@getvitops/create 0.8.1 → 0.9.0-alpha.0

package/templates/emdash/README.md

@@ -3,7 +3,7 @@
 An [EmDash CMS](https://docs.emdashcms.com) website on Cloudflare Workers,
 styled by the [Vitops design system](https://www.npmjs.com/org/getvitops).
 
-Scaffolded from `vp create @getvitops:emdash`.
+Scaffolded from `vp create @getvitops:emdash --directory <client-slug>` (pass a directory: `vp create` derives the package name from it and invents a random slug otherwise).
 
 ## Stack
 
@@ -15,7 +15,7 @@ Scaffolded from `vp create @getvitops:emdash`.
   `src/assets/logo.svg`, and serves the web-component runtime
 - **`@getvitops/emdash`** — design-system Portable Text blocks in the editor
   slash menu (hero, cards, accordion, carousel, gallery, marquee, banner, …);
-  `npx vitops docs blocks` lists every block and field
+  `vp exec vitops docs blocks` lists every block and field
 
 `src/assets/placeholder/` ships neutral wireframe images for layout work
 before real imagery exists — delete once real assets land (separate from
@@ -24,8 +24,8 @@ before real imagery exists — delete once real assets land (separate from
 ## Local development
 
 ```bash
-pnpm install
-pnpm dev
+vp install
+vpr dev
 ```
 
 Once this is its own repo (not sitting inside the `getvitops/design-system`
@@ -36,22 +36,30 @@ honours that option at a project's actual root, and errors on it otherwise.
 No Cloudflare account needed: `astro dev` runs the Worker locally with local
 D1/R2 emulation (state in `.wrangler/`). On first boot EmDash runs its
 migrations and applies the structure from `seed/seed.json` — a `pages`
-collection, a `primary` menu, and the site settings.
+collection, three menus (`primary`, `footer-sitemap`, `footer-legal`), and the site
+settings.
 
 - Site: <http://localhost:4321>
 - Admin: <http://localhost:4321/_emdash/admin>
 
 Open the admin and complete the setup wizard — it creates your first account,
 and choosing to **include sample content** publishes the starter pages from
-the seed: home, about, terms (`/terms`), and privacy policy (`/privacy`).
-Until then the home route shows a friendly empty state. Unknown paths render
-`src/pages/404.astro`.
+the seed: home, about, contact (`/contact`), terms (`/terms`), privacy policy
+(`/privacy`) and cookie notice (`/cookies`) — every link in the seeded menus
+resolves. Until then the home route shows a friendly empty state. Unknown paths
+get the prerendered `src/pages/404.astro` with a real 404 status.
+
+**Pages are prerendered.** `vpr build` writes static HTML for every published
+`pages` entry, so an edit in the admin goes live on the next rebuild rather than
+per request — see AGENTS.md "Rendering and freshness" for how production content
+reaches the build (`scripts/pull-content.mjs`) and for the publish-triggered rebuild.
+In `vpr dev` the pages read your local database, so edits appear straight away.
 
 The two legal pages are placeholders. To generate real ones from what your site
 actually does, fill in `site.json`'s `organization`/`site.legal` fields and run:
 
 ```sh
-npx vitops legal --format portable-text --out ./legal
+vp exec vitops legal --format portable-text --out ./legal
 ```
 
 Then paste each document's blocks into the matching page in the admin. The
@@ -61,8 +69,8 @@ before you publish.
 ## Deploy
 
 ```bash
-npx wrangler login
-pnpm deploy
+vp exec wrangler login
+vpr deploy
 ```
 
 Wrangler provisions the D1 database and R2 bucket named in `wrangler.jsonc`
@@ -92,7 +100,7 @@ One-time setup — see [Start a new EmDash site](https://docs.vitops.ca/guides/n
 procedure, then work through the checklist:
 
 ```bash
-pnpm run sop && open SETUP.html   # or: xdg-open SETUP.html
+vpr sop && open SETUP.html   # or: xdg-open SETUP.html
 ```
 
 It covers host choice, GitHub + branch policy, hosting resources, going live
@@ -102,7 +110,7 @@ command per step. An AI agent can work the same list autonomously via
 `.agents/skills/setup/`; it stops at the steps that genuinely need a human
 (the Cloudflare API token, the domain cutover, publishing legal documents).
 
