@cparkerwebm/webmonterey 1.0.0

package/template/site/.prettierrc.json

@@ -0,0 +1,17 @@
+{
+  "printWidth": 100,
+  "singleQuote": true,
+  "semi": true,
+  "trailingComma": "all",
+  "plugins": ["prettier-plugin-astro"],
+  "overrides": [
+    {
+      "files": "*.astro",
+      "options": { "parser": "astro" }
+    },
+    {
+      "files": "*.jsonc",
+      "options": { "parser": "jsonc", "trailingComma": "none" }
+    }
+  ]
+}

package/template/site/CLAUDE.md

@@ -0,0 +1,245 @@
+# CLAUDE.md
+
+This is a **WebMonterey client site**. It is a thin repo: the framework lives in the
+`@cparkerwebm/webmonterey` package, and what is here is what makes this client's site
+different from every other one.
+
+The relationship is a WordPress parent theme and child theme.
+
+|               | Parent (the package)                                     | Child (this repo)                  |
+| ------------- | -------------------------------------------------------- | ---------------------------------- |
+| Owns          | layouts, styles, form pipeline, emails, routes, includes | components, content, palette, copy |
+| Changes by    | `npm update @cparkerwebm/webmonterey`                    | editing files here                 |
+| Overridden by | this repo, always                                        | —                                  |
+
+**A fix to the package reaches this site on `npm update`.** That is the entire point of the
+package existing, and it is why the default answer to "the shared behavior is wrong" is to fix
+it upstream rather than to work around it here.
+
+## The one rule that protects that
+
+**Prefer overriding to editing around.** When something in the package is not right for this
+client, express it as an override in this repo — a token in `design.json`, a rule in
+`src/styles/custom/`, a wrapper in `src/actions/index.ts`. Do not reach into `node_modules` and
+do not copy a package file here so you can change two lines: a copy stops receiving fixes the
+moment it is made, silently, and nothing will ever tell you.
+
+Copying a package file here is legitimate exactly once: when this client genuinely needs
+different behavior, not a different value. Say so in a comment at the top of the copy, naming
+what it forked from and why, so the next person knows it is deliberate.
+
+## Commands
+
+| Command           | Runs                                                       |
+| ----------------- | ---------------------------------------------------------- |
+| `npm run dev`     | dev server — fast, and blind to half the things that break |
+| `npm run preview` | **a real build on real workerd**                           |
+| `npm run check`   | types and content schema                                   |
+| `npx webm doctor` | the things that fail silently                              |
+| `npm run format`  | prettier                                                   |
+
+**Run `npm run preview`, not `dev`, before merging anything** that touches styles,
+`wrangler.jsonc`, a route's `prerender` flag, or the form pipeline. `dev` cannot see CSS
+bundling, cascade order, or the asset router. Every trap in `/webm:traps` was invisible in
+`dev` and visible in `preview`.
+
+## Hard rules
+
+### 1. Vanilla CSS and vanilla JS only
+
+**Banned outright:** Tailwind, Bootstrap, Sass/Less/Stylus, CSS-in-JS, PostCSS plugin chains,
+React, Vue, Svelte, Solid, Preact, Alpine, htmx, jQuery, Lodash, and any UI or utility
+framework.
+
+**Allowed:** plain `.css` using `@layer` and custom properties, plain `.js`/`.ts` modules,
+`.astro` components, and `zod` (build-time validation only, never shipped).
+
+TypeScript is allowed and expected — the rule targets frameworks and preprocessors, not types.
+
+Do not add a dependency to solve something CSS or the web platform already does.
+
+### 2. Style through tokens, and set tokens in `design.json`
+
+Every color, space, size, radius, shadow, z-index, duration and easing is a `--webm-*` custom
+property. Component CSS contains **no literal values** for these.
+
+The palette lives in [design.json](design.json), which compiles to the token layer at build
+time. Retheming this client is editing that file — one value cascades everywhere.
+
+For a rule rather than a value, [src/styles/custom/](src/styles/custom/) is the seam:
+`webm.components.custom` beats `webm.components.core` at identical specificity, so an override
+lands without `!important` and stays legible as an override.
+
+**Do not edit the package's stylesheets.** That is the change from generation 2, where a client
+repo was a copy of the starter and editing it in place was correct. Here it is a copy-forward
