@omniharmonic/openspace-cli 0.0.0-stage → 0.1.0

package/dist/starter/variants/cloudflare/.github/openspace/gated-sync.mjs

@@ -0,0 +1,121 @@
+// Members-only and password pages → the Worker's private R2 bucket (generated; managed by
+// site-kit updates). Runs in the publish workflow's `gated` job — the only job allowed to mint
+// the run's GitHub OIDC identity token — with no packages installed: Node built-ins only.
+//
+// The committed page files are stubs (`contentRef`, no sections); the OpenSpace Hub keeps their
+// content. This asks the Hub for exactly the versions this commit names and puts them at
+// `pages/<pageId>/<contentRef>.json` through the Cloudflare API, before the Worker deploys.
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const CF_API = "https://api.cloudflare.com/client/v4";
+
+async function pageFiles(dir) {
+  let entries = [];
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) out.push(...(await pageFiles(p)));
+    else if (e.name.endsWith(".json")) out.push(p);
+  }
+  return out;
+}
+
+/** The OS_GATED bucket name from wrangler.jsonc (line comments and trailing commas allowed). */
+function bucketName(text) {
+  const json = text
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .replace(/^\s*\/\/.*$/gm, "")
+    .replace(/,(\s*[}\]])/g, "$1");
+  return JSON.parse(json).r2_buckets?.find((b) => b.binding === "OS_GATED")?.bucket_name;
+}
+
+/** The Hub must be https (plain http only for a local Hub). */
+function hubOrigin(raw) {
+  const url = new URL(String(raw));
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local))
+    throw new Error(`The Hub address must use https (got ${url.origin}).`);
+  return String(raw).replace(/\/+$/, "");
+}
+
+export async function main({
+  cwd = process.cwd(),
+  env = process.env,
+  fetch = globalThis.fetch,
+  log = console.log,
+} = {}) {
+  const config = JSON.parse(await readFile(join(cwd, "openspace.json"), "utf8"));
+  const stubs = [];
+  for (const file of await pageFiles(join(cwd, "content/pages"))) {
+    const page = JSON.parse(await readFile(file, "utf8"));
+    if (typeof page.id === "string" && typeof page.contentRef === "string")
+      stubs.push({ id: page.id, ref: page.contentRef });
+  }
+  if (!stubs.length) {
+    log("No members-only or password pages to upload.");
+    return 0;
+  }
+  const hub = hubOrigin(config.hub);
+  const bucket = bucketName(await readFile(join(cwd, "wrangler.jsonc"), "utf8"));
+  if (!bucket) throw new Error('wrangler.jsonc has no "bucket_name" for the OS_GATED binding.');
+  const { CLOUDFLARE_API_TOKEN: cfToken, CLOUDFLARE_ACCOUNT_ID: account } = env;
+  if (!cfToken || !account)
+    throw new Error("CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID are needed.");
+  if (!env.ACTIONS_ID_TOKEN_REQUEST_URL || !env.ACTIONS_ID_TOKEN_REQUEST_TOKEN)
+    throw new Error("This job needs `permissions: id-token: write`.");
+  const tokenUrl = new URL(env.ACTIONS_ID_TOKEN_REQUEST_URL);
+  tokenUrl.searchParams.set("audience", hub);
+  const idRes = await fetch(tokenUrl.toString(), {
+    headers: { authorization: `Bearer ${env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}` },
+  });
+  const idToken = idRes.ok ? (await idRes.json()).value : undefined;
+  if (!idToken) throw new Error(`GitHub didn't issue an identity token (${idRes.status}).`);
+  const res = await fetch(`${hub}/ci/sites/${encodeURIComponent(config.siteId)}/gated`, {
+    headers: { authorization: `Bearer ${idToken}`, accept: "application/json" },
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !Array.isArray(body.pages))
+    throw new Error(
+      `The Hub didn't hand over the private pages (${res.status} ${body.error?.message ?? ""}).`,
+    );
+  const byKey = new Map(body.pages.map((p) => [`${p.id}/${p.ref}`, p]));
+  const missing = stubs.filter((s) => !byKey.has(`${s.id}/${s.ref}`));
+  if (missing.length)
+    throw new Error(`Missing private page content: ${missing.map((m) => m.id).join(", ")}.`);
+  const cf = (path, init = {}) =>
+    fetch(`${CF_API}/accounts/${account}${path}`, {
+      ...init,
+      headers: { authorization: `Bearer ${cfToken}`, ...init.headers },
+    });
+  // Create the bucket on the first run (an existing bucket answers 409).
+  const created = await cf("/r2/buckets", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name: bucket }),
+  });
+  if (!created.ok && created.status !== 409)
+    throw new Error(`Creating ${bucket} failed (${created.status}).`);
+  for (const s of stubs) {
+    const put = await cf(`/r2/buckets/${bucket}/objects/pages/${s.id}/${s.ref}.json`, {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(byKey.get(`${s.id}/${s.ref}`).page),
+    });
+    if (!put.ok) throw new Error(`Uploading ${s.id} failed (${put.status}).`);
+  }
+  log(`Uploaded ${stubs.length} private page(s) to ${bucket}.`);
+  return stubs.length;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+  main().catch((err) => {
+    console.error(`::error::${err.message}`);
+    process.exit(1);
+  });

