@getvitops/create 0.9.0-alpha.3 → 0.9.0-alpha.5

package/templates/emdash/site.json

@@ -33,10 +33,17 @@
             },
             "ui-primary": "brand",
             "brand-primary": "brand",
-            "info": "sky",
+            "info": {
+              "hue": "sky",
+              "solid": 700
+            },
             "success": "brand",
             "warning": "sun",
-            "danger": "rose"
+            "danger": {
+              "hue": "rose",
+              "solid": 700
+            },
+            "ui-accent": "sun"
           },
           "utilities": ["bg", "text", "icon", "border"]
         },
@@ -106,6 +113,13 @@
               "br": "0.25rem",
               "p": "0.25em 0.5em",
               "fs": "0.75rem"
+            },
+            "content": {
+              "ds": "var(--ds-default)",
+              "b": "var(--b-default)",
+              "br": "0.5rem",
+              "p": "1rem",
+              "fs": "var(--fs-default)"
             }
           },
           "z": {
@@ -115,22 +129,77 @@
             "top": 1000
           },
           "items": {
-            "button": {
+            "btn": {
               "group": "control",
               "element": "button",
-              "default_role": "brand-primary",
+              "class": "btn",
+              "fill": false,
+              "overrides": {
+                "b": "1px solid transparent",
+                "fs": "inherit"
+              },
+              "base": {
+                "display": "inline-flex",
+                "align-items": "center",
+                "justify-content": "center",
+                "gap": "0.4em",
+                "padding": "var(--p-btn-group)",
+                "border-radius": "var(--br-btn-group)",
+                "border": "var(--b-btn-group)",
+                "box-shadow": "var(--ds-btn-group)",
+                "background": "transparent",
+                "color": "inherit",
+                "font-family": "inherit",
+                "font-size": "var(--fs-btn-group)",
+                "font-weight": "inherit",
+                "text-decoration": "none",
+                "cursor": "pointer"
+              },
+              "states": {
+                "hover": {
+                  "step": 1,
+                  "css": {
+                    "background-color": "var(--color-bg-surface-muted)"
+                  }
+                },
+                "focus-visible": {
+                  "ring": true
+                }
+              },
+              "roles": []
+            },
+            "cta": {
+              "group": "control",
+              "class": "cta",
+              "fill": true,
+              "default_role": "ui-primary",
+              "overrides": {
+                "p": "0.75em 1.5em",
+                "b": "none",
+                "ds": "var(--shadow-sm)",
+                "fs": "inherit"
+              },
               "base": {
-                "padding": "0.6em 1.2em",
-                "border-radius": "var(--br-control, 0.25rem)",
-                "border": "none",
+                "display": "inline-flex",
+                "align-items": "center",
+                "justify-content": "center",
+                "gap": "0.5em",
+                "padding": "var(--p-cta-group)",
+                "border-radius": "var(--br-cta-group)",
+                "border": "var(--b-cta-group)",
+                "font-family": "inherit",
+                "font-size": "var(--fs-cta-group)",
                 "font-weight": "600",
-                "color": "#fff",
+                "line-height": "inherit",
+                "text-decoration": "none",
                 "cursor": "pointer",
-                "box-shadow": "var(--shadow-sm)"
+                "color": "var(--color-text-on-ui-primary)",
+                "box-shadow": "var(--ds-cta-group)"
               },
               "states": {
                 "hover": {
-                  "step": 1
+                  "step": 1,
+                  "lift": "1px"
                 },
                 "active": {
                   "scale": 0.97
@@ -139,8 +208,27 @@
                   "ring": true
                 }
               },
-              "roles": ["success", "danger", "warning", "info"],
-              "class": "btn"
+              "roles": ["success", "danger", "warning", "info"]
+            },
+            "link": {
+              "group": "control",
+              "element": "a",
+              "class": "link",
+              "default_role": "ui-primary",
+              "base": {
+                "color": "var(--color-text-ui-primary)",
+                "text-decoration": "underline",
+                "text-underline-offset": "0.15em"
+              },
+              "states": {
+                "hover": {
+                  "step": 1
+                },
+                "focus-visible": {
+                  "ring": true
+                }
+              },
+              "roles": []
             },
             "card": {
               "group": "panel",
@@ -199,6 +287,23 @@
               },
               "states": {},
               "roles": ["success", "danger", "warning", "info"]
+            },
+            "details": {
+              "group": "content"
+            },
+            "steps": {
+              "group": "content",
+              "class": "steps",
+              "overrides": {
+                "b": "1px solid var(--color-border-surface-muted)",
+                "br": "0.75rem",
+                "p": "1.5rem",
+                "ds": "none"
+              },
+              "base": {
+                "--steps-marker-size": "2.5rem",
+                "--steps-line-width": "2px"
+              }
             }
           }
         },
@@ -309,14 +414,40 @@
   },
   "site": {
     "defaultLocale": "en",
+    "chrome": {
+      "masthead": {
+        "position": "sticky",
+        "behavior": "always",
+        "surface": "glass",
+        "layout": "full",
+        "elevation": { "shadow": "sm", "onScroll": true },
+        "height": "4rem"
+      },
+      "nav": { "compact": "drawer", "drawerSide": "end" }
+    },
     "templates": {
       "contact": {
         "type": "form",
         "fields": [
-          { "name": "name", "type": "text", "required": true },
-          { "name": "email", "type": "email", "required": true },
-          { "name": "tel", "type": "tel" },
-          { "name": "message", "type": "textarea", "required": true }
+          {
+            "name": "name",
+            "type": "text",
+            "required": true
+          },
+          {
+            "name": "email",
+            "type": "email",
+            "required": true
+          },
+          {
+            "name": "tel",
+            "type": "tel"
+          },
+          {
+            "name": "message",
+            "type": "textarea",
+            "required": true
+          }
         ]
       }
     },

