@cparkerwebm/webmonterey 1.0.0

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "@cparkerwebm/webmonterey",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "The WebMonterey Astro framework: plumbing, design system, and Claude Code skills for client sites on Cloudflare Workers",
+  "license": "MIT",
+  "author": "Carl Parker",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cparkerwebm/webmonterey.git"
+  },
+  "//engines": "22.18 is the first release with unflagged TypeScript type stripping, which the webm CLI needs to import src/design/*.ts at runtime.",
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "//peerDependencies": "astro is NEVER a plain dependency. Two copies of Astro in one tree breaks the integration in ways that are hard to read. Widen the range only after examples/minimal is green on the new major - see ARCHITECTURE.md section 8.",
+  "peerDependencies": {
+    "astro": "^7.0.0"
+  },
+  "//dependencies": "The integration wires these itself, so a client site installs only astro and this package.",
+  "dependencies": {
+    "@astrojs/cloudflare": "^14.1.7",
+    "@astrojs/sitemap": "^3.7.3"
+  },
+  "devDependencies": {
+    "@astrojs/check": "^0.9.10",
+    "@cloudflare/workers-types": "^5.20260826.1",
+    "@types/node": "^26.1.2",
+    "astro": "^7.1.6",
+    "esbuild": "^0.28.2",
+    "prettier": "^3.9.6",
+    "prettier-plugin-astro": "^0.14.1",
+    "typescript": "^6.0.3"
+  },
+  "bin": {
+    "webm": "dist/webm.mjs"
+  },
+  "//exports": "The subpath map mirrors src/includes/ vendor-first tree, so an import in a client repo reads almost identically to the gen-2 relative path. `./design` deliberately contains no Astro imports so it stays testable under `node --test`.",
+  "exports": {
+    ".": "./src/integration/index.ts",
+    "./styles.css": "./src/styles/global.css",
+    "./layouts/base.astro": "./src/layouts/base.astro",
+    "./design": "./src/design/index.ts",
+    "./content": "./src/integration/content.ts",
+    "./actions": "./src/actions/index.ts",
+    "./pages/slug": "./src/pages/[...slug].astro",
+    "./pages/robots": "./src/pages/robots.txt.ts",
+    "./pages/webm": "./src/pages/webm.astro",
+    "./pages/404.astro": "./src/pages/404.astro",
+    "./emails": "./src/emails/index.ts",
+    "./cloudflare/d1": "./src/includes/cloudflare/d1/client.ts",
+    "./cloudflare/r2": "./src/includes/cloudflare/r2/media.ts",
+    "./cloudflare/turnstile": "./src/includes/cloudflare/turnstile/verify.ts",
+    "./cloudflare/turnstile/Turnstile.astro": "./src/includes/cloudflare/turnstile/Turnstile.astro",
+    "./cloudflare/workers": "./src/includes/cloudflare/workers/env.ts",
+    "./google/tag-manager": "./src/includes/google/tag-manager/TagManager.astro",
+    "./sinch/mailgun": "./src/includes/sinch/mailgun/send.ts",
+    "./webmonterey/site": "./src/includes/webmonterey/site.ts",
+    "./webmonterey/compliance": "./src/includes/webmonterey/compliance/consent.ts",
+    "./webmonterey/compliance/CookieConsent.astro": "./src/includes/webmonterey/compliance/CookieConsent.astro",
+    "./webmonterey/compliance/ConsentInit.astro": "./src/includes/webmonterey/compliance/ConsentInit.astro",
+    "./webmonterey/forms": "./src/includes/webmonterey/forms/honeypot.ts",
+    "./webmonterey/prose": "./src/includes/webmonterey/prose/inline.ts",
+    "./webmonterey/credits": "./src/includes/webmonterey/credits/credit.ts",
+    "./webmonterey/credits/Credit.astro": "./src/includes/webmonterey/credits/Credit.astro",
+    "./webmonterey/scroll-top/ScrollTop.astro": "./src/includes/webmonterey/scroll-top/ScrollTop.astro",
+    "./structured-data": "./src/includes/webmonterey/structured-data/nodes.ts",
+    "./schema/design.json": "./schema/design.json",
+    "./package.json": "./package.json",
+    "./adapter": "./src/integration/adapter.ts",
+    "./app-middleware": "./src/integration/app-middleware.ts",
+    "./worker": "./src/worker.ts"
+  },
+  "files": [
+    "src",
+    "dist",
+    "skills",
+    "agents",
+    "hooks",
+    "template",
+    "schema",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build-cli.mjs",
+    "prepare": "npm run build",
+    "prepack": "npm run build",
+    "test": "node --test \"src/**/*.test.ts\" \"scripts/**/*.test.mjs\"",
+    "check": "tsc --noEmit",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "release": "node scripts/release.mjs",
+    "test:e2e": "node scripts/e2e.mjs",
+    "prepublishOnly": "node scripts/check-release.mjs"
+  },
+  "//bin": "No leading ./ - npm 11 strips it and warns that the bin was invalid. Points at the BUILT file. Node refuses to strip types for anything under node_modules, so the CLI cannot run from source once installed - see scripts/build-cli.mjs. The library still ships as .ts because Astro compiles it itself."