package/dist/starter/variants/cloudflare/.github/workflows/publish.yml

@@ -0,0 +1,70 @@
+# .github/workflows/publish.yml (generated; managed by site-kit updates) — Cloudflare target.
+# Prerendered pages deploy as static assets of a Worker in the owner's Cloudflare account; the
+# Worker serves members pages, sign-in and password pages. The D1 database is provisioned
+# automatically on the first deploy. Members-only / password page content is never in this
+# repository: the Hub keeps it, and this run copies the versions its commit names into the
+# Worker's private R2 bucket (authorized by the run's GitHub OIDC identity, no stored token).
+name: Publish
+on:
+  push: { branches: [main] }
+  workflow_dispatch:
+permissions: { contents: read }
+concurrency: { group: publish, cancel-in-progress: true }
+jobs:
+  # Members-only and password pages → the Worker's private R2 bucket (from the Hub). The only job
+  # that may mint the run's identity token, so it installs nothing: one Node script, built-ins only.
+  gated:
+    runs-on: ubuntu-latest
+    permissions: { contents: read, id-token: write }
+    steps:
+      - uses: actions/checkout@v7
+        with: { persist-credentials: false }
+      - uses: actions/setup-node@v7
+        with: { node-version: 22 }
+      - run: node .github/openspace/gated-sync.mjs
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  publish:
+    needs: gated
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        # package.json keys the npm cache: Hub-created sites have no lockfile at first.
+        with: { node-version: 22, cache: npm, cache-dependency-path: package.json }
+      - uses: actions/cache@v6
+        with:
+          path: node_modules/.astro
+          key: os-assets-${{ hashFiles('media/**') }}
+          restore-keys: os-assets-
+      # Sites created by the Hub start without a lockfile.
+      - run: if [ -f package-lock.json ]; then npm ci; else npm install; fi
+      - run: npx openspace check --ci # schema, links, budgets, secret scan
+      - run: npm run build # astro build (+ pagefind, og images, Worker)
+        env:
+          OPENSPACE_TURNSTILE_SITE_KEY: ${{ vars.OPENSPACE_TURNSTILE_SITE_KEY }}
+          # Self-host the font pairing (downloaded once from Google Fonts during the build).
+          OPENSPACE_GOOGLE_FONTS: download
+          OPENSPACE_REMOTE_IMAGES: download
+      # Worker secrets from this repository's Actions secrets (the Hub sets them): the member
+      # session key, page password hashes and, in sovereign mode, the owner's own Stripe keys.
+      # Before the deploy, so the new version starts with them: on the very first run
+      # `wrangler secret bulk` creates the Worker as a draft (non-interactive default), and
+      # `wrangler deploy` never deletes secrets. Re-running is idempotent.
+      - name: Worker secrets
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          OS_SESSION_SECRET: ${{ secrets.OS_SESSION_SECRET }}
+          OS_PAGE_PASSWORDS: ${{ secrets.OS_PAGE_PASSWORDS }}
+          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
+          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
+        run: |
+          node -e 'const o={};for(const k of ["OS_SESSION_SECRET","OS_PAGE_PASSWORDS","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET"])if(process.env[k])o[k]=process.env[k];if(Object.keys(o).length)require("fs").writeFileSync(process.env.RUNNER_TEMP+"/os-secrets.json",JSON.stringify(o),{mode:0o600})'
+          if [ -f "$RUNNER_TEMP/os-secrets.json" ]; then npx wrangler secret bulk "$RUNNER_TEMP/os-secrets.json"; fi
+          rm -f "$RUNNER_TEMP/os-secrets.json"
+      - run: npx wrangler deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/dist/starter/variants/cloudflare/astro.config.mjs

@@ -0,0 +1,11 @@
+// OpenSpace site shell — Cloudflare target. Pages are prerendered as static assets; the Worker
+// serves members pages, sign-in and password pages. Everything else comes from openspace.json
+// and content/ via the site-kit integration.
+import cloudflare from "@astrojs/cloudflare";
+import openspace, { CLOUDFLARE_ADAPTER_OPTIONS } from "@omniharmonic/openspace-site-kit";
+import { defineConfig } from "astro/config";
+
+export default defineConfig({
+  adapter: cloudflare(CLOUDFLARE_ADAPTER_OPTIONS),
+  integrations: [openspace()],
+});

package/dist/starter/variants/cloudflare/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "openspace-site",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "astro dev",
+    "build": "astro build",
+    "preview": "astro preview",
+    "check": "openspace check"
+  },
+  "dependencies": {
+    "@astrojs/cloudflare": "^14.4.2",
+    "@omniharmonic/openspace-site-kit": "^0.1.0",
+    "astro": "^7.4.2"
+  },
+  "devDependencies": {
+    "@omniharmonic/openspace-cli": "^0.1.0",
+    "wrangler": "^4.152.0"
+  },
+  "engines": {
+    "node": ">=22.23.4"
+  }
+}

