@getvitops/create 0.5.0 → 0.6.0

package/templates/static/AGENTS.md

@@ -0,0 +1,57 @@
+This is a static Astro website styled by the Vitops design system, deployed
+as Cloudflare Workers static assets (no server runtime, no database).
+
+## Ground rules
+
+- `design-system.json` is the single source of truth for the design system
+  (colors, type, spacing, patterns, animations). Never edit `src/styles/` by
+  hand — it is generated from the JSON by the `vitops()` integration on every
+  dev/build and is gitignored.
+- `src/assets/placeholder/` holds neutral wireframe stand-ins (square,
+  portrait, landscape; SVG + PNG) for layout work before real imagery
+  exists. Delete the directory once real assets land.
+- Prefer framework CSS classes (utilities, patterns, type roles like
+  `font-heading`) over bespoke CSS. Run `npx vitops agents` to append the
+  full generated class-vocabulary reference to this file.
+- **Layout foundations — these are the answer, not a starting point.** Six
+  substitutions carry the structure of nearly every page:
+  | About to write… | Write instead |
+  | --- | --- |
+  | a `wrap`/`wrapper`/`container`/`inner` class | **`centered`** |
+  | `max-width` + `margin-inline: auto` | **`centered`** |
+  | `padding-block` on a section | **`region`** |
+  | margins between headings/paragraphs/lists | **`rhythm`** |
+  | `display: grid` + `grid-template-columns: repeat(n, …)` | **`subgrid`** |
+  | `repeat(auto-fit, minmax(…))` | **`grid-auto`** |
+  | `display: flex` + `gap` for a row of controls | **`cluster`** |
+- Every page is prerendered by default (`output: 'static'`) — there is no
+  server to fall back to, so nothing here can read request-time data
+  (cookies, headers, query params) at render time. If a page genuinely needs
+  that, it needs an adapter and a different template — this one stays pure
+  static on purpose.
+
+## Branch model
+
+- Work on **`dev`** (the integration branch). Every push auto-deploys the
+  isolated `-dev` worker (`dev.<domain>` with a custom domain).
+- **`main`** is production and branch-protected — never push or merge to it
+  directly. Production ships only via the manual **promote** flow:
+  `.github/workflows/promote.yml`, dispatched manually, opens a `dev → main`
+  PR with auto-merge; merging deploys prod. Only run it when the user
+  explicitly asks to promote/ship to production.
+
+## Commands
+
+- `pnpm dev` — local dev
+- `pnpm typecheck` — `astro check`
+- `pnpm run build:css` — regenerate the framework CSS from `design-system.json`
+- `pnpm deploy` — build + `wrangler deploy` to prod
+- `pnpm run deploy:dev` — build + deploy the isolated dev worker
+- `pnpm run init:github` — one-time: create + push the GitHub repo (main +
+  dev, dev default, branch protection + environment policy). Only run when
+  the user asks to set up GitHub.
+- `pnpm run init:hosting` — one-time: read the Cloudflare account id and set
+  it as a repo secret. Only run when the user asks for it.
+- `npx vitops validate design-system.json` — schema-check the design config
+- `npx vitops lint -i design-system.json -f css` — find framework classes in
+  source that resolve to nothing under this format

