@getvitops/create 0.8.0-alpha.0 → 0.8.2

package/templates/emdash/SETUP.html

@@ -194,6 +194,59 @@
                 so.
               </span>
             </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.content-in-prod" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                <strong>Know where content is edited (EmDash template).</strong> Editors work on the
+                <em>production</em> site — drafts, "Publish changes" and preview links are the
+                staging step. The dev site holds a disposable copy of production's database; it is
+                refreshed from prod and never promoted back. Code, pages and
+                <code>site.json</code> still go dev → main.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.refresh-dev" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: run <strong>Refresh dev from prod</strong> (Actions tab) once the
+                prod site has content, and again before rehearsing a schema change. It runs weekly
+                on its own. To copy media as well, set <code>R2_ACCESS_KEY_ID</code> and
+                <code>R2_SECRET_ACCESS_KEY</code> (an R2 API token's S3 credentials) as repo
+                secrets; without them only the database is refreshed.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.magic-link" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: onboard the sender domain for sign-in email —
+                <code>npx vitops email setup send.&lt;your-domain&gt;</code>, then put that address
+                in <code>cloudflareEmail({ from })</code> in <code>astro.config.mjs</code> (it ships
+                a placeholder). Editors sign in with a magic link ("Sign in with email" on the login
+                page) because a passkey only works at the origin it was registered on, so a
+                refreshed dev site has no other way in. Check <strong>Settings → Email</strong> and
+                send the test email on both prod and dev.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="hosting.preview-secret" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                EmDash template: set a different <code>EMDASH_PREVIEW_SECRET</code> on the dev
+                worker (<code>wrangler secret put EMDASH_PREVIEW_SECRET</code>). The secret lives in
+                the database, so a refresh copies prod's — and prod preview links would then open
+                drafts on dev.
+              </span>
+            </label>
           </div>
         </details>
 

package/templates/emdash/astro.config.mjs

@@ -1,4 +1,5 @@
 import react from '@astrojs/react';
+import { cloudflareEmail } from '@emdash-cms/cloudflare/plugins';
 import vitops from '@getvitops/astro';
 import { resolveOrganizationName } from '@getvitops/astro/routes';
 import { vitopsEmdash, vitopsHosting } from '@getvitops/emdash';
@@ -35,8 +36,9 @@ export default defineConfig({
     emdash({
       database,
       storage,
-      // Vitops design-system blocks (image compare, copy snippet, banner,
-      // disclosure, carousel) in the editor slash menu. Default 'integration'
+      // Vitops design-system blocks (link/button, image compare, copy snippet,
+      // banner, disclosure, accordion, hero, carousel, gallery, cards, marquee) in the
+      // editor slash menu. Narrow them with `vitopsEmdash({ blocks: { exclude } })`. Default 'integration'
       // script delivery: Layout.astro renders <Head /> from @getvitops/astro,
       // which emits the web-component runtime tags.
       //
@@ -46,7 +48,24 @@ export default defineConfig({
       // a VITOPS_GITHUB_TOKEN secret are set (see SETUP.html) — see
       // AGENTS.md's "EmDash plugin as the design-system editing surface".
       // Until then the live half still works; only the sync half is skipped.
-      plugins: [vitopsEmdash({ designSystemEditor: { config } })],
+      //
+      // cloudflareEmail sends magic-link sign-in, invites and account recovery
+      // through Cloudflare Email Sending (the EMAIL binding in wrangler.jsonc).
+      // Magic link is how an editor gets into a site whose database was copied
+      // from another origin: a passkey only works at the origin it was
+      // registered on, so a dev database refreshed from prod
+      // (scripts/refresh-dev.mjs) would otherwise lock everyone out of dev. The
+      // cloned users already exist, so the same email signs in on both origins.
+      // `from` must be on a domain onboarded with Cloudflare Email Sending —
+      // `npx vitops email setup send.<your-domain>` — and is usually the
+      // subdomain, not the apex (see AGENTS.md's "Sender-domain onboarding").
+      // Without it, magic link answers "Email is not configured".
+      plugins: [
+        vitopsEmdash({ designSystemEditor: { config } }),
+        cloudflareEmail({
+          from: { email: 'cms@send.my-emdash-site.example.com', name: organizationName },
+        }),
+      ],
       // 1.0's runtime migration mode defaults to 'auto' (apply pending core
       // migrations on first request) — fine for local dev, but a deploy
       // should have already migrated before traffic arrives. 'check' 503s a