+that stops receiving fixes.
+
+### 3. Never restyle for accessibility unless asked
+
+A client's colors, contrast, focus rings, type sizes and spacing are **configured**, not
+accidental. Do not "fix" any of them because an audit or a WCAG level says they fall short —
+including darkening a color, enlarging text, or swapping a token as a side effect of unrelated
+work.
+
+**Report it, do not change it.** State the measured number and the element, then wait:
+
+> The secondary consent buttons are 1.19:1 against the card. Want me to change that?
+
+Two things this is not. It does not license shipping markup that is broken rather than merely
+low-contrast — semantics, labels, roles, keyboard operability and focus ORDER are correctness,
+and they get fixed like any other bug. And it does not apply once you have been asked: a
+request to fix a contrast problem is the permission, for that problem.
+
+A client signs off on a palette. A change made on our own initiative between one deploy and the
+next is a change they never approved and will not think to look for.
+
+### 4. Page content is JSON, never hardcoded
+
+Copy, headings, links and block ordering live in `src/content/pages/*.json` — one file per
+page. Never hardcode client copy into an `.astro` file. If content cannot be expressed in the
+block schema, the component's `schema.ts` is what changes, not the markup.
+
+Private data — user logins, form submissions — goes to **Cloudflare D1**, never to JSON.
+
+### 5. The prefix is `webm-`, never `wm-`
+
+Custom properties (`--webm-action`), class names (`.webm-section`), Cloudflare resource names
+(`webm-<slug>`), the CLI, the skills namespace. No exceptions.
+
+### 6. Cloudflare bindings come from `cloudflare:workers`
+
+```ts
+import { env } from 'cloudflare:workers';
+const { results } = await env.DB.prepare('SELECT 1').run();
+```
+
+Request metadata is `Astro.request.cf`. The execution context is `Astro.locals.cfContext`.
+
+### 7. Content edits happen on a branch
+
+Never edit page JSON directly on `main`. Branch, edit, push — Workers Builds gives the branch
+its own preview URL for client review, and a schema-breaking edit fails there instead of on the
+live site. Merge when approved.
+
+### 8. Every third party is consent-gated
+
+Anything loaded from outside the site — pixel, analytics, embed, widget — must be gated on the
+visitor's cookie choice. Categories: `essential` (never gated), `functional`, `analytics`,
+`marketing`. Unsure between the last two? Choose `marketing`; it is what US privacy law treats
+as "sale or sharing".
+
+```ts
+import { whenConsented } from '@cparkerwebm/webmonterey/webmonterey/compliance';
+
+whenConsented('marketing', () => {
+  /* create the script element here, not before */
+});
+```
+
+Loading a script and "not using it" is not gating — the request itself sets the cookie.
+
+**Write the gated version even when `features.compliance` is `false`.** With compliance off,
+`whenConsented` fires immediately for every category, so the same code works on both kinds of
+site and turning consent on later needs no changes.
+
+**Never read `document.cookie` to check consent.** That misses the Global Privacy Control path,
+and a visitor sending GPC has legally opted out — from January 2027 every browser must offer
+that setting, so it stops being an edge case.
+
+**Prefer Google Tag Manager for pixels and analytics.** `TagManager` is wired into the layout and
+`ConsentInit` sets Consent Mode v2 before it loads, so a tag added in the GTM UI inherits the
+visitor's choice with no code change. Write code only for an embed or widget that must render
+into a specific element. Accessibility overlays (UserWay, accessiBe) are rejected on liability,
+not price.
+
+### 9. Look it up before you use it — four servers, one per question
+
+All four are declared in [.mcp.json](.mcp.json) and pre-approved in
+[.claude/settings.json](.claude/settings.json), so they work on any machine without anyone
+clicking Approve. `webm doctor` fails if a site has lost one.
+
+| Question                                                               | Server         |
+| ---------------------------------------------------------------------- | -------------- |
+| What does this Astro API do, and is it still called that?              | `astro-docs`   |
+| What does this web platform API do, and which browsers have it?        | `mdn`          |
+| Is this the right way to do SEO, a11y, performance, privacy, security? | `website-spec` |
+| Will this email render, arrive, and be readable?                       | `email-spec`   |
