@getvitops/create 0.6.0 → 0.8.0-alpha.0

package/templates/emdash/package.json

@@ -7,25 +7,30 @@
     "dev": "astro dev",
     "build": "astro build",
     "preview": "astro preview",
-    "deploy": "astro build && wrangler deploy",
-    "deploy:dev": "astro build && node scripts/build-dev-wrangler.mjs && wrangler deploy --config dist/server/wrangler.dev.json",
-    "init:github": "node scripts/init-github.mjs",
-    "init:hosting": "node scripts/init-hosting.mjs",
+    "deploy": "vitops email check && astro build && emdash migrate --wrangler-config wrangler.jsonc && wrangler deploy",
+    "deploy:dev": "vitops email check && astro build && node scripts/build-dev-wrangler.mjs && emdash migrate --wrangler-config dist/server/wrangler.dev.json && wrangler deploy --config dist/server/wrangler.dev.json",
+    "init:github": "vitops setup repo",
+    "init:hosting": "vitops setup hosting",
+    "setup": "vitops setup all",
     "typecheck": "astro check",
-    "build:css": "vitops generate -i design-system.json -f tailwind -o src/styles",
-    "lint:design": "vitops lint -i design-system.json -f tailwind --strict",
+    "build:css": "vitops generate -i site.json -f tailwind -o src/styles",
+    "lint:design": "vitops lint -i site.json -f tailwind --strict",
+    "sop": "vitops generate -i site.json -f css -o .vitops/sop",
     "prepare": "vp config"
   },
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.0",
     "@astrojs/react": "^6.0.0",
-    "@emdash-cms/cloudflare": "^0.31.0",
+    "@emdash-cms/cloudflare": "^1.0.1",
     "@getvitops/astro": "latest",
+    "@getvitops/core": "latest",
     "@getvitops/emdash": "latest",
+    "@tailwindcss/vite": "^4.3.3",
     "astro": "^7.1.2",
-    "emdash": "^0.31.0",
+    "emdash": "^1.0.1",
     "react": "^19.2.4",
-    "react-dom": "^19.2.4"
+    "react-dom": "^19.2.4",
+    "tailwindcss": "^4.3.3"
   },
   "devDependencies": {
     "@astrojs/check": "^0.9.7",

package/templates/emdash/seed/seed.json

@@ -97,7 +97,7 @@
               "_type": "vitops.details",
               "_key": "next-steps",
               "summary": "Next steps",
-              "body": "Adjust design-system.json to your brand (colors, type, patterns), replace src/assets/logo.svg, then deploy with `pnpm deploy`.",
+              "body": "Adjust site.json (under designSystem.themes.default) to your brand (colors, type, patterns), replace src/assets/logo.svg, then deploy with `pnpm deploy`.",
               "open": false
             }
           ]