+}

package/schema/design.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/cparkerwebm/webmonterey/schema/design.json",
+  "title": "WebMonterey design system",
+  "description": "Per-client design tokens and brand context. Sits beside webmonterey.json at the repo root. Compiled at build into CSS custom properties, email-safe literals, brand context and a resolved palette.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "$schema": { "type": "string" },
+    "version": { "const": 1, "description": "Bumped only for a breaking change to this shape." },
+
+    "brand": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "The words half of the design system. Reaches site copy, social posts and anything written in the client's name.",
+      "properties": {
+        "name": { "type": "string" },
+        "voice": {
+          "type": "string",
+          "description": "How this client writes. One or two sentences, concrete. e.g. 'Direct, credential-led, never breathless. Written for CPAs.'"
+        },
+        "rules": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Hard rules a writer or generator must not break. Phrase each as an instruction, e.g. 'Gold is a fill only - never gold text or links on white.'"
+        },
+        "logo": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "primary": { "type": "string", "description": "Full lockup." },
+            "mark": {
+              "type": "string",
+              "description": "Icon-only mark, for favicons and tight spaces."
+            }
+          }
+        }
+      }
+    },
+
+    "color": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "base": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "The neutral ramp. Everything semantic points at these, never the other way round. 100 lightest, 900 darkest - the direction does not invert for a dark design.",
+          "properties": {
+            "100": { "type": "string" },
+            "300": { "type": "string" },
+            "500": { "type": "string" },
+            "700": { "type": "string" },
+            "900": { "type": "string" }
+          }
+        },
+        "action": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "The brand color. Retheming a client usually starts and ends here.",
+          "properties": {
+            "base": { "type": "string" },
+            "dark": { "type": "string" },
+            "light": { "type": "string" }
+          }
+        },
+        "border": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": { "subtle": { "type": "string" } }
+        },
+        "state": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "success": { "type": "string" },
+            "warning": { "type": "string" },
+            "danger": { "type": "string" },
+            "info": { "type": "string" }
+          }
+        }
+      }
+    },
+
+    "font": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Full CSS font stacks, not family names - no fallbacks are appended. A self-hosted face still needs its @font-face declared in src/styles/custom/.",
+      "properties": {
+        "sans": { "type": "string" },
+        "mono": { "type": "string" }
+      }
+    },
+
+    "radius": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Name only the steps that differ from the defaults.",
+      "properties": {
+        "none": { "type": "string" },
+        "xs": { "type": "string" },
+        "sm": { "type": "string" },
+        "md": { "type": "string" },
+        "lg": { "type": "string" },
+        "xl": { "type": "string" },
+        "pill": { "type": "string" },
+        "circle": { "type": "string" }
+      }
+    },
+
+    "overrides": {
+      "type": "object",
+      "description": "Raw token overrides, applied last. Keys must start with --webm-; anything else is a build error, because a property outside the prefix is set, never read, and the page looks untouched.",
+      "propertyNames": { "pattern": "^--webm-[a-z0-9-]+$" },
+      "additionalProperties": { "type": "string" }
+    }
+  }
+}

package/skills/launch/SKILL.md

@@ -0,0 +1,183 @@
+---
+name: launch
+description: Launch a WebMonterey client site onto its real domain - structured data, Turnstile, sending domain, production secrets, remote migrations, custom domain, verification, and the environment flip. Use for "launch the site", "point the domain at it", "we're going live", "take it out of preview".
