@getvitops/create 0.7.0 → 0.8.1

package/templates/static/SETUP.html

@@ -159,6 +159,94 @@
                 this exists.
               </span>
             </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.emdash-fingerprint" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>(EmDash template)</strong> After the first deploy to each environment, run
+                <code>npx emdash migrate --status</code> locally against that environment's real
+                database, review the printed account/database identity, and set the reviewed
+                fingerprint:
+                <code
+                  >gh variable set EMDASH_TARGET_FINGERPRINT --env dev --body &lt;value&gt;</code
+                >
+                and again with <code>--env production</code>. No command can do this for you — it's
+                the human review the fingerprint guard exists for. Deploys fail clearly on the
+                migration-apply step until it's set for that environment.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.design-system-editor-token" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>(EmDash template, only if <code>designSystemEditor</code> is on)</strong>
+                Create a fine-grained GitHub PAT scoped to this one repository,
+                <code>Contents: Read and write</code> only — no <code>admin</code> scope, no access
+                to any other repo — then <code>gh secret set VITOPS_GITHUB_TOKEN</code>. Also set
+                <code>site.deployment.repo</code> (<code>"owner/name"</code>) and
+                <code>site.deployment.branch</code> (default <code>"dev"</code>) in
+                <code>site.json</code>. Without these the live design-system editor still works —
+                only the auto-commit-to-source half is skipped, and the admin page's response says
+                so.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.content-in-prod" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>Know where content is edited (EmDash template).</strong> Editors work on the
+                <em>production</em> site — drafts, "Publish changes" and preview links are the
+                staging step. The dev site holds a disposable copy of production's database; it is
+                refreshed from prod and never promoted back. Code, pages and
+                <code>site.json</code> still go dev → main.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.refresh-dev" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: run <strong>Refresh dev from prod</strong> (Actions tab) once the
+                prod site has content, and again before rehearsing a schema change. It runs weekly
+                on its own. To copy media as well, set <code>R2_ACCESS_KEY_ID</code> and
+                <code>R2_SECRET_ACCESS_KEY</code> (an R2 API token's S3 credentials) as repo
+                secrets; without them only the database is refreshed.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.magic-link" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: onboard the sender domain for sign-in email —
+                <code>npx vitops email setup send.&lt;your-domain&gt;</code>, then put that address
+                in <code>cloudflareEmail({ from })</code> in <code>astro.config.mjs</code> (it ships
+                a placeholder). Editors sign in with a magic link ("Sign in with email" on the login
+                page) because a passkey only works at the origin it was registered on, so a
+                refreshed dev site has no other way in. Check <strong>Settings → Email</strong> and
+                send the test email on both prod and dev.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.preview-secret" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: set a different <code>EMDASH_PREVIEW_SECRET</code> on the dev
+                worker (<code>wrangler secret put EMDASH_PREVIEW_SECRET</code>). The secret lives in
+                the database, so a refresh copies prod's — and prod preview links would then open
+                drafts on dev.
+              </span>
+            </label>
           </div>
         </details>
 
@@ -326,6 +414,21 @@
                 <code>npx vitops setup ads</code>.
               </span>
             </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="connections.email" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                If <code>site.notifications.email</code> sends mail, onboard its sender domain:
+                <code>npx vitops email setup --dry</code>, then <code>npx vitops email setup</code>.
+                Cloudflare onboards an exact name — usually a subdomain like
+                <code>send.&lt;domain&gt;</code>, not the apex — so a mismatch here is silent at
+                build time and only fails when a form is actually submitted in production. Both
+                templates' <code>deploy</code> script already runs
+                <code>vitops email check</code> first as a non-blocking warning.
+              </span>
+            </label>
             <label class="custom-check">
               <input type="checkbox" data-sop="connections.manual" />
               <span class="custom-check__box"

package/templates/static/package.json

@@ -7,8 +7,8 @@
     "dev": "astro dev",
     "build": "astro build",
     "preview": "astro preview",
-    "deploy": "astro build && wrangler deploy",
-    "deploy:dev": "astro build && node scripts/dev-wrangler-config.mjs && wrangler deploy --config .wrangler.dev.json",
+    "deploy": "vitops email check && astro build && wrangler deploy",
+    "deploy:dev": "vitops email check && astro build && node scripts/dev-wrangler-config.mjs && wrangler deploy --config .wrangler.dev.json",
     "init:github": "vitops setup repo",
     "init:hosting": "vitops setup hosting --no-dev-resources",
     "setup": "vitops setup repo && vitops setup hosting --no-dev-resources",
@@ -20,10 +20,10 @@
   },
   "dependencies": {
     "@getvitops/astro": "latest",
-    "astro": "^7.1.2"
+    "astro": "^7.4.4"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.7",
+    "@astrojs/check": "^0.9.12",
     "@getvitops/cli": "latest",
     "typescript": "^6.0.3",
     "vite": "latest",
@@ -33,9 +33,9 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": "24.18.0",
+      "version": "24",
       "onFail": "download"
     }
   },
-  "packageManager": "pnpm@11.17.0"
+  "packageManager": "pnpm@12.16.1"
 }

package/templates/static/pnpm-workspace.yaml

@@ -0,0 +1,21 @@
+# Build scripts: allow only what each runtime needs; rest false so
+# strictDepBuilds (pnpm >=10.26 / 11) passes.
+allowBuilds:
+  esbuild: true
+  workerd: true
+  sharp: false
+
+# Supply-chain hardening: nothing installs within 3 days of its publish
+# (toolchain exempt), and no non-registry transitive sources.
+minimumReleaseAge: 4320
+minimumReleaseAgeExclude:
+  - '@getvitops/*'
+  - vite-plus
+  - '@voidzero-dev/*'
+  - oxlint
+  - '@oxlint/*'
+  - oxlint-tsgolint
+  - '@oxlint-tsgolint/*'
+  - oxfmt
+  - '@oxfmt/*'
+blockExoticSubdeps: true

package/templates/static/public/_headers

@@ -0,0 +1,10 @@
+# Cloudflare Workers static assets apply this file to every asset response.
+#
+# A baseline that cannot break a page. No Content-Security-Policy on purpose: <Head /> emits
+# inline scripts (the consent stub, the colour-scheme bootstrap), so a strict policy needs
+# per-site nonces or hashes — add one deliberately once you know which third-party tags you load.
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+  X-Frame-Options: SAMEORIGIN

package/templates/static/site.json

@@ -23,8 +23,8 @@
             }
           },
           "roles": {
-            "neutral": "ink",
-            "surface": "ink",
+            "neutral": { "hue": "ink", "kind": "surface" },
+            "surface": { "hue": "ink", "kind": "surface" },
             "ui-primary": "brand",
             "brand-primary": "brand",
             "info": "sky",