package/templates/emdash/src/layouts/Layout.astro

@@ -5,9 +5,11 @@ import { getMenu, getSiteSettings } from 'emdash';
 import { createPublicPageContext } from 'emdash/page';
 import SiteFooter from '@getvitops/astro/components/SiteFooter.astro';
 import SiteNav from '@getvitops/astro/components/SiteNav.astro';
+import Masthead from '@getvitops/astro/components/Masthead.astro';
+import { resolveNavOptions } from '@getvitops/astro/components/masthead.ts';
 import { loadNavMenus } from '@getvitops/astro/components/sitenav.ts';
 import { EmDashHead } from 'emdash/ui';
-import { VitopsWidgetArea } from '@getvitops/emdash/astro';
+import { VitopsMegaPanel, VitopsWidgetArea } from '@getvitops/emdash/astro';
 import config from '../../site.json' with { type: 'json' };
 // Design-system CSS, layout-scoped (vitops css.inject: false): only pages
 // rendered through this layout get it — keeps it out of /_emdash/admin, while
@@ -75,18 +77,19 @@ const orgName = config.organization?.name || siteTitle;
   <body>
     <!-- Widget areas (Widgets in the admin): the same content wherever they appear. -->
     <VitopsWidgetArea name="announcement" class="centered" />
-    <header class="navbar-sticky centered">
-      <div class="navbar">
-        <a class="brand flex items-center" href="/" aria-label={`${siteTitle} home`}>
-          <span class="brand-mark" set:html={logo} aria-hidden="true" />
-          <span class="font-heading">{siteTitle}</span>
-        </a>
-        <div class="header-end flex items-center">
-          <SiteNav {...nav} />
-          <wc-color-scheme-toggle></wc-color-scheme-toggle>
-        </div>
+    <!-- The masthead's look and the nav's behaviour come from `site.chrome` in site.json
+         (position, hide-on-scroll, glass, inset, shadow, drawer vs dropdown). A prop here
+         overrides one field for this layout. -->
+    <Masthead config={config}>
+      <a slot="brand" class="brand flex items-center" href="/" aria-label={`${siteTitle} home`}>
+        <span class="brand-mark" set:html={logo} aria-hidden="true" />
+        <span class="font-heading">{siteTitle}</span>
+      </a>
+      <div class="header-end flex items-center">
+        <SiteNav {...nav} {...resolveNavOptions(config)} megaPanel={VitopsMegaPanel} />
+        <wc-color-scheme-toggle></wc-color-scheme-toggle>
       </div>
-    </header>
+    </Masthead>
 
     <main class="centered rhythm">
       <slot />
@@ -109,10 +112,6 @@ const orgName = config.organization?.name || siteTitle;
         block-size: 1.75rem;
       }
 
