "Read(**/.env)",
+          "Read(**/.env.*)",
+          "Read(**/*.pem)",
+          "Read(**/*.key)",
+          "Read(**/.npmrc)",
+          "Edit(**/.dev.vars)",
+          "Edit(**/.env)",
+          "Write(**/.dev.vars)",
+          "Write(**/.env)"
+        ]
+      }
+    },
+    null,
+    2
+  ) + "\n";
+  files[".mcp.json"] = JSON.stringify(mcpConfig(), null, 2) + "\n";
+  files["src/actions/index.ts"] = `/*
+ * Form handlers.
+ *
+ * \`src/actions/index.ts\` is a FIXED path - Astro looks nowhere else - so this file has to live
+ * in the client repo. What it contains is a re-export, and that is the whole point: the pipeline
+ * itself is package-owned, so a fix to validation, Turnstile handling, the D1 write or an email
+ * template reaches this site on npm update rather than never.
+ *
+ * The order inside it is load-bearing: validate, verify Turnstile, write to D1, notify, then
+ * autorespond. Storing before sending means a Mailgun failure leaves an enquiry with
+ * notified_at NULL rather than losing it.
+ *
+ * Forms are defined in src/forms/*.json, one per form, and the filename is the form id. There
+ * is no registry to keep in step - adding src/forms/quote.json is the whole job.
+ *
+ * TO CUSTOMIZE: wrap rather than fork. Import the package's server, spread it, and add your own
+ * action beside it. Copying the pipeline in here is how a site stops receiving fixes.
+ */
+export { server } from '@cparkerwebm/webmonterey/actions';
+`;
+  files["src/components/registry.ts"] = `import type { AstroComponentFactory } from 'astro/runtime/server/index.js';
+
+/*
+ * THE BLOCK REGISTRY - client-owned, because every visible component is. The package ships
+ * none.
+ *
+ * Maps a block \`type\` in page JSON to the component that renders it. Adding a component means
+ * THREE things: the folder, an entry here, and its schema joining the union in
+ * src/content.config.ts.
+ *
+ * FORGETTING THIS FILE IS THE MOST COMMON BUG. Nothing errors - the build succeeds and the
+ * block renders as nothing. Miss the union instead and valid JSON fails to build.
+ */
+export const blocks: Record<string, AstroComponentFactory> = {};
+
+export const registeredTypes = (): string[] => Object.keys(blocks);
+`;
+  files["src/content.config.ts"] = `import { webmontereyCollections } from '@cparkerwebm/webmonterey/content';
+
+/*
+ * The block union is what makes a typo in page JSON a BUILD ERROR rather than a blank space.
+ * Add each component's schema as you build it:
+ *
+ *   import { schema as content000001 } from './components/content/content-000001/schema.ts';
+ *   export const collections = webmontereyCollections([content000001]);
+ *
+ * A union needs at least one member, so this stays commented until the first component exists.
+ */
+export const collections = webmontereyCollections([]);
+`;
+  files["src/styles/custom/_index.css"] = `/*
+ * The client override seam.
+ *
+ * webm.components.custom beats webm.components.core at identical specificity, so a rule here
+ * lands without !important and stays legible as an override. webm.overrides is the last word.
+ *
+ * To retheme, change the TOKEN in design.json rather than the rule - one declaration cascades
+ * everywhere. Reach for this file when the token system genuinely does not express something.
+ *
+ * NOTHING IMPORTS THIS FILE FROM THIS REPO. The package's base layout pulls it in through a
+ * virtual module, so it ships automatically and there is no entry point here to keep in step.
+ */
+
+@layer webm.components.custom {
+}
+
+@layer webm.overrides {
+}
+`;
+  files["src/content/pages/home.json"] = JSON.stringify(
+    {
+      title: client === "CHANGEME" ? "Home" : client,
+      showTitle: true,
+      description: "",
+      blocks: []
+    },
+    null,
+    2
+  ) + "\n";
+  files["public/site.webmanifest"] = JSON.stringify(
+    {
+      name: client === "CHANGEME" ? domain : client,
+      short_name: client === "CHANGEME" ? domain : client,
+      icons: [
+        { src: "/android-chrome-192x192.png", sizes: "192x192", type: "image/png" },
+        {
+          src: "/android-chrome-512x512.png",
+          sizes: "512x512",
+          type: "image/png",
+          purpose: "any maskable"
+        }
+      ],
+      theme_color: "#006abe",
+      background_color: "#ffffff",
+      display: "standalone",
+      start_url: "/"
+    },
+    null,
+    2
+  ) + "\n";
+  files[".gitignore"] = `node_modules/
+dist/
+.astro/
+.wrangler/
+worker-configuration.d.ts
+.DS_Store
+
+# Secrets. Never committed, never uploaded - wrangler secret put is the only path.
+.dev.vars
+.dev.vars.*
+.env
+.env.*
+
+# Refused by preinstall; here as belt and braces.
+pnpm-lock.yaml
+yarn.lock
+bun.lock*
+`;
+  files[".dev.vars.example"] = `# Copy to .dev.vars for local development. NEVER commit .dev.vars.
+# Anything here must also exist as a real Worker secret - \`wrangler secret put\`.
+# Record each one in the password manager as you create it: wrangler cannot read a secret back.
+
+# TURNSTILE_SECRET_KEY=
+# MAILGUN_API_KEY=
+# MAILGUN_DOMAIN=
+`;
+  files[".nvmrc"] = "24\n";
+  files["README.md"] = `# ${client === "CHANGEME" ? n.repo : client}
+
+${domain} \u2014 built on [@cparkerwebm/webmonterey](https://github.com/cparkerwebm/webmonterey).
+
+## Commands
+
+| Command | Runs |
+| --- | --- |
+| \`npm run dev\` | local dev server |
+| \`npm run preview\` | **a real build on real workerd** \u2014 use this, not dev, for anything touching styles, routes or wrangler.jsonc |
+| \`npm run check\` | types and content schema |
+| \`npx webm doctor\` | the things that fail silently |
+
+## Cloudflare
+
+| | |
+| --- | --- |
+| Worker | \`${n.worker}\` |
+| D1 | \`${n.d1}\` |
+| R2 media | \`${n.r2Media}\` |
+
+The repo is named for the domain; Cloudflare resources use the slug, with no TLD, so a
+preview hostname never embeds a domain Chrome could mistake for a lookalike.
+
+## Deploying
+
+Push to deploy. A \`wrangler deploy\` from a laptop creates a version no build produced, so
+history stops describing what is live and the next push reverts it.
+`;
+  return files;
+}
+var init_scaffold = __esm({
+  "src/cli/scaffold.ts"() {
+    "use strict";
+    init_slug();
+    init_mcp();
+  }
+});
+
+// src/cli/sync.ts
+var sync_exports = {};
+__export(sync_exports, {
+  run: () => run,
+  sync: () => sync
+});
+import {
+  cpSync,
+  existsSync as existsSync2,
+  mkdirSync,
+  readFileSync as readFileSync2,
+  rmSync,
+  writeFileSync,
+  readdirSync
+} from "node:fs";
+import { basename, join as join2 } from "node:path";
+function syncDir(source, target) {
+  if (!existsSync2(source)) return [];
+  mkdirSync(target, { recursive: true });
+  const written = [];
+  for (const entry2 of readdirSync(source, { withFileTypes: true })) {
+    if (entry2.name.startsWith(".")) continue;
+    if (!entry2.isFile()) continue;
+    cpSync(join2(source, entry2.name), join2(target, entry2.name));
+    written.push(entry2.name);
+  }
+  return written.sort();
+}
+function addMissing(source, target) {
+  if (!existsSync2(source)) return [];
+  mkdirSync(target, { recursive: true });
+  const added = [];
+  for (const entry2 of readdirSync(source, { withFileTypes: true })) {
+    if (entry2.name.startsWith(".") || !entry2.isFile()) continue;
+    const dest = join2(target, entry2.name);
+    if (existsSync2(dest)) continue;
+    cpSync(join2(source, entry2.name), dest);
+    added.push(entry2.name);
+  }
+  return added.sort();
+}
+function listSkills(dir) {
+  if (!existsSync2(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync2(join2(dir, e.name, "SKILL.md"))).map((e) => e.name).sort();
+}
+function sync(siteRoot) {
+  const version = packageVersion();
+  const source = join2(PACKAGE_ROOT, "skills");
+  const target = join2(siteRoot, ".claude", "skills", NAMESPACE);
+  const before = listSkills(join2(target, "skills"));
+  const after = listSkills(source);
+  rmSync(target, { recursive: true, force: true });
+  mkdirSync(join2(target, ".claude-plugin"), { recursive: true });
+  const noDotfiles = (src) => !basename(src).startsWith(".");
+  if (existsSync2(source)) {
+    cpSync(source, join2(target, "skills"), { recursive: true, filter: noDotfiles });
+  }
+  const plugin = (dir) => {
+    const from = join2(PACKAGE_ROOT, dir);
+    if (!existsSync2(from)) return [];
+    const names = readdirSync(from).filter(noDotfiles).sort();
+    if (names.length) cpSync(from, join2(target, dir), { recursive: true, filter: noDotfiles });
+    return names;
+  };
+  const agents = plugin("agents");
+  const hooks = plugin("hooks");
+  writeFileSync(
+    join2(target, ".claude-plugin", "plugin.json"),
+    JSON.stringify(
+      {
+        name: NAMESPACE,
+        description: "WebMonterey fleet skills. Materialized by `webm sync` - do not edit here.",
+        version
+      },
+      null,
+      2
+    ) + "\n"
+  );
+  writeFileSync(
+    join2(target, ".webm-sync.json"),
+    JSON.stringify({ version, namespace: NAMESPACE, skills: after }, null, 2) + "\n"
+  );
+  const template = join2(PACKAGE_ROOT, "template");
+  return {
+    added: after.filter((s) => !before.includes(s)),
+    removed: before.filter((s) => !after.includes(s)),
+    unchanged: after.filter((s) => before.includes(s)),
+    version,
+    agents,
+    hooks,
+    scripts: syncDir(join2(template, "scripts"), join2(siteRoot, "scripts")),
+    /*
+     * CI, REPLACE-managed like scripts/. A site never edits its own workflow - if a leg is wrong
+     * it is wrong on every site, and it gets fixed here. Five sites once had no CI whatsoever,
+     * which is how code depending on an unpublished package reached main without a word.