package/templates/emdash/package.json

@@ -20,22 +20,23 @@
   },
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.0",
-    "@astrojs/react": "^6.0.0",
-    "@emdash-cms/cloudflare": "^1.0.1",
+    "@astrojs/react": "^7.1.2",
+    "@emdash-cms/cloudflare": "^1.4.0",
     "@getvitops/astro": "latest",
     "@getvitops/core": "latest",
     "@getvitops/emdash": "latest",
     "@tailwindcss/vite": "^4.3.3",
-    "astro": "^7.1.2",
-    "emdash": "^1.0.1",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
+    "astro": "^7.4.4",
+    "emdash": "^1.4.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "tailwindcss": "^4.3.3"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.7",
+    "@astrojs/check": "^0.9.12",
     "@cloudflare/workers-types": "^4.20260305.1",
     "@getvitops/cli": "latest",
+    "@iconify-json/fa7-solid": "^1.2.5",
     "typescript": "^6.0.3",
     "vite": "latest",
     "vite-plus": "latest",
@@ -44,11 +45,11 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": "24.18.0",
+      "version": "24",
       "onFail": "download"
     }
   },
-  "packageManager": "pnpm@11.17.0",
+  "packageManager": "pnpm@12.16.1",
   "emdash": {
     "seed": "seed/seed.json"
   }