-      .navbar {
-        block-size: 64px;
-      }
-
       .header-end {
         gap: var(--space-s, 0.75rem);
       }

package/templates/emdash/src/pages/[...slug].astro

@@ -8,7 +8,7 @@ import Layout from '../layouts/Layout.astro';
 // the content database — `scripts/pull-content.mjs` loads production's into the
 // local build database first (it is part of `deploy`/`deploy:dev`) — so an edit
 // in the admin goes live on the next rebuild, which a publish webhook triggers
-// (see .agents/skills/content-and-deploys).
+// (see .agents/skills/emdash-content-and-deploys).
 //
 // There is no `Astro.rewrite('/404')` here and no on-demand fallback: a URL that
 // isn't in the list below simply has no route, so Astro serves the prerendered

package/templates/emdash/src/pages/api/track.ts

@@ -2,7 +2,7 @@
  * The site's one on-demand endpoint: contact-form posts (the `vitops_form` block) and the
  * conversion beacons (`<Tracking />`, `tel:`/`mailto:` clicks) all arrive here.
  *
- * Every public page is prerendered (see .agents/skills/content-and-deploys); this route sets
+ * Every public page is prerendered (see .agents/skills/emdash-content-and-deploys); this route sets
  * `prerender = false` because it has to run on each request. It is the one exception, and the
  * Cloudflare adapter handles it in the Worker beside the EmDash admin.
  *

package/templates/emdash/src/pages/index.astro

@@ -5,7 +5,7 @@ import Layout from '../layouts/Layout.astro';
 
 // Prerendered, like every page in this template: written to static HTML at build
 // time from the `home` entry (seed/seed.json → pages/home). Edit it in the admin;
-// a publish triggers a rebuild that bakes the change in (.agents/skills/content-and-deploys,
+// a publish triggers a rebuild that bakes the change in (.agents/skills/emdash-content-and-deploys,
 // "Rendering and freshness"). The Vitops blocks from @getvitops/emdash render automatically —
 // EmDash merges the plugin's block components into <PortableText>.
 //

package/templates/static/.agents/skills/setup/SKILL.md

@@ -59,3 +59,10 @@ report that verbatim rather than guessing at a fix. A step reported as
 "blocked" is not a failure to retry; it is waiting on one of the hard stops
 above, or on a `site.json` field the user still needs to fill in (stage 5,
 Configuration).
+
+## Naming the project
+
+`vp create` takes the package name from the target directory and invents a random slug when none
+is given, so pass one: `vp create @getvitops:<template> --directory <client-slug>`. `wrangler.jsonc`'s
+`name` (and on EmDash the D1 `database_name` and R2 `bucket_name`) are separate and still say what
+the template shipped; rename them to match before the first deploy.

package/templates/static/.claude/settings.json

@@ -0,0 +1,6 @@
+{
+  "permissions": {
+    "allow": ["Bash(pnpm exec playwright cli:*)", "Bash(npx --no-install playwright cli:*)"],
+    "deny": ["mcp__claude-in-chrome__*", "mcp__playwright__*"]
+  }
+}

package/templates/static/.playwright/cli.config.json

@@ -0,0 +1,7 @@
+{
+  "browser": {
+    "browserName": "chromium",
+    "launchOptions": { "headless": true }
+  },
+  "outputDir": ".playwright-cli"
+}

package/templates/static/AGENTS.md

@@ -3,138 +3,50 @@
 Built with the Vitops design system (`@getvitops/*`); tokens and site facts live in `site.json`.
 Prefer its classes and patterns over hand-written CSS. Load the skill that matches the task:
 
-- [contact-form](.agents/skills/contact-form/SKILL.md) — Use when adding or changing a form, fixing submissions that don't arrive, setting up noti…
-- [content-and-deploys](.agents/skills/content-and-deploys/SKILL.md) — Use for any deploy or build problem, stale or missing content, "my publish isn't live", s…
-- [csp](.agents/skills/csp/SKILL.md) — Use when changing `public/_headers`, adding an embed, tracking snippet or third-party scr…
-- [custom-blocks](.agents/skills/custom-blocks/SKILL.md) — Use before creating, renaming or deleting any block type, any `src/components/blocks/*` r…
-- [vitops-design-system](.agents/skills/vitops-design-system/SKILL.md) — Use when styling or authoring pages or components (choosing utility/pattern classes, colo…
+- [vitops-ads](.agents/skills/vitops-ads/SKILL.md) — Use when adding or changing a Google/Meta/LinkedIn/TikTok/Microsoft/Reddit/Pinterest/Snapchat pixel
+- [vitops-consent](.agents/skills/vitops-consent/SKILL.md) — Use before gating, adding or changing any non-essential third-party tag, cookie, embed
+- [vitops-csp](.agents/skills/vitops-csp/SKILL.md) — Use when changing `public/_headers`, adding an embed, tracking snippet or third-party script, turning the CSP on
+- [vitops-design-system](.agents/skills/vitops-design-system/SKILL.md) — Use when styling or authoring pages or components (choosing utility/pattern classes, colours, spacing, typography)
+- [vitops-see-the-page](.agents/skills/vitops-see-the-page/SKILL.md) — How to look at a rendered page of this site
 