+     */
+    workflows: syncDir(join2(template, "workflows"), join2(siteRoot, ".github/workflows")),
+    migrations: addMissing(join2(template, "migrations"), join2(siteRoot, "migrations"))
+  };
+}
+function ensureGitignored(siteRoot) {
+  const path = join2(siteRoot, ".gitignore");
+  const entry2 = `.claude/skills/${NAMESPACE}/`;
+  const current = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  if (current.includes(entry2)) return false;
+  const addition = `
+# Materialized by \`webm sync\` on every install. Package-owned; never commit.
+# Client skills go BESIDE it, at .claude/skills/<name>/.
+${entry2}
+`;
+  writeFileSync(path, current.replace(/\n*$/, "\n") + addition);
+  return true;
+}
+function run(argv2) {
+  const siteRoot = argv2[0] ?? process.cwd();
+  const result = sync(siteRoot);
+  const total = result.added.length + result.unchanged.length;
+  console.log(`webm sync: ${total} skills at .claude/skills/${NAMESPACE}/ (v${result.version})`);
+  for (const s of result.added) console.log(`  + /${NAMESPACE}:${s}`);
+  for (const s of result.removed) console.log(`  - /${NAMESPACE}:${s}`);
+  if (result.agents.length) console.log(`  agents: ${result.agents.join(", ")}`);
+  if (result.hooks.length) console.log(`  hooks: ${result.hooks.join(", ")}`);
+  if (result.scripts.length) {
+    console.log(`  scripts/ refreshed: ${result.scripts.join(", ")}`);
+  }
+  for (const m of result.migrations) {
+    console.log(`  + migrations/${m}  (apply it: npx wrangler d1 migrations apply <DB> --remote)`);
+  }
+  if (ensureGitignored(siteRoot)) {
+    console.log(`  gitignored .claude/skills/${NAMESPACE}/`);
+  }
+  if (result.added.length || result.removed.length) {
+    console.log(
+      `
+Skill changes are picked up live. If this was the first sync in this repo, restart Claude Code so it can watch the new directory.`
+    );
+  }
+  return 0;
+}
+var NAMESPACE;
+var init_sync = __esm({
+  "src/cli/sync.ts"() {
+    "use strict";
+    init_package_root();
+    NAMESPACE = "webm";
+  }
+});
+
+// src/cli/seed.ts
+import { cpSync as cpSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join3, relative } from "node:path";
+function walk(dir) {
+  if (!existsSync3(dir)) return [];
+  return readdirSync2(dir, { withFileTypes: true }).flatMap((e) => {
+    if (e.name.startsWith(".") && e.name !== ".editorconfig" && e.name !== ".prettierrc.json" && e.name !== ".prettierignore") {
+      return [];
+    }
+    const full = join3(dir, e.name);
+    return e.isDirectory() ? walk(full) : [full];
+  });
+}
+function seed(packageRoot, siteRoot) {
+  const written = [];
+  for (const { from, to } of SEEDS) {
+    const source = join3(packageRoot, "template", from);
+    for (const file of walk(source)) {
+      const rel = relative(source, file);
+      const dest = join3(siteRoot, to === "." ? rel : join3(to, rel));
+      if (existsSync3(dest)) continue;
+      mkdirSync2(dirname2(dest), { recursive: true });
+      cpSync2(file, dest);
+      written.push(relative(siteRoot, dest));
+    }
+  }
+  return written.sort();
+}
+function gitkeepEmptyDirs(siteRoot, dirs) {
+  const kept = [];
+  for (const dir of dirs) {
+    const full = join3(siteRoot, dir);
+    mkdirSync2(full, { recursive: true });
+    if (readdirSync2(full).length > 0) continue;
+    writeFileSync2(join3(full, ".gitkeep"), "");
+    kept.push(join3(dir, ".gitkeep"));
+  }
+  const walkDirs = (d) => {
+    for (const e of readdirSync2(d, { withFileTypes: true })) {
+      if (!e.isDirectory() || e.name === "node_modules" || e.name.startsWith(".")) continue;
+      const full = join3(d, e.name);
+      if (readdirSync2(full).length === 0) {
+        writeFileSync2(join3(full, ".gitkeep"), "");
+        kept.push(join3(relative(siteRoot, full), ".gitkeep"));
+      } else {
+        walkDirs(full);
+      }
+    }
+  };
+  walkDirs(siteRoot);
+  return [...new Set(kept)].sort();
+}
+var SEEDS, SCAFFOLD_DIRS;
+var init_seed = __esm({
+  "src/cli/seed.ts"() {
+    "use strict";
+    SEEDS = [
+      { from: "site", to: "." },
+      { from: "public", to: "public" },
+      { from: "assets", to: "src/assets/images" }
+    ];
+    SCAFFOLD_DIRS = [
+      "migrations",
+      "public",
+      "src/assets/fonts",
+      "src/assets/icons",
+      "src/assets/images",
+      "src/components/asides",
+      "src/components/content",
+      "src/components/general",
+      "src/components/interfaces",
+      "src/components/regions",
+      "src/content/pages",
+      "src/forms",
+      "src/pages",
+      "src/pages/webapp",
+      "src/scripts",
+      "src/styles/custom"
+    ];
+  }
+});
+
+// src/cli/new.ts
+var new_exports = {};
+__export(new_exports, {
+  run: () => run2
+});
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join4, resolve } from "node:path";
+function parseArgs(argv2) {
+  const positional = argv2.filter((a) => !a.startsWith("--"));
+  const flag = (name) => {
+    const hit = argv2.find((a) => a.startsWith(`--${name}=`));
+    return hit ? hit.slice(name.length + 3) : void 0;
+  };
+  return {
+    domain: positional[0],
+    client: flag("client"),
+    org: flag("org") ?? "webmonterey",
+    stagingEmail: flag("staging-email"),
+    into: flag("into"),
+    install: !argv2.includes("--no-install")
+  };
+}
+function gitUserEmail() {
+  try {
+    return execFileSync("git", ["config", "user.email"], { encoding: "utf8" }).trim();
+  } catch {
+    return "";
+  }
+}
+function run2(argv2) {
+  const args = parseArgs(argv2);
+  if (!args.domain) {
+    console.error(
+      'webm new <domain> [--client="Name"] [--org=webmonterey] [--staging-email=you@example.com] [--into=path] [--no-install]'
+    );
+    console.error('\n  webm new autire.com --client="Autire Technologies"');
+    return 1;
+  }
+  let domain;
+  try {
+    domain = normalizeDomain(args.domain);
+  } catch (error) {
+    console.error(`webm new: ${error instanceof DomainError ? error.message : error}`);
+    return 1;
+  }
+  const names = resourceNames(domain);
+  const root = resolve(args.into ?? repoName(domain));
+  if (existsSync4(root) && readdirSync3(root).length > 0) {
+    console.error(`webm new: ${root} exists and is not empty. Refusing to scaffold over it.`);
+    return 1;
+  }
+  const files = scaffold({
+    domain,
+    client: args.client,
+    org: args.org,
+    stagingEmail: args.stagingEmail ?? gitUserEmail(),
+    packageVersion: packageVersion(),
+    /* Real today, not a constant - see ScaffoldOptions.today for what a stale one does. */
+    today: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)
+  });
+  for (const [path, contents] of Object.entries(files)) {
+    const full = join4(root, path);
+    mkdirSync3(dirname3(full), { recursive: true });
+    writeFileSync3(full, contents);
+  }
+  const seeded = seed(PACKAGE_ROOT, root);
+  sync(root);
+  const kept = gitkeepEmptyDirs(root, SCAFFOLD_DIRS);
+  console.log(`Scaffolded ${Object.keys(files).length} files into ${root}`);
+  console.log(`  + ${seeded.length} seeded (favicons, headers, CLAUDE.md, a contact form)`);
+  console.log(`  + ${kept.length} .gitkeep, so the empty directories survive a clone
+`);
+  console.log(`  repo     ${args.org}/${names.repo}      (keeps the domain)`);
+  console.log(
+    `  worker   ${names.worker}                (slug - no TLD, so Chrome does not flag previews)`
+  );
+  console.log(`  d1       ${names.d1}`);
+  console.log(`  r2       ${names.r2Media}`);
+  try {
+    execFileSync("git", ["init", "-q", "-b", "main"], { cwd: root });
+  } catch {
+    console.log("\n  (git init failed - initialize the repo yourself)");
+  }
+  if (args.install) {
+    console.log("\nInstalling\u2026");
+    try {
+      execFileSync("npm", ["install"], { cwd: root, stdio: "inherit" });
+    } catch {
+      console.error(
+        `
+Install failed. The scaffold is written and fine; fix the cause above and run npm install in ${names.repo}.`
+      );
+      return 1;
+    }
+  }
+  console.log(`
+Next:`);
+  console.log(`  cd ${names.repo}`);
+  console.log(`  claude          # then /webm:start \u2014 it takes it from here`);
+  console.log(`
+Start Claude from the repo root. Project skills-dir plugins load only from the`);
+  console.log(`directory you start in; launching from a subdirectory misses them.`);
+  return 0;
+}
+var init_new = __esm({
+  "src/cli/new.ts"() {
+    "use strict";
+    init_slug();
+    init_scaffold();
+    init_sync();
+    init_seed();
+    init_package_root();
+  }
+});
+
+// src/design/defaults.ts
+var DEFAULTS, TOKEN_NAMES;
+var init_defaults = __esm({
+  "src/design/defaults.ts"() {
+    "use strict";
+    DEFAULTS = [
+      {
+        title: "base palette",
+        note: "Raw neutrals. Everything semantic below points at these, not the other way round.",
+        tokens: [
+          { name: "--webm-base-100", value: "#ffffff" },
+          { name: "--webm-base-300", value: "#f1eae8" },
+          { name: "--webm-base-500", value: "#3f3f3f" },
+          { name: "--webm-base-700", value: "#222222" },
+          { name: "--webm-base-900", value: "#000000" }
+        ]
+      },
+      {
+        title: "action",
+        note: "The brand color. Retheming a client usually starts and ends here.",
+        tokens: [
+          { name: "--webm-action", value: "#006abe" },
+          { name: "--webm-action-dark", value: "#003e80" },
+          { name: "--webm-action-light", value: "#6bc7ff" }
+        ]
+      },
+      {
+        title: "surface",
+        tokens: [
+          { name: "--webm-surface", value: "var(--webm-base-100)" },
+          { name: "--webm-surface-alt", value: "var(--webm-base-300)" },
+          { name: "--webm-surface-accent", value: "var(--webm-action-light)" },
+          { name: "--webm-surface-inverse", value: "var(--webm-base-900)" },
+          { name: "--webm-surface-raised", value: "var(--webm-base-100)" }
+        ]
+      },
+      {
+        title: "text",
+        tokens: [
+          { name: "--webm-text", value: "var(--webm-base-700)" },
+          { name: "--webm-text-muted", value: "var(--webm-base-500)" },
+          { name: "--webm-text-strong", value: "var(--webm-base-900)" },
+          { name: "--webm-text-inverse", value: "var(--webm-base-100)" },
+          { name: "--webm-text-on-action", value: "var(--webm-base-100)" }
+        ]
+      },
+      {
+        title: "link",
+        tokens: [
+          { name: "--webm-link", value: "var(--webm-action)" },
+          { name: "--webm-link-hover", value: "var(--webm-action-dark)" },
+          { name: "--webm-link-visited", value: "var(--webm-action-dark)" }
+        ]
+      },
+      {
+        title: "border",
+        tokens: [
+          { name: "--webm-border-subtle", value: "#dcd3d0" },
+          { name: "--webm-border-interactive", value: "var(--webm-base-500)" },
+          { name: "--webm-border-strong", value: "var(--webm-base-700)" }
+        ]
+      },
+      {
+        title: "state",
+        tokens: [
+          { name: "--webm-state-success", value: "#0f7b3f" },
+          { name: "--webm-state-warning", value: "#9a6700" },
+          { name: "--webm-state-danger", value: "#b3261e" },
+          { name: "--webm-state-info", value: "var(--webm-action)" }
+        ]
+      },
+      {
+        title: "font",
+        note: [
+          "System stack by default - zero network cost, no layout shift, no dependency.",
+          "To use a real typeface, put the woff2 in public/fonts/, declare @font-face in",
+          "src/styles/custom/, and set font.sans in design.json."
