@getvitops/create 0.7.0 → 0.8.1

package/templates/emdash/AGENTS.md

@@ -19,6 +19,16 @@ styled by the Vitops design system.
   `getEmDashCollection` / `getEmDashEntry` from `emdash`; render Portable Text
   with `<PortableText />` from `emdash/ui` (the Vitops blocks from
   `@getvitops/emdash` are merged in automatically).
+- **Building pages from patterns:** the editor's insert menu offers the `vitops.*` blocks —
+  link/button, image compare, copy snippet, banner, disclosure, accordion, hero, carousel, gallery,
+  cards, marquee (`npx vitops docs blocks` lists them with every field). Repeating content (cards, gallery images, accordion items, carousel slides) is
+  a repeater field. A block cannot contain other blocks, and a `vitops.*` block inside EmDash's
+  built-in `columns` does not render — for layout (a section, a split, a hero) use a `blocks`
+  field, or hand-write the page template with `@getvitops/astro` components
+  (`Subgrid`, `Cards`, `Carousel`, …). `npx vitops docs components` lists every pattern, which
+  tiers provide it, and which block renders it. Override a block's rendering per site with
+  `<PortableText components={{ type: { 'vitops.cards': MyCards } }} />`; hide one with
+  `vitopsEmdash({ blocks: { exclude: [...] } })` in `astro.config.mjs`.
 - `seed/seed.json` only applies against an empty database: structure
   (collections, menus, settings) on first boot; the `content` entries only
   when the setup wizard's "include sample content" option is chosen. Changing
@@ -30,15 +40,16 @@ styled by the Vitops design system.
   full generated class-vocabulary reference to this file.
 - **Layout foundations — these are the answer, not a starting point.** Six
   substitutions carry the structure of nearly every page:
-  | About to write… | Write instead |
-  | --- | --- |
-  | a `wrap`/`wrapper`/`container`/`inner` class | **`centered`** |
-  | `max-width` + `margin-inline: auto` | **`centered`** |
-  | `padding-block` on a section | **`region`** |
-  | margins between headings/paragraphs/lists | **`rhythm`** |
-  | `display: grid` + `grid-template-columns: repeat(n, …)` | **`subgrid`** |
-  | `repeat(auto-fit, minmax(…))` | **`grid-auto`** |
-  | `display: flex` + `gap` for a row of controls | **`cluster`** |
+
+  | About to write…                                         | Write instead   |
+  | ------------------------------------------------------- | --------------- |
+  | a `wrap`/`wrapper`/`container`/`inner` class            | **`centered`**  |
+  | `max-width` + `margin-inline: auto`                     | **`centered`**  |
+  | `padding-block` on a section                            | **`region`**    |
+  | margins between headings/paragraphs/lists               | **`rhythm`**    |
+  | `display: grid` + `grid-template-columns: repeat(n, …)` | **`subgrid`**   |
+  | `repeat(auto-fit, minmax(…))`                           | **`grid-auto`** |
+  | `display: flex` + `gap` for a row of controls           | **`cluster`**   |
 
   `centered` is a grid of _named tracks_, not a max-width box — a child widens
   itself with `breakout`/`spotlight`/`fullbleed` without the parent knowing, which
@@ -105,11 +116,42 @@ styled by the Vitops design system.
   the fields its forms collect, where it deploys — rather than from guesses.
   It still needs review before launch.
 