-`pnpm deploy:dev` reproduces the dev deploy locally: it rewrites the
+`vpr deploy:dev` reproduces the dev deploy locally: it rewrites the
 adapter-generated wrangler config (`scripts/build-dev-wrangler.mjs`) so the
 dev worker never touches prod data — it hard-fails without `DEV_D1_ID`,
 on purpose. Schema/content changes live in the EmDash database, not git, so
@@ -119,7 +127,7 @@ is a configurable dimension of the project, not a rewrite:
   belong to this target.
 - **`node`** — `@astrojs/node` (standalone) + SQLite file + local uploads,
   for a VPS / docker-compose / k8s host. Not installed by default; to switch:
-  `pnpm add @astrojs/node better-sqlite3`, then `vitopsHosting({ target:
+  `vp add @astrojs/node better-sqlite3`, then `vitopsHosting({ target:
   'node' })` (or set `HOSTING=node` — the env var wins). Run the built site
   with `node ./dist/server/entry.mjs`; data lives in `./data/` (gitignored) —
   persist it as a volume. Scheduled publishing runs in-process on Node, so
@@ -139,12 +147,12 @@ and media in the storage backend (bucket/directory copy).
   agents answer from current documentation. Your running site also exposes its
   own content MCP server at `/_emdash/api/mcp` (authenticated).
 - **Skills** (`.agents/skills/`): `promote` dispatches the dev → main
-  promotion workflow. Run `npx vitops agents` to also write the design-system
+  promotion workflow. Run `vp exec vitops agents` to also write the design-system
   class reference into `AGENTS.md`.
 - **EmDash skills** are installed per project so they match the pinned `emdash`
-  version: `npx skills add emdash-cms/skills --skill '*' -a claude-code -y`,
-  then commit `.agents/skills/` and `skills-lock.json`. Update with
-  `npx skills update` after an `emdash` bump.
+  version: `vp dlx skills add emdash-cms/skills --skill '*' -y`,
+  then commit `.agents/skills/`, the `.claude/skills/` symlinks and `skills-lock.json`. Update with
+  `vp dlx skills update` after an `emdash` bump.
 - **Claude Code on the web**: the SessionStart hook
   (`.claude/hooks/session-start.sh`) installs Node 24 (matching
   `devEngines`), activates the pinned pnpm, and installs dependencies in the
@@ -164,27 +172,30 @@ routes stay unstyled by it.
 Useful commands (via `@getvitops/cli`):
 
 ```bash
-npx vitops validate site.json   # check the config against the schema
-npx vitops agents               # write the design-system reference into AGENTS.md
-pnpm build:css                  # regenerate the CSS manually
+vp exec vitops validate site.json   # check the config against the schema
+vp exec vitops agents               # write the design-system reference into AGENTS.md
+vpr build:css                  # regenerate the CSS manually
 ```
 