+---
+
+# Launch
+
+Run only when the site is content-complete and approved on a preview URL. Every step is safe to
+re-run; several are the kind that fail silently, which is why they are written down.
+
+## 1. Pre-flight
+
+```sh
+npx webm doctor
+npm run build
+```
+
+Both clean. Doctor's warnings about placeholder artwork and the missing agency credit become
+blocking here: replace the seeded favicons and share image with the client's own, and confirm
+the footer imports `Credit.astro`.
+
+## 2. Structured data
+
+**The package emits no JSON-LD on its own.** What a business claims about itself is the site's
+to say, and this is where it gets decided - once, with the client's real details in front of you.
+
+1. **Identify the business.** Read `webmonterey.json`'s `organization`, the home page, the
+   contact page, and the live site if there is one. Decide the primary type: `Organization` is
+   the default; `LocalBusiness` (or a subtype - `Restaurant`, `Dentist`, `Store`) only if there is
+   a physical address the public visits; `Person` alongside it for a candidate, an artist, a
+   consultant whose name is the brand. Look up the subtype on schema.org rather than guessing.
+2. **Fill `organization`** - legalName, telephone (E.164), email, address, `sameAs` profiles,
+   `logo` (a path under `public/`, at least 112×112, NOT the share image), `hours` if there are
+   opening hours. **Every empty field is omitted; never invent one.** Wrong opening hours in
+   structured data are surfaced by search engines as fact.
+3. **Write the component.** `src/components/general/structured-data.astro`, composed from the
+   package's builders, and export it from the registry:
+
+   ```astro
+   ---
+   import {
+     graphContext,
+     renderJsonLd,
+     organizationNode,
+     websiteNode,
+     webPageNode,
+     breadcrumbNode,
+     personNode,
+   } from '@cparkerwebm/webmonterey/structured-data';
+   const { title, description, image } = Astro.props;
+   const ctx = graphContext(Astro.site!, Astro.url.pathname, { title, description });
+   const jsonLd = renderJsonLd([
+     organizationNode(ctx, image),
+     personNode(ctx), // null unless organization.founder is set
+     websiteNode(ctx),
+     webPageNode(ctx),
+     breadcrumbNode(ctx), // two levels from the path; pass a trail for deeper pages
+   ]);
+   ---
+
+   {jsonLd && <script type="application/ld+json" set:html={jsonLd} />}
+   ```
+
+   ```ts
+   // src/components/registry.ts
+   export { default as structuredData } from './general/structured-data.astro';
+   ```
+
+   The layout renders it in `<head>` on every indexable route. Add a node the builders do not
+   have - `Event`, `Product`, `FAQPage` - as a plain object in the array; `renderJsonLd` handles
+   escaping and `@id` wiring for anything you hand it. **Only describe what is visible on the
+   page.** Structured data about content a visitor cannot see is a manual-action risk.
+
+4. **Validate** the built home page and one inner page with Google's Rich Results Test before
+   moving on.
+
+## 3. Turnstile
+
+If the site has a form: create the widget in the Cloudflare dashboard (**Turnstile → Add
+widget**), hostname list = the apex domain AND `<account-subdomain>.workers.dev` so branch
+previews keep working. Turnstile has no wildcards and the free tier allows 10 hostnames.
+
+Then, **in the same change**: sitekey into `vars.PUBLIC_TURNSTILE_SITE_KEY` in `wrangler.jsonc`,
+secret via `npx wrangler secret put TURNSTILE_SECRET_KEY`, and `features.turnstile: true`. A
+mismatch fails exactly like a bot does and names nothing.
