@getvitops/create 0.8.0-alpha.0 → 0.8.1

package/templates/emdash/src/pages/index.astro

@@ -14,11 +14,17 @@ import Layout from '../layouts/Layout.astro';
 // shows up without a redeploy. Add `getStaticPaths()` + `prerender = true`
 // here only if this site's home page genuinely doesn't need that.
 const { entry: page } = await getEmDashEntry('pages', 'home');
+
+// `page.data` is typed `unknown` until `.emdash/types.ts` is generated from a
+// running site (`pnpm dev`, then `emdash types`), so a fresh scaffold would fail
+// `astro check`; the cast keeps it passing both before and after, where the
+// generated type is already `string`.
+const title = page?.data.title as string | undefined;
 ---
 
-<Layout description={page?.data.title}>
+<Layout description={title}>
   <section class="rhythm">
-    <h1>{page?.data.title ?? 'Welcome'}</h1>
+    <h1>{title ?? 'Welcome'}</h1>
     {
       page?.data.content ? (
         <PortableText value={page.data.content} />

package/templates/emdash/wrangler.jsonc

@@ -30,6 +30,10 @@
       "bucket_name": "my-emdash-site-media",
     },
   ],
+  // Outbound mail for EmDash's magic-link sign-in, invites and recovery
+  // (cloudflareEmail() in astro.config.mjs). The binding does nothing until the
+  // sender domain is onboarded: `npx vitops email setup send.<your-domain>`.
+  "send_email": [{ "name": "EMAIL" }],
   // Drives scheduled publishing, plugin cron, and maintenance (see
   // src/worker.ts). Without it, content scheduled in the admin never
   // publishes on Cloudflare Workers. Local `astro dev` doesn't need it.

package/templates/static/.github/workflows/backmerge.yml

@@ -0,0 +1,18 @@
+# Carry changes made directly on `main` (a hotfix) back into `dev`, so the
+# integration branch doesn't silently drift from what is live. Runs on every
+# push to `main`, including each promotion, and opens a PR only when merging
+# main into dev would actually change dev.
+#
+# Deploys via the vitops toolchain's reusable workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-backmerge.yml
+# for why the PR is left for a human unless BACKMERGE_TOKEN is set.
+name: Back-merge main → dev
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  backmerge:
+    uses: getvitops/design-system/.github/workflows/site-backmerge.yml@v1
+    secrets: inherit

package/templates/static/.node-version

@@ -0,0 +1 @@
+24

package/templates/static/AGENTS.md

@@ -18,15 +18,15 @@ as Cloudflare Workers static assets (no server runtime, no database).
   full generated class-vocabulary reference to this file.
 - **Layout foundations — these are the answer, not a starting point.** Six
   substitutions carry the structure of nearly every page:
-  | About to write… | Write instead |
-  | --- | --- |
-  | a `wrap`/`wrapper`/`container`/`inner` class | **`centered`** |
-  | `max-width` + `margin-inline: auto` | **`centered`** |
-  | `padding-block` on a section | **`region`** |
-  | margins between headings/paragraphs/lists | **`rhythm`** |
-  | `display: grid` + `grid-template-columns: repeat(n, …)` | **`subgrid`** |
-  | `repeat(auto-fit, minmax(…))` | **`grid-auto`** |
-  | `display: flex` + `gap` for a row of controls | **`cluster`** |
+  | About to write…                                         | Write instead   |
+  | ------------------------------------------------------- | --------------- |
+  | a `wrap`/`wrapper`/`container`/`inner` class            | **`centered`**  |
+  | `max-width` + `margin-inline: auto`                     | **`centered`**  |
+  | `padding-block` on a section                            | **`region`**    |
+  | margins between headings/paragraphs/lists               | **`rhythm`**    |
+  | `display: grid` + `grid-template-columns: repeat(n, …)` | **`subgrid`**   |
+  | `repeat(auto-fit, minmax(…))`                           | **`grid-auto`** |
+  | `display: flex` + `gap` for a row of controls           | **`cluster`**   |
 - Every page is prerendered by default (`output: 'static'`) — there is no
   server to fall back to, so nothing here can read request-time data
   (cookies, headers, query params) at render time. If a page genuinely needs