package/templates/static/README.md

@@ -0,0 +1,85 @@
+# My Static Site
+
+A static [Astro](https://astro.build) website on Cloudflare Workers (static
+assets — no server runtime), styled by the
+[Vitops design system](https://www.npmjs.com/org/getvitops).
+
+Scaffolded from `vp create @getvitops:static`.
+
+## Stack
+
+- **Astro** (`output: 'static'`) on **Cloudflare Workers Static Assets** — no
+  adapter, no database, no server runtime
+- **`@getvitops/astro`** — generates the design-system CSS from
+  `design-system.json` and serves the web-component runtime
+
+`src/assets/placeholder/` ships neutral wireframe images for layout work
+before real imagery exists — delete once real assets land.
+
+## Local development
+
+```bash
+pnpm install
+pnpm dev
+```
+
+- Site: <http://localhost:4321>
+
+## Deploy
+
+```bash
+npx wrangler login
+pnpm deploy
+```
+
+For a custom domain, uncomment the `routes` block in `wrangler.jsonc` and set
+your apex — Cloudflare provisions the DNS record + TLS cert on deploy.
+
+## Environments: dev → main promotion
+
+The repo ships a two-environment flow modeled on branch = environment:
+
+- **`dev`** is the integration branch. Every push auto-deploys the isolated
+  `-dev` worker (`.github/workflows/deploy-dev.yml`), served at
+  `dev.<domain>` when a custom domain is configured (or the worker's
+  `workers.dev` URL otherwise).
+- **`main`** is production. Every push auto-deploys the prod worker
+  (`.github/workflows/deploy-prod.yml`) — gated behind a `production`
+  GitHub Environment that requires an admin's approval before it runs.
+- **Promotion is manual**: run the **"Promote dev → main"** workflow
+  (`.github/workflows/promote.yml`) and it opens a PR from `dev` into `main`
+  with auto-merge enabled. With required reviews on `main`, a human approves
+  the PR; merging deploys prod (after the admin approval above).
+
+One-time setup:
+
+1. `pnpm run init:github` — creates a GitHub repo named after this project
+   (via the `gh` CLI; `-- --public` for a public repo), commits if needed,
+   pushes `main` + `dev`, makes `dev` the default branch, protects `main`
+   (PR + review + the `ci` check required), and creates a `production`
+   environment gated on your admin collaborators. Idempotent; `-- --dry-run`
+   previews. (Branch protection and environment reviewers need GitHub
+   Pro/Team on a private repo — the script prints the manual equivalent if
+   your plan doesn't support them.)
+2. `pnpm run init:hosting` — reads your Cloudflare account id (after
+   `npx wrangler login`) and sets the `CLOUDFLARE_ACCOUNT_ID` repo secret.
+   Idempotent; `-- --dry-run` previews.
+3. Create a Cloudflare API token (Workers edit —
+   <https://dash.cloudflare.com/profile/api-tokens>; tokens can't be created
+   via CLI) and `gh secret set CLOUDFLARE_API_TOKEN`. Optionally
+   `PROMOTE_TOKEN` (a PAT allowed to bypass protection) for hands-off
+   promotion. The first workflow runs fail until the secrets exist.
+
+`pnpm run deploy:dev` reproduces the dev deploy locally: it writes a
+gitignored `.wrangler.dev.json` with the worker renamed and any custom-domain
+route prefixed `dev.` (`scripts/dev-wrangler-config.mjs`), so it never
+touches the prod worker.
+
+## CI/deploy workflows
+
+`.github/workflows/{ci,deploy-dev,deploy-prod,promote}.yml` are thin callers
+of reusable workflows published by
+[`getvitops/design-system`](https://github.com/getvitops/design-system),
+pinned to `@v1`. A fix to the shared deploy logic there reaches this repo the
+next time those workflows run — no re-pasting needed. Bump the pin
+deliberately if you want to hold back a change.

package/templates/static/_gitignore

@@ -0,0 +1,24 @@
+# build output
+dist/
+
+# dependencies
+node_modules/
+
+# generated types
+.astro/
+
+# wrangler local state
+.wrangler/
+.wrangler.dev.json
+
+# generated by the vitops() integration on dev/build
+src/styles/
+public/vitops/
+
+# environment
+.env
+.env.*
+!.env.example
+
+# os / editor
+.DS_Store

package/templates/static/astro.config.mjs

@@ -0,0 +1,19 @@
+// @ts-check
+import vitops from '@getvitops/astro';
+import { defineConfig } from 'astro/config';
+
+export default defineConfig({
+  // Pure static output — deploys as Workers Static Assets (see
+  // wrangler.jsonc), no adapter and no server runtime.
+  output: 'static',
+  integrations: [
+    vitops({
+      css: {
+        input: 'design-system.json',
+        format: 'css',
+        out: 'src/styles',
+      },
+      webComponents: true,
+    }),
+  ],
+});