 ## Project map
 
-| Path                             | Purpose                                                                                    |
-| -------------------------------- | ------------------------------------------------------------------------------------------ |
-| `site.json`                      | Org + site config; design tokens/patterns at `designSystem.themes.default` → generated CSS |
-| `seed/seed.json`                 | First-boot content model + starter content                                                 |
-| `src/worker.ts`                  | Worker entry (fetch + EmDash scheduled handler)                                            |
-| `src/live.config.ts`             | Astro live content collections wiring for EmDash                                           |
-| `src/layouts/Layout.astro`       | Site chrome: EmDash + Vitops head tags, nav from the CMS menu                              |
-| `src/pages/index.astro`          | Home — renders the `home` page entry                                                       |
-| `src/pages/[...slug].astro`      | Catch-all — renders any `pages` entry at its slug                                          |
-| `src/pages/404.astro`            | Not-found page (the catch-all rewrites here)                                               |
-| `wrangler.jsonc`                 | Cloudflare bindings (D1/R2) + cron trigger                                                 |
-| `scripts/build-dev-wrangler.mjs` | Rewrites the built wrangler config for the isolated dev worker                             |
-| `SETUP.html`                     | Client-onboarding checklist — run `pnpm run sop` first (see "One-time setup")              |
-| `.github/workflows/`             | deploy-dev (push to `dev`), deploy-prod (push to `main`), promote                          |
-| `.agents/skills/promote/`        | Agent skill: dispatch the dev → main promotion                                             |
-| `.mcp.json`                      | Astro + EmDash docs MCP servers for coding agents                                          |
-| `.claude/hooks/`                 | Claude Code web: Node 24 + pnpm setup on session start                                     |
+| Path                             | Purpose                                                                                            |
+| -------------------------------- | -------------------------------------------------------------------------------------------------- |
+| `site.json`                      | Org + site config; design tokens/patterns at `designSystem.themes.default` → generated CSS         |
+| `seed/seed.json`                 | First-boot content model + starter content                                                         |
+| `src/worker.ts`                  | Worker entry (fetch + EmDash scheduled handler)                                                    |
+| `src/live.config.ts`             | Astro live content collections wiring for EmDash                                                   |
+| `src/layouts/Layout.astro`       | Site chrome: EmDash + Vitops head tags, nav from the CMS menu                                      |
+| `src/pages/index.astro`          | Home — prerendered from the `home` page entry                                                      |
+| `src/pages/[...slug].astro`      | Prerendered once per published `pages` entry (`getStaticPaths`)                                    |
+| `src/pages/404.astro`            | Prerendered not-found page, served with a 404 status for any unmatched URL                         |
+| `public/_headers`                | Report-Only CSP for the static pages (see AGENTS.md "Content Security Policy")                     |
+| `scripts/pull-content.mjs`       | Loads production's D1 into the local build DB before the prerender (`deploy`/`deploy:dev`)         |
+| `wrangler.jsonc`                 | Cloudflare bindings (D1/R2) + cron trigger                                                         |
+| `scripts/build-dev-wrangler.mjs` | Rewrites the built wrangler config for the isolated dev worker                                     |
+| `SETUP.html`                     | Client-onboarding checklist — run `vpr sop` first (see "One-time setup")                           |
+| `.github/workflows/`             | deploy-dev (push to `dev`), deploy-prod (push to `main`, or an `emdash-publish` dispatch), promote |
+| `.agents/skills/promote/`        | Agent skill: dispatch the dev → main promotion                                                     |
+| `.agents/skills/custom-blocks/`  | Agent skill: when (and how) to add a block type — compose, extend, local, upstream                 |
+| `.mcp.json`                      | Astro + EmDash docs MCP servers for coding agents                                                  |
+| `.claude/hooks/`                 | Claude Code web: Node 24 + pnpm setup on session start                                             |