+## EmDash 1.x behaviours worth knowing
+
+- **Passkeys are bound to the hostname they were created on.** After the
+  workers.dev → custom-domain cutover, use **Settings → General → Change
+  domain**, then **Continue on** to add a passkey at the new address.
+- **HTML blocks created in the admin run JavaScript** in a sandboxed iframe
+  (Contributor and up can add it). Astro's `security.csp` blocks their styles
+  and scripts, so don't turn CSP on without allowing for that.
+- **Link entries by `entry.data.slug`, never `entry.id`** — on multilingual
+  sites `id` carries a locale prefix.
+- **Submit `/sitemap.xml`** to search engines, not a per-collection sitemap;
+  collection sitemaps now split into pages of 2,000 entries.
+- **A stuck D1 migration lock** is cleared with
+  `pnpm exec emdash migrate --take-over-lock <id>` (confirms the target, or
+  needs `--expected-target-fingerprint` non-interactively).
+
 ## Docs MCP servers
 
 `.mcp.json` preconfigures the Astro docs and EmDash docs MCP servers — prefer
 searching them over pre-trained knowledge for Astro/EmDash questions.
 
+## EmDash agent skills
+
+The EmDash skills (`building-emdash-site`, `creating-plugins`, `emdash-cli`,
+`upgrading-emdash` and the two WordPress porting skills) are installed per
+project, not globally, so they match the `emdash` version this repo pins. If
+`.agents/skills/building-emdash-site/` is missing, install them (the setup guide
+and `SETUP.html` have the full step):
+
+```bash
+npx skills add emdash-cms/skills --skill '*' -a claude-code -y
+```
+
+Refresh them with `npx skills update` after bumping `emdash` — the
+`upgrading-emdash` skill covers the rest of the upgrade.
+
 ## Commands
 
 - `pnpm dev` — local dev with local D1/R2 emulation (no Cloudflare account)

package/templates/emdash/README.md

@@ -14,7 +14,8 @@ Scaffolded from `vp create @getvitops:emdash`.
   (Tailwind v4 format), generates favicons/PWA assets from
   `src/assets/logo.svg`, and serves the web-component runtime
 - **`@getvitops/emdash`** — design-system Portable Text blocks in the editor
-  slash menu: image compare, copy snippet, banner, disclosure, carousel
+  slash menu (hero, cards, accordion, carousel, gallery, marquee, banner, …);
+  `npx vitops docs blocks` lists every block and field
 
 `src/assets/placeholder/` ships neutral wireframe images for layout work
 before real imagery exists — delete once real assets land (separate from
@@ -27,6 +28,11 @@ pnpm install
 pnpm dev
 ```
 
+Once this is its own repo (not sitting inside the `getvitops/design-system`
+monorepo), uncomment `lint.options` in `vite.config.ts` for type-aware
+`vp check`/`vp lint` — it ships commented out because vite-plus 1.0 only
+honours that option at a project's actual root, and errors on it otherwise.
+
 No Cloudflare account needed: `astro dev` runs the Worker locally with local
 D1/R2 emulation (state in `.wrangler/`). On first boot EmDash runs its
 migrations and applies the structure from `seed/seed.json` — a `pages`
@@ -82,7 +88,8 @@ The repo ships a two-environment flow modeled on branch = environment:
   into `main` with auto-merge enabled. With required reviews on `main`, a
   human approves the PR; merging deploys prod.
 
-One-time setup — work through the checklist:
+One-time setup — see [Start a new EmDash site](https://docs.vitops.ca/guides/new-emdash-site) for the whole
+procedure, then work through the checklist:
 
 ```bash
 pnpm run sop && open SETUP.html   # or: xdg-open SETUP.html
@@ -113,12 +120,12 @@ is a configurable dimension of the project, not a rewrite:
 - **`node`** — `@astrojs/node` (standalone) + SQLite file + local uploads,
   for a VPS / docker-compose / k8s host. Not installed by default; to switch:
   `pnpm add @astrojs/node better-sqlite3`, then `vitopsHosting({ target:
-'node' })` (or set `HOSTING=node` — the env var wins). Run the built site
+  'node' })` (or set `HOSTING=node` — the env var wins). Run the built site
   with `node ./dist/server/entry.mjs`; data lives in `./data/` (gitignored) —
   persist it as a volume. Scheduled publishing runs in-process on Node, so
   the worker/cron pieces aren't needed. For production, move storage to
   S3-compatible and/or the database to Postgres via `vitopsHosting({ node:
-{ database, storage } })`. CI deploy for Node hosts is TBD — the shipped
+  { database, storage } })`. CI deploy for Node hosts is TBD — the shipped
   workflows are Cloudflare-specific.
 