package/templates/static/design-system.json

@@ -0,0 +1,148 @@
+{
+  "$schema": "./node_modules/@getvitops/generator/schema.json",
+  "colors": {
+    "palette": {
+      "brand": { "seed": "#2e9b73" },
+      "ink": { "seed": "#3f4a5c" },
+      "sky": { "seed": "#2f7bc0" },
+      "sun": { "seed": "#d08a1f" },
+      "rose": { "seed": "#c74a42" }
+    },
+    "roles": {
+      "neutral": "ink",
+      "surface": "ink",
+      "ui-primary": "brand",
+      "brand-primary": "brand",
+      "info": "sky",
+      "success": "brand",
+      "warning": "sun",
+      "danger": "rose"
+    },
+    "utilities": ["bg", "text", "icon", "border"]
+  },
+  "shadows": {
+    "sm": "0 1px 2px rgb(0 0 0 / 0.08)",
+    "md": "0 4px 6px rgb(0 0 0 / 0.12)",
+    "lg": "0 10px 15px rgb(0 0 0 / 0.18)"
+  },
+  "fonts": {
+    "display": "system-ui, -apple-system, \"Segoe UI\", sans-serif",
+    "sans": "system-ui, -apple-system, \"Segoe UI\", Roboto, sans-serif",
+    "mono": "ui-monospace, \"SF Mono\", Menlo, monospace"
+  },
+  "typeScale": {
+    "base": "1rem",
+    "names": ["2xs", "xs", "s", "m", "l", "xl", "2xl", "3xl"],
+    "baseStep": 4,
+    "baseline": "m",
+    "ratio": 1.2,
+    "fluid": { "minVw": "22.5rem", "maxVw": "80rem", "minRatio": 1.12 }
+  },
+  "spaceScale": {
+    "base": "1rem",
+    "names": ["2xs", "xs", "s", "m", "l", "xl", "2xl", "3xl"],
+    "baseStep": 4,
+    "baseline": "m",
+    "ratio": 1.25,
+    "fluid": { "minVw": "22.5rem", "maxVw": "80rem", "minRatio": 1.2 }
+  },
+  "patterns": {
+    "defaults": {
+      "ds": "none",
+      "b": "1px solid var(--color-bg-surface-x-muted)",
+      "br": "0.375rem",
+      "p": "1rem",
+      "fs": "1rem"
+    },
+    "radii": { "circle": "50%" },
+    "groups": {
+      "control": {
+        "ds": "var(--ds-default)",
+        "b": "var(--b-default)",
+        "br": "var(--br-default)",
+        "p": "0.5em 1em",
+        "fs": "var(--fs-default)"
+      },
+      "panel": {
+        "ds": "var(--shadow-md)",
+        "b": "var(--b-default)",
+        "br": "0.5rem",
+        "p": "1rem",
+        "fs": "var(--fs-default)"
+      }
+    },
+    "z": { "raised": 1, "sticky": 100, "overlay": 200, "top": 1000 },
+    "items": {
+      "button": {
+        "group": "control",
+        "element": "button",
+        "default_role": "brand-primary",
+        "base": {
+          "padding": "0.6em 1.2em",
+          "border-radius": "var(--br-control, 0.25rem)",
+          "border": "none",
+          "font-weight": "600",
+          "color": "#fff",
+          "cursor": "pointer",
+          "box-shadow": "var(--shadow-sm)"
+        },
+        "states": {
+          "hover": { "step": 1 },
+          "active": { "scale": 0.97 },
+          "focus-visible": { "ring": true }
+        },
+        "roles": []
+      },
+      "card": {
+        "group": "panel",
+        "class": "card",
+        "base": {
+          "border-radius": "var(--br-card-group)",
+          "padding": "1.5rem",
+          "background": "var(--color-bg-surface-muted)",
+          "border": "var(--b-card-group)",
+          "box-shadow": "var(--ds-card-group)"
+        },
+        "states": {},
+        "roles": []
+      }
+    }
+  },
+  "typography": {
+    "families": {
+      "display": "var(--font-display)",
+      "sans": "var(--font-sans)",
+      "code": "var(--font-mono, ui-monospace, monospace)"
+    },
+    "roles": {
+      "display": {
+        "family": "display",
+        "size": "var(--text-3xl)",
+        "weight": 700,
+        "line-height": "1.05",
+        "tracking": "-0.03em"
+      },
+      "heading": {
+        "family": "display",
+        "size": "var(--text-xl)",
+        "weight": 600,
+        "line-height": "1.3"
+      },
+      "body": { "family": "sans", "size": "var(--text-m)", "weight": 400, "line-height": "1.55" }
+    },
+    "headings": { "h1": "display", "h2": "heading", "h3": "heading" }
+  },
+  "animations": {
+    "effects": {
+      "fade-in": { "kf": "composite", "vars": { "opacity-from": 0 } },
+      "slide-up": {
+        "kf": "composite",
+        "vars": { "translate-y-from": "var(--slide-distance, 2rem)" }
+      }
+    },
+    "journeys": {
+      "base": { "fade": { "opacity-from": 0 }, "slide": {} },
+      "compose": [["fade"], ["slide"], ["fade", "slide"]]
+    }
+  }
+}