package/templates/emdash/pnpm-lock.yaml

@@ -0,0 +1,183 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      '@pnpm/exe':
+        specifier: 12.16.1
+        version: 12.16.1
+      pnpm:
+        specifier: 12.16.1
+        version: 12.16.1
+
+packages:
+
+  '@pnpm/exe.android-arm64@12.16.1':
+    resolution: {integrity: sha512-PKf78Ew+i0CBYf0Xc+eMcqQiqyBT+u8XCVg1F5roc98/6wWfdYlWhrUMmEBiKWaJ3JqHxrtt8l1NwZ7qfJt2/Q==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/exe.android-x64@12.16.1':
+    resolution: {integrity: sha512-xdu7gMbB98pdvhwMeA6612Of515FDlRUtfA/1f7nWPZfPLnEdSRBO2u+1N0XBtQ/ennhPH/lrxB1gC6gnR/cdg==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/exe.darwin-arm64@12.16.1':
+    resolution: {integrity: sha512-pVbmIIbhixiLvADLu1WA3TaW8FZy/D72R1De27WbbFx8/2mxvnsTyFVm4fO9kjpjMY7RzJd48CiQ96p8fO3ebQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.16.1':
+    resolution: {integrity: sha512-xZvQBFqcZjO7vFKTK3XsJpqY6lnBL9EWSLCzVUPq3kZ94+D96gwJCa76xxGNK8Cj32f4eeM91Qg+yNRR4sRpDw==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.freebsd-x64@12.16.1':
+    resolution: {integrity: sha512-zTtunfi9mBhRXiXEJYfwiJj0tk7MgTSfqDSRh+Az9FZ9THazVIiQiVNS8jpcsftDOqu7LKNffQdjmgwHDThfUg==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/exe.linux-arm64-musl@12.16.1':
+    resolution: {integrity: sha512-BJ3mOmcmQgcUo92Ee/WfEOt1pRiv3y2MMAkhEiYHd85UiPpHTfFhv+SpCbALmfExzXk3UlaRtMYwHlkQymc4VA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.16.1':
+    resolution: {integrity: sha512-JaRd5gNxwdNGBBkrZFt8bknrK4YmHVJBW0JMhUQ0fJ0dEYp6C2GT9ExaCqOO8EwYEyqM+jpKgJIK+8WFaJy3ew==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-ppc64@12.16.1':
+    resolution: {integrity: sha512-FnSV0Jv40S1cMv7vFNWwvu0X567Lec4L4HCRead3CFcD6zQDNbGw81s8N5bcKPahtPD9ApVuhsbmFCx4rw6RMw==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-riscv64@12.16.1':
+    resolution: {integrity: sha512-C1Sww4FN5IttD4atRRhAKmQtSGWVp04ZAKNxO8pfu2bkRPwOW+7v+2DH1Xs1W+kZYYpO86BYDvUcadefF+AgaQ==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-s390x@12.16.1':
+    resolution: {integrity: sha512-kn2fautsTcxIMODoovQVqZyfpDRdNgGkoeVqNdrKqbeBBvrEl+fXLkmZiq5xDht1LMr4sYiCNcsMfNMT6JPFmg==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.16.1':
+    resolution: {integrity: sha512-PM6ccHCOe/O9SsTflTJTYWfwogJZa6EmUvpnwZgiPguJBddh20wDQKgxUPXf48rDsPm9vMsIij0uHswwwbXL8g==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.16.1':
+    resolution: {integrity: sha512-RK//8ZLcXGW8A2k8bQOXZDBN1Qu92zN4dYnG1bzj1zoQ1fkZ6jNzZ1AvXtsfGVma795CJtvoaF5bLXf4l/FIUw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.16.1':
+    resolution: {integrity: sha512-Ox3kNNVxtGw6pK7SVejmeOUgHhUTZgAM7NQQ6cU7frPw3ix9+j7d2MGbRg3fyEFAaKWq8ZAZLTQGcDyLnAu+qA==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.16.1':
+    resolution: {integrity: sha512-k+FhRJ0ttphFoFIVB1Sk4v76YJAulafmA/Ly57cysesUhhIzVlApeOShUz0jXubKx317TThlEfpQrukldnqORA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@pnpm/exe@12.16.1':
+    resolution: {integrity: sha512-Opsh2R7IuFY3ekd0C282Tmzgr5hiSlKMOv05/3dJXUrrp5NbmjC1Cm5PCFsa8xsiXY7z4oSkI4Qof1LjTkgAJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  pnpm@12.16.1:
+    resolution: {integrity: sha512-CR0d7nknV1Zhsl2rPCrjHK/BxU1rce1qZgDPDByxBDSkR+rhQBXxsj4ua+3u1535SpMuIWTSgyKA3OP7MvZW0Q==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.android-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.android-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.darwin-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.freebsd-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-ppc64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-riscv64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-s390x@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.16.1':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.16.1':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.16.1':
+    optional: true
+
+  '@pnpm/exe@12.16.1':
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.16.1
+      '@pnpm/exe.android-x64': 12.16.1
+      '@pnpm/exe.darwin-arm64': 12.16.1
+      '@pnpm/exe.darwin-x64': 12.16.1
+      '@pnpm/exe.freebsd-x64': 12.16.1
+      '@pnpm/exe.linux-arm64': 12.16.1
+      '@pnpm/exe.linux-arm64-musl': 12.16.1
+      '@pnpm/exe.linux-ppc64': 12.16.1
+      '@pnpm/exe.linux-riscv64': 12.16.1
+      '@pnpm/exe.linux-s390x': 12.16.1
+      '@pnpm/exe.linux-x64': 12.16.1
+      '@pnpm/exe.linux-x64-musl': 12.16.1
+      '@pnpm/exe.win32-arm64': 12.16.1
+      '@pnpm/exe.win32-x64': 12.16.1
+
+  pnpm@12.16.1:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.16.1
+      '@pnpm/exe.android-x64': 12.16.1
+      '@pnpm/exe.darwin-arm64': 12.16.1
+      '@pnpm/exe.darwin-x64': 12.16.1
+      '@pnpm/exe.freebsd-x64': 12.16.1
+      '@pnpm/exe.linux-arm64': 12.16.1
+      '@pnpm/exe.linux-arm64-musl': 12.16.1
+      '@pnpm/exe.linux-ppc64': 12.16.1
+      '@pnpm/exe.linux-riscv64': 12.16.1
+      '@pnpm/exe.linux-s390x': 12.16.1
+      '@pnpm/exe.linux-x64': 12.16.1
+      '@pnpm/exe.linux-x64-musl': 12.16.1
+      '@pnpm/exe.win32-arm64': 12.16.1
+      '@pnpm/exe.win32-x64': 12.16.1
+
+---

package/templates/emdash/pnpm-workspace.yaml

@@ -8,7 +8,7 @@ allowBuilds:
 
 # Supply-chain hardening: cooldown on brand-new releases (toolchain exempt)
 # and no non-registry transitive sources.
-minimumReleaseAge: 1440
+minimumReleaseAge: 4320
 minimumReleaseAgeExclude:
   - '@getvitops/*'
   - emdash

package/templates/emdash/public/_headers

@@ -0,0 +1,10 @@
+# Cloudflare Workers static assets apply this file to every asset response.
+#
+# A baseline that cannot break a page. No Content-Security-Policy on purpose: <Head /> emits
+# inline scripts (the consent stub, the colour-scheme bootstrap), so a strict policy needs
+# per-site nonces or hashes — add one deliberately once you know which third-party tags you load.
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+  X-Frame-Options: SAMEORIGIN

package/templates/emdash/scripts/build-dev-wrangler.mjs

@@ -66,6 +66,12 @@ cfg.r2_buckets = (cfg.r2_buckets ?? []).map((r) =>
   r.binding === 'MEDIA' ? { ...r, bucket_name: `${r.bucket_name}-dev` } : r,
 );
 