-Reference, rendered from this project: `vitops docs <topic>` (no topic lists them).
-<!-- managed by `vitops agents sync` · @getvitops/cli@8.3.0-alpha.2 — edit outside this block -->
+Reference, rendered from this project: `vp exec vitops docs [topic]` (no topic lists them).
 <!-- vitops:end -->
 
-This is a static Astro website styled by the Vitops design system, deployed
-as Cloudflare Workers static assets (no server runtime, no database).
+This is a static Astro website styled by the Vitops design system, deployed as Cloudflare Workers
+static assets (no server runtime, no database).
 
 ## Ground rules
 
-- `site.json` is the single source of truth — organization + site facts, and
-  the design system (colors, type, spacing, patterns, animations) under
-  `designSystem.themes.default`. Never edit `src/styles/` by hand — it is
-  generated from `site.json` by the `vitops()` integration on every dev/build
-  and is gitignored. (There is no separate `design-system.json`: a scaffolded
-  config can't merely reference a sibling file, so the token set lives inside
-  `site.json`.)
-- `src/assets/placeholder/` holds neutral wireframe stand-ins (square,
-  portrait, landscape; SVG + PNG) for layout work before real imagery
-  exists. Delete the directory once real assets land.
-- Prefer framework CSS classes (utilities, patterns, type roles like
-  `font-heading`) over bespoke CSS. `vp exec vitops docs classes` prints the
-  full class vocabulary.
-- **Layout foundations — these are the answer, not a starting point.** Six
-  substitutions carry the structure of nearly every page:
-  | About to write…                                         | Write instead   |
-  | ------------------------------------------------------- | --------------- |
-  | a `wrap`/`wrapper`/`container`/`inner` class            | **`centered`**  |
-  | `max-width` + `margin-inline: auto`                     | **`centered`**  |
-  | `padding-block` on a section                            | **`region`**    |
-  | margins between headings/paragraphs/lists               | **`rhythm`**    |
-  | `display: grid` + `grid-template-columns: repeat(n, …)` | **`subgrid`**   |
-  | `repeat(auto-fit, minmax(…))`                           | **`grid-auto`** |
-  | `display: flex` + `gap` for a row of controls           | **`cluster`**   |
-- Every page is prerendered by default (`output: 'static'`) — there is no
-  server to fall back to, so nothing here can read request-time data
-  (cookies, headers, query params) at render time. If a page genuinely needs
-  that, it needs an adapter and a different template — this one stays pure
-  static on purpose.
-- **`SETUP.html` is the client-onboarding checklist.** When working it via the
-  `.agents/skills/setup/` skill, tick a box only for a step you actually
-  completed — never on the operator's behalf for a step marked human-only
-  (the Cloudflare API token, the domain cutover, publishing legal documents).
-
-## Branch model
-
-- Work on **`dev`** (the integration branch). Every push auto-deploys the
-  isolated `-dev` worker (`dev.<domain>` with a custom domain).
-- **`main`** is production and branch-protected — never push or merge to it
-  directly. Production ships only via the manual **promote** flow:
-  `.github/workflows/promote.yml`, dispatched manually, opens a `dev → main`
-  PR with auto-merge; merging deploys prod. Only run it when the user
-  explicitly asks to promote/ship to production.
-
-## Labels: badge and tag
-
-Two label patterns, both enabled in `site.json`'s `patterns.items`: **`badge`** is a
-static label (a status, count or category) and **`tag`** is a label that may be
-static _or_ dynamic (editable, dismissable, in a `tag-list`). Don't invent a third
-name — `chip` and `pill` are not part of this vocabulary. The button pattern's class
-is `btn` (`<a class="btn">` is styled, not just a bare `<button>`).
-
-## Content Security Policy
-
-`public/_headers` ships a **`Content-Security-Policy-Report-Only`** header for every
-page (they are all static assets): violations are logged to the browser console and
-nothing is blocked, so it can't break a page. Its `script-src` is `'self'` plus the
-SHA-256 of each inline script `<Head />` emits (the colour-scheme bootstrap and the
-consent-gate stub), with no `'unsafe-inline'`. `contentSecurityPolicy()` and
-`inlineScriptHashes()` from `@getvitops/astro` produce the same strings.
-
-Before enforcing it (rename the header to `Content-Security-Policy`), browse the pages
-with the console open: add the origins of any third-party tag the consent gate
-activates to `script-src` / `connect-src`, any embed to `frame-src`, and hash any
-inline script you add yourself. Hashes rather than nonces because a static page has no
-per-request response to carry one.
-
-## Skills
-
-`@getvitops/skills` ships agent skills that update with the package. `skills experimental_sync` (run
-by `prepare`, so by `vp install`) links them into `.agents/skills/` and `.claude/skills/`; they are
-gitignored. The set is written for EmDash sites, so `csp` is the one that applies here. A skill you
-write yourself with the same name is never replaced. `setup` is this site's own.
+- `site.json` is the single source of truth: organization + site facts, and the design system under
+  `designSystem.themes.default`. Never edit `src/styles/`: it is generated from `site.json` on every
+  dev/build and gitignored.
+- Every page is prerendered (`output: 'static'`): nothing can read request-time data (cookies,
+  headers, query params). A page that needs that needs an adapter and a different template.
+- Prefer framework classes (utilities, patterns, type roles like `font-heading`) over bespoke CSS.
+  `vpr lint:design` fails the pre-commit hook on unresolvable classes and layout primitives you
+  hand-rolled (`centered`, `region`, `rhythm`, `subgrid`, `grid-auto`, `cluster` exist for those).
+- `src/assets/placeholder/` is wireframe stand-in imagery; delete it once real assets land.
+- `SETUP.html` is the onboarding checklist (the `setup` skill). Tick a box only for a step you
+  completed, never for a human-only one (the Cloudflare API token, domain cutover, legal documents).
+
+## Branches
+
+Work on **`dev`**; every push auto-deploys the isolated `-dev` worker. **`main`** is production and
+protected: never push or merge to it directly; production ships only through the manual `promote`
+workflow (`.github/workflows/promote.yml`), only when the user explicitly asks. Shipping is not a
+package release: no changeset or version bump.
 