+
+**Astro moves faster than any training corpus and the web platform never stops.** Much of what a
+model recalls about both is two majors out of date, and the recalled version is always confidently
+wrong rather than obviously wrong. Look it up.
+
+**`astro-docs` and `mdn` outrank the two specification servers on facts.** The Website and Email
+Specifications are opinionated best-practice guides — genuinely good ones, and the source for
+_what a good site or email does_ — but they are not normative standards despite the name, and
+they are at 0.x. On what an API is or does, MDN and the Astro docs win.
+
+**`email-spec` before touching `src/emails/`.** An email template that looks right in a browser is
+evidence of nothing: the rendering quirks and the deliverability rules are the whole problem, and
+they are exactly what recall gets wrong.
+
+If a server is unavailable in a session — `mdn` is explicitly an experiment Mozilla may withdraw —
+**say so and cite the documentation site directly.** Never fall back to recall silently. A session
+that quietly stops checking is the failure all four are here to prevent.
+
+### 10. A class used by more than one page belongs in a shared stylesheet
+
+Astro scopes a component's `<style>` to that component's markup. A class defined in one page's
+`<style>` block and used in another renders **completely unstyled** — no error, no warning, just
+a bare element. It is invisible until someone looks at the second page.
+
+Shared class → `src/styles/custom/`. A page's own `<style>` block is only for markup that page
+alone renders.
+
+### 11. Never edit inside `node_modules`
+
+A change there survives until the next install and not one second longer. If the package is
+wrong, fix the package — see the top of this file.
+
+## Structure
+
+```
+design.json                 this client's palette. Compiles to --webm-* tokens.
+webmonterey.json            domain, client name, environment, features.
+src/
+  components/               EVERY visible component. The package ships none.
+    registry.ts             maps a block `type` to its component. A block whose type is
+                            not here renders as nothing, silently.
+  content/pages/*.json      the words. One file per route; home.json is `/`.
+  forms/*.json              form definitions. Filename is the form id.
+  actions/index.ts          re-exports the package pipeline. Wrap to customize.
+  pages/webapp/             the web app, if this site grows one. Folder is fixed; the public
+                            URL is `app.path` in webmonterey.json. Every page `prerender = false`.
+  styles/custom/            per-client CSS overrides.
+  assets/                   images processed at build time.
+public/                     served verbatim. Favicons, _headers.
+migrations/                 D1 schema. Additive only — never edit an applied migration.
+```
+
+## Component IDs
+
+Components are numbered, not named for what they look like: `content-000001`, not `hero-split`.
+A name describing the current design stops being true the first time the design changes, and
+renaming it means touching every content file that references it.
+
+The `type` in a page JSON file must match a key in `registry.ts`. Inventing one — or copying it
+from another project — makes the block render as nothing, with no error.
+
+## Skills
+
+`.claude/skills/webm/` is materialized from the package on every install. Do not edit it; it is
+replaced wholesale. This client's own skills go beside it at `.claude/skills/<name>/`.
+
+|                       |                                                                           |
+| --------------------- | ------------------------------------------------------------------------- |
+| `/webm:traps`         | the things that fail silently — read this before debugging anything weird |
+| `/webm:new-component` | adding a block type                                                       |
+| `/webm:start`         | standing a new site up: repo, Cloudflare resources, first deploy          |
+| `/webm:launch`        | launch checklist: structured data, sending domain, secrets, DNS, cutover  |
+| `/webm:upgrade`       | taking a new package version                                              |
+
+Content edits: branch, edit `src/content/pages/*.json`, `npm run check`, push — the branch
+preview is the client's review link. Merge when approved. Never change a block's `type`.
+
+Palette: `design.json`. Fonts are full CSS stacks; a self-hosted face still needs its
+`@font-face` in `src/styles/custom/`. The `overrides` map takes any `--webm-*` token raw.