package/templates/emdash/SETUP.html

@@ -7,7 +7,7 @@
     <!--
       Opened straight from disk (file://) before anything is deployed, which is
       when most of these steps happen — so it links a relative, pre-generated
-      stylesheet rather than the site's own build output. Run `pnpm run sop`
+      stylesheet rather than the site's own build output. Run `vpr sop`
       first (it's a one-line `vitops generate -f css` into .vitops/sop/); the
       banner below explains this if the stylesheet 404s, and the markup stays
       legible either way — every item here is a real checkbox in a real
@@ -21,7 +21,7 @@
     -->
     <link id="sop-stylesheet" rel="stylesheet" href=".vitops/sop/styles.css" />
     <style>
-      /* Minimal fallback so the page is still legible before `pnpm run sop`
+      /* Minimal fallback so the page is still legible before `vpr sop`
          has run once — intentionally not framework CSS, since it only ever
          applies in the narrow window before the real stylesheet exists. */
       body {
@@ -42,7 +42,7 @@
       <header class="region rhythm">
         <h1>Client onboarding checklist</h1>
         <p id="no-stylesheet-notice" class="banner" hidden>
-          This page isn't styled yet — run <code>pnpm run sop</code> once (it generates
+          This page isn't styled yet — run <code>vpr sop</code> once (it generates
           <code>.vitops/sop/styles.css</code>), then reload.
         </p>
         <p>
@@ -90,7 +90,7 @@
               <span class="custom-check__box"
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
-              <span> Preview it: <code>npx vitops setup repo --dry</code> </span>
+              <span> Preview it: <code>vp exec vitops setup repo --dry</code> </span>
             </label>
             <label class="custom-check">
               <input type="checkbox" data-sop="repo.run" />
@@ -98,7 +98,7 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Run it: <code>npx vitops setup repo</code> — creates the GitHub repo, pushes
+                Run it: <code>vp exec vitops setup repo</code> — creates the GitHub repo, pushes
                 <code>main</code> + <code>dev</code>, makes <code>dev</code> default, and requests
                 branch protection + the <code>production</code>/<code>dev</code>
                 environments.
@@ -126,7 +126,7 @@
               <span class="custom-check__box"
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
-              <span> Preview it: <code>npx vitops setup hosting --dry</code> </span>
+              <span> Preview it: <code>vp exec vitops setup hosting --dry</code> </span>
             </label>
             <label class="custom-check">
               <input type="checkbox" data-sop="hosting.run" />
@@ -134,10 +134,10 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Run it: <code>npx vitops setup hosting</code> — provisions the isolated dev D1
+                Run it: <code>vp exec vitops setup hosting</code> — provisions the isolated dev D1
                 database + R2 bucket (EmDash template) and sets the <code>DEV_D1_ID</code> /
                 <code>CLOUDFLARE_ACCOUNT_ID</code> repo secrets. Requires
-                <code>npx wrangler login</code> first.
+                <code>vp exec wrangler login</code> first.
               </span>
             </label>
             <label class="custom-check">
@@ -276,7 +276,7 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Deploy once (<code>pnpm deploy</code>), note the printed
+                Deploy once (<code>vpr deploy</code>), note the printed
                 <code>*.workers.dev</code> URL, and set
                 <code>site.environments.production.url</code> in <code>site.json</code> to it.
               </span>
@@ -315,8 +315,8 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Preview it: <code>npx vitops setup domain --domain &lt;apex&gt; --dry</code> — this
-                only plans and checks; it never applies the cutover itself.
+                Preview it: <code>vp exec vitops setup domain --domain &lt;apex&gt; --dry</code> —
+                this only plans and checks; it never applies the cutover itself.
               </span>
             </label>
             <label class="custom-check">
@@ -326,7 +326,7 @@
               ></span>
               <span>
                 Uncomment the <code>routes</code> block in <code>wrangler.jsonc</code>, set your
-                apex, and deploy: <code>pnpm deploy</code>.
+                apex, and deploy: <code>vpr deploy</code>.
               </span>
             </label>
             <label class="custom-check">
@@ -347,7 +347,8 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Re-run <code>npx vitops robots</code> and <code>npx vitops search notify</code>.
+                Re-run <code>vp exec vitops robots</code> and
+                <code>vp exec vitops search notify</code>.
               </span>
             </label>
           </div>
@@ -373,7 +374,7 @@
               <span class="custom-check__box"
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
-              <span> Check it: <code>npx vitops validate site.json</code> </span>
+              <span> Check it: <code>vp exec vitops validate site.json</code> </span>
             </label>
           </div>
         </details>
@@ -398,8 +399,8 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Preview then run: <code>npx vitops setup search --dry</code>, then
-                <code>npx vitops setup search</code>. This is a <strong>user OAuth</strong>
+                Preview then run: <code>vp exec vitops setup search --dry</code>, then
+                <code>vp exec vitops setup search</code>. This is a <strong>user OAuth</strong>
                 action, deliberately — verifying a site makes the caller an owner, and that should
                 be a person, not a deploy robot.
               </span>
@@ -410,8 +411,25 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                Preview then run: <code>npx vitops setup ads --dry</code>, then
-                <code>npx vitops setup ads</code>.
+                Preview then run: <code>vp exec vitops setup ads --dry</code>, then
+                <code>vp exec vitops setup ads</code>.
+              </span>
+            </label>
+            <label class="custom-check">
+              <input type="checkbox" data-sop="connections.turnstile" />
+              <span class="custom-check__box"
+                ><span class="custom-check__indicator custom-check__indicator--check"></span
+              ></span>
+              <span>
+                If the site has a contact form, create its spam check:
+                <code>vp exec vitops setup turnstile --dry</code>, then
+                <code>vp exec vitops setup turnstile</code>. It needs
+                <code>CLOUDFLARE_API_TOKEN</code> with
+                <strong>Account &gt; Turnstile &gt; Edit</strong> (plus
+                <code>CLOUDFLARE_ACCOUNT_ID</code>) and <code>wrangler login</code>. The public site
+                key goes into <code>site.security.turnstile.siteKey</code>; the secret is saved as
+                the Worker secret <code>VITOPS_TURNSTILE_SECRET</code> and never touches
+                <code>site.json</code>. It never edits or deletes an existing widget.
               </span>
             </label>
             <label class="custom-check">
@@ -453,10 +471,10 @@
               ></span>
               <span>
                 Generate real documents from the filled-in config —
-                <code>npx vitops legal --format portable-text</code> (EmDash; paste into the admin)
-                or <code>npx vitops legal --format md</code> (static; commit the output). The seeded
-                <code>/terms</code> and <code>/privacy</code> pages are deliberately short,
-                obviously-unfinished placeholders.
+                <code>vp exec vitops legal --format portable-text</code> (EmDash; paste into the
+                admin) or <code>vp exec vitops legal --format md</code> (static; commit the output).
+                The seeded <code>/terms</code> and <code>/privacy</code> pages are deliberately
+                short, obviously-unfinished placeholders.
               </span>
             </label>
             <label class="custom-check">
@@ -484,7 +502,7 @@
               ></span>
               <span>
                 Robots directive matches the live origin's intent (blocked while on workers.dev,
-                open after cutover) — <code>npx vitops robots</code>.
+                open after cutover) — <code>vp exec vitops robots</code>.
               </span>
             </label>
             <label class="custom-check">
@@ -509,7 +527,7 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                <code>npx vitops lint --src</code> and <code>pnpm typecheck</code> both clean.
+                <code>vp exec vitops lint --src</code> and <code>vpr typecheck</code> both clean.
               </span>
             </label>
             <label class="custom-check">
@@ -527,7 +545,7 @@
               <span class="custom-check__box"
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
-              <span> <code>npx vitops search notify</code> run once live. </span>
+              <span> <code>vp exec vitops search notify</code> run once live. </span>
             </label>
             <label class="custom-check">
               <input type="checkbox" data-sop="launch.check" />
@@ -535,8 +553,8 @@
                 ><span class="custom-check__indicator custom-check__indicator--check"></span
               ></span>
               <span>
-                A day or two later: <code>npx vitops search notify --check</code> confirms Google
-                actually indexed it.
+                A day or two later: <code>vp exec vitops search notify --check</code> confirms
+                Google actually indexed it.
               </span>
             </label>
           </div>