+        ].join("\n"),
+        tokens: [
+          {
+            name: "--webm-font-sans",
+            value: "system-ui, -apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif"
+          },
+          {
+            name: "--webm-font-mono",
+            value: "ui-monospace, SFMono-Regular, Menlo, Consolas, monospace"
+          }
+        ]
+      },
+      {
+        title: "font-size",
+        note: "Fluid scale. Each step interpolates between a mobile and a desktop size.",
+        tokens: [
+          { name: "--webm-font-size-2xs", value: "clamp(0.6944rem, 0.6859rem + 0.0426vw, 0.72rem)" },
+          { name: "--webm-font-size-xs", value: "clamp(0.8333rem, 0.8111rem + 0.1111vw, 0.9rem)" },
+          { name: "--webm-font-size-sm", value: "clamp(1rem, 0.9583rem + 0.2083vw, 1.125rem)" },
+          { name: "--webm-font-size-md", value: "clamp(1.2rem, 1.1312rem + 0.3438vw, 1.406rem)" },
+          { name: "--webm-font-size-lg", value: "clamp(1.44rem, 1.3341rem + 0.5297vw, 1.758rem)" },
+          { name: "--webm-font-size-xl", value: "clamp(1.728rem, 1.5716rem + 0.7821vw, 2.197rem)" },
+          { name: "--webm-font-size-2xl", value: "clamp(2.074rem, 1.8493rem + 1.1216vw, 2.747rem)" },
+          { name: "--webm-font-size-3xl", value: "clamp(2.488rem, 2.1734rem + 1.5748vw, 3.433rem)" },
+          { name: "--webm-font-size-4xl", value: "clamp(2.986rem, 2.5508rem + 2.1759vw, 4.292rem)" }
+        ]
+      },
+      {
+        title: "leading",
+        tokens: [
+          { name: "--webm-leading-tight", value: "1.1" },
+          { name: "--webm-leading-snug", value: "1.25" },
+          { name: "--webm-leading-normal", value: "1.5" },
+          { name: "--webm-leading-loose", value: "1.7" }
+        ]
+      },
+      {
+        title: "tracking",
+        tokens: [
+          { name: "--webm-tracking-tight", value: "-0.02em" },
+          { name: "--webm-tracking-normal", value: "0em" },
+          { name: "--webm-tracking-wide", value: "0.06em" }
+        ]
+      },
+      {
+        title: "weight",
+        tokens: [
+          { name: "--webm-weight-regular", value: "400" },
+          { name: "--webm-weight-medium", value: "500" },
+          { name: "--webm-weight-semibold", value: "600" },
+          { name: "--webm-weight-bold", value: "700" }
+        ]
+      },
+      {
+        title: "space",
+        tokens: [
+          { name: "--webm-space-3xs", value: "0.25rem" },
+          { name: "--webm-space-2xs", value: "0.5rem" },
+          { name: "--webm-space-xs", value: "0.75rem" },
+          { name: "--webm-space-sm", value: "1rem" },
+          { name: "--webm-space-md", value: "1.5rem" },
+          { name: "--webm-space-lg", value: "2rem" },
+          { name: "--webm-space-xl", value: "3rem" },
+          { name: "--webm-space-2xl", value: "4rem" },
+          { name: "--webm-space-3xl", value: "6rem" },
+          { name: "--webm-space-4xl", value: "8rem" }
+        ]
+      },
+      {
+        title: "space, fluid",
+        tokens: [
+          { name: "--webm-space-fluid-sm", value: "clamp(1rem, 0.8333rem + 0.8333vw, 1.5rem)" },
+          { name: "--webm-space-fluid-md", value: "clamp(1.5rem, 1.25rem + 1.25vw, 2.25rem)" },
+          { name: "--webm-space-fluid-lg", value: "clamp(2rem, 1.6667rem + 1.6667vw, 3rem)" },
+          { name: "--webm-space-fluid-xl", value: "clamp(3rem, 2.5rem + 2.5vw, 4.5rem)" },
+          { name: "--webm-space-fluid-2xl", value: "clamp(4rem, 3.3333rem + 3.3333vw, 6rem)" },
+          { name: "--webm-space-fluid-3xl", value: "clamp(6rem, 5rem + 5vw, 9rem)" }
+        ]
+      },
+      {
+        title: "section rhythm",
+        tokens: [
+          { name: "--webm-section-sm", value: "clamp(2rem, 1.6667rem + 1.6667vw, 3rem)" },
+          { name: "--webm-section-md", value: "clamp(3rem, 2rem + 5vw, 6rem)" },
+          { name: "--webm-section-lg", value: "clamp(4rem, 2.6667rem + 6.6667vw, 8rem)" },
+          { name: "--webm-section-xl", value: "clamp(6rem, 4rem + 10vw, 12rem)" }
+        ]
+      },
+      {
+        title: "gutter",
+        tokens: [{ name: "--webm-gutter", value: "clamp(1rem, 0.3333rem + 3.3333vw, 3rem)" }]
+      },
+      {
+        title: "width",
+        tokens: [
+          { name: "--webm-width-max", value: "1920px" },
+          { name: "--webm-width-wide", value: "1600px" },
+          { name: "--webm-width-content", value: "1280px" },
+          { name: "--webm-width-narrow", value: "960px" },
+          { name: "--webm-width-text", value: "68ch" }
+        ]
+      },
+      {
+        title: "radius",
+        tokens: [
+          { name: "--webm-radius-none", value: "0" },
+          { name: "--webm-radius-xs", value: "0.125rem" },
+          { name: "--webm-radius-sm", value: "0.25rem" },
+          { name: "--webm-radius-md", value: "0.5rem" },
+          { name: "--webm-radius-lg", value: "1rem" },
+          { name: "--webm-radius-xl", value: "1.5rem" },
+          { name: "--webm-radius-pill", value: "62.4375rem" },
+          { name: "--webm-radius-circle", value: "50%" }
+        ]
+      },
+      {
+        title: "border-width",
+        tokens: [
+          { name: "--webm-border-width-0", value: "0" },
+          { name: "--webm-border-width-1", value: "1px" },
+          { name: "--webm-border-width-2", value: "2px" },
+          { name: "--webm-border-width-4", value: "4px" }
+        ]
+      },
+      {
+        title: "shadow",
+        tokens: [
+          { name: "--webm-shadow-xs", value: "0 1px 2px 0 rgb(34 34 34 / 0.06)" },
+          {
+            name: "--webm-shadow-sm",
+            value: "0 1px 3px 0 rgb(34 34 34 / 0.1), 0 1px 2px -1px rgb(34 34 34 / 0.1)"
+          },
+          {
+            name: "--webm-shadow-md",
+            value: "0 4px 6px -1px rgb(34 34 34 / 0.1), 0 2px 4px -2px rgb(34 34 34 / 0.1)"
+          },
+          {
+            name: "--webm-shadow-lg",
+            value: "0 10px 15px -3px rgb(34 34 34 / 0.1), 0 4px 6px -4px rgb(34 34 34 / 0.1)"
+          },
+          {
+            name: "--webm-shadow-xl",
+            value: "0 20px 25px -5px rgb(34 34 34 / 0.12), 0 8px 10px -6px rgb(34 34 34 / 0.1)"
+          }
+        ]
+      },
+      {
+        title: "z-index",
+        note: "Named layers only. Never write a raw z-index in component CSS.",
+        tokens: [
+          { name: "--webm-z-below", value: "-1" },
+          { name: "--webm-z-base", value: "0" },
+          { name: "--webm-z-raised", value: "10" },
+          { name: "--webm-z-sticky", value: "100" },
+          { name: "--webm-z-header", value: "200" },
+          { name: "--webm-z-drawer", value: "300" },
+          { name: "--webm-z-overlay", value: "400" },
+          { name: "--webm-z-modal", value: "500" },
+          { name: "--webm-z-toast", value: "600" },
+          { name: "--webm-z-tooltip", value: "700" },
+          { name: "--webm-z-skiplink", value: "900" }
+        ]
+      },
+      {
+        title: "duration",
+        tokens: [
+          { name: "--webm-duration-instant", value: "75ms" },
+          { name: "--webm-duration-fast", value: "150ms" },
+          { name: "--webm-duration-normal", value: "250ms" },
+          { name: "--webm-duration-slow", value: "400ms" },
+          { name: "--webm-duration-slower", value: "600ms" }
+        ]
+      },
+      {
+        title: "easing",
+        tokens: [
+          { name: "--webm-ease-linear", value: "linear" },
+          { name: "--webm-ease-out", value: "cubic-bezier(0.16, 1, 0.3, 1)" },
+          { name: "--webm-ease-in", value: "cubic-bezier(0.7, 0, 0.84, 0)" },
+          { name: "--webm-ease-in-out", value: "cubic-bezier(0.65, 0, 0.35, 1)" },
+          { name: "--webm-ease-spring", value: "cubic-bezier(0.34, 1.56, 0.64, 1)" }
+        ]
+      },
+      {
+        title: "scroll reveal",
+        note: [
+          "Defaults for .webm-reveal. Overridable per element with data-reveal-delay and",
+          "data-reveal-duration, which observe.ts writes as inline properties.",
+          "",
+          "NOT var(--webm-duration-slow), and not a card-sized distance. The motion scale tops out",
+          "at 400ms, tuned for a button or a dropdown - something small moving a short way. A reveal",
+          "is a whole content group arriving, and at 400ms over 1.5rem it reads as a twitch.",
+          "",
+          "7.5rem over 1500ms was arrived at on a real client homepage, not picked. Raising duration",
+          "alone did nothing: --webm-ease-out front-loads the curve, so extra time only stretches the",
+          "settle. Raising distance alone lurched. Both had to grow together."