package/templates/static/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "my-static-site",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "astro dev",
+    "build": "astro build",
+    "preview": "astro preview",
+    "deploy": "astro build && wrangler deploy",
+    "deploy:dev": "astro build && node scripts/dev-wrangler-config.mjs && wrangler deploy --config .wrangler.dev.json",
+    "init:github": "node scripts/init-github.mjs",
+    "init:hosting": "node scripts/init-hosting.mjs",
+    "typecheck": "astro check",
+    "build:css": "vitops generate -i design-system.json -f css -o src/styles",
+    "lint:design": "vitops lint -i design-system.json -f css --strict",
+    "prepare": "vp config"
+  },
+  "dependencies": {
+    "@getvitops/astro": "latest",
+    "astro": "^7.1.2"
+  },
+  "devDependencies": {
+    "@astrojs/check": "^0.9.7",
+    "@getvitops/cli": "latest",
+    "typescript": "^6.0.3",
+    "vite": "latest",
+    "vite-plus": "latest",
+    "wrangler": "^4.111.0"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "24.18.0",
+      "onFail": "download"
+    }
+  },
+  "packageManager": "pnpm@11.17.0"
+}

package/templates/static/scripts/dev-wrangler-config.mjs

@@ -0,0 +1,28 @@
+// Local counterpart to the rewrite the CI dev-deploy workflow does: no adapter
+// regenerates this site's `wrangler.jsonc` (it's a pure static build — Workers
+// Static Assets, no server config to merge), so the checked-in file already
+// IS the deploy config. This just suffixes the worker name and any
+// custom-domain route so a local `pnpm run deploy:dev` never touches the prod
+// worker, writing the result to a gitignored file rather than editing
+// wrangler.jsonc in place.
+//
+//   pnpm run deploy:dev   → astro build && node scripts/dev-wrangler-config.mjs
+//                           && wrangler deploy --config .wrangler.dev.json
+
+import { readFileSync, writeFileSync } from 'node:fs';
+
+const SRC = 'wrangler.jsonc';
+const OUT = '.wrangler.dev.json';
+
+const raw = readFileSync(SRC, 'utf8')
+  .replace(/\/\/.*$/gm, '')
+  .replace(/,(\s*[}\]])/g, '$1');
+const cfg = JSON.parse(raw);
+
+cfg.name = `${cfg.name}-dev`;
+cfg.routes = (cfg.routes ?? []).map((r) =>
+  r?.pattern ? { ...r, pattern: `dev.${r.pattern}` } : r,
+);
+
+writeFileSync(OUT, `${JSON.stringify(cfg, null, 2)}\n`);
+console.log(`Wrote ${OUT}\n  name: ${cfg.name}\n  routes: ${JSON.stringify(cfg.routes)}`);