+// No cron on dev. Dev's database is a copy of prod (scripts/refresh-dev.mjs),
+// so it carries prod's scheduled publishes and plugin jobs; leaving the trigger
+// on would run them a second time against the copy. The cost: scheduled
+// publishing can't be exercised on dev.
+delete cfg.triggers;
+
 // Flat config — no nested environments.
 delete cfg.env;
 

package/templates/emdash/scripts/refresh-dev.mjs

@@ -0,0 +1,182 @@
+// Refreshes the DEV D1 database (and, optionally, the dev media bucket) from
+// PRODUCTION. One direction only: prod is the source of truth for content, dev
+// is a disposable copy used to rehearse code and schema changes against real
+// data (EmDash's own "rehearse changes on a preview environment" pattern).
+//
+//   node scripts/refresh-dev.mjs          # wipe dev D1, import prod's export
+//   node scripts/refresh-dev.mjs --dry    # run every check, change nothing
+//
+// Names come from wrangler.jsonc, the same way scripts/build-dev-wrangler.mjs
+// derives them, so the two can't disagree about which resources are "dev":
+//
+//   D1      <database_name>      → <database_name>-dev   (id from $DEV_D1_ID)
+//   R2      <bucket_name>        → <bucket_name>-dev
+//
+// SAFETY, in the order it is enforced:
+//   1. $DEV_D1_ID must be set, and `wrangler d1 info <name>-dev` must report
+//      that same id. A name that resolves to a different database than the id
+//      we were told about means one of the two is stale.
+//   2. The dev id must differ from prod's. This script DROPS every table in
+//      the target, so pointing it at prod would erase production — the exact
+//      thing the dev/prod split exists to prevent.
+//   Both checks run before the first write, and `--dry` stops after them.
+//
+// Not copied: anything outside D1/R2. Sessions live in the Astro session store
+// (KV), not D1, so nothing is carried over there. The preview-link secret IS in
+// D1 — set EMDASH_PREVIEW_SECRET on the dev worker so prod preview links don't
+// verify on dev (see SETUP.html).
+//
+// Media is copied only when R2 S3 credentials are present, because wrangler has
+// no bucket-to-bucket sync and rclone needs the S3 API:
+//   R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, CLOUDFLARE_ACCOUNT_ID
+// Without them the database is refreshed and media is left alone, with a note —
+// dev then shows broken images for anything uploaded since the last copy.
+//
+// KNOWN LIMIT: `wrangler d1 export` does not support virtual tables, so an FTS5
+// search table breaks the export. EmDash rebuilds its search index on the first
+// search call, so if an export ever fails on one, drop it from prod's schema
+// dump rather than working around it here.
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+/**
+ * Pull the D1 database and R2 bucket names out of a wrangler.jsonc source.
+ * Regex rather than a JSONC parser: the template carries no parser, the file
+ * is ours, and these two keys are the only thing read. `//` comment lines are
+ * stripped first so a commented-out example block can't be picked up.
+ */
+export function parseBindingNames(jsonc) {
+  const code = jsonc
+    .split('\n')
+    .filter((line) => !line.trim().startsWith('//'))
+    .join('\n');
+  const database = /"database_name"\s*:\s*"([^"]+)"/.exec(code)?.[1];
+  const bucket = /"bucket_name"\s*:\s*"([^"]+)"/.exec(code)?.[1];
+  return { database, bucket };
+}
+
+/**
+ * Throws unless it is safe to wipe `devId`'s database. Pure, so the one check
+ * that stands between this script and production is asserted in a test.
+ */
+export function assertSafeTarget({ devName, devId, devReportedId, prodId }) {
+  if (!devId) throw new Error('DEV_D1_ID is not set.');
+  if (!devName.endsWith('-dev')) throw new Error(`Refusing: "${devName}" is not a -dev database.`);
+  if (devReportedId !== devId) {
+    throw new Error(
+      `DEV_D1_ID (${devId}) does not match "${devName}" (${devReportedId}). One of them is stale.`,
+    );
+  }
+  if (devId === prodId) throw new Error('Refusing: the dev database id is the production id.');
+}
+
+/**
+ * SQL that empties a database: views, then virtual tables, then ordinary