+
+## 4. Check the client's existing DMARC BEFORE adding a sending domain
+
+```sh
+dig +short TXT _dmarc.<client-domain>
+```
+
+A DMARC record on `example.com` applies to its subdomains by default. If the client already
+publishes `p=reject` and DKIM on the new sending subdomain is not right, **every message
+vanishes** - no bounce, no error, nothing in the logs. Fix the DKIM before the first send, not
+after the first missing enquiry.
+
+## 5. Sending domain
+
+Transactional mail sends from `webm.<client-domain>` as `website@webm.<client-domain>` - separate
+from the client's own mail, so a bounce problem on one never poisons the other.
+
+Add the domain in Mailgun, then add the SPF, DKIM and tracking records it gives you to the zone.
+Every client zone is on the agency Cloudflare account, so this is a DNS edit.
+
+## 6. Production secrets
+
+Anything in `.dev.vars` locally must exist as a real secret on the Worker. Local files are never
+uploaded.
+
+```sh
+npx wrangler secret list
+npx wrangler secret put MAILGUN_API_KEY
+npx wrangler secret put MAILGUN_DOMAIN        # webm.<client-domain>
+npx wrangler secret put TURNSTILE_SECRET_KEY  # if not done in step 3
+```
+
+**Record each one in the password manager as you create it.** Wrangler cannot read a secret
+back out, so nothing else in the system backs them up.
+
+Public values - the Turnstile site key, a GTM container id - are not secrets. They go in
+`vars` in `wrangler.jsonc` or `gtmId` in `webmonterey.json`, and are committed.
+
+## 7. D1, if the site uses it
+
+```sh
+npx wrangler d1 migrations list webm-<slug>-db --remote
+npx wrangler d1 migrations apply webm-<slug>-db --remote
+```
+
+`--remote` is the step people forget. Local migrations do nothing in production, and local and
+remote are separate stores - **data never moves between them in either direction**.
+
+## 8. Custom domain
+
+Cloudflare dashboard, the Worker, **Settings → Domains & Routes → Add → Custom domain**. The
+apex only; Cloudflare provisions the certificate. Send `www` to the apex with a Redirect Rule,
+not a second custom domain. MX records are untouched - a custom domain claims address records
+only.
+
+## 9. Verify
+
+Wait for a known marker before asserting anything - some edges serve the previous version for a
+minute or two, and a check run in that window reports old titles and missing assets that are
+fine.
+
+Then, in a **real browser with the console open**:
+
+- every page renders and every internal link resolves
+- the contact form submits, and the notification arrives
+- Turnstile renders - it refuses to render headless, so a headless pass proves nothing
+
+And for every route with `prerender = false`, including its trailing-slash form:
+
+```sh
+curl -H "Sec-Fetch-Dest: document" -H "Sec-Fetch-Mode: navigate" https://<domain>/<route>
+```
+
+That header is what the asset router branches on. Without it curl gets the real page and Chrome
+gets the 404.
+
+**A form test before step 10 goes to `stagingEmail`** with `[staging → …]` in the subject naming
+who it was really for. That is the system working - check that inbox, not the client's.
+
+## 10. Hand the site its email back, and record the launch
+
+In one change:
+
+```json
+"environment": "production",
+"launched": "YYYY-MM-DD"
+```
+
+Until `environment` flips, every message the site sends is redirected to `stagingEmail` - correct
+right up to the moment the domain is attached and wrong immediately after: the form keeps saying
+thank you, the client's inbox stays empty, and the first anyone hears of it is a customer asking
+why nobody called back. `webm doctor` fails a launched site still declared staging, which is why
+both fields change together.
+
+Anything served from `workers.dev` is still treated as staging whatever this says, so branch
+previews of the live site keep redirecting. That is deliberate.
+
+Commit, push, and confirm the deploy. Then run `npx webm doctor` one last time: zero failures.

package/skills/new-component/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: new-component
+description: Add a new page block to a WebMonterey site - the folder, the schema, the registry entry and the content union. Use for "build a hero", "add a testimonial section", "we need a pricing table", "make a new block type".