package/templates/emdash/site.json

@@ -0,0 +1,303 @@
+{
+  "$schema": "./node_modules/@getvitops/generator/config.schema.json",
+  "designSystem": {
+    "themes": {
+      "default": {
+        "$schema": "./node_modules/@getvitops/generator/schema.json",
+        "colors": {
+          "palette": {
+            "brand": {
+              "seed": "#2e9b73"
+            },
+            "ink": {
+              "seed": "#3f4a5c"
+            },
+            "sky": {
+              "seed": "#2f7bc0"
+            },
+            "sun": {
+              "seed": "#d08a1f"
+            },
+            "rose": {
+              "seed": "#c74a42"
+            }
+          },
+          "roles": {
+            "neutral": "ink",
+            "surface": "ink",
+            "ui-primary": "brand",
+            "brand-primary": "brand",
+            "info": "sky",
+            "success": "brand",
+            "warning": "sun",
+            "danger": "rose"
+          },
+          "utilities": ["bg", "text", "icon", "border"]
+        },
+        "shadows": {
+          "sm": "0 1px 2px rgb(0 0 0 / 0.08)",
+          "md": "0 4px 6px rgb(0 0 0 / 0.12)",
+          "lg": "0 10px 15px rgb(0 0 0 / 0.18)"
+        },
+        "fonts": {
+          "display": "system-ui, -apple-system, \"Segoe UI\", sans-serif",
+          "sans": "system-ui, -apple-system, \"Segoe UI\", Roboto, sans-serif",
+          "mono": "ui-monospace, \"SF Mono\", Menlo, monospace"
+        },
+        "typeScale": {
+          "base": "1rem",
+          "names": ["2xs", "xs", "s", "m", "l", "xl", "2xl", "3xl"],
+          "baseStep": 4,
+          "baseline": "m",
+          "ratio": 1.2,
+          "fluid": {
+            "minVw": "22.5rem",
+            "maxVw": "80rem",
+            "minRatio": 1.12
+          }
+        },
+        "spaceScale": {
+          "base": "1rem",
+          "names": ["2xs", "xs", "s", "m", "l", "xl", "2xl", "3xl"],
+          "baseStep": 4,
+          "baseline": "m",
+          "ratio": 1.25,
+          "fluid": {
+            "minVw": "22.5rem",
+            "maxVw": "80rem",
+            "minRatio": 1.2
+          }
+        },
+        "patterns": {
+          "defaults": {
+            "ds": "none",
+            "b": "1px solid var(--color-bg-surface-x-muted)",
+            "br": "0.375rem",
+            "p": "1rem",
+            "fs": "1rem"
+          },
+          "radii": {
+            "circle": "50%"
+          },
+          "groups": {
+            "control": {
+              "ds": "var(--ds-default)",
+              "b": "var(--b-default)",
+              "br": "var(--br-default)",
+              "p": "0.5em 1em",
+              "fs": "var(--fs-default)"
+            },
+            "panel": {
+              "ds": "var(--shadow-md)",
+              "b": "var(--b-default)",
+              "br": "0.5rem",
+              "p": "1rem",
+              "fs": "var(--fs-default)"
+            }
+          },
+          "z": {
+            "raised": 1,
+            "sticky": 100,
+            "overlay": 200,
+            "top": 1000
+          },
+          "items": {
+            "button": {
+              "group": "control",
+              "element": "button",
+              "default_role": "brand-primary",
+              "base": {
+                "padding": "0.6em 1.2em",
+                "border-radius": "var(--br-control, 0.25rem)",
+                "border": "none",
+                "font-weight": "600",
+                "color": "#fff",
+                "cursor": "pointer",
+                "box-shadow": "var(--shadow-sm)"
+              },
+              "states": {
+                "hover": {
+                  "step": 1
+                },
+                "active": {
+                  "scale": 0.97
+                },
+                "focus-visible": {
+                  "ring": true
+                }
+              },
+              "roles": []
+            },
+            "card": {
+              "group": "panel",
+              "class": "card",
+              "base": {
+                "border-radius": "var(--br-card-group)",
+                "padding": "1.5rem",
+                "background": "var(--color-bg-surface-muted)",
+                "border": "var(--b-card-group)",
+                "box-shadow": "var(--ds-card-group)"
+              },
+              "states": {},
+              "roles": []
+            }
+          }
+        },
+        "typography": {
+          "families": {
+            "display": "var(--font-display)",
+            "sans": "var(--font-sans)",
+            "code": "var(--font-mono, ui-monospace, monospace)"
+          },
+          "roles": {
+            "display": {
+              "family": "display",
+              "size": "var(--text-3xl)",
+              "weight": 700,
+              "line-height": "1.05",
+              "tracking": "-0.03em"
+            },
+            "heading": {
+              "family": "display",
+              "size": "var(--text-xl)",
+              "weight": 600,
+              "line-height": "1.3"
+            },
+            "body": {
+              "family": "sans",
+              "size": "var(--text-m)",
+              "weight": 400,
+              "line-height": "1.55"
+            }
+          },
+          "headings": {
+            "h1": "display",
+            "h2": "heading",
+            "h3": "heading"
+          }
+        },
+        "animations": {
+          "effects": {
+            "fade-in": {
+              "kf": "composite",
+              "vars": {
+                "opacity-from": 0
+              }
+            },
+            "slide-up": {
+              "kf": "composite",
+              "vars": {
+                "translate-y-from": "var(--slide-distance, 2rem)"
+              }
+            }
+          },
+          "journeys": {
+            "base": {
+              "fade": {
+                "opacity-from": 0
+              },
+              "slide": {}
+            },
+            "compose": [["fade"], ["slide"], ["fade", "slide"]]
+          }
+        }
+      }
+    },
+    "defaultColorScheme": "light"
+  },
+  "organization": {
+    "name": "My EmDash Site"
+  },
+  "site": {
+    "defaultLocale": "en",
+    "locales": {
+      "en": {
+        "name": "English"
+      }
+    },
+    "environments": {
+      "production": {
+        "url": "https://my-emdash-site.example.com"
+      },
+      "dev": {
+        "url": "https://dev.my-emdash-site.example.com",
+        "robots": "noindex,nofollow"
+      }
+    },
+    "icons": {
+      "sprite": true,
+      "semantic": [
+        "menu",
+        "close",
+        "home",
+        "settings",
+        "search",
+        "add",
+        "remove",
+        "delete",
+        "edit",
+        "save",
+        "copy",
+        "paste",
+        "attach",
+        "upload",
+        "download",
+        "share",
+        "bookmark",
+        "favorite",
+        "star",
+        "login",
+        "logout",
+        "email",
+        "phone",
+        "location",
+        "globe",
+        "link",
+        "clock",
+        "calendar",
+        "schedule",
+        "person",
+        "group",
+        "file",
+        "folder",
+        "image",
+        "export",
+        "import",
+        "backup",
+        "compress",
+        "check",
+        "error",
+        "warning",
+        "info",
+        "help",
+        "cart",
+        "tag",
+        "receipt",
+        "leaf",
+        "tree",
+        "seedling",
+        "trowel",
+        "droplet",
+        "snowflake",
+        "sun",
+        "cloud",
+        "grid",
+        "list",
+        "filter",
+        "sort",
+        "fullscreen",
+        "collapse",
+        "building",
+        "video",
+        "lock",
+        "unlock",
+        "eye",
+        "print",
+        "code",
+        "palette",
+        "lightbulb",
+        "lightning"
+      ]
+    }
+  }
+}