package/template/site/CONTENT.md

@@ -0,0 +1,135 @@
+# Editing this site's content
+
+For anyone changing words on the site — no coding required.
+
+> **Using Claude Cowork?** Paste this whole file into the folder's **Folder instructions**
+> when you connect the site. Cowork does not read it automatically.
+
+---
+
+## Where the words live
+
+All page content is in **`src/content/pages/`**. One file per page. The filename is the web
+address:
+
+| File                                  | Page on the site   |
+| ------------------------------------- | ------------------ |
+| `src/content/pages/home.json`         | the home page, `/` |
+| `src/content/pages/about.json`        | `/about`           |
+| `src/content/pages/contact.json`      | `/contact`         |
+| `src/content/pages/services/seo.json` | `/services/seo`    |
+
+`home.json` is the one exception — it becomes `/`, not `/home`.
+
+Adding a new file adds a new page. Deleting one removes that page.
+
+---
+
+## What a page file looks like
+
+```json
+{
+  "title": "About",
+  "description": "Family-run since 1994.",
+  "blocks": [
+    {
+      "type": "content-000001",
+      "heading": "Who we are",
+      "body": "We have served the Monterey Bay area for thirty years."
+    }
+  ]
+}
+```
+
+- **`title`** — the browser tab, and what search results show as the headline. Required.
+- **`description`** — the grey summary line in Google results. One or two sentences.
+- **`blocks`** — the sections of the page, top to bottom.
+
+---
+
+## What you can change
+
+**Any text.** Headings, body copy, button labels, link addresses, `title`, `description`.
+
+**The order of sections.** Move a whole `{ ... }` block up or down inside `blocks` and the
+section moves up or down on the page.
+
+**Remove a section.** Delete its whole `{ ... }` block, including the comma that separates it
+from the next one.
+
+---
+
+## What you must not change
+
+**Never invent or edit a `"type"` value.** That is not a label — it is the name of a building
+block that has to already exist. If you make one up, or copy one from another site, that
+section renders as **nothing at all** and the page silently loses content.
+
+To add a kind of section that does not exist yet, ask for a new component to be built.
+
+**Do not touch these at all:**
+
+- `src/components/` — the building blocks themselves
+- `src/styles/` — fonts, colors, spacing
+- `src/layouts/`, `src/pages/`, `src/includes/`
+- anything ending in `.astro`, `.ts`, `.css`
+- `package.json`, `astro.config.mjs`, `wrangler.jsonc`, `tsconfig.json`
+- `webmonterey.json` — the site's identity. Changing `domain` breaks search listings.
+- `.dev.vars` — passwords and keys, never to be opened, copied, or pasted anywhere
+
+**The cookie banner and privacy dialog are not page content.** They are legally significant:
+the wording describes what the site actually does with data, and the categories map to real
+behavior. Changing that text on your own can make the site's disclosure inaccurate. If a
+client wants different wording, raise it — do not edit it here.
+
+---
+
+## Getting JSON right
+
+The format is strict, and one wrong character stops the whole site from building.
+
+- Every name and every piece of text is in `"double quotes"`. Never `'single'`, never curly
+  `"smart"` quotes — if you draft in Word or Google Docs, it will substitute those silently.
+- A comma between items, but **no comma after the last one** in a list or block.
+- Every `{` needs a `}`, every `[` needs a `]`.
+- An apostrophe inside text is fine: `"We're open"`. A double quote inside text needs a
+  backslash: `"They said \"yes\""`.
+
+---
+
+## How to publish a change
+
+**Always work on a branch. Never edit the live site directly.**
+
+```sh
+git checkout -b content/homepage-copy      # 1. start a branch
+                                           # 2. make your edits
+npm run check                              # 3. confirm nothing is broken
+git add -A
+git commit -m "Update homepage copy"
+git push -u origin HEAD                    # 4. push
+```
+
+`npm run check` is the safety net — it catches a missing comma or a wrong field before it can
+reach anyone. **If it reports an error, fix it before pushing.**
+
+Pushing gives the branch its own preview web address, something like
+`content-homepage-copy-webm-example-com.workers.dev`. Send that link for review.
+
+When it is approved, merge the branch into `main`. That publishes it to the real site.
+
+---
+
+## If something goes wrong
+
+**The build failed.** Almost always a JSON typo — a missing comma, a smart quote, an extra
+comma after the last item. The error message names the file.
+
+**A section vanished.** Its `"type"` does not match a real component. Check the spelling
+against the folder names in `src/components/`.
+
+**A change is not showing up.** Confirm you edited the right file for that page, that the
+branch was pushed, and that you are looking at the preview URL for _that_ branch.
+
+Nothing here can be broken permanently — every change is on a branch until it is merged, and
+anything merged can be reverted.