+        ].join("\n"),
+        tokens: [
+          { name: "--webm-reveal-duration", value: "1500ms" },
+          { name: "--webm-reveal-delay", value: "0ms" },
+          { name: "--webm-reveal-distance", value: "7.5rem" },
+          { name: "--webm-reveal-ease", value: "var(--webm-ease-out)" },
+          { name: "--webm-reveal-blur", value: "8px" },
+          { name: "--webm-reveal-stagger-step", value: "80ms" }
+        ]
+      },
+      {
+        title: "focus",
+        tokens: [
+          { name: "--webm-focus-width", value: "3px" },
+          { name: "--webm-focus-offset", value: "2px" },
+          { name: "--webm-focus-color", value: "var(--webm-action)" }
+        ]
+      },
+      {
+        title: "composites",
+        tokens: [
+          { name: "--webm-focus-ring", value: "var(--webm-focus-width) solid var(--webm-focus-color)" }
+        ]
+      }
+    ];
+    TOKEN_NAMES = new Set(
+      DEFAULTS.flatMap((g) => g.tokens.map((t) => t.name))
+    );
+  }
+});
+
+// src/design/compile.ts
+var MAPPING;
+var init_compile = __esm({
+  "src/design/compile.ts"() {
+    "use strict";
+    init_defaults();
+    MAPPING = [
+      [["color", "base", "100"], "--webm-base-100"],
+      [["color", "base", "300"], "--webm-base-300"],
+      [["color", "base", "500"], "--webm-base-500"],
+      [["color", "base", "700"], "--webm-base-700"],
+      [["color", "base", "900"], "--webm-base-900"],
+      [["color", "action", "base"], "--webm-action"],
+      [["color", "action", "dark"], "--webm-action-dark"],
+      [["color", "action", "light"], "--webm-action-light"],
+      [["color", "border", "subtle"], "--webm-border-subtle"],
+      [["color", "state", "success"], "--webm-state-success"],
+      [["color", "state", "warning"], "--webm-state-warning"],
+      [["color", "state", "danger"], "--webm-state-danger"],
+      [["color", "state", "info"], "--webm-state-info"],
+      [["font", "sans"], "--webm-font-sans"],
+      [["font", "mono"], "--webm-font-mono"],
+      [["radius", "none"], "--webm-radius-none"],
+      [["radius", "xs"], "--webm-radius-xs"],
+      [["radius", "sm"], "--webm-radius-sm"],
+      [["radius", "md"], "--webm-radius-md"],
+      [["radius", "lg"], "--webm-radius-lg"],
+      [["radius", "xl"], "--webm-radius-xl"],
+      [["radius", "pill"], "--webm-radius-pill"],
+      [["radius", "circle"], "--webm-radius-circle"]
+    ];
+  }
+});
+
+// src/cli/design-extract.ts
+var design_extract_exports = {};
+__export(design_extract_exports, {
+  extract: () => extract,
+  parseTokens: () => parseTokens,
+  run: () => run3
+});
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "node:fs";
+function parseTokens(css) {
+  const source = css.replace(/\/\*[\s\S]*?\*\//g, "");
+  const base = /* @__PURE__ */ new Map();
+  const conditional = /* @__PURE__ */ new Map();
+  const CONDITIONAL = /^@(media|supports|container)\b/;
+  const atRules = [];
+  const atRuleDepth = [];
+  let depth = 0;
+  let buffer = "";
+  for (let i = 0; i < source.length; i++) {
+    const char = source[i];
+    if (char === "{") {
+      const prelude = buffer.trim();
+      if (CONDITIONAL.test(prelude)) {
+        atRules.push(prelude);
+        atRuleDepth.push(depth);
+      }
+      depth++;
+      buffer = "";
+      continue;
+    }
+    if (char === "}") {
+      depth--;
+      if (atRuleDepth.length && atRuleDepth.at(-1) === depth) {
+        atRules.pop();
+        atRuleDepth.pop();
+      }
+      buffer = "";
+      continue;
+    }
+    if (char === ";") {
+      const declaration = buffer.trim();
+      const match = /^(--webm-[\w-]+)\s*:\s*([\s\S]+)$/.exec(declaration);
+      if (match) {
+        const [, name, value] = match;
+        if (atRules.length === 0) {
+          base.set(name, value.trim());
+        } else {
+          conditional.set(name, [...conditional.get(name) ?? [], atRules.join(" / ")]);
+        }
+      }
+      buffer = "";
+      continue;
+    }
+    buffer += char;
+  }
+  return { base, conditional };
+}
+function setPath(target, path, value) {
+  let node = target;
+  for (const key of path.slice(0, -1)) {
+    node[key] ??= {};
+    node = node[key];
+  }
+  node[path.at(-1)] = value;
+}
+function extract(css) {
+  const { base: found, conditional } = parseTokens(css);
+  const design = { version: 1 };
+  const mapped = [];
+  const overridden = [];
+  const added = [];
+  let unchanged = 0;
+  for (const [name, value] of found) {
+    const isKnown = DEFAULT_VALUES.has(name);
+    if (isKnown && DEFAULT_VALUES.get(name) === value) {
+      unchanged++;
+      continue;
+    }
+    const path = REVERSE.get(name);
+    if (path) {
+      setPath(design, path, value);
+      mapped.push(name);
+    } else {
+      design.overrides ??= {};
+      design.overrides[name] = value;
+      (isKnown ? overridden : added).push(name);
+    }
+  }
+  return { design, mapped, overridden, added, unchanged, conditional };
+}
+function run3(argv2) {
+  const input = argv2[0] ?? "src/styles/tokens.css";
+  const output = argv2[1] ?? "design.json";
+  if (!existsSync5(input)) {
+    console.error(`webm design:extract: no such file: ${input}`);
+    console.error(`  usage: webm design:extract [tokens.css] [design.json]`);
+    return 1;
+  }
+  if (existsSync5(output)) {
+    console.error(`webm design:extract: ${output} already exists. Move it aside first.`);
+    return 1;
+  }
+  const result = extract(readFileSync4(input, "utf8"));
+  const json = JSON.stringify(
+    { $schema: "./node_modules/@cparkerwebm/webmonterey/schema/design.json", ...result.design },
+    null,
+    2
+  );
+  writeFileSync4(output, json + "\n");
+  console.log(`Read ${input}`);
+  console.log(`  ${result.unchanged} tokens match the defaults and were omitted`);
+  if (result.mapped.length) {
+    console.log(`  ${result.mapped.length} mapped to structured fields:`);
+    for (const n of result.mapped) console.log(`      ${n}`);
+  }
+  if (result.overridden.length) {
+    console.log(`  ${result.overridden.length} kept as overrides (no structured field exists):`);
+    for (const n of result.overridden) console.log(`      ${n}`);
+  }
+  if (result.added.length) {
+    console.log(`  ${result.added.length} are site tokens, not part of the default set:`);
+    for (const n of result.added) console.log(`      ${n}`);
+  }
+  console.log(`
+Wrote ${output}`);
+  if (result.conditional.size) {
+    console.log(
+      `
+${result.conditional.size} tokens are ALSO set inside an at-rule. design.json holds one
+flat :root block, so those conditional values are NOT in it and must stay in CSS:
+`
+    );
+    for (const [name, rules] of result.conditional) {
+      console.log(`      ${name}   ${[...new Set(rules)].join(", ")}`);
+    }
+    console.log(
+      `
+  Move those blocks to src/styles/custom/_index.css. Leaving them behind silently
+  drops reduced-motion handling and every responsive token override.`
+    );
+  }
+  console.log(
+    `
+Next: delete ${input}, and check the compiled output matches what the site rendered before.`
+  );
+  return 0;
+}
+var DEFAULT_VALUES, REVERSE;
+var init_design_extract = __esm({
+  "src/cli/design-extract.ts"() {
+    "use strict";
+    init_defaults();
+    init_compile();
+    DEFAULT_VALUES = new Map(DEFAULTS.flatMap((g) => g.tokens.map((t) => [t.name, t.value])));
+    REVERSE = new Map(MAPPING.map(([path, token]) => [token, path]));
+  }
+});
+
+// src/cli/compare.ts
+var compare_exports = {};
+__export(compare_exports, {
+  compare: () => compare,
+  cssDeclarations: () => cssDeclarations,
+  headTags: () => headTags,
+  jsonLd: () => jsonLd,
+  run: () => run4,
+  visibleText: () => visibleText
+});
+import { readFileSync as readFileSync5, existsSync as existsSync6, readdirSync as readdirSync4, statSync } from "node:fs";
+import { join as join5, relative as relative2 } from "node:path";
+function walk2(dir, match) {
+  if (!existsSync6(dir)) return [];
+  return readdirSync4(dir, { withFileTypes: true }).flatMap((e) => {
+    const full = join5(dir, e.name);
+    return e.isDirectory() ? walk2(full, match) : match(e.name) ? [full] : [];
+  });
+}
+function visibleText(html) {
+  return html.replace(/<(script|style)[^>]*>[\s\S]*?<\/\1>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/<[^>]+>/g, " ").replace(/&[a-z]+;|&#\d+;/gi, " ").replace(/\s+/g, " ").trim();
+}
+function headTags(html) {
+  const head = html.slice(0, html.indexOf("</head>") + 1);
+  return [...head.matchAll(/<(meta|link)\b[^>]*>/gi)].map(
+    (m) => m[0].replace(/\s+/g, " ").replace(/\.[A-Za-z0-9_-]{8,}\.(css|js|woff2?|png|jpg|webp|svg)/g, ".$1").replace(/(\/_server-islands\/[A-Za-z0-9_-]+)\?[^"']*/g, "$1")