package/templates/emdash/src/layouts/Layout.astro

@@ -1,8 +1,10 @@
 ---
 import VitopsHead from '@getvitops/astro/Head.astro';
+import { resolveOrganizationName } from '@getvitops/astro/routes';
 import { getMenu, getSiteSettings } from 'emdash';
 import { createPublicPageContext } from 'emdash/page';
 import { EmDashHead } from 'emdash/ui';
+import config from '../../site.json' with { type: 'json' };
 // Design-system CSS, layout-scoped (vitops css.inject: false): only pages
 // rendered through this layout get it — keeps it out of /_emdash/admin, while
 // EmDash previews (rendered through this layout) keep it.
@@ -19,7 +21,11 @@ interface Props {
 
 const { title, description, image } = Astro.props;
 const settings = await getSiteSettings();
-const siteTitle = settings?.title || 'My EmDash Site';
+// getSiteSettings().title is the editable, client-facing display name (set in
+// the EmDash admin) — it wins whenever it's set. resolveOrganizationName(config)
+// is the fallback rather than a second hardcoded string, so a fresh scaffold
+// shows organization.name (from site.json) before anyone's touched the admin.
+const siteTitle = settings?.title || resolveOrganizationName(config) || 'My EmDash Site';
 const fullTitle = title ? `${title} — ${siteTitle}` : siteTitle;
 const siteDescription = settings?.tagline || 'An EmDash website with the Vitops design system';
 

package/templates/emdash/src/pages/404.astro

@@ -1,5 +1,10 @@
 ---
 import Layout from '../layouts/Layout.astro';
+
+// No per-request data — safe to prerender per AGENTS.md's "Prerender by
+// default" rule. [...slug].astro reaches this via Astro.rewrite('/404'),
+// which resolves a prerendered destination the same as a server-rendered one.
+export const prerender = true;
 ---
 
 <Layout title="Page not found">

package/templates/emdash/src/pages/[...slug].astro

@@ -4,6 +4,13 @@ import { PortableText } from 'emdash/ui';
 import Layout from '../layouts/Layout.astro';
 