 Moving an existing site between targets (either direction) is a data
@@ -134,6 +141,10 @@ and media in the storage backend (bucket/directory copy).
 - **Skills** (`.agents/skills/`): `promote` dispatches the dev → main
   promotion workflow. Run `npx vitops agents` to also write the design-system
   class reference into `AGENTS.md`.
+- **EmDash skills** are installed per project so they match the pinned `emdash`
+  version: `npx skills add emdash-cms/skills --skill '*' -a claude-code -y`,
+  then commit `.agents/skills/` and `skills-lock.json`. Update with
+  `npx skills update` after an `emdash` bump.
 - **Claude Code on the web**: the SessionStart hook
   (`.claude/hooks/session-start.sh`) installs Node 24 (matching
   `devEngines`), activates the pinned pnpm, and installs dependencies in the

package/templates/emdash/SETUP.html

@@ -159,6 +159,94 @@
                 this exists.
               </span>
             </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.emdash-fingerprint" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>(EmDash template)</strong> After the first deploy to each environment, run
+                <code>npx emdash migrate --status</code> locally against that environment's real
+                database, review the printed account/database identity, and set the reviewed
+                fingerprint:
+                <code
+                  >gh variable set EMDASH_TARGET_FINGERPRINT --env dev --body &lt;value&gt;</code
+                >
+                and again with <code>--env production</code>. No command can do this for you — it's
+                the human review the fingerprint guard exists for. Deploys fail clearly on the
+                migration-apply step until it's set for that environment.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.design-system-editor-token" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>(EmDash template, only if <code>designSystemEditor</code> is on)</strong>
+                Create a fine-grained GitHub PAT scoped to this one repository,
+                <code>Contents: Read and write</code> only — no <code>admin</code> scope, no access
+                to any other repo — then <code>gh secret set VITOPS_GITHUB_TOKEN</code>. Also set
+                <code>site.deployment.repo</code> (<code>"owner/name"</code>) and
+                <code>site.deployment.branch</code> (default <code>"dev"</code>) in
+                <code>site.json</code>. Without these the live design-system editor still works —
+                only the auto-commit-to-source half is skipped, and the admin page's response says
+                so.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.content-in-prod" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>Know where content is edited (EmDash template).</strong> Editors work on the
+                <em>production</em> site — drafts, "Publish changes" and preview links are the
+                staging step. The dev site holds a disposable copy of production's database; it is
+                refreshed from prod and never promoted back. Code, pages and
+                <code>site.json</code> still go dev → main.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.refresh-dev" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: run <strong>Refresh dev from prod</strong> (Actions tab) once the
+                prod site has content, and again before rehearsing a schema change. It runs weekly
+                on its own. To copy media as well, set <code>R2_ACCESS_KEY_ID</code> and
+                <code>R2_SECRET_ACCESS_KEY</code> (an R2 API token's S3 credentials) as repo
+                secrets; without them only the database is refreshed.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.magic-link" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: onboard the sender domain for sign-in email —
+                <code>npx vitops email setup send.&lt;your-domain&gt;</code>, then put that address
+                in <code>cloudflareEmail({ from })</code> in <code>astro.config.mjs</code> (it ships
+                a placeholder). Editors sign in with a magic link ("Sign in with email" on the login
+                page) because a passkey only works at the origin it was registered on, so a
+                refreshed dev site has no other way in. Check <strong>Settings → Email</strong> and
+                send the test email on both prod and dev.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.preview-secret" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: set a different <code>EMDASH_PREVIEW_SECRET</code> on the dev
+                worker (<code>wrangler secret put EMDASH_PREVIEW_SECRET</code>). The secret lives in
+                the database, so a refresh copies prod's — and prod preview links would then open
+                drafts on dev.
+              </span>
+            </label>
           </div>
         </details>
 