+  ).sort();
+}
+function jsonLd(html) {
+  const blocks = [
+    ...html.matchAll(/<script[^>]+application\/ld\+json[^>]*>([\s\S]*?)<\/script>/gi)
+  ];
+  try {
+    return JSON.stringify(
+      blocks.map((b) => JSON.parse(b[1])),
+      null,
+      1
+    );
+  } catch {
+    return blocks.map((b) => b[1]).join("\n");
+  }
+}
+function cssDeclarations(dist) {
+  const inline = walk2(dist, (f) => f.endsWith(".html")).flatMap((f) => [...readFileSync5(f, "utf8").matchAll(/<style[^>]*>([\s\S]*?)<\/style>/gi)]).map((m) => m[1]);
+  const css = [
+    ...walk2(join5(dist, "_astro"), (f) => f.endsWith(".css")).map((f) => readFileSync5(f, "utf8")),
+    ...inline
+  ].join("\n").replace(/\/\*[\s\S]*?\*\//g, "").replace(/\[data-astro-cid-[a-z0-9]+\]/gi, "");
+  return new Set(
+    css.split(/[{};]/).map((d) => d.trim()).filter((d) => d.includes(":") && d.length < 300)
+  );
+}
+function compare(oldDist, newDist) {
+  const diffs = [];
+  const pages = walk2(oldDist, (f) => f.endsWith(".html")).map((f) => relative2(oldDist, f));
+  for (const page of pages) {
+    const a = readFileSync5(join5(oldDist, page), "utf8");
+    const bPath = join5(newDist, page);
+    if (!existsSync6(bPath)) {
+      diffs.push({ layer: "text", page, missing: ["THE WHOLE PAGE"], added: [] });
+      continue;
+    }
+    const b = readFileSync5(bPath, "utf8");
+    const at = words(visibleText(a));
+    const bt = words(visibleText(b));
+    if (setDiff(at, bt).length || setDiff(bt, at).length) {
+      diffs.push({ layer: "text", page, missing: setDiff(at, bt), added: setDiff(bt, at) });
+    }
+    const ah = new Set(headTags(a));
+    const bh = new Set(headTags(b));
+    if (setDiff(ah, bh).length || setDiff(bh, ah).length) {
+      diffs.push({ layer: "head", page, missing: setDiff(ah, bh), added: setDiff(bh, ah) });
+    }
+    if (jsonLd(a) !== jsonLd(b)) {
+      diffs.push({ layer: "jsonld", page, missing: ["graph differs"], added: [] });
+    }
+  }
+  const ac = cssDeclarations(oldDist);
+  const bc = cssDeclarations(newDist);
+  const lost = setDiff(ac, bc);
+  const gained = setDiff(bc, ac);
+  if (lost.length) {
+    diffs.push({ layer: "css", page: "(bundle)", missing: lost, added: gained });
+  } else if (gained.length) {
+    diffs.push({ layer: "css", page: "(bundle)", missing: [], added: gained, info: true });
+  }
+  return diffs;
+}
+function run4(argv2) {
+  const [oldDist, newDist] = argv2;
+  if (!oldDist || !newDist) {
+    console.error("webm compare <old-dist/client> <new-dist/client>");
+    console.error("\n  Build both sites first. Compares text, head tags, JSON-LD and CSS.");
+    return 1;
+  }
+  for (const d of [oldDist, newDist]) {
+    if (!existsSync6(d) || !statSync(d).isDirectory()) {
+      console.error(`webm compare: no such directory: ${d}`);
+      return 1;
+    }
+  }
+  const diffs = compare(oldDist, newDist);
+  const pages = walk2(oldDist, (f) => f.endsWith(".html")).length;
+  const regressions = diffs.filter((d) => !d.info);
+  if (!diffs.length) {
+    console.log(`webm compare: ${pages} pages, no differences in text, head, JSON-LD or CSS.`);
+    return 0;
+  }
+  for (const d of diffs) {
+    console.log(`
+${d.layer.toUpperCase()}${d.info ? " (not a regression)" : ""}  ${d.page}`);
+    for (const m of d.missing.slice(0, 25)) console.log(`  - ${m.slice(0, 160)}`);
+    if (d.missing.length > 25) console.log(`  \u2026 ${d.missing.length - 25} more missing`);
+    for (const a of d.added.slice(0, 10)) console.log(`  + ${a.slice(0, 160)}`);
+    if (d.added.length > 10) console.log(`  \u2026 ${d.added.length - 10} more added`);
+  }
+  if (!regressions.length) {
+    console.log(
+      `
+webm compare: ${pages} pages, no regressions in text, head, JSON-LD or CSS. The additions above are what the new build serves and the old did not.`
+    );
+    return 0;
+  }
+  console.log(
+    `
+${regressions.length} differences across ${pages} pages. A "-" line is something the old site served and the new one does not.`
+  );
+  return 1;
+}
+var setDiff, words;
+var init_compare = __esm({
+  "src/cli/compare.ts"() {
+    "use strict";
+    setDiff = (a, b) => [...a].filter((x) => !b.has(x));
+    words = (s) => new Set(s.split(" ").filter(Boolean));
+  }
+});
+
+// src/includes/webmonterey/config.ts
+function isConfigured(value) {
+  return typeof value === "string" && value.length > 0 && value !== PLACEHOLDER;
+}
+function isValidTimeZone(zone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: zone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function appEnabled(config) {
+  return config.app?.enabled === true;
+}
+function resolveAppPath(config) {
+  const raw = (config.app?.path ?? APP_DIR).replace(/^\/+|\/+$/g, "");
+  return raw || APP_DIR;
+}
+function workerFirstPaths(config) {
+  const paths = ["/_actions/*"];
+  if (appEnabled(config)) {
+    const app = resolveAppPath(config);
+    paths.push(`/${app}/*`, `/${app}`, `/${app}/`);
+  }
+  return paths;
+}
+var APP_DIR, PLACEHOLDER;
+var init_config = __esm({
+  "src/includes/webmonterey/config.ts"() {
+    "use strict";
+    APP_DIR = "webapp";
+    PLACEHOLDER = "CHANGEME";
+  }
+});
+
+// src/cli/checks.ts
+function stripComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/<!--[\s\S]*?-->/g, " ");
+}
+function onDemandRoutes(pages) {
+  const out = [];
+  for (const [file, source] of pages) {
+    if (!/export\s+const\s+prerender\s*=\s*false/.test(source)) continue;
+    const route = "/" + file.replace(/^.*src\/pages\//, "").replace(/\.(astro|ts|js|md)$/, "").replace(/\/index$/, "").replace(/^index$/, "");
+    out.push(route === "/" ? "/" : route);
+  }
+  return out;
+}
+function actionsCalled(sources) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [file, raw] of sources) {
+    if (!/from\s+['"]astro:actions['"]/.test(raw)) continue;
+    const src = stripComments(raw);
+    for (const m of src.matchAll(/\bactions\.([a-zA-Z][a-zA-Z0-9]*)/g)) {
+      const name = m[1];
+      out.set(name, [...out.get(name) ?? [], file]);
+    }
+  }
+  return out;
+}
+function actionsExported(actions) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [, raw] of actions) {
+    const src = stripComments(raw);
+    for (const m of src.matchAll(/([a-zA-Z][a-zA-Z0-9]*)\s*:\s*defineAction\b/g)) names.add(m[1]);
+    for (const m of src.matchAll(/export\s+const\s+([a-zA-Z][a-zA-Z0-9]*)\s*=\s*defineAction\b/g))
+      names.add(m[1]);
+    const server = src.match(/export\s+const\s+server\s*=\s*\{([\s\S]*?)\n\}/);
+    if (server) {
+      for (const m of server[1].matchAll(/^\s*([a-zA-Z][a-zA-Z0-9]*)\s*(?:,|:)/gm)) names.add(m[1]);
+    }
+  }
+  return [...names];
+}
+function tablesCreated(migrations) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [, raw] of migrations) {
+    for (const m of stripComments(raw).matchAll(
+      /CREATE\s+(?:TABLE|VIEW)(?:\s+IF\s+NOT\s+EXISTS)?\s+[`"\[]?([a-zA-Z_][a-zA-Z0-9_]*)/gi
+    ))
+      names.add(m[1].toLowerCase());
+  }
+  return [...names];
+}
+function tablesReferenced(sources) {
+  const out = /* @__PURE__ */ new Map();
+  for (const group of sources) {
+    for (const [file, raw] of group) {
+      for (const m of stripComments(raw).matchAll(
+        /\b(?:FROM|INSERT\s+INTO|UPDATE|DELETE\s+FROM|JOIN)\s+[`"\[]?([a-z_][a-zA-Z0-9_]*)/g
+      )) {
+        const name = m[1].toLowerCase();
+        if (name === "sqlite_master" || name.startsWith("sqlite_")) continue;
+        out.set(name, [...out.get(name) ?? [], file]);
+      }
+    }
+  }
+  return out;
+}
+var pass, fail, warn, PACKAGE_ACTIONS, CHECKS;
+var init_checks = __esm({
+  "src/cli/checks.ts"() {
+    "use strict";
+    init_config();
+    init_mcp();
+    pass = { status: "pass" };
+    fail = (detail) => ({ status: "fail", detail });
+    warn = (detail) => ({ status: "warn", detail });
+    PACKAGE_ACTIONS = ["submitForm"];
+    CHECKS = [
+      {
+        id: "actions-exist",
+        title: "Every action a page calls is one the server exports",
+        silentAs: "the button posts to an action that is not there - no build error, and nothing said at runtime until somebody submits",
+        run(ctx) {
+          const called = actionsCalled(new Map([...ctx.pages, ...ctx.components, ...ctx.includes]));
+          if (called.size === 0) return pass;
+          const available = /* @__PURE__ */ new Set([...PACKAGE_ACTIONS, ...actionsExported(ctx.actions)]);
+          const missing = [...called].filter(([name]) => !available.has(name));
+          if (missing.length === 0) return pass;