package/template/site/PRIVACY-POLICY-DRAFT.md

@@ -0,0 +1,81 @@
+# Privacy policy — DRAFT
+
+**NOT READY TO PUBLISH.** Every `{{PLACEHOLDER}}` below must be filled in, and every section
+describing something this site does not do must be deleted, before launch. This is a drafting
+aid, not legal advice — the client, and their counsel if they have any, must review it.
+
+## Why this is markdown and not a page
+
+The package ships zero components, so it cannot ship page JSON: a block whose `type` is not in
+this site's registry fails the content schema and the build stops. Once the site has a prose
+block, `/webm:edit-content` turns this into `src/content/pages/privacy.json` — the text below is
+already in reading order, one heading per section.
+
+---
+
+**Effective date:** {{DATE}}
+
+{{LEGAL_ENTITY_NAME}} ("we", "us") operates {{DOMAIN}}. This policy explains what the site collects, why, and the choices you have.
+
+## What we collect
+
+**Information you give us.** If you submit a form, we receive what you typed into it — typically your name, email address, phone number and message.
+
+**Information collected automatically.** Our hosting provider, Cloudflare, processes technical information required to serve the site: your IP address, browser user-agent, the pages you request, and the country your request came from. This is standard server logging and is used to deliver the site, keep it available, and defend it against abuse.
+
+## Cookies and similar technologies
+
+We group these into four categories:
+
+- **Essential** — required for the site to work and to resist abuse. These are never optional.
+- **Functional** — remember preferences, such as your cookie choices.
+- **Analytics** — help us understand which pages are used.
+- **Marketing** — used for advertising measurement or audience building.
+
+When you first visit, a banner lets you accept or reject each optional category. Nothing in the functional, analytics or marketing categories loads until you choose. You can change your choices at any time from the cookie settings link in the site footer.
+
+**Global Privacy Control.** If your browser sends a GPC signal, we treat it as an opt-out of analytics and marketing automatically, and you will not be asked again. You do not need to interact with the banner for this to take effect.
+
+## Who we share information with
+
+We do not sell your personal information. We do not share it for cross-context behavioral advertising except as described under Analytics below, and only where you have consented.
+
+The site relies on these processors:
+
+- **Cloudflare** — hosting, content delivery, and security. Processes technical request data as described above. _Essential._
+- **Cloudflare Turnstile** — spam and abuse protection on forms. Runs only on pages with a form and is treated as essential, because without it the form cannot resist automated abuse.
+- **Mailgun (Sinch)** — delivers form submissions to us by email.
+- **Google Tag Manager / Google Analytics** — measures site usage. _Loads only with your consent to the analytics category._ Google Consent Mode v2 is enabled, so Google is told your choice directly.
+- {{ADD_OR_REMOVE_PROCESSORS_TO_MATCH_THE_SITE}}
+
+## How long we keep things
+
+Form submissions are retained for {{RETENTION_PERIOD}} and then deleted. Server logs are retained by Cloudflare under their own retention schedule.
+
+## Your rights
+
+Depending on where you live — including under the California Consumer Privacy Act as amended by the CPRA — you may have the right to:
+
+- know what personal information we hold about you and how it is used;
+- request a copy of it;
+- request that we correct or delete it;
+- opt out of its sale or sharing (we do not sell it, and the GPC signal and cookie banner both control sharing);
+- not be discriminated against for exercising any of these rights.
+
+To make a request, contact us at {{CONTACT_EMAIL}}. We may need to verify your identity before acting on it.
+
+## Children
+
+The site is not directed at children under 13 and we do not knowingly collect their information.
+
+## Changes
+
+We will update this page if our practices change, and revise the effective date above.
+
+## Contact
+
+{{LEGAL_ENTITY_NAME}}
+
+{{POSTAL_ADDRESS}}
+
+{{CONTACT_EMAIL}}