+---
+
+# New component
+
+**The package ships zero visible components.** Every block a visitor sees is built here, in this
+repo, for this client. That is deliberate: generation 1 shipped framework chrome and every site
+overrode it.
+
+## Component IDs
+
+A folder named `{singular-type}-{6 digits}`, containing an `.astro` file of the same name plus
+its `schema.ts`:
+
+```
+src/components/content/content-000004/
+  content-000004.astro
+  schema.ts
+```
+
+IDs are allocated sequentially **per type** and never reused. Check what exists before picking one.
+
+| Folder        | Holds                                                   | Prefix       |
+| ------------- | ------------------------------------------------------- | ------------ |
+| `asides/`     | supporting content beside the main flow                 | `aside-`     |
+| `content/`    | the main page content blocks                            | `content-`   |
+| `general/`    | shared primitives — the fallback when nothing else fits | `general-`   |
+| `interfaces/` | interactive UI                                          | `interface-` |
+| `regions/`    | page chrome — header, footer, nav                       | `region-`    |
+
+## Three places, and missing either of the last two fails differently
+
+**1. The folder.** Schema first, then markup.
+
+```ts
+// schema.ts
+import { z } from 'astro/zod';
+
+export const schema = z.object({
+  type: z.literal('content-000004'),
+  heading: z.string(),
+  body: z.array(z.string()).default([]),
+});
+```
+
+**2. `src/components/registry.ts`** — two lines, an import and a map entry. The key **must** equal
+the folder ID and the `type` in page JSON.
+
+> **Forgetting this is the most common bug in the content model.** Nothing errors. `astro check`
+> passes, the build succeeds, and the block renders as nothing. The router logs a warning at build
+> time — read the build output.
+
+**3. `src/content.config.ts`** — add the schema to the union passed to `webmontereyCollections`.
+
+Miss the registry and the block validates but renders as nothing. Miss the union and valid JSON
+fails to build.
+
+## Styling
+
+**Tokens only. No literal values.** Every color, space, size, radius, shadow, z-index, duration
+and easing is a `--webm-*` custom property. `webm doctor` warns on literal colors in component CSS.
+
+To retheme, change the **token** in `design.json` — one declaration cascades everywhere.
+
+**A class used by more than one page belongs in a shared stylesheet.** Astro scopes a component's
+`<style>` to that component's markup, so a class defined in one page's `<style>` and used in
+another renders completely unstyled — no error, no warning, a bare element. This bit one client
+build five separate times.
+
+## Build it in isolation
+
+`/webm` is a scratch route for exactly this — noindex, excluded from the sitemap. Compose the
+block there, get it right, then wire it into a page. **Leave it empty when done.**
+
+## Verify
+
+```sh
+npm run check
+npm run preview   # NOT dev - preview is a real build on real workerd
+```
+
+`dev` cannot detect CSS bundling, cascade order, or the asset router. Every trap worth catching is
+invisible in `dev` and visible in `preview`. See `/webm:traps`.

package/skills/start/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: start
+description: Stand up a new WebMonterey client site - scaffold, GitHub repo, identity, Cloudflare resources, Workers Builds, first deploy. Use for "start a new site for <client>", "spin up <domain>", "set this up for a new client", "we have a new client".
+---
+
+# Start a client site
+
+**Resumable.** This is routinely invoked against a repo that is already half set up, so every
+step checks before it acts and is safe to re-run.
+
+**Derive, do not ask.** If the answer is in the repo, on disk, or on the live domain, take it
+from there and say where you got it. Asking for a fact the repo already contains is the failure
+this skill exists to prevent.
+
+## 0. Read the state before writing anything
+
+```sh
+git remote get-url origin 2>/dev/null   # repo created? which one?
+npx webm doctor                         # everything below, in one command
+npx wrangler whoami                     # auth + account
+dig +short NS <domain>                  # is the zone on our Cloudflare account?
+curl -sI https://<domain> | head -5     # is anything already live?
+```
+
+**If a site is already live, say so prominently.** It changes the project: launch becomes a
+cutover, and the existing site is the content source.