 // Catch-all: any entry in the `pages` collection renders at its slug.
+//
+// Deliberately NOT prerendered, unlike AGENTS.md's general "prerender by
+// default" rule — see index.astro's comment for why: a live EmDash publish
+// should reach visitors without a redeploy. A page that's known ahead of
+// time and doesn't need that (rarely edited, or fine to lag a build) can
+// move to its own prerendered route with `getStaticPaths()` over the
+// `pages` collection instead of relying on this catch-all.
 const { slug } = Astro.params;
 const { entry: page } = slug ? await getEmDashEntry('pages', slug) : { entry: null };
 

package/templates/emdash/src/pages/index.astro

@@ -6,6 +6,13 @@ import Layout from '../layouts/Layout.astro';
 // The seeded home page (seed/seed.json → pages/home). Edit it in the admin;
 // the Vitops blocks from @getvitops/emdash render automatically — EmDash
 // merges the plugin's block components into <PortableText>.
+//
+// Deliberately NOT prerendered, unlike AGENTS.md's general "prerender by
+// default" rule: this is the one route where the tradeoff that rule names
+// (prerendered = fast, but reflects the database as of the last build) is
+// unacceptable — the whole point of editing in EmDash is that a publish
+// shows up without a redeploy. Add `getStaticPaths()` + `prerender = true`
+// here only if this site's home page genuinely doesn't need that.
 const { entry: page } = await getEmDashEntry('pages', 'home');
 ---
 

package/templates/emdash/vite.config.ts

@@ -8,16 +8,30 @@ export default defineConfig({
     // `subgrid` is the drift this catches, and it is only ever cheap to fix at the
     // moment it is written. `vitops lint` takes the staged paths as positionals.
     'src/**/*.{astro,html,ts,tsx,jsx,vue,svelte,css}':
-      'vitops lint -i design-system.json -f tailwind --strict',
+      'vitops lint -i site.json -f tailwind --strict',
   },
   fmt: {
+    // Explicit, matching the monorepo root's style: unlike `lint`, a nested
+    // `fmt` config genuinely takes effect independently here rather than
+    // being root-only, so leaving these unset let this file (and anything
+    // else oxfmt formats under this directory, e.g. SETUP.html's embedded
+    // `<script>`) drift to a different default quote style each time
+    // `vp check --fix` ran, breaking `templates.test.ts`'s byte-identical
+    // mirror assertion.
+    semi: true,
+    singleQuote: true,
     ignorePatterns: ['dist/**', 'node_modules/**', 'src/styles/**', 'public/vitops/**'],
   },
   lint: {
     ignorePatterns: ['dist/**', 'node_modules/**', 'src/styles/**', 'public/vitops/**'],
-    options: {
-      typeAware: true,
-      typeCheck: true,
-    },
+    // `options.typeAware`/`typeCheck` commented out, not deleted: vite-plus 1.0
+    // only honours those at the root config, and while this file sits nested
+    // inside the getvitops/design-system monorepo (which has its own root
+    // vite.config.ts), setting them here is a hard error — "typeAware is only
+    // supported in the root config" — rather than the silent no-op it was
+    // pre-1.0. Once `vp create @getvitops:emdash` scaffolds this file out into
+    // its own project, it *becomes* that project's root config, and
+    // uncommenting this is the right move there.
+    // options: { typeAware: true, typeCheck: true },
   },
 });

package/templates/emdash/wrangler.jsonc

@@ -4,11 +4,16 @@
   "main": "./src/worker.ts",
   "compatibility_date": "2026-02-24",
   "compatibility_flags": ["nodejs_compat"],
+  // Explicit rather than relying on wrangler's default: this is the fact that
+  // lets a first deploy go live at <name>.<account>.workers.dev without
+  // touching any existing site's DNS — see SETUP.html's "Domain strategy"
+  // stage and site.json's environments.production.url.
   "workers_dev": true,
   // Custom domain: uncomment and set your apex. Cloudflare provisions the DNS
-  // record + TLS cert on deploy (the zone must already exist in the account).
-  // The dev deploy (scripts/build-dev-wrangler.mjs) automatically serves the
-  // dev worker from dev.<domain> when this is set.
+  // record + TLS cert on deploy (the zone must already exist in the account) —
+  // and OVERWRITES it, the moment an existing live site at that domain goes
+  // dark. The dev deploy (scripts/build-dev-wrangler.mjs) automatically serves
+  // the dev worker from dev.<domain> when this is set.
   // "routes": [{ "pattern": "example.com", "custom_domain": true }],
   // No database_id / bucket ids needed up front: wrangler provisions the D1
   // database and R2 bucket on the first `pnpm deploy` if they don't exist.