@@ -326,6 +414,21 @@
                 <code>npx vitops setup ads</code>.
               </span>
             </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="connections.email" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                If <code>site.notifications.email</code> sends mail, onboard its sender domain:
+                <code>npx vitops email setup --dry</code>, then <code>npx vitops email setup</code>.
+                Cloudflare onboards an exact name — usually a subdomain like
+                <code>send.&lt;domain&gt;</code>, not the apex — so a mismatch here is silent at
+                build time and only fails when a form is actually submitted in production. Both
+                templates' <code>deploy</code> script already runs
+                <code>vitops email check</code> first as a non-blocking warning.
+              </span>
+            </label>
             <label class="custom-check">
               <input type="checkbox" data-sop="connections.manual" />
               <span class="custom-check__box"

package/templates/emdash/astro.config.mjs

@@ -1,8 +1,18 @@
 import react from '@astrojs/react';
+import { cloudflareEmail } from '@emdash-cms/cloudflare/plugins';
 import vitops from '@getvitops/astro';
+import { resolveOrganizationName } from '@getvitops/astro/routes';
 import { vitopsEmdash, vitopsHosting } from '@getvitops/emdash';
 import { defineConfig } from 'astro/config';
 import emdash from 'emdash/astro';
+import config from './site.json' with { type: 'json' };
+
+// site.json's organization.name is the one build-time-readable source for a
+// display name — EmDash's own getSiteSettings() only resolves inside a live
+// Worker request (AsyncLocalStorage + a DB binding), so it can't be read here
+// even though it's what Layout.astro shows on rendered pages. See AGENTS.md's
+// "EmDash plugin as the design-system editing surface".
+const organizationName = resolveOrganizationName(config) ?? 'My EmDash Site';
 
 // Hosting seam: adapter + EmDash database/storage for the configured target.
 // Default 'cloudflare' (Workers + D1 + R2 — see wrangler.jsonc / src/worker.ts).
@@ -26,16 +36,49 @@ export default defineConfig({
     emdash({
       database,
       storage,
-      // Vitops design-system blocks (image compare, copy snippet, banner,
-      // disclosure, carousel) in the editor slash menu. Default 'integration'
+      // Vitops design-system blocks (link/button, image compare, copy snippet,
+      // banner, disclosure, accordion, hero, carousel, gallery, cards, marquee) in the
+      // editor slash menu. Narrow them with `vitopsEmdash({ blocks: { exclude } })`. Default 'integration'
       // script delivery: Layout.astro renders <Head /> from @getvitops/astro,
       // which emits the web-component runtime tags.
-      plugins: [vitopsEmdash()],
+      //
+      // designSystemEditor mounts a live <wc-theme-editor> admin page at
+      // /design-system — edits are visible site-wide immediately (no
+      // rebuild) and auto-sync back to source once site.deployment.repo and
+      // a VITOPS_GITHUB_TOKEN secret are set (see SETUP.html) — see
+      // AGENTS.md's "EmDash plugin as the design-system editing surface".
+      // Until then the live half still works; only the sync half is skipped.
+      //
+      // cloudflareEmail sends magic-link sign-in, invites and account recovery
+      // through Cloudflare Email Sending (the EMAIL binding in wrangler.jsonc).
+      // Magic link is how an editor gets into a site whose database was copied
+      // from another origin: a passkey only works at the origin it was
+      // registered on, so a dev database refreshed from prod
+      // (scripts/refresh-dev.mjs) would otherwise lock everyone out of dev. The
+      // cloned users already exist, so the same email signs in on both origins.
+      // `from` must be on a domain onboarded with Cloudflare Email Sending —
+      // `npx vitops email setup send.<your-domain>` — and is usually the
+      // subdomain, not the apex (see AGENTS.md's "Sender-domain onboarding").
+      // Without it, magic link answers "Email is not configured".
+      plugins: [
+        vitopsEmdash({ designSystemEditor: { config } }),
+        cloudflareEmail({
+          from: { email: 'cms@send.my-emdash-site.example.com', name: organizationName },
+        }),
+      ],
+      // 1.0's runtime migration mode defaults to 'auto' (apply pending core
+      // migrations on first request) — fine for local dev, but a deploy
+      // should have already migrated before traffic arrives. 'check' 503s a
+      // request instead of migrating behind it if the explicit `emdash
+      // migrate` step in site-deploy-emdash.yml (see AGENTS.md's CI/CD
+      // section) was skipped or failed. `dev: 'auto'` keeps the convenient
+      // first-run behaviour for `pnpm dev`.
+      migrations: { runtime: 'check', dev: 'auto' },
     }),
     vitops({
       favicon: {
         source: 'src/assets/logo.svg',
-        name: 'My EmDash Site',
+        name: organizationName,
         themeColor: '#2e9b73',
         backgroundColor: '#ffffff',
       },