 ## Commands
 
-This is a **Vite+** project: use `vp` (and its `vpr` shorthand), not `pnpm`/`npm`/`npx`.
-The package manager underneath is pnpm, but `vp` picks it up for you.
-
-| To…                                      | Run                                                  |
-| ---------------------------------------- | ---------------------------------------------------- |
-| install dependencies                     | `vp install`                                         |
-| add / remove / update a package          | `vp add <pkg>` · `vp remove <pkg>` · `vp update`     |
-| run a `package.json` script              | `vpr <script>` (alias for `vp run <script>`)         |
-| run a locally installed binary           | `vp exec <bin>` (e.g. `vp exec vitops docs classes`) |
-| run a one-off package without installing | `vp dlx <pkg>`                                       |
-| format + lint + typecheck (files)        | `vp check`                                           |
-| typecheck Astro (`.astro` files)         | `vpr typecheck`                                      |
-
-**Scripts that wrap Astro must go through `vpr`.** `vp dev` / `vp build` run Vite
-directly and skip Astro, so use `vpr dev`, `vpr build`, `vpr preview`.
-
-**`vpr dev` returns immediately.** `astro dev` now starts the server in the
-background. Check it with `vp exec astro dev status`, read its output with
-`vp exec astro dev logs --follow`, and stop it with `vp exec astro dev stop`; the
-site is at <http://localhost:4321>. Don't wait on it as if it were a foreground
-process.
-
-| Script                                    | What it does                                                                                                                        |
-| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| `vpr dev`                                 | local dev                                                                                                                           |
-| `vpr build:css`                           | regenerate the framework CSS from `site.json`                                                                                       |
-| `vpr deploy`                              | build + `wrangler deploy` to prod                                                                                                   |
-| `vpr deploy:dev`                          | build + deploy the isolated dev worker                                                                                              |
-| `vpr init:github`                         | one-time: create + push the GitHub repo (main + dev, dev default, branch protection + environment policy). Only when the user asks. |
-| `vpr init:hosting`                        | one-time: read the Cloudflare account id and set it as a repo secret. Only when the user asks.                                      |
-| `vp exec vitops validate site.json`       | schema-check the site config                                                                                                        |
-| `vp exec vitops lint -i site.json -f css` | find framework classes in source that resolve to nothing under this format                                                          |
+This is a **Vite+** project: use `vp` (and `vpr` for scripts), not `pnpm`/`npm`/`npx`. Scripts that
+wrap Astro go through `vpr` (`vpr dev`, `vpr build`), because `vp dev`/`vp build` skip Astro.
+`vpr dev` returns immediately (the server runs in the background): check it with
+`vp exec astro dev status`, read `vp exec astro dev logs --follow`, stop with
+`vp exec astro dev stop`; the site is at <http://localhost:4321>. `package.json` lists the scripts;
+`vp check` and `vpr typecheck` verify a change. `vpr init:github` and `vpr init:hosting` are one-time
+setup, only when the user asks.
 