+          return fail(
+            missing.map(([name, files]) => `actions.${name} (${files[0]}) is not exported by src/actions/`).join("; ")
+          );
+        }
+      },
+      {
+        id: "migrations-cover-tables",
+        title: "Every table the code reads has a migration that creates it",
+        silentAs: "production keeps working against tables that already exist there while local dev has none - and the repo can no longer rebuild its own database",
+        run(ctx) {
+          if (!ctx.site.features?.d1) return pass;
+          if (ctx.migrations.size === 0) return pass;
+          const created = new Set(tablesCreated(ctx.migrations));
+          const referenced = tablesReferenced([ctx.includes, ctx.pages, ctx.components, ctx.actions]);
+          const missing = [...referenced].filter(([t]) => !created.has(t));
+          if (missing.length === 0) return pass;
+          return fail(
+            missing.map(([t, files]) => `${t} (used in ${files[0]}) has no CREATE in migrations/`).join("; ")
+          );
+        }
+      },
+      {
+        id: "d1-binding",
+        title: "features.d1 has a database bound to write to",
+        silentAs: "the form validates, thanks the visitor and stores nothing, because the binding it writes through does not exist",
+        run(ctx) {
+          if (!ctx.site.features?.d1) return pass;
+          const bindings = ctx.wrangler?.d1_databases ?? [];
+          if (bindings.some((b) => b.binding === "DB" && b.database_id)) return pass;
+          return fail(
+            bindings.length === 0 ? "features.d1 is true and wrangler has no d1_databases block" : "features.d1 is true but no d1_databases entry binds DB with a database_id"
+          );
+        }
+      },
+      {
+        id: "run-worker-first",
+        title: "Every on-demand route is in run_worker_first, in both slash forms",
+        silentAs: "200 to curl, a 404 page in Chrome - the router branches on Sec-Fetch-Dest",
+        run(ctx) {
+          const listed = ctx.wrangler?.assets?.run_worker_first ?? [];
+          const missing = [];
+          const appPath = appEnabled(ctx.site) ? resolveAppPath(ctx.site) : APP_DIR;
+          const publicRoute = (route) => route === `/${APP_DIR}` || route.startsWith(`/${APP_DIR}/`) ? `/${appPath}${route.slice(APP_DIR.length + 1)}` : route;
+          for (const route of onDemandRoutes(ctx.pages).map(publicRoute)) {
+            const covered = (p) => listed.some(
+              (entry2) => entry2 === p || entry2.endsWith("/*") && p.startsWith(entry2.slice(0, -1))
+            );
+            for (const form of [route, `${route}/`]) if (!covered(form)) missing.push(form);
+          }
+          return missing.length ? fail(`not listed: ${[...new Set(missing)].join(", ")}`) : pass;
+        }
+      },
+      {
+        id: "app-namespace",
+        title: "The web app namespace is wired for the path it is served at",
+        silentAs: "the app 404s in a browser and works in curl, a marketing page shadows the portal, or a portal page prerenders and never sees a binding",
+        run(ctx) {
+          const appPages = [...ctx.pages.keys()].filter((f) => f.includes(`src/pages/${APP_DIR}/`));
+          if (!appEnabled(ctx.site)) {
+            return appPages.length ? warn(
+              `src/pages/${APP_DIR}/ has ${appPages.length} route(s) but app.enabled is false in webmonterey.json, so nothing derives the noindex, sitemap exclusion or run_worker_first entries for them. Switch it on, or move the routes.`
+            ) : pass;
+          }
+          const path = resolveAppPath(ctx.site);
+          const problems = [];
+          const listed = new Set(ctx.wrangler?.assets?.run_worker_first ?? []);
+          const needed = workerFirstPaths(ctx.site).filter((p) => p !== "/_actions/*");
+          const absent = needed.filter((p) => !listed.has(p));
+          if (absent.length) problems.push(`run_worker_first is missing ${absent.join(", ")}`);
+          if (ctx.contentPages.includes(path)) {
+            problems.push(`src/content/pages/${path}.json collides with app.path "${path}"`);
+          }
+          const prerendered = appPages.filter(
+            (f) => !/export\s+const\s+prerender\s*=\s*false/.test(ctx.pages.get(f) ?? "")
+          );
+          if (prerendered.length) {
+            problems.push(`not \`prerender = false\`: ${prerendered.join(", ")}`);
+          }
+          return problems.length ? fail(problems.join("; ")) : pass;
+        }
+      },
+      {
+        id: "changeme",
+        title: "No CHANGEME left in webmonterey.json",
+        silentAs: "a placeholder in a credit link, an email subject, or structured data",
+        run(ctx) {
+          const stale = Object.entries(ctx.site).filter(([, v]) => v === PLACEHOLDER).map(([k]) => k);
+          return stale.length ? fail(`still placeholder: ${stale.join(", ")}`) : pass;
+        }
+      },
+      {
+        id: "timezone",
+        title: "timeZone is a real IANA zone",
+        silentAs: "Intl.DateTimeFormat throws at runtime, in a Worker, not on your laptop",
+        run(ctx) {
+          const zone = ctx.site.timeZone;
+          if (!zone) return warn("unset - defaults to America/Los_Angeles");
+          return isValidTimeZone(zone) ? pass : fail(
+            `"${zone}" is not a zone Intl knows. There is no Pacific/LA; the Pacific/* zones are ocean locations.`
+          );
+        }
+      },
+      {
+        id: "skills-synced",
+        title: "Fleet skills are materialized and match the installed version",
+        silentAs: "no /webm: skills in the session, and no error saying why",
+        run(ctx) {
+          if (!ctx.sync) {
+            return fail(
+              ".claude/skills/webm/ is missing. `npm install --ignore-scripts` skips the postinstall sync silently - run `npx webm sync`."
+            );
+          }
+          return ctx.sync.version === ctx.version ? pass : warn(`synced v${ctx.sync.version}, installed v${ctx.version} - run \`npx webm sync\``);
+        }
+      },
+      {
+        /*
+         * THE DOCS SERVERS, AND WHY A CHECK RATHER THAN TRUST.
+         *
+         * Astro ships majors faster than any training corpus turns over and the web platform moves
+         * continuously, so a session working from recall writes code against an API that changed. The
+         * servers are the fix; this check is what notices when a site has quietly lost them - a
+         * merge that dropped .mcp.json, a settings file rewritten by hand, a site scaffolded before
+         * the server existed. None of those announce themselves. The site keeps building, and the
+         * only symptom is worse code, months later, with nothing to point at.
+         *
+         * DECLARED IS NOT ENOUGH. A server missing from `enabledMcpjsonServers` prompts for approval
+         * on every machine, so the rule that depends on it holds only for whoever happened to hit
+         * Approve. That is reported separately because the fix is different.
+         */
+        id: "mcp-docs",
+        title: "The four documentation servers are wired and pre-approved",
+        silentAs: "code written from training-data recall instead of current docs",
+        run(ctx) {
+          if (!ctx.mcp.declared) return fail("no .mcp.json - run `npx webm upgrade` to restore it");
+          const { undeclared, unapproved, wrongUrl } = mcpGaps(ctx.mcp.declared, ctx.mcp.enabled);
+          const problems = [
+            undeclared.length && `missing from .mcp.json: ${undeclared.join(", ")}`,
+            unapproved.length && `declared but not in enabledMcpjsonServers, so inert until someone approves them by hand: ${unapproved.join(", ")}`,
+            wrongUrl.length && wrongUrl.map(
+              (n) => `${n} points at ${ctx.mcp.declared?.[n]?.url}, expected ${MCP_SERVERS[n].url}`
+            ).join("; ")
+          ].filter(Boolean);
+          return problems.length ? fail(`${problems.join(". ")}. \`npx webm upgrade\` adds what is missing, in place.`) : pass;
+        }
+      },
+      {
+        id: "staging-email",
+        title: "A staging site has somewhere to send its mail",
+        silentAs: "every form submission on the preview throws instead of arriving anywhere",
+        run(ctx) {
+          if (ctx.site.environment !== "staging") return pass;
+          return isConfigured(ctx.site.stagingEmail) ? pass : fail(
+            'environment is "staging" but stagingEmail is empty. Every message this site tries to send will throw. Set "stagingEmail" in webmonterey.json to the inbox that should receive test mail.'