package/templates/emdash/_gitignore

@@ -12,6 +12,9 @@ worker-configuration.d.ts
 # wrangler local state (local D1/R2 data lives here during `astro dev`)
 .wrangler/
 
+# production content dump `scripts/pull-content.mjs` loads into the local build DB
+.vitops/content.sql
+
 # node hosting target: SQLite db + local uploads
 data/
 

package/templates/emdash/astro.config.mjs

@@ -23,6 +23,15 @@ const organizationName = resolveOrganizationName(config) ?? 'My EmDash Site';
 // data migration, not a rewrite — see README "Hosting".
 const { adapter, database, storage } = await vitopsHosting();
 
+// Favicon/PWA colours come from site.json rather than a second copy here that
+// drifts when the palette changes: the browser-UI colour is the `brand-primary`
+// role's hue seed. (The page background behind the maskable icon is a computed
+// ramp step, not a config value, so `backgroundColor` below stays a literal.)
+const colors = config.designSystem?.themes?.default?.colors ?? {};
+const roleHue = (role) =>
+  typeof colors.roles?.[role] === 'string' ? colors.roles[role] : colors.roles?.[role]?.hue;
+const brandColor = colors.palette?.[roleHue('brand-primary')]?.seed ?? '#2e9b73';
+
 export default defineConfig({
   output: 'server',
   adapter,
@@ -79,7 +88,7 @@ export default defineConfig({
       favicon: {
         source: 'src/assets/logo.svg',
         name: organizationName,
-        themeColor: '#2e9b73',
+        themeColor: brandColor,
         backgroundColor: '#ffffff',
       },
       // inject: false — Layout.astro imports the generated stylesheet, so
@@ -91,6 +100,10 @@ export default defineConfig({
       // there instead of a bare design-system.json. legal/fonts/search/ads/
       // reviews all read the same file (see AGENTS.md's "Client onboarding").
       css: { format: 'tailwind', inject: false, input: 'site.json' },
+      // The /design-system admin page embeds public/vitops/design-system-editor.html in an
+      // iframe; this writes it, with its manifest, editor.js and editor.css, without loading
+      // the editor on public pages.
+      editorManifest: true,
       site: { input: 'site.json' },
     }),
   ],