package/templates/emdash/package.json

@@ -7,8 +7,8 @@
     "dev": "astro dev",
     "build": "astro build",
     "preview": "astro preview",
-    "deploy": "astro build && wrangler deploy",
-    "deploy:dev": "astro build && node scripts/build-dev-wrangler.mjs && wrangler deploy --config dist/server/wrangler.dev.json",
+    "deploy": "vitops email check && astro build && emdash migrate --wrangler-config wrangler.jsonc && wrangler deploy",
+    "deploy:dev": "vitops email check && astro build && node scripts/build-dev-wrangler.mjs && emdash migrate --wrangler-config dist/server/wrangler.dev.json && wrangler deploy --config dist/server/wrangler.dev.json",
     "init:github": "vitops setup repo",
     "init:hosting": "vitops setup hosting",
     "setup": "vitops setup all",
@@ -20,19 +20,23 @@
   },
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.0",
-    "@astrojs/react": "^6.0.0",
-    "@emdash-cms/cloudflare": "^0.31.0",
+    "@astrojs/react": "^7.1.2",
+    "@emdash-cms/cloudflare": "^1.4.0",
     "@getvitops/astro": "latest",
+    "@getvitops/core": "latest",
     "@getvitops/emdash": "latest",
-    "astro": "^7.1.2",
-    "emdash": "^0.31.0",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4"
+    "@tailwindcss/vite": "^4.3.3",
+    "astro": "^7.4.4",
+    "emdash": "^1.4.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "tailwindcss": "^4.3.3"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.7",
+    "@astrojs/check": "^0.9.12",
     "@cloudflare/workers-types": "^4.20260305.1",
     "@getvitops/cli": "latest",
+    "@iconify-json/fa7-solid": "^1.2.5",
     "typescript": "^6.0.3",
     "vite": "latest",
     "vite-plus": "latest",
@@ -41,11 +45,11 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": "24.18.0",
+      "version": "24",
       "onFail": "download"
     }
   },
-  "packageManager": "pnpm@11.17.0",
+  "packageManager": "pnpm@12.16.1",
   "emdash": {
     "seed": "seed/seed.json"
   }