+
+## 1. Scaffold
+
+Only if this directory is not already a site (no `webmonterey.json`):
+
+```sh
+npx @cparkerwebm/webmonterey new <domain> --client="<Name>"
+cd <domain_with_underscores>
+```
+
+It writes the identity files, a working contact form, a home page, the fleet skills, and runs
+`git init` and `npm install`. Nothing outside the directory is touched.
+
+**Three names, and they differ on purpose:**
+
+|             | Example                                              |                              |
+| ----------- | ---------------------------------------------------- | ---------------------------- |
+| GitHub repo | `webmonterey/autire_com`                             | Full domain, **underscores** |
+| Slug        | `autire`                                             | Domain minus the TLD         |
+| Cloudflare  | `webm-autire`, `webm-autire-db`, `webm-autire-media` | The slug, prefixed           |
+
+The slug drops the TLD because a Worker named `webm-autire-com` puts `autire-com` into every
+preview hostname, and Chrome's lookalike check then warns the client the site looks fake.
+`autire.com` and `autire.org` both want `autire` - check the slug is free before committing.
+
+## 2. Create the GitHub repo
+
+Guarded, because this is re-run against sites that already have one. `git remote get-url`, not
+`git remote -v` - the latter exits 0 with no output when there are no remotes and guards nothing.
+
+```sh
+git remote get-url origin 2>/dev/null \
+  || gh repo create <org>/<repo> --private --source=. --remote=origin --push
+```
+
+Private. Client CI needs no secret: the framework is a public package.
+
+## 3. Identity
+
+`webmonterey.json` - confirm `client`, `domain`, `timeZone`, `locale`, `stagingEmail`. Leave
+`launched` null and `environment` on `staging` until `/webm:launch`.
+
+`organization` feeds nothing until the site has structured data; `/webm:launch` decides what
+schema the business gets. Fill the contact fields now if they are known - never guess one.
+
+`design.json` is optional. A site with none compiles the default tokens, which is the right
+starting point before anyone has chosen a palette. Fonts are full CSS stacks; a self-hosted
+face still needs its `@font-face` in `src/styles/custom/`.
+
+## 4. Cloudflare resources
+
+Create only what the site needs. A marketing site with a contact form needs D1; it does not need
+R2 until someone has a video.
+
+```sh
+npx wrangler d1 create webm-<slug>-db --update-config     # writes the binding into wrangler.jsonc
+npx wrangler d1 migrations apply webm-<slug>-db --local
+npx wrangler r2 bucket create webm-<slug>-media           # only if media is going to R2
+```
+
+Set `features.d1: true` once the binding exists. `features.turnstile` waits for `/webm:launch`,
+which creates the widget and its keys together - a sitekey without its secret fails exactly
+like a bot does.
+
+**Every route with `export const prerender = false` goes in `run_worker_first`, in both slash
+forms.** Miss one and it returns 200 to curl and a 404 page to Chrome. `webm doctor` checks.
+
+## 5. Workers Builds
+
+Connect the repo in the Cloudflare dashboard: **Workers & Pages → Create → Import a repository**.
+The Worker name must be `webm-<slug>` exactly - Workers Builds fails on a mismatch with
+`wrangler.jsonc`.
+
+No build variables are needed. **Push to deploy from then on** - a `wrangler deploy` from a
+laptop creates a version no build produced, so history stops describing what is live, and the
+next push reverts it.
+
+## 6. Verify the first deploy
+
+Wait a minute after the build reports success - a brand-new Worker can return `error code:
+1042` on valid paths for about that long. Then, in a real browser with the console open, load
+the `workers.dev` URL. The home page renders, the console is clean.
+
+## 7. Hand over
+
+Workers Builds comments the preview URL on every PR - that is the client's review link. Preview
+hostnames use the slug, so Chrome's lookalike warning should not appear; if it does, it is a
+URL-shape false positive and **Ignore is safe**.
+
+Next: `/webm:new-component` for each block, then `/webm:launch` when the site is
+content-complete and approved on a preview.