+ * tables. `rows` is `{ name, type, sql }` from sqlite_master. A virtual table
+ * owns shadow tables named `<virtual>_*`, which SQLite refuses to drop on their
+ * own and removes with the parent, so those are skipped.
+ */
+export function dropStatements(rows) {
+  const virtual = rows.filter((r) => /^CREATE VIRTUAL TABLE/i.test(r.sql ?? ''));
+  const isShadow = (name) => virtual.some((v) => name.startsWith(`${v.name}_`));
+  const tables = rows.filter(
+    (r) => r.type === 'table' && !virtual.includes(r) && !isShadow(r.name),
+  );
+  const q = (name) => `"${name.replaceAll('"', '""')}"`;
+  return [
+    'PRAGMA defer_foreign_keys = true;',
+    ...rows.filter((r) => r.type === 'view').map((r) => `DROP VIEW IF EXISTS ${q(r.name)};`),
+    ...virtual.map((r) => `DROP TABLE IF EXISTS ${q(r.name)};`),
+    ...tables.map((r) => `DROP TABLE IF EXISTS ${q(r.name)};`),
+  ];
+}
+
+const wrangler = (args, opts = {}) =>
+  execFileSync('pnpm', ['exec', 'wrangler', ...args], { encoding: 'utf8', ...opts });
+
+const d1Id = (name) => JSON.parse(wrangler(['d1', 'info', name, '--json'])).uuid;
+
+function main() {
+  const dry = process.argv.includes('--dry');
+  const wranglerConfig = 'wrangler.jsonc';
+  if (!existsSync(wranglerConfig))
+    throw new Error(`Run from the project root (no ${wranglerConfig}).`);
+
+  const { database, bucket } = parseBindingNames(readFileSync(wranglerConfig, 'utf8'));
+  if (!database) throw new Error(`No D1 database_name found in ${wranglerConfig}.`);
+  const devDatabase = `${database}-dev`;
+
+  assertSafeTarget({
+    devName: devDatabase,
+    devId: process.env.DEV_D1_ID,
+    devReportedId: d1Id(devDatabase),
+    prodId: d1Id(database),
+  });
+  console.log(`OK to refresh ${devDatabase} from ${database}.`);
+
+  const dir = mkdtempSync(join(tmpdir(), 'refresh-dev-'));
+  const dump = join(dir, 'prod.sql');
+  const wipe = join(dir, 'wipe.sql');
+
+  const master = JSON.parse(
+    wrangler([
+      'd1',
+      'execute',
+      devDatabase,
+      '--remote',
+      '--json',
+      '--command',
+      "SELECT name, type, sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' AND name NOT LIKE '\\_cf\\_%' ESCAPE '\\' AND type IN ('table','view')",
+    ]),
+  )[0].results;
+  writeFileSync(wipe, `${dropStatements(master).join('\n')}\n`);
+
+  if (dry) {
+    console.log(`--dry: would drop ${master.length} objects from ${devDatabase} and import prod.`);
+    console.log(
+      bucket ? `--dry: would copy ${bucket} → ${bucket}-dev.` : '--dry: no R2 bucket found.',
+    );
+    return;
+  }
+
+  wrangler(['d1', 'export', database, '--remote', '--output', dump], { stdio: 'inherit' });
+  wrangler(['d1', 'execute', devDatabase, '--remote', '--file', wipe], { stdio: 'inherit' });
+  wrangler(['d1', 'execute', devDatabase, '--remote', '--file', dump], { stdio: 'inherit' });
+  console.log(`Imported ${database} into ${devDatabase}.`);
+
+  const { R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, CLOUDFLARE_ACCOUNT_ID } = process.env;
+  if (!bucket) return;
+  if (!R2_ACCESS_KEY_ID || !R2_SECRET_ACCESS_KEY || !CLOUDFLARE_ACCOUNT_ID) {
+    console.log(
+      `Skipped media: R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY not set, ${bucket}-dev left as is.`,
+    );
+    return;
+  }
+  // Credentials ride rclone's env-var config, not the command line, so the
+  // secret never appears in a process listing.
+  const env = {
+    ...process.env,
+    RCLONE_CONFIG_R2_TYPE: 's3',
+    RCLONE_CONFIG_R2_PROVIDER: 'Cloudflare',
+    RCLONE_CONFIG_R2_ENDPOINT: `https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com`,
+    RCLONE_CONFIG_R2_ACCESS_KEY_ID: R2_ACCESS_KEY_ID,
+    RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: R2_SECRET_ACCESS_KEY,
+  };
+  // `sync`, not `copy`: media deleted from prod should disappear from dev too.
+  execFileSync('rclone', ['sync', `R2:${bucket}`, `R2:${bucket}-dev`], { env, stdio: 'inherit' });
+  console.log(`Synced ${bucket} → ${bucket}-dev.`);
+}
+
+// Importable for tests without running; executed when invoked as a script.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    main();
+  } catch (err) {
+    console.error(`ERROR: ${err.message}`);
+    process.exit(1);
+  }
+}