package/templates/static/scripts/init-github.mjs

@@ -0,0 +1,186 @@
+// One-time GitHub bootstrap: creates a GitHub repo named after this project
+// (package.json name), pushes `main` + `dev`, makes `dev` the default branch,
+// and provisions the branch-protection + environment policy the deploy
+// workflows assume (deploy-dev on push to dev, deploy-prod on push to main,
+// promote.yml between them):
+//
+//   - `main` requires a PR + the `ci` status check — it only advances via
+//     promote.yml, never a direct push.
+//   - the `production` GitHub Environment requires review from an admin
+//     collaborator before deploy-prod.yml is allowed to run — this is the
+//     "promoting to prod needs admin sign-off" gate.
+//   - `dev` is left UNPROTECTED on purpose — that's what lets an agent (or
+//     anyone with push access) commit and merge there directly for
+//     integration; only the promotion to `main` is gated.
+//
+//   pnpm run init:github             # private repo (default)
+//   pnpm run init:github -- --public
+//   pnpm run init:github -- --dry-run
+//
+// Idempotent: safe to re-run — existing git repo, commits, dev branch, origin
+// remote, branch protection and environments are all left alone or updated
+// in place. Requires the GitHub CLI (`gh`), logged in (`gh auth login`).
+//
+// NOTE: branch protection and environment required-reviewers are GitHub
+// Pro/Team features on a PRIVATE repo. Each `gh api` call below prints the
+// manual equivalent and continues rather than aborting when it 403s.
+
+import { execSync, spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+
+const args = new Set(process.argv.slice(2));
+const dryRun = args.has('--dry-run');
+const visibility = args.has('--public') ? '--public' : '--private';
+
+const repoName = JSON.parse(readFileSync('package.json', 'utf8')).name.replace(/^@[^/]+\//, '');
+
+function check(cmd) {
+  return spawnSync(cmd[0], cmd.slice(1), { encoding: 'utf8' });
+}
+
+function quiet(cmd) {
+  try {
+    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function run(cmd) {
+  if (dryRun) {
+    console.log(`[dry-run] ${cmd}`);
+    return;
+  }
+  console.log(`$ ${cmd}`);
+  try {
+    execSync(cmd, { stdio: 'inherit' });
+  } catch {
+    console.error(
+      `\nERROR: \`${cmd}\` failed (see output above). Fix and re-run — the script is idempotent.`,
+    );
+    process.exit(1);
+  }
+}
+
+/**
+ * Like `run`, but for `gh api` calls that provision an org/plan-gated
+ * feature (branch protection, environment reviewers). A 403 there means the
+ * repo's plan doesn't support it — not that the bootstrap failed — so this
+ * prints the manual equivalent and keeps going instead of exiting.
+ */
+function runPolicy(cmd, manualHint) {
+  if (dryRun) {
+    console.log(`[dry-run] ${cmd}`);
+    return;
+  }
+  console.log(`$ ${cmd}`);
+  const result = spawnSync(cmd, { shell: true, encoding: 'utf8' });
+  if (result.status === 0) return;
+  console.warn(
+    `\nWARNING: \`${cmd}\` failed (likely needs GitHub Pro/Team on a private repo).\n` +
+      `Set it up manually instead:\n  ${manualHint}\n`,
+  );
+}
+
+// --- Preflight: gh installed and authenticated -------------------------------
+if (check(['gh', '--version']).status !== 0) {
+  console.error('ERROR: the GitHub CLI (`gh`) is required. Install it from https://cli.github.com');
+  process.exit(1);
+}
+if (check(['gh', 'auth', 'status']).status !== 0) {
+  console.error('ERROR: `gh` is not logged in. Run `gh auth login` first.');
+  process.exit(1);
+}
+
+// --- Local git: repo, initial commit, main + dev branches --------------------
+if (quiet('git rev-parse --is-inside-work-tree') === null) {
+  run('git init -b main');
+}
+if (quiet('git rev-parse HEAD') === null) {
+  run('git add -A');
+  run('git commit -m "Initial commit (scaffolded from @getvitops/create)"');
+}
+
+// The workflows key off `main`; normalize whatever the initial branch is.
+const branch = quiet('git branch --show-current');
+if (branch && branch !== 'main' && branch !== 'dev') {
+  run(`git branch -m ${branch} main`);
+}
+if (quiet('git show-ref --verify refs/heads/dev') === null) {
+  run('git branch dev main');
+}
+
+// --- GitHub: create repo (same name), push, default to dev -------------------
+if (quiet('git remote get-url origin') === null) {
+  run(`gh repo create ${repoName} ${visibility} --source=. --remote=origin`);
+} else {
+  console.log('origin remote already set — skipping `gh repo create`.');
+}
+run('git push -u origin main dev');
+run('gh repo edit --default-branch dev');
+run('git checkout dev');
+
+// --- Policy: protect main, gate production behind admin review --------------
+const nwo = quiet('gh repo view --json nameWithOwner -q .nameWithOwner');
+if (nwo) {
+  runPolicy(
+    `gh api -X PUT repos/${nwo}/branches/main/protection --input - <<'JSON'
+{
+  "required_status_checks": { "strict": true, "contexts": ["ci"] },
+  "enforce_admins": false,
+  "required_pull_request_reviews": { "required_approving_review_count": 1 },
+  "restrictions": null,
+  "allow_force_pushes": false,
+  "allow_deletions": false
+}
+JSON`,
+    `Settings → Branches → protect 'main' (require a PR, 1 approval, the 'ci' ` +
+      `status check, no force-push/deletion).`,
+  );
+
+  const admins = quiet(
+    `gh api repos/${nwo}/collaborators?permission=admin -q '[.[].login]' 2>/dev/null`,
+  );
+  const reviewers = admins
+    ? JSON.parse(admins).map((login) => ({ type: 'User', id_or_login: login }))
+    : [];
+
+  runPolicy(
+    `gh api -X PUT repos/${nwo}/environments/production --input - <<'JSON'
+{
+  "reviewers": ${JSON.stringify(reviewers)},
+  "deployment_branch_policy": { "protected_branches": true, "custom_branch_policies": false }
+}
+JSON`,
+    `Settings → Environments → 'production' → require reviewers = your admins, ` +
+      `restrict deployment branches to 'main'. This is the prod-needs-admin-approval gate.`,
+  );
+
+  // `dev` gets an environment too (for the deploy-dev workflow's `environment:
+  // dev` reference), but deliberately no reviewers and no branch restriction —
+  // that's what keeps it open for direct pushes/merges.
+  runPolicy(
+    `gh api -X PUT repos/${nwo}/environments/dev --input - <<'JSON'
+{ "reviewers": [] }
+JSON`,
+    `Settings → Environments → create 'dev' with no required reviewers.`,
+  );
+} else {
+  console.warn('WARNING: could not resolve the repo name-with-owner; skipping policy setup.');
+}
+
+// --- What's left (manual, needs your Cloudflare account) ---------------------
+console.log(`
+Repo ready: main (protected, production) + dev (integration, default branch).
+NOTE: the first workflow runs will fail until the secrets below exist.
+
+Next steps:
+  1. Dev resources:  wrangler d1 create ${repoName}-dev   (note the printed id)
+                     wrangler r2 bucket create ${repoName}-media-dev
+  2. Secrets:        gh secret set CLOUDFLARE_API_TOKEN
+                     gh secret set CLOUDFLARE_ACCOUNT_ID
+                     gh secret set DEV_D1_ID
+  3. Verify policy:  Settings → Branches (main protected?) and
+                     Settings → Environments → production (reviewers set?) —
+                     printed above if this ran on a plan that supports them.
+`);