+          );
+        }
+      },
+      {
+        id: "select-element",
+        title: "No querySelector<HTMLSelectElement>",
+        silentAs: "ts(2344), which reads like a typo rather than a type conflict",
+        run(ctx) {
+          const hits = [];
+          for (const [file, src] of [...ctx.pages, ...ctx.components]) {
+            if (/querySelector<\s*HTMLSelectElement/.test(stripComments(src))) hits.push(file);
+          }
+          return hits.length ? fail(
+            `${hits.join(", ")} - HTMLRewriter's Element interface merges with lib.dom's, and only HTMLSelectElement shadows remove(). Cast instead: \`as HTMLSelectElement | null\`.`
+          ) : pass;
+        }
+      },
+      {
+        id: "image-on-demand",
+        title: "No <Image> or getImage on an on-demand route",
+        silentAs: "a dead /_image URL, in production only - astro dev serves it happily",
+        run(ctx) {
+          const routes = new Set(onDemandRoutes(ctx.pages));
+          const hits = [];
+          for (const [file, src] of ctx.pages) {
+            if (!/export\s+const\s+prerender\s*=\s*false/.test(src)) continue;
+            const code = stripComments(src);
+            if (/<Image\b|getImage\s*\(/.test(code) && !/Astro\.isPrerendered/.test(code))
+              hits.push(file);
+          }
+          return hits.length ? fail(
+            `${hits.join(", ")} - imageService: 'compile' ships no runtime endpoint. Branch on Astro.isPrerendered and fall back to a plain <img>. (${routes.size} on-demand routes)`
+          ) : pass;
+        }
+      },
+      {
+        id: "compatibility-date",
+        title: "compatibility_date is not stale",
+        silentAs: 'EVERY page renders as the literal text "[object Object]" - build succeeds, no error',
+        run(ctx) {
+          const date = ctx.wrangler?.compatibility_date;
+          if (!date) return ctx.wrangler ? warn("wrangler.jsonc sets no compatibility_date") : pass;
+          const age = (Date.parse(ctx.today) - Date.parse(date)) / 864e5;
+          if (Number.isNaN(age)) return warn(`compatibility_date is not a date: ${date}`);
+          if (age < 0) {
+            return fail(
+              `compatibility_date is ${date}, which is in the FUTURE. The runtime bundled with your wrangler refuses a date it does not know, so the site will not build - miniflare reports ERR_FUTURE_COMPATIBILITY_DATE. Set it to a date at least a fortnight behind today, which is what \`webm new\` now scaffolds.`
+            );
+          }
+          if (age > 180) {
+            return fail(
+              `compatibility_date is ${date}, ${Math.round(age)} days old. Run \`npm run preview\` and open a page: if it says "[object Object]", this is why. Bump it to today, redeploy, and check the site still behaves - the date pins runtime behavior.`
+            );
+          }
+          if (age > 90) {
+            return warn(
+              `compatibility_date is ${date}, ${Math.round(age)} days old. Not broken yet. Bump it on the next deploy, and verify on a preview URL rather than in production.`
+            );
+          }
+          return pass;
+        }
+      },
+      {
+        id: "cron-without-handler",
+        title: "A Cron Trigger has a scheduled() handler to run",
+        silentAs: "the cron fires on schedule and does nothing at all, forever",
+        run(ctx) {
+          const crons = ctx.wrangler?.triggers?.crons ?? [];
+          if (crons.length === 0) return pass;
+          const main = ctx.wrangler?.main;
+          if (!main) {
+            return fail(
+              `wrangler.jsonc declares ${crons.length} Cron Trigger(s) (${crons.join(", ")}) but sets no "main". The adapter's generated Worker exports only fetch, so Cloudflare invokes a scheduled handler that does not exist and nothing reports it. Point "main" at a source entrypoint that re-exports @astrojs/cloudflare/handler and adds scheduled().`
+            );
+          }
+          if (/dist\//.test(main)) {
+            return fail(
+              `"main" is ${main}, which points into the build output. It must name a SOURCE entrypoint - the adapter builds it. The Pages-era ./dist/_worker.js/index.js is the value not to use.`
+            );
+          }
+          if (ctx.workerEntry === null) {
+            return warn(`"main" is ${main} but that file was not found from the site root.`);
+          }
+          const source = stripComments(ctx.workerEntry);
+          if (!/\bscheduled\b\s*[(:]/.test(source)) {
+            return fail(
+              `${main} does not export a scheduled() handler, so the ${crons.length} declared cron(s) have nothing to run.`
+            );
+          }
+          if (!/@astrojs\/cloudflare\/handler/.test(source) && !/\bdefineWorker\b/.test(source)) {
+            return fail(
+              `${main} neither calls defineWorker nor imports handle from @astrojs/cloudflare/handler. Replacing the generated entrypoint without one of them means every page, action and API route on the site stops being served - the cron would work and nothing else would.`
+            );
+          }
+          return pass;
+        }
+      },
+      {
+        id: "block-types-registered",
+        title: "Every block type used in content is in the registry",
+        silentAs: "the block renders as NOTHING - no error, no warning, no gap in the page",
+        run(ctx) {
+          if (ctx.registry === null) return pass;
+          const registered = new Set(
+            [...ctx.registry.matchAll(/['"]([A-Za-z][\w.-]*)['"]\s*:/g)].map((m) => m[1])
+          );
+          if (registered.size === 0 && ctx.content.size === 0) return pass;
+          const missing = /* @__PURE__ */ new Map();
+          for (const [file, raw] of ctx.content) {
+            let parsed;
+            try {
+              parsed = JSON.parse(raw);
+            } catch {
+              continue;
+            }
+            for (const block of parsed.blocks ?? []) {
+              const type = block?.type;
+              if (typeof type !== "string" || registered.has(type)) continue;
+              missing.set(type, [...missing.get(type) ?? [], file]);
+            }
+          }
+          if (missing.size === 0) return pass;
+          const lines = [...missing].map(([type, files]) => `${type} (${files.join(", ")})`);
+          return fail(
+            `not in src/components/registry.ts: ${lines.join("; ")}. Those blocks render as nothing. Either register the component or remove the block.`
+          );
+        }
+      },
+      {
+        id: "agency-credit",
+        title: "Something renders the agency credit",
+        silentAs: 'the site ships with no "Powered by WebMonterey" and nobody notices for months',
+        run(ctx) {
+          if (ctx.components.size === 0) return pass;
+          if (ctx.site.domain === "webmonterey.com") return pass;
+          for (const src of ctx.components.values()) {
+            if (/webmonterey\/credits/.test(stripComments(src))) return pass;
+          }
+          return warn(
+            "no component imports @cparkerwebm/webmonterey/webmonterey/credits/Credit.astro. The footer component is where it goes."
+          );
+        }
+      },
+      {
+        id: "placeholder-branding",
+        title: "No placeholder mark is being served as the client's",
+        silentAs: "the client's site shows WebMonterey's favicon, and nobody looks at a favicon",
+        run(ctx) {
+          if (ctx.placeholders.length === 0) return pass;
+          const detail = `still the package's placeholder, byte for byte: ${ctx.placeholders.join(", ")}. Replace with the client's own artwork before launch.`;
+          return isConfigured(ctx.site.launched) ? fail(detail) : warn(detail);
+        }
+      },
+      {
+        id: "environment",
+        title: "The declared environment matches where the site actually is",
+        silentAs: "a launched site whose client email is still being diverted to the agency's inbox",
+        run(ctx) {
+          const declared = ctx.site.environment;
+          if (declared !== void 0 && declared !== "production" && declared !== "staging") {
+            return fail(
+              `environment is "${String(declared)}"; it must be "production" or "staging". An unrecognised value is treated as production, so this site is mailing real people.`
+            );
+          }
+          if (declared === "staging" && isConfigured(ctx.site.launched)) {
+            return fail(
+              `this site launched on ${ctx.site.launched} but is still declared staging, so every email it sends is being redirected away from its real recipients. Set "environment": "production" in webmonterey.json.`
+            );
+          }
+          if (declared !== "staging" && !isConfigured(ctx.site.launched)) {
+            return warn(
+              `this site has no launch date but is treated as production, so testing a form will email the client's real contacts. Set "environment": "staging" in webmonterey.json until /webm:launch.`
+            );
+          }
+          return pass;
+        }
+      },
+      {
+        id: "seeded-files",
+        title: "The files Astro copies verbatim are present",
+        silentAs: "a missing favicon or an absent _headers - no build error either way",
+        run(ctx) {
+          const gone = Object.entries(ctx.present).filter(([, there]) => !there).map(([file]) => file);
+          return gone.length ? warn(`missing: ${gone.join(", ")}. \`webm sync\` restores package-owned ones.`) : pass;
+        }
+      },
+      {
+        id: "literal-values",
+        title: "Component CSS contains no literal colors or sizes",
+        silentAs: "drift away from the token system, one component at a time",
+        run(ctx) {
+          const hits = [];
+          for (const [file, src] of ctx.components) {
+            const styles = [...src.matchAll(/<style[^>]*>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join("\n");
+            if (!styles) continue;
+            const withoutVars = stripComments(styles).replace(/--webm-[\w-]+\s*:[^;]+;/g, "");
+            if (/#[0-9a-fA-F]{3,8}\b|\brgb a?\(|\bhsl a?\(/.test(withoutVars)) hits.push(file);
+          }
+          return hits.length ? warn(`literal colors in: ${hits.join(", ")}`) : pass;
+        }
+      }
+    ];
+  }
+});
+
+// src/integration/config.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync5 } from "node:fs";
+import { join as join6 } from "node:path";
+function readJson(path, what, required) {
+  if (!existsSync7(path)) {
+    if (required) {
+      throw new ConfigError(`${what} not found at ${path}. Every site needs one.`);
+    }
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync6(path, "utf8"));
+  } catch (error) {
+    throw new ConfigError(
+      `${what} at ${path} is not valid JSON: ${error instanceof Error ? error.message : error}`
+    );
+  }
+}
+function loadSiteFiles(root) {
+  const sitePath = join6(root, "webmonterey.json");
+  const designPath = join6(root, "design.json");
+  const site = readJson(sitePath, "webmonterey.json", true);
+  const design = readJson(designPath, "design.json", false);
+  return {
+    site,
+    design: design ?? {},
+    paths: { site: sitePath, design: design ? designPath : null }
+  };
+}
+var ConfigError;
+var init_config2 = __esm({
+  "src/integration/config.ts"() {
+    "use strict";
+    ConfigError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ConfigError";
+      }
+    };
+  }
+});
+
+// src/cli/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  buildContext: () => buildContext,
+  run: () => run5
+});
+import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync6 } from "node:fs";
+import { join as join7, relative as relative3 } from "node:path";
+function parseJsonc(source) {
+  const stripped = source.replace(/\\"|"(?:\\"|[^"])*"|(\/\/.*|\/\*[\s\S]*?\*\/)/g, (m, comment) => comment ? "" : m).replace(/,(\s*[}\]])/g, "$1");
+  return JSON.parse(stripped);
+}
+function readTree(root, dir, exts) {
+  const out = /* @__PURE__ */ new Map();
+  const walk3 = (d) => {
+    if (!existsSync8(d)) return;
+    for (const entry2 of readdirSync6(d, { withFileTypes: true })) {
+      const full = join7(d, entry2.name);
+      if (entry2.isDirectory()) walk3(full);
+      else if (exts.some((e) => entry2.name.endsWith(e))) {
+        out.set(relative3(root, full), readFileSync7(full, "utf8"));
+      }
+    }
+  };
+  walk3(join7(root, dir));
+  return out;
+}
+function placeholderFiles(siteRoot) {
+  const seeded = join7(PACKAGE_ROOT, "template", "public");
+  if (!existsSync8(seeded)) return [];
+  return readdirSync6(seeded).filter((file) => {
+    const theirs = join7(siteRoot, "public", file);
+    if (!existsSync8(theirs)) return false;
+    try {
+      return readFileSync7(theirs, "base64") === readFileSync7(join7(seeded, file), "base64");
+    } catch {
+      return false;
+    }
+  }).map((file) => `public/${file}`);
+}
+function readWorkerEntry(siteRoot, wranglerPath) {
+  if (!wranglerPath) return null;
+  const config = parseJsonc(readFileSync7(wranglerPath, "utf8"));
+  if (!config.main) return null;
+  const entry2 = join7(siteRoot, config.main);
+  return existsSync8(entry2) ? readFileSync7(entry2, "utf8") : null;
+}
+function contentPageNames(root) {
+  const dir = join7(root, "src/content/pages");
+  if (!existsSync8(dir)) return [];
+  return readdirSync6(dir).filter((f) => f.endsWith(".json")).map((f) => f.replace(/\.json$/, ""));
+}
+function readMcp(siteRoot) {
+  const read = (rel, pick) => {
+    const path = join7(siteRoot, rel);
+    if (!existsSync8(path)) return null;
+    try {
+      return pick(JSON.parse(readFileSync7(path, "utf8")));
+    } catch {
+      return null;
+    }
+  };
+  return {
+    declared: read(".mcp.json", (p) => p.mcpServers ?? null),
+    enabled: read(".claude/settings.json", (p) => p.enabledMcpjsonServers ?? null)
+  };
+}
+function buildContext(siteRoot) {
+  const { site } = loadSiteFiles(siteRoot);
+  const wranglerPath = ["wrangler.jsonc", "wrangler.json"].map((f) => join7(siteRoot, f)).find(existsSync8);
+  const syncPath = join7(siteRoot, ".claude/skills/webm/.webm-sync.json");
+  return {
+    site,
+    wrangler: wranglerPath ? parseJsonc(readFileSync7(wranglerPath, "utf8")) : null,
+    pages: readTree(siteRoot, "src/pages", [".astro", ".ts"]),
+    components: readTree(siteRoot, "src/components", [".astro", ".ts"]),
+    today: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+    workerEntry: readWorkerEntry(siteRoot, wranglerPath),
+    placeholders: placeholderFiles(siteRoot),
+    contentPages: contentPageNames(siteRoot),
+    content: readTree(siteRoot, "src/content/pages", [".json"]),
+    /*
+     * Everything else in the repo that can hold a call the compiler will not resolve for you:
+     * actions, the site's own includes and email templates, and the SQL that has to have a
+     * migration behind it. Read here rather than in each check so a check stays a pure function
+     * of its context and the tests can hand it a literal.