package/template/site/public/_headers

@@ -0,0 +1,70 @@
+# Cloudflare Workers static-asset headers.
+#
+# The adapter MERGES this with its own generated rules (it adds immutable Cache-Control for
+# /_astro/*), so do not add caching rules for hashed assets here.
+#
+# Deliberately conservative: these are safe for every client site as shipped. The full CSP
+# ships REPORT-ONLY — it enforces nothing and cannot break a site. See the notes below before
+# promoting it to enforcing.
+
+/*
+  # Stop browsers guessing a MIME type and executing an upload as script.
+  X-Content-Type-Options: nosniff
+
+  # Nobody may frame this site. Replaces the legacy X-Frame-Options.
+  Content-Security-Policy: frame-ancestors 'none'
+
+  # Send the origin to other sites, the full URL to our own. Keeps paths out of referrers.
+  Referrer-Policy: strict-origin-when-cross-origin
+
+  # Turn off APIs the site does not use, for itself and anything it embeds.
+  Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=()
+
+  # Two years, and eligible for preload. See the caveat below before uncommenting.
+  # Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+
+  # Report-only. Violations appear in the browser console and NOTHING is blocked. See below.
+  Content-Security-Policy-Report-Only: default-src 'self'; base-uri 'self'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; connect-src 'self' https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://challenges.cloudflare.com
+
+# THE REPORT-ONLY CSP
+#
+# Report-only enforces nothing, so this is safe to ship unconfigured: a client site with an
+# untuned policy gets console warnings, never a broken page. Read the console on a real
+# browser — a status-code check cannot see a CSP violation.
+#
+# WHAT IT COVERS. The hosts above are the starter's complete third-party list: Google Tag
+# Manager and Google Analytics (only ever loaded with analytics consent) and Cloudflare
+# Turnstile. Everything else is 'self'.
+#
+# WHAT YOU MUST ADD PER CLIENT:
+#   - R2 media — `img-src`/`media-src https://media.<client-domain>` if the site uses it.
+#     Not included here because the host is derived from the client's own domain.
+#   - Any third party added through the `add-third-party` skill. Adding the script without
+#     adding its host here means the policy stops describing the site.
+#
+# WHY 'unsafe-inline' IS IN BOTH script-src AND style-src. Not laziness — it is structural,
+# and measured on a real build. Every page carries three inline scripts and three inline
+# styles:
+#   - ConsentInit's blocking script, which must run before any third party and therefore
+#     cannot be an external file.
+#   - The `@layer` order statement, which base.astro emits inline BECAUSE a bare @layer
+#     statement does not survive bundling (see CLAUDE.md Traps — moving it out of the
+#     document silently inverts the cascade).
+#   - Astro's own inlining of small component scripts and scoped styles, which changes hash
+#     every build, so static hashes in this file would go stale on the next deploy.
+# Nonces would be the real fix and need a server-rendered response; most routes here are
+# static. So 'unsafe-inline' stays until that changes — but note it weakens ONLY the inline
+# case. default-src, form-action, base-uri, object-src and the host allowlists still catch an
+# injected external script, a form retargeted at another origin, and a rewritten <base>.
+#
+# PROMOTING IT TO ENFORCING. Per client, once the console is clean on every page including
+# forms: rename the header to `Content-Security-Policy`. Do it on a preview URL first, click
+# through every route, and submit a form — Turnstile renders in an iframe, so `frame-src` is
+# the directive most likely to bite, and it fails in a way that looks like the widget simply
+# not appearing.
+#
+# HSTS
+#
+# Only enable once the custom domain is live and HTTPS is confirmed working, INCLUDING every
+# subdomain. `includeSubDomains` will break any subdomain still served over plain HTTP, and
+# `preload` is effectively irreversible for two years.