package/templates/static/.agents/skills/setup/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: setup
+description: Work the client-onboarding checklist (SETUP.html) autonomously — GitHub repo + branch policy, hosting resources, Search Console/GCP/ads connections. Use when the user asks to set up, onboard, or provision this project (e.g. "run setup", "onboard this site", "get this ready to deploy"). Never run this as a side effect of unrelated work, and never on your own initiative without the user asking.
+---
+
+# Setup (client onboarding)
+
+`SETUP.html` is the canonical checklist — this skill adds only sequencing,
+gates, and where to stop. It does not restate the steps; read `SETUP.html`
+(or `npx vitops setup --help`) for what each stage actually does and why.
+
+## Steps
+
+1. **Preview the whole sequence first.**
+
+   ```bash
+   npx vitops setup all --dry
+   ```
+
+   Read the plan before doing anything. It names every step it would take and
+   why any step is blocked — a missing credential, a field not yet in
+   `site.json`, GitHub Pro/Team gating branch protection.
+
+2. **Run it.**
+
+   ```bash
+   npx vitops setup all
+   ```
+
+   Re-run `npx vitops setup --check` after each leg rather than retrying on
+   your own judgment — a step already done resolves to a no-op skip, so a
+   second run is safe, and `--check` tells you exactly what still needs doing
+   instead of you guessing from output.
+
+3. **Tick `SETUP.html` boxes only for what you actually completed.** Never
+   check a box for a step marked below as human-only, even if you did
+   everything up to it — the human still has to act.
+
+## Hard stops — ask the human, do not attempt
+
+- **The Cloudflare API token.** No API can create one; there is no command to
+  run. Tell the user to create it at
+  <https://dash.cloudflare.com/profile/api-tokens> (Workers + D1 + R2 edit)
+  and run `gh secret set CLOUDFLARE_API_TOKEN`, then continue.
+- **The domain cutover** (`vitops setup domain`, stage 4b in `SETUP.html`).
+  Uncommenting the custom-domain route and deploying overwrites the zone's DNS
+  record at that instant — it takes an existing live site down. `setup domain`
+  only ever plans and checks this; it never applies it, and neither should
+  you. Report the plan and hand the actual cutover to the user.
+- **Publishing any generated legal document.** `vitops legal` renders a
+  starting point from the config, not a reviewed policy. Generate it, tell the
+  user it needs review, and stop — do not paste it into the admin or commit it
+  yourself.
+
+## If something is blocked
+
+`vitops setup --check` names the field or credential and where to get it —
+report that verbatim rather than guessing at a fix. A step reported as
+"blocked" is not a failure to retry; it is waiting on one of the hard stops
+above, or on a `site.json` field the user still needs to fill in (stage 5,
+Configuration).

package/templates/static/.github/workflows/deploy-prod.yml

@@ -1,7 +1,7 @@
 # Deploys `main` to production.
 # `main` should be branch-protected — it then only advances via the Promote
 # workflow (promote.yml), so a push here always represents promoted code. The
-# `production` GitHub Environment (set up by `scripts/init-github.mjs`) has
+# `production` GitHub Environment (set up by `vitops setup repo`) has
 # required reviewers restricted to admins, so this PAUSES for approval before
 # deploying.
 #

package/templates/static/AGENTS.md

@@ -3,10 +3,13 @@ as Cloudflare Workers static assets (no server runtime, no database).
 
 ## Ground rules
 
-- `design-system.json` is the single source of truth for the design system
-  (colors, type, spacing, patterns, animations). Never edit `src/styles/` by
-  hand — it is generated from the JSON by the `vitops()` integration on every
-  dev/build and is gitignored.
+- `site.json` is the single source of truth — organization + site facts, and
+  the design system (colors, type, spacing, patterns, animations) under
+  `designSystem.themes.default`. Never edit `src/styles/` by hand — it is
+  generated from `site.json` by the `vitops()` integration on every dev/build
+  and is gitignored. (There is no separate `design-system.json`: a scaffolded
+  config can't merely reference a sibling file, so the token set lives inside
+  `site.json`.)
 - `src/assets/placeholder/` holds neutral wireframe stand-ins (square,
   portrait, landscape; SVG + PNG) for layout work before real imagery
   exists. Delete the directory once real assets land.
@@ -29,6 +32,10 @@ as Cloudflare Workers static assets (no server runtime, no database).
   (cookies, headers, query params) at render time. If a page genuinely needs
   that, it needs an adapter and a different template — this one stays pure
   static on purpose.
+- **`SETUP.html` is the client-onboarding checklist.** When working it via the
+  `.agents/skills/setup/` skill, tick a box only for a step you actually
+  completed — never on the operator's behalf for a step marked human-only
+  (the Cloudflare API token, the domain cutover, publishing legal documents).
 