+     */
+    actions: readTree(siteRoot, "src/actions", [".ts"]),
+    includes: readTree(siteRoot, "src/includes", [".ts", ".astro"]),
+    emails: readTree(siteRoot, "src/emails", [".ts"]),
+    migrations: readTree(siteRoot, "migrations", [".sql"]),
+    registry: existsSync8(join7(siteRoot, "src/components/registry.ts")) ? readFileSync7(join7(siteRoot, "src/components/registry.ts"), "utf8") : null,
+    present: Object.fromEntries(
+      [
+        "public/_headers",
+        "public/favicon.ico",
+        "public/site.webmanifest",
+        "scripts/check-node.mjs"
+      ].map((f) => [f, existsSync8(join7(siteRoot, f))])
+    ),
+    sync: existsSync8(syncPath) ? JSON.parse(readFileSync7(syncPath, "utf8")) : null,
+    mcp: readMcp(siteRoot),
+    version: packageVersion()
+  };
+}
+function run5(argv2) {
+  const siteRoot = argv2[0] ?? process.cwd();
+  if (!existsSync8(join7(siteRoot, "webmonterey.json"))) {
+    console.error(`webm doctor: no webmonterey.json in ${siteRoot}. Not a WebMonterey site.`);
+    return 1;
+  }
+  const ctx = buildContext(siteRoot);
+  let failed = 0;
+  let warned = 0;
+  for (const check of CHECKS) {
+    const result = check.run(ctx);
+    const mark = result.status === "pass" ? "  ok " : result.status === "warn" ? "warn " : "FAIL ";
+    console.log(`${mark} ${check.title}`);
+    if (result.detail) {
+      console.log(`       ${result.detail}`);
+      if (result.status === "fail") console.log(`       fails as: ${check.silentAs}`);
+    }
+    if (result.status === "fail") failed++;
+    if (result.status === "warn") warned++;
+  }
+  console.log(
+    `
+${CHECKS.length - failed - warned} passed, ${warned} warning${warned === 1 ? "" : "s"}, ${failed} failed`
+  );
+  return failed > 0 ? 1 : 0;
+}
+var init_doctor = __esm({
+  "src/cli/doctor.ts"() {
+    "use strict";
+    init_checks();
+    init_config2();
+    init_package_root();
+  }
+});
+
+// src/cli/codemods.ts
+function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) if ((pa[i] ?? 0) !== (pb[i] ?? 0)) return (pa[i] ?? 0) - (pb[i] ?? 0);
+  return 0;
+}
+function codemodsBetween(from, to, list = CODEMODS) {
+  return list.filter((c) => compareVersions(c.version, from) > 0 && compareVersions(c.version, to) <= 0).sort((a, b) => compareVersions(a.version, b.version));
+}
+var CODEMODS;
+var init_codemods = __esm({
+  "src/cli/codemods.ts"() {
+    "use strict";
+    CODEMODS = [];
+  }
+});
+
+// src/cli/upgrade.ts
+var upgrade_exports = {};
+__export(upgrade_exports, {
+  run: () => run6
+});
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { join as join8 } from "node:path";
+function git(siteRoot, args) {
+  return execFileSync2("git", args, { cwd: siteRoot, encoding: "utf8" }).trim();
+}
+function installedVersion(siteRoot) {
+  const path = join8(siteRoot, "node_modules", PACKAGE, "package.json");
+  if (!existsSync9(path)) return null;
+  return JSON.parse(readFileSync8(path, "utf8")).version;
+}
+function run6(argv2) {
+  const siteRoot = process.cwd();
+  const target = argv2.find((a) => !a.startsWith("-")) ?? "latest";
+  const dryRun = argv2.includes("--dry-run");
+  if (!existsSync9(join8(siteRoot, "webmonterey.json"))) {
+    console.error(`webm upgrade: no webmonterey.json here. Not a WebMonterey site.`);
+    return 1;
+  }
+  if (git(siteRoot, ["status", "--porcelain"])) {
+    console.error("webm upgrade: working tree is not clean. Commit or stash first.");
+    return 1;
+  }
+  const from = installedVersion(siteRoot);
+  console.log(`Installed: ${from ?? "nothing"} -> ${target}`);
+  if (dryRun) {
+    console.log("--dry-run: stopping before any change.");
+    return 0;
+  }
+  const branch = `upgrade/${PACKAGE.split("/")[1]}-${target}`;
+  if (git(siteRoot, ["rev-parse", "--abbrev-ref", "HEAD"]) === "main") {
+    git(siteRoot, ["checkout", "-b", branch]);
+    console.log(`Branched to ${branch}. Never upgrade on main.`);
+  }
+  execFileSync2("npm", ["install", `${PACKAGE}@${target}`], { cwd: siteRoot, stdio: "inherit" });
+  const to = installedVersion(siteRoot);
+  if (!to) {
+    console.error("webm upgrade: install did not produce a version. Check the npm output above.");
+    return 1;
+  }
+  const mods = codemodsBetween(from ?? "0.0.0", to);
+  if (mods.length) {
+    console.log(`
+Running ${mods.length} codemod${mods.length === 1 ? "" : "s"}:`);
+    for (const mod of mods) {
+      const changes = mod.run(siteRoot);
+      console.log(`  ${mod.version} ${mod.title}`);
+      for (const c of changes) console.log(`      ${c}`);
+      if (!changes.length) console.log(`      nothing to change`);
+    }
+  }
+  const synced = sync(siteRoot);
+  console.log(`
+Skills re-materialized (v${synced.version})`);
+  for (const s of synced.added) console.log(`  + /webm:${s}`);
+  for (const s of synced.removed) console.log(`  - /webm:${s}`);
+  console.log(`
+Now, in order:`);
+  console.log(`  npx webm doctor`);
+  console.log(`  npm run check && npm run build`);
+  console.log(`  git push -u origin HEAD   # review the preview URL before merging`);
+  if (synced.added.length || synced.removed.length) {
+    console.log(`
+Skill changes are live already. Run /reload-plugins if anything outside`);
+    console.log(`skills/ changed - agents, hooks and .mcp.json are not picked up live.`);
+  }
+  return 0;
+}
+var PACKAGE;
+var init_upgrade = __esm({
+  "src/cli/upgrade.ts"() {
+    "use strict";
+    init_codemods();
+    init_sync();
+    init_package_root();
+    PACKAGE = packageName();
+  }
+});
+
+// bin/webm.mjs
+init_package_root();
+import { readFileSync as readFileSync9 } from "node:fs";
+import { join as join9 } from "node:path";
+var pkg = JSON.parse(readFileSync9(join9(PACKAGE_ROOT, "package.json"), "utf8"));
+var COMMANDS = {
+  new: {
+    blurb: "Scaffold a new client site from a domain",
+    load: () => Promise.resolve().then(() => (init_new(), new_exports))
+  },
+  "design:extract": {
+    blurb: "Turn a hand-edited tokens.css into design.json",
+    load: () => Promise.resolve().then(() => (init_design_extract(), design_extract_exports))
+  },
+  compare: {
+    blurb: "Diff two built sites - text, head tags, JSON-LD and CSS. For rebuilds.",
+    load: () => Promise.resolve().then(() => (init_compare(), compare_exports))
+  },
+  sync: {
+    blurb: "Materialize the fleet skills into .claude/skills/webm/",
+    load: () => Promise.resolve().then(() => (init_sync(), sync_exports))
+  },
+  doctor: {
+    blurb: "Check this site against the traps that fail silently",
+    load: () => Promise.resolve().then(() => (init_doctor(), doctor_exports))
+  },
+  upgrade: {
+    blurb: "Move this site to a newer framework version",
+    load: () => Promise.resolve().then(() => (init_upgrade(), upgrade_exports))
+  }
+};
+function usage() {
+  const width = Math.max(...Object.keys(COMMANDS).map((k) => k.length));
+  console.log(`webm ${pkg.version} - ${pkg.description}
+`);
+  console.log("Usage: webm <command> [options]\n");
+  console.log("Commands:");
+  for (const [name, c] of Object.entries(COMMANDS)) {
+    console.log(`  ${name.padEnd(width)}  ${c.blurb}`);
+  }
+}
+var [command, ...argv] = process.argv.slice(2);
+if (!command || command === "--help" || command === "-h" || command === "help") {
+  usage();
+  process.exit(0);
+}
+if (command === "--version" || command === "-v") {
+  console.log(pkg.version);
+  process.exit(0);
+}
+var entry = COMMANDS[command];
+if (!entry) {
+  console.error(`webm: unknown command "${command}"
+`);
+  usage();
+  process.exit(1);
+}
+try {
+  const mod = await entry.load();
+  process.exit(await mod.run(argv) ?? 0);
+} catch (error) {
+  console.error(`webm ${command}: ${error instanceof Error ? error.message : error}`);
+  if (process.env.WEBM_DEBUG) console.error(error);
+  process.exit(1);
+}