package/templates/static/scripts/init-hosting.mjs

@@ -0,0 +1,62 @@
+// One-time hosting-platform setup for this static site.
+//
+//   pnpm run init:hosting
+//   pnpm run init:hosting -- --dry-run
+//
+// There is no D1/R2 to provision here — a pure static build has no data
+// layer — so this reduces to reading the Cloudflare account id from
+// `wrangler whoami` and, when a GitHub repo is wired up (see
+// init-github.mjs), setting it as a repo secret. The API token itself still
+// has to be created by hand (the CLI can't mint one).
+//
+// Idempotent: safe to re-run. Requires wrangler auth (`npx wrangler login`).
+
+import { execSync, spawnSync } from 'node:child_process';
+
+const dryRun = process.argv.includes('--dry-run');
+
+function quiet(cmd) {
+  try {
+    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function run(cmd) {
+  if (dryRun) {
+    console.log(`[dry-run] ${cmd}`);
+    return;
+  }
+  console.log(`$ ${cmd}`);
+  execSync(cmd, { stdio: 'inherit' });
+}
+
+const whoami = spawnSync('npx', ['wrangler', 'whoami'], { encoding: 'utf8' });
+if (whoami.status !== 0) {
+  console.error('ERROR: wrangler is not logged in. Run `npx wrangler login` first.');
+  process.exit(1);
+}
+// "Account Name | <32-hex account id>" table row in `wrangler whoami` output.
+const accountId = (whoami.stdout.match(/\b([0-9a-f]{32})\b/) ?? [])[1] ?? null;
+
+const hasGh = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8' }).status === 0;
+const hasOrigin = quiet('git remote get-url origin') !== null;
+if (hasGh && hasOrigin && accountId) {
+  run(`gh secret set CLOUDFLARE_ACCOUNT_ID --body ${accountId}`);
+} else {
+  console.log(
+    '\nSkipping GitHub secret (no gh auth, no origin remote, or no account id — run init:github first).',
+  );
+}
+
+console.log(`
+Cloudflare account: ${accountId ?? '(not found — check `wrangler whoami`)'}
+
+Still manual (CLI can't create API tokens):
+  1. Create a token with Workers edit permission:
+     https://dash.cloudflare.com/profile/api-tokens
+  2. gh secret set CLOUDFLARE_API_TOKEN
+
+Prod/dev D1/R2 don't apply here — this is a pure static site.
+`);