package/templates/emdash/pnpm-lock.yaml

@@ -0,0 +1,183 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      '@pnpm/exe':
+        specifier: 12.16.1
+        version: 12.16.1
+      pnpm:
+        specifier: 12.16.1
+        version: 12.16.1
+
+packages:
+
+  '@pnpm/exe.android-arm64@12.16.1':
+    resolution: {integrity: sha512-PKf78Ew+i0CBYf0Xc+eMcqQiqyBT+u8XCVg1F5roc98/6wWfdYlWhrUMmEBiKWaJ3JqHxrtt8l1NwZ7qfJt2/Q==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/exe.android-x64@12.16.1':
+    resolution: {integrity: sha512-xdu7gMbB98pdvhwMeA6612Of515FDlRUtfA/1f7nWPZfPLnEdSRBO2u+1N0XBtQ/ennhPH/lrxB1gC6gnR/cdg==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/exe.darwin-arm64@12.16.1':
+    resolution: {integrity: sha512-pVbmIIbhixiLvADLu1WA3TaW8FZy/D72R1De27WbbFx8/2mxvnsTyFVm4fO9kjpjMY7RzJd48CiQ96p8fO3ebQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.16.1':
+    resolution: {integrity: sha512-xZvQBFqcZjO7vFKTK3XsJpqY6lnBL9EWSLCzVUPq3kZ94+D96gwJCa76xxGNK8Cj32f4eeM91Qg+yNRR4sRpDw==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.freebsd-x64@12.16.1':
+    resolution: {integrity: sha512-zTtunfi9mBhRXiXEJYfwiJj0tk7MgTSfqDSRh+Az9FZ9THazVIiQiVNS8jpcsftDOqu7LKNffQdjmgwHDThfUg==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/exe.linux-arm64-musl@12.16.1':
+    resolution: {integrity: sha512-BJ3mOmcmQgcUo92Ee/WfEOt1pRiv3y2MMAkhEiYHd85UiPpHTfFhv+SpCbALmfExzXk3UlaRtMYwHlkQymc4VA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.16.1':
+    resolution: {integrity: sha512-JaRd5gNxwdNGBBkrZFt8bknrK4YmHVJBW0JMhUQ0fJ0dEYp6C2GT9ExaCqOO8EwYEyqM+jpKgJIK+8WFaJy3ew==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-ppc64@12.16.1':
+    resolution: {integrity: sha512-FnSV0Jv40S1cMv7vFNWwvu0X567Lec4L4HCRead3CFcD6zQDNbGw81s8N5bcKPahtPD9ApVuhsbmFCx4rw6RMw==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-riscv64@12.16.1':
+    resolution: {integrity: sha512-C1Sww4FN5IttD4atRRhAKmQtSGWVp04ZAKNxO8pfu2bkRPwOW+7v+2DH1Xs1W+kZYYpO86BYDvUcadefF+AgaQ==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-s390x@12.16.1':
+    resolution: {integrity: sha512-kn2fautsTcxIMODoovQVqZyfpDRdNgGkoeVqNdrKqbeBBvrEl+fXLkmZiq5xDht1LMr4sYiCNcsMfNMT6JPFmg==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.16.1':
+    resolution: {integrity: sha512-PM6ccHCOe/O9SsTflTJTYWfwogJZa6EmUvpnwZgiPguJBddh20wDQKgxUPXf48rDsPm9vMsIij0uHswwwbXL8g==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.16.1':
+    resolution: {integrity: sha512-RK//8ZLcXGW8A2k8bQOXZDBN1Qu92zN4dYnG1bzj1zoQ1fkZ6jNzZ1AvXtsfGVma795CJtvoaF5bLXf4l/FIUw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.16.1':
+    resolution: {integrity: sha512-Ox3kNNVxtGw6pK7SVejmeOUgHhUTZgAM7NQQ6cU7frPw3ix9+j7d2MGbRg3fyEFAaKWq8ZAZLTQGcDyLnAu+qA==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.16.1':
+    resolution: {integrity: sha512-k+FhRJ0ttphFoFIVB1Sk4v76YJAulafmA/Ly57cysesUhhIzVlApeOShUz0jXubKx317TThlEfpQrukldnqORA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@pnpm/exe@12.16.1':
+    resolution: {integrity: sha512-Opsh2R7IuFY3ekd0C282Tmzgr5hiSlKMOv05/3dJXUrrp5NbmjC1Cm5PCFsa8xsiXY7z4oSkI4Qof1LjTkgAJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  pnpm@12.16.1:
+    resolution: {integrity: sha512-CR0d7nknV1Zhsl2rPCrjHK/BxU1rce1qZgDPDByxBDSkR+rhQBXxsj4ua+3u1535SpMuIWTSgyKA3OP7MvZW0Q==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.android-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.android-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.darwin-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.freebsd-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-ppc64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-riscv64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-s390x@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe@12.16.1':
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.16.1
+      '@pnpm/exe.android-x64': 12.16.1
+      '@pnpm/exe.darwin-arm64': 12.16.1
+      '@pnpm/exe.darwin-x64': 12.16.1
+      '@pnpm/exe.freebsd-x64': 12.16.1
+      '@pnpm/exe.linux-arm64': 12.16.1
+      '@pnpm/exe.linux-arm64-musl': 12.16.1
+      '@pnpm/exe.linux-ppc64': 12.16.1
+      '@pnpm/exe.linux-riscv64': 12.16.1
+      '@pnpm/exe.linux-s390x': 12.16.1
+      '@pnpm/exe.linux-x64': 12.16.1
+      '@pnpm/exe.linux-x64-musl': 12.16.1
+      '@pnpm/exe.win32-arm64': 12.16.1
+      '@pnpm/exe.win32-x64': 12.16.1
+
+  pnpm@12.16.1:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.16.1
+      '@pnpm/exe.android-x64': 12.16.1
+      '@pnpm/exe.darwin-arm64': 12.16.1
+      '@pnpm/exe.darwin-x64': 12.16.1
+      '@pnpm/exe.freebsd-x64': 12.16.1
+      '@pnpm/exe.linux-arm64': 12.16.1
+      '@pnpm/exe.linux-arm64-musl': 12.16.1
+      '@pnpm/exe.linux-ppc64': 12.16.1
+      '@pnpm/exe.linux-riscv64': 12.16.1
+      '@pnpm/exe.linux-s390x': 12.16.1
+      '@pnpm/exe.linux-x64': 12.16.1
+      '@pnpm/exe.linux-x64-musl': 12.16.1
+      '@pnpm/exe.win32-arm64': 12.16.1
+      '@pnpm/exe.win32-x64': 12.16.1
+
+---