package/templates/emdash/package.json

@@ -5,10 +5,12 @@
   "type": "module",
   "scripts": {
     "dev": "astro dev",
-    "build": "astro build",
+    "build": "astro build && vitops emdash check-prerender",
     "preview": "astro preview",
-    "deploy": "vitops email check && astro build && emdash migrate --wrangler-config wrangler.jsonc && wrangler deploy",
-    "deploy:dev": "vitops email check && astro build && node scripts/build-dev-wrangler.mjs && emdash migrate --wrangler-config dist/server/wrangler.dev.json && wrangler deploy --config dist/server/wrangler.dev.json",
+    "pull-content": "node scripts/pull-content.mjs",
+    "prepare-local-db": "vitops emdash prepare-db",
+    "deploy": "vitops email check && node scripts/pull-content.mjs && vitops emdash prepare-db && astro build && vitops emdash check-prerender && emdash migrate --wrangler-config wrangler.jsonc && wrangler deploy",
+    "deploy:dev": "vitops email check && node scripts/pull-content.mjs && vitops emdash prepare-db && astro build && vitops emdash check-prerender && node scripts/build-dev-wrangler.mjs && emdash migrate --wrangler-config dist/server/wrangler.dev.json && wrangler deploy --config dist/server/wrangler.dev.json",
     "init:github": "vitops setup repo",
     "init:hosting": "vitops setup hosting",
     "setup": "vitops setup all",
@@ -21,13 +23,13 @@
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.0",
     "@astrojs/react": "^7.1.2",
-    "@emdash-cms/cloudflare": "^1.4.0",
+    "@emdash-cms/cloudflare": "latest",
     "@getvitops/astro": "latest",
     "@getvitops/core": "latest",
     "@getvitops/emdash": "latest",
     "@tailwindcss/vite": "^4.3.3",
     "astro": "^7.4.4",
-    "emdash": "^1.4.0",
+    "emdash": "latest",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "tailwindcss": "^4.3.3"

package/templates/emdash/public/_headers

@@ -1,9 +1,24 @@
-# Cloudflare Workers static assets apply this file to every asset response.
+# Cloudflare static-assets response headers. They apply to files served from the
+# static asset store — the prerendered pages — and NOT to responses the Worker
+# renders itself (the EmDash admin at /_emdash/*, its API, anything left
+# on-demand). See AGENTS.md "Content Security Policy".
 #
-# A baseline that cannot break a page. No Content-Security-Policy on purpose: <Head /> emits
-# inline scripts (the consent stub, the colour-scheme bootstrap), so a strict policy needs
-# per-site nonces or hashes — add one deliberately once you know which third-party tags you load.
+# REPORT-ONLY on purpose: violations are logged to the browser console and
+# nothing is blocked, so this cannot break a page. Read the console on the
+# pages you ship, add what is legitimately needed, then rename the header to
+# `Content-Security-Policy` to enforce it.
+#
+# The two sha256 values are the inline scripts <Head /> emits (the colour-scheme
+# bootstrap and the consent-gate stub). They change only when
+# @getvitops/astro changes those scripts; regenerate with
+#   vp exec node -e "import('@getvitops/astro').then(m => console.log(m.contentSecurityPolicy()))"
+# `templates.test.ts` in the toolchain repo guards that they match.
+#
+# Expect reports for scripts this policy cannot name by hash: EmDash's own head
+# tags, a server-island loader, an editor's HTML block, and third-party tags the
+# consent gate activates (allow their origins in script-src/connect-src).
 /*
+  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' 'sha256-CEiVlTo192T9Rug/nAl+ihvkqOQkYdr6Rq3oc+gR9JU=' 'sha256-z/UqsITVvNGOJSaOSvhN1rdtyYdMIxpQ/lMXM1q0g90=' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-src https://challenges.cloudflare.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'
   X-Content-Type-Options: nosniff
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