package/templates/static/src/assets/placeholder/wireframe-400x400.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 400 400"><rect width="100%" height="100%" fill="#DDDDDD"/><path fill="#999999" d="M87.3 204.72h11.66v-12.54q0-1.77.24-3.92zm17.36 0h4.82v3.79q0 .53-.35.91-.34.39-.98.39h-3.49v9.35h-5.7v-9.35H82.79q-.66 0-1.16-.42-.51-.41-.64-1.02l-.69-3.31 18.16-24.25h6.2zm35.59-4.72q0 5.01-1.08 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.47 3.59-2.59 1.18-5.58 1.18-3 0-5.55-1.18-2.56-1.17-4.44-3.59-1.88-2.41-2.94-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.94-6.09t4.44-3.59q2.55-1.18 5.55-1.18 2.99 0 5.58 1.18 2.58 1.18 4.47 3.59 1.9 2.41 2.97 6.09 1.08 3.69 1.08 8.72m-6.76 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1 1.62-1.6 4.35t-.6 6.89.6 6.89 1.6 4.35q1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m37.5 0q0 5.01-1.08 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.47 3.59-2.59 1.18-5.58 1.18-3 0-5.55-1.18-2.56-1.17-4.44-3.59-1.88-2.41-2.94-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.94-6.09t4.44-3.59q2.55-1.18 5.55-1.18 2.99 0 5.58 1.18 2.58 1.18 4.47 3.59 1.9 2.41 2.97 6.09 1.08 3.69 1.08 8.72m-6.76 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1 1.62-1.6 4.35t-.6 6.89.6 6.89 1.6 4.35q1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m48.84 10.39-3.47 3.42-8.99-8.99-9.06 9.04-3.47-3.42 9.06-9.09-8.64-8.64 3.45-3.44 8.64 8.64 8.58-8.59 3.5 3.45-8.61 8.61zm22.95-5.67h11.66v-12.54q0-1.77.24-3.92zm17.35 0h4.83v3.79q0 .53-.35.91-.34.39-.98.39h-3.5v9.35h-5.69v-9.35h-16.17q-.66 0-1.16-.42-.51-.41-.64-1.02l-.69-3.31 18.15-24.25h6.2zm35.59-4.72q0 5.01-1.07 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.48 3.59-2.58 1.18-5.57 1.18-3 0-5.56-1.18-2.55-1.17-4.43-3.59-1.89-2.41-2.95-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.95-6.09 1.88-2.41 4.43-3.59 2.56-1.18 5.56-1.18 2.99 0 5.57 1.18 2.59 1.18 4.48 3.59 1.9 2.41 2.97 6.09 1.07 3.69 1.07 8.72m-6.75 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1.01 1.62-1.6 4.35-.6 2.73-.6 6.89t.6 6.89q.59 2.73 1.6 4.35 1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m37.49 0q0 5.01-1.07 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.48 3.59-2.58 1.18-5.57 1.18-3 0-5.56-1.18-2.55-1.17-4.43-3.59-1.89-2.41-2.95-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.95-6.09 1.88-2.41 4.43-3.59 2.56-1.18 5.56-1.18 2.99 0 5.57 1.18 2.59 1.18 4.48 3.59 1.9 2.41 2.97 6.09 1.07 3.69 1.07 8.72m-6.75 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1.01 1.62-1.6 4.35-.6 2.73-.6 6.89t.6 6.89q.59 2.73 1.6 4.35 1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89"/></svg>