package/templates/emdash/pnpm-workspace.yaml

@@ -8,7 +8,7 @@ allowBuilds:
 
 # Supply-chain hardening: cooldown on brand-new releases (toolchain exempt)
 # and no non-registry transitive sources.
-minimumReleaseAge: 1440
+minimumReleaseAge: 4320
 minimumReleaseAgeExclude:
   - '@getvitops/*'
   - emdash

package/templates/emdash/public/_headers

@@ -0,0 +1,10 @@
+# Cloudflare Workers static assets apply this file to every asset response.
+#
+# A baseline that cannot break a page. No Content-Security-Policy on purpose: <Head /> emits
+# inline scripts (the consent stub, the colour-scheme bootstrap), so a strict policy needs
+# per-site nonces or hashes — add one deliberately once you know which third-party tags you load.
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+  X-Frame-Options: SAMEORIGIN

package/templates/emdash/scripts/build-dev-wrangler.mjs

@@ -66,6 +66,12 @@ cfg.r2_buckets = (cfg.r2_buckets ?? []).map((r) =>
   r.binding === 'MEDIA' ? { ...r, bucket_name: `${r.bucket_name}-dev` } : r,
 );
 
+// No cron on dev. Dev's database is a copy of prod (scripts/refresh-dev.mjs),
+// so it carries prod's scheduled publishes and plugin jobs; leaving the trigger
+// on would run them a second time against the copy. The cost: scheduled
+// publishing can't be exercised on dev.
+delete cfg.triggers;
+
 // Flat config — no nested environments.
 delete cfg.env;