-**Release flow.** A site is not a published package, so there is no changeset or
-version bump: ship by committing to `dev` (auto-deploys the dev worker) and then
-running the **promote** workflow. `vp` has no `vp change` / `vp pm change` command
-(checked against vp 1.5.0); for a _package_ it does have `vp pm version`,
-`vp pm publish` and `vp pm stage`.
+## Where to look
 
-**Naming the project.** `vp create` takes the package name from the target
-directory and invents a random slug when none is given, so pass one:
-`vp create @getvitops:static --directory <client-slug>`. `wrangler.jsonc`'s `name`
-is separate and still says what the template shipped — rename it to match before
-the first deploy.
+- **Skills** are listed in the block at the top; load the one matching the task before starting.
+- **Reference** for this project's own tokens, classes and config: `vp exec vitops docs`.

package/templates/static/_gitignore

@@ -27,11 +27,11 @@ public/vitops/
 .DS_Store
 
 # agent skills linked from @getvitops/skills by `skills experimental_sync` (see skills-lock.json)
-.agents/skills/custom-blocks
-.agents/skills/content-and-deploys
-.agents/skills/contact-form
-.agents/skills/csp
-.claude/skills/custom-blocks
-.claude/skills/content-and-deploys
-.claude/skills/contact-form
-.claude/skills/csp
+# (the `vitops-` and `emdash-` prefixes are reserved for toolkit skills)
+.agents/skills/vitops-*
+.agents/skills/emdash-*
+.claude/skills/vitops-*
+.claude/skills/emdash-*
+# playwright-cli: skill regenerated by `prepare`; output is per-session scratch
+.claude/skills/playwright-cli
+.playwright-cli/

package/templates/static/package.json

@@ -16,7 +16,7 @@
     "build:css": "vitops generate -i site.json -f css -o src/styles",
     "lint:design": "vitops lint -i site.json -f css --strict",
     "sop": "vitops generate -i site.json -f css -o .vitops/sop",
-    "prepare": "vp config && skills experimental_sync -y -a claude-code --no-frozen-lockfile && vitops agents sync -i site.json"
+    "prepare": "vp config && skills experimental_sync -y -a claude-code --no-frozen-lockfile && playwright cli install --skills && vitops agents sync -i site.json"
   },
   "dependencies": {
     "@getvitops/astro": "latest",
@@ -26,10 +26,11 @@
   "devDependencies": {
     "@astrojs/check": "^0.9.12",
     "@getvitops/cli": "latest",
+    "playwright": "^1.62.1",
     "skills": "^1.7.6",
     "typescript": "^6.0.3",
-    "vite": "latest",
-    "vite-plus": "latest",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^1.5.1",
+    "vite-plus": "^1.5.1",
     "wrangler": "^4.111.0"
   },
   "devEngines": {

package/templates/static/pnpm-workspace.yaml

@@ -5,17 +5,12 @@ allowBuilds:
   workerd: true
   sharp: false
 
-# Supply-chain hardening: nothing installs within 3 days of its publish
-# (toolchain exempt), and no non-registry transitive sources.
+# Supply-chain hardening: nothing installs within 3 days of its publish, and no non-registry
+# transitive sources. Only our own lockstep `@getvitops/*` is exempt. Do NOT exempt a third-party
+# toolchain: an exempt package's exact pins are not exempt (vite-plus pins `@oxc-project/*`
+# exactly), so the install fails whenever one is fresher than the window. A security patch may be
+# admitted with an exact `name@x.y.z` line and a dated reason; remove it once it matures.
 minimumReleaseAge: 4320
 minimumReleaseAgeExclude:
   - '@getvitops/*'
-  - vite-plus
-  - '@voidzero-dev/*'
-  - oxlint
-  - '@oxlint/*'
-  - oxlint-tsgolint
-  - '@oxlint-tsgolint/*'
-  - oxfmt
-  - '@oxfmt/*'
 blockExoticSubdeps: true