package/templates/emdash/scripts/pull-content.mjs

@@ -0,0 +1,83 @@
+// Pre-build step: load production's EmDash content into the LOCAL D1 the build
+// prerenders from.
+//
+// Why this exists: `src/pages/index.astro` and `[...slug].astro` are prerendered
+// (`prerender = true` + `getStaticPaths`), so their HTML is written during
+// `astro build`. The Cloudflare adapter prerenders inside a local workerd with a
+// LOCAL D1 (`.wrangler/state`), never the deployed database — so on a CI runner
+// the build would see an empty, auto-seeded database and bake "No home page yet"
+// into every page. Production is the truth for content (see AGENTS.md), so this
+// copies production's D1 into the local one first.
+//
+//   wrangler d1 export <db> --remote   →   .vitops/content.sql
+//   wrangler d1 execute <db> --local   ←   .vitops/content.sql   (state cleared first)
+//
+// Read-only against production (an export). It only ever writes the local
+// `.wrangler/state/v3/d1` directory, which is disposable build state.
+//
+// Fails CLOSED. A deploy that proceeds after a failed pull would publish an empty
+// site over a good one, so any failure aborts the deploy — except one case that is
+// not a failure: the remote database does not exist yet (the first deploy, where
+// wrangler provisions it). Building from the seed is only right once the local database is
+// migrated and seeded, which is `scripts/prepare-local-db.mjs`'s job, run straight after this.
+//
+// Skip with SKIP_PULL_CONTENT=1 (e.g. a deliberate seed-only build).
+
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, rmSync } from 'node:fs';
+
+if (process.env.SKIP_PULL_CONTENT) {
+  console.log('pull-content: SKIP_PULL_CONTENT set — prerendering from the local/seed database.');
+  process.exit(0);
+}
+
+/** wrangler.jsonc allows comments and trailing commas; JSON.parse does not. */
+function parseJsonc(text) {
+  const out = text
+    .replace(/("(?:[^"\\]|\\.)*")|\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, (m, str) => str ?? '')
+    .replace(/,(\s*[}\]])/g, '$1');
+  return JSON.parse(out);
+}
+
+const config = parseJsonc(readFileSync('wrangler.jsonc', 'utf8'));
+const db = config.d1_databases?.[0]?.database_name;
+if (!db) {
+  console.error('pull-content: wrangler.jsonc has no d1_databases[0].database_name.');
+  process.exit(1);
+}
+
+const dump = '.vitops/content.sql';
+mkdirSync('.vitops', { recursive: true });
+
+const wrangler = (args) =>
+  spawnSync('wrangler', args, { encoding: 'utf8', env: { ...process.env, CI: '1' } });
+
+const exported = wrangler([
+  'd1',
+  'export',
+  db,
+  '--remote',
+  '--output',
+  dump,
+  '--skip-confirmation',
+]);
+if (exported.status !== 0) {
+  const text = `${exported.stdout}\n${exported.stderr}`;
+  if (/not found|does not exist|no such database|couldn'?t find|could not find|7404/i.test(text)) {
+    console.warn(
+      `pull-content: remote database "${db}" does not exist yet (first deploy?) — ` +
+        'prerendering from the seed.',
+    );
+    process.exit(0);
+  }
+  console.error(`pull-content: could not export "${db}" from production:\n${text}`);
+  console.error('Refusing to build — prerendering now would publish an empty site.');
+  process.exit(1);
+}
+
+// Replaying onto a populated local database collides on CREATE TABLE, so start clean.
+rmSync('.wrangler/state/v3/d1', { recursive: true, force: true });
+execFileSync('wrangler', ['d1', 'execute', db, '--local', '--file', dump, '--yes'], {
+  stdio: 'inherit',
+});
+console.log(`pull-content: loaded production "${db}" into the local build database.`);