package/templates/static/SETUP.html

@@ -194,6 +194,59 @@
                 so.
               </span>
             </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.content-in-prod" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>Know where content is edited (EmDash template).</strong> Editors work on the
+                <em>production</em> site — drafts, "Publish changes" and preview links are the
+                staging step. The dev site holds a disposable copy of production's database; it is
+                refreshed from prod and never promoted back. Code, pages and
+                <code>site.json</code> still go dev → main.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.refresh-dev" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: run <strong>Refresh dev from prod</strong> (Actions tab) once the
+                prod site has content, and again before rehearsing a schema change. It runs weekly
+                on its own. To copy media as well, set <code>R2_ACCESS_KEY_ID</code> and
+                <code>R2_SECRET_ACCESS_KEY</code> (an R2 API token's S3 credentials) as repo
+                secrets; without them only the database is refreshed.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.magic-link" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: onboard the sender domain for sign-in email —
+                <code>npx vitops email setup send.&lt;your-domain&gt;</code>, then put that address
+                in <code>cloudflareEmail({ from })</code> in <code>astro.config.mjs</code> (it ships
+                a placeholder). Editors sign in with a magic link ("Sign in with email" on the login
+                page) because a passkey only works at the origin it was registered on, so a
+                refreshed dev site has no other way in. Check <strong>Settings → Email</strong> and
+                send the test email on both prod and dev.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.preview-secret" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: set a different <code>EMDASH_PREVIEW_SECRET</code> on the dev
+                worker (<code>wrangler secret put EMDASH_PREVIEW_SECRET</code>). The secret lives in
+                the database, so a refresh copies prod's — and prod preview links would then open
+                drafts on dev.
+              </span>
+            </label>
           </div>
         </details>
 

package/templates/static/package.json

@@ -20,10 +20,10 @@
   },
   "dependencies": {
     "@getvitops/astro": "latest",
-    "astro": "^7.1.2"
+    "astro": "^7.4.4"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.7",
+    "@astrojs/check": "^0.9.12",
     "@getvitops/cli": "latest",
     "typescript": "^6.0.3",
     "vite": "latest",
@@ -33,9 +33,9 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": "24.18.0",
+      "version": "24",
       "onFail": "download"
     }
   },
-  "packageManager": "pnpm@11.17.0"
+  "packageManager": "pnpm@12.16.1"
 }

package/templates/static/pnpm-workspace.yaml

@@ -0,0 +1,21 @@
+# Build scripts: allow only what each runtime needs; rest false so
+# strictDepBuilds (pnpm >=10.26 / 11) passes.
+allowBuilds:
+  esbuild: true
+  workerd: true
+  sharp: false
+
+# Supply-chain hardening: nothing installs within 3 days of its publish
+# (toolchain exempt), and no non-registry transitive sources.
+minimumReleaseAge: 4320
+minimumReleaseAgeExclude:
+  - '@getvitops/*'
+  - vite-plus
+  - '@voidzero-dev/*'
+  - oxlint
+  - '@oxlint/*'
+  - oxlint-tsgolint
+  - '@oxlint-tsgolint/*'
+  - oxfmt
+  - '@oxfmt/*'
+blockExoticSubdeps: true

package/templates/static/public/_headers

@@ -0,0 +1,10 @@
+# Cloudflare Workers static assets apply this file to every asset response.
+#
+# A baseline that cannot break a page. No Content-Security-Policy on purpose: <Head /> emits
+# inline scripts (the consent stub, the colour-scheme bootstrap), so a strict policy needs
+# per-site nonces or hashes — add one deliberately once you know which third-party tags you load.
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+  X-Frame-Options: SAMEORIGIN

package/templates/static/site.json

@@ -23,8 +23,8 @@
             }
           },
           "roles": {
-            "neutral": "ink",
-            "surface": "ink",
+            "neutral": { "hue": "ink", "kind": "surface" },
+            "surface": { "hue": "ink", "kind": "surface" },
             "ui-primary": "brand",
             "brand-primary": "brand",
             "info": "sky",