package/template/site/src/forms/contact.json

@@ -0,0 +1,45 @@
+{
+  "//": "A form definition. Copy this file to add another form; the filename is the form's id, and that id is what lands in the `form` column in D1.",
+  "name": "Contact",
+  "//notify": "WHO GETS THE EMAIL. Ships EMPTY on purpose — an unset recipient is obvious, whereas a placeholder address silently swallows every enquiry. Set this before launch.",
+  "//subject": "TOPIC ONLY. The `[Client Name] ` prefix is added by src/emails/subject.ts from webmonterey.json — do not write it here or it renders twice. {{field}} placeholders interpolate submitted values; an unmatched one becomes empty rather than showing up literally.",
+  "notify": {
+    "to": [],
+    "subject": "New contact enquiry from {{name}}"
+  },
+  "//autoresponse": "THE CONFIRMATION SENT BACK TO THE VISITOR. Omit this whole block to send nothing — that is the default, because an autoresponder that goes out before the client has agreed to its wording is a promise the agency made on their behalf. `subject` is TOPIC ONLY, same as notify.subject: the `[Client Name] ` prefix is added by src/emails/subject.ts. It is sent to the address in the form's `email` field, with Reply-To set to the FIRST notify.to recipient, so a visitor replying reaches a human. It never sends if notify.to is empty.",
+  "autoresponse": {
+    "subject": "We received your enquiry",
+    "body": "Thanks for getting in touch. We have received your message and will get back to you shortly."
+  },
+  "//fields": "Rendered in order. `type` maps to an input type; `required` is enforced server-side, not just in the browser.",
+  "fields": [
+    {
+      "name": "name",
+      "label": "Your name",
+      "type": "text",
+      "required": true,
+      "autocomplete": "name"
+    },
+    {
+      "name": "email",
+      "label": "Email address",
+      "type": "email",
+      "required": true,
+      "autocomplete": "email"
+    },
+    {
+      "name": "phone",
+      "label": "Phone",
+      "type": "tel",
+      "required": false,
+      "autocomplete": "tel"
+    },
+    {
+      "name": "message",
+      "label": "How can we help?",
+      "type": "textarea",
+      "required": true
+    }
+  ]
+}

package/template/workflows/ci.yml

@@ -0,0 +1,52 @@
+# PACKAGE-MANAGED. Rewritten by `webm sync` on every install - edit it in the package
+# (template/workflows/ci.yml), never here, or your change disappears on the next `npm update`.
+#
+# WHY THIS EXISTS. Sites once shipped with no CI at all, and a dropped action, an absent
+# migration and a route with no middleware all sat in main for weeks because the only thing that
+# would have run `astro check` was a person remembering to.
+#
+# `webm doctor` is in here deliberately. The type checker catches what TypeScript can see; doctor
+# catches what it cannot - an action nothing exports, a table with no migration, a D1 flag with no
+# binding, an on-demand route the asset router will 404.
+name: CI
+
+on:
+  push:
+  pull_request:
+
+# One run per branch. Keyed on head_ref||ref_name rather than github.ref, which differs between
+# push and pull_request events and so runs a branch with an open PR twice.
+concurrency:
+  group: ci-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Check, test, build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      # No registry credential. The framework is a public package on npmjs.
+      - run: npm ci
+
+      # astro check. This is the one that fails on a missing prop, a dropped action or an
+      # ambient type that never came across.
+      - run: npm run check
+
+      - run: npm test --if-present
+
+      # The checks a compiler cannot make. Non-blocking for now so it reports rather than
+      # gates - a doctor that fails a repo on its first run gets switched off.
+      - run: npx webm doctor
+        continue-on-error: true
+
+      - run: npm run build