 ## Branch model
 
@@ -44,7 +51,7 @@ as Cloudflare Workers static assets (no server runtime, no database).
 
 - `pnpm dev` — local dev
 - `pnpm typecheck` — `astro check`
-- `pnpm run build:css` — regenerate the framework CSS from `design-system.json`
+- `pnpm run build:css` — regenerate the framework CSS from `site.json`
 - `pnpm deploy` — build + `wrangler deploy` to prod
 - `pnpm run deploy:dev` — build + deploy the isolated dev worker
 - `pnpm run init:github` — one-time: create + push the GitHub repo (main +
@@ -52,6 +59,6 @@ as Cloudflare Workers static assets (no server runtime, no database).
   the user asks to set up GitHub.
 - `pnpm run init:hosting` — one-time: read the Cloudflare account id and set
   it as a repo secret. Only run when the user asks for it.
-- `npx vitops validate design-system.json` — schema-check the design config
-- `npx vitops lint -i design-system.json -f css` — find framework classes in
+- `npx vitops validate site.json` — schema-check the site config
+- `npx vitops lint -i site.json -f css` — find framework classes in
   source that resolve to nothing under this format

package/templates/static/README.md

@@ -10,8 +10,9 @@ Scaffolded from `vp create @getvitops:static`.
 
 - **Astro** (`output: 'static'`) on **Cloudflare Workers Static Assets** — no
   adapter, no database, no server runtime
-- **`@getvitops/astro`** — generates the design-system CSS from
-  `design-system.json` and serves the web-component runtime
+- **`@getvitops/astro`** — generates the design-system CSS from `site.json`
+  (design tokens live at `designSystem.themes.default`) and serves the
+  web-component runtime
 
 `src/assets/placeholder/` ships neutral wireframe images for layout work
 before real imagery exists — delete once real assets land.
@@ -51,24 +52,18 @@ The repo ships a two-environment flow modeled on branch = environment:
   with auto-merge enabled. With required reviews on `main`, a human approves
   the PR; merging deploys prod (after the admin approval above).
 
-One-time setup:
-
-1. `pnpm run init:github` — creates a GitHub repo named after this project
-   (via the `gh` CLI; `-- --public` for a public repo), commits if needed,
-   pushes `main` + `dev`, makes `dev` the default branch, protects `main`
-   (PR + review + the `ci` check required), and creates a `production`
-   environment gated on your admin collaborators. Idempotent; `-- --dry-run`
-   previews. (Branch protection and environment reviewers need GitHub
-   Pro/Team on a private repo — the script prints the manual equivalent if
-   your plan doesn't support them.)
-2. `pnpm run init:hosting` — reads your Cloudflare account id (after
-   `npx wrangler login`) and sets the `CLOUDFLARE_ACCOUNT_ID` repo secret.
-   Idempotent; `-- --dry-run` previews.
-3. Create a Cloudflare API token (Workers edit —
-   <https://dash.cloudflare.com/profile/api-tokens>; tokens can't be created
-   via CLI) and `gh secret set CLOUDFLARE_API_TOKEN`. Optionally
-   `PROMOTE_TOKEN` (a PAT allowed to bypass protection) for hands-off
-   promotion. The first workflow runs fail until the secrets exist.
+One-time setup — work through the checklist:
+
+```bash
+pnpm run sop && open SETUP.html   # or: xdg-open SETUP.html
+```
+
+It covers host choice, GitHub + branch policy, hosting resources, going live
+safely on `*.workers.dev` before any custom-domain cutover, configuration,
+Search Console/GCP/ads connections, legal documents, and launch gates — one
+command per step. An AI agent can work the same list autonomously via
+`.agents/skills/setup/`; it stops at the steps that genuinely need a human
+(the Cloudflare API token, the domain cutover, publishing legal documents).
 
 `pnpm run deploy:dev` reproduces the dev deploy locally: it writes a
 gitignored `.wrangler.dev.json` with the worker renamed and any custom-domain