package/dist/starter/variants/cloudflare/wrangler.jsonc

@@ -0,0 +1,13 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  // Renamed to the site's repository name when Cloudflare hosting is connected.
+  "name": "openspace-site",
+  "compatibility_date": "2026-10-01",
+  "compatibility_flags": ["nodejs_compat"],
+  // Gated (members / password) page content — never stored in the public repository. The
+  // publish workflow (`openspace gated-sync`) creates the bucket and fills it from the Hub.
+  "r2_buckets": [{ "binding": "OS_GATED", "bucket_name": "openspace-site-gated" }],
+  // Stock and orders for the store (Phase 5).
+  "d1_databases": [{ "binding": "OS_DB" }],
+  "observability": { "enabled": true }
+}

package/dist/templates/atelier/content/collections/projects/_collection.json

@@ -0,0 +1,13 @@
+{
+  "kind": "portfolio",
+  "label": "Projects",
+  "itemLabel": "Project",
+  "list": {
+    "layout": "grid",
+    "pageSize": 24,
+    "sort": "date-desc"
+  },
+  "itemPage": {
+    "layout": "gallery"
+  }
+}

package/dist/templates/atelier/content/collections/projects/cordillera.mdoc

@@ -0,0 +1,32 @@
+---
+status: published
+title: Cordillera
+date: 2026-06-01
+year: 2026
+client: Personal project
+role: Photography
+excerpt: Three winters above the treeline in the San Juan Mountains, waiting for the light to go flat.
+image: https://images.unsplash.com/photo-1783611066016-59e16b0ac1c8?w=1600&q=80
+imageAlt: Cordillera, cover photograph
+gallery:
+  - src: https://images.unsplash.com/photo-1783611066016-59e16b0ac1c8?w=2400&q=80
+    alt: Snowy peaks reflected in a still mountain lake
+    width: 2400
+    height: 1600
+  - src: https://images.unsplash.com/photo-1501785888041-af3ef285b470?w=2400&q=80
+    alt: A rowing boat on a turquoise lake below jagged mountains
+    width: 2400
+    height: 1600
+  - src: https://images.unsplash.com/photo-1506744038136-46273834b3fb?w=2400&q=80
+    alt: A misty river valley with pine trees and granite cliffs at dawn
+    width: 2400
+    height: 1602
+  - src: https://images.unsplash.com/photo-1470071459604-3b5ec3a7fe05?w=2400&q=80
+    alt: Mist rolling over green cliffs at sunrise
+    width: 2400
+    height: 1430
+---
+
+Three winters above the treeline in the San Juan Mountains, waiting for the light to go flat.
+
+Shot on large-format film and printed in the studio. Prints from this series are available in editions of 25 and 10.

package/dist/templates/atelier/content/collections/projects/field-studies.mdoc

@@ -0,0 +1,32 @@
+---
+status: published
+title: Field Studies
+date: 2024-06-01
+year: 2024
+client: Exhibition, Lowry Gallery
+role: Photography
+excerpt: Meadows, back roads and wildflowers from a summer spent driving the high plains.
+image: https://images.unsplash.com/photo-1465146344425-f00d5f5c8f07?w=1600&q=80
+imageAlt: Field Studies, cover photograph
+gallery:
+  - src: https://images.unsplash.com/photo-1465146344425-f00d5f5c8f07?w=2400&q=80
+    alt: Wild red poppies scattered through a summer meadow
+    width: 2400
+    height: 1590
+  - src: https://images.unsplash.com/photo-1490750967868-88aa4486c946?w=2400&q=80
+    alt: Orange poppies against a clear blue sky
+    width: 2400
+    height: 1601
+  - src: https://images.unsplash.com/photo-1501854140801-50d01698950b?w=2400&q=80
+    alt: Rolling green hills seen from above, ridges catching the light
+    width: 2400
+    height: 1429
+  - src: https://images.unsplash.com/photo-1500530855697-b586d89ba3ee?w=2400&q=80
+    alt: A desert road running straight toward red rock mountains
+    width: 2400
+    height: 3600
+---
+
+Meadows, back roads and wildflowers from a summer spent driving the high plains.
+
+Shot on large-format film and printed in the studio. Prints from this series are available in editions of 25 and 10.

package/dist/templates/atelier/content/collections/projects/salt-and-glass.mdoc

@@ -0,0 +1,32 @@
+---
+status: published
+title: Salt & Glass
+date: 2025-06-01
+year: 2025
+client: Commission, Tidewater Hotels
+role: Photography
+excerpt: The Pacific coast from above and at eye level, for a hotel group's new coastal lodges.
+image: https://images.unsplash.com/photo-1505142468610-359e7d316be0?w=1600&q=80
+imageAlt: Salt & Glass, cover photograph
+gallery:
+  - src: https://images.unsplash.com/photo-1505142468610-359e7d316be0?w=2400&q=80
+    alt: An aerial view of turquoise surf meeting a sandy shore
+    width: 2400
+    height: 4272
+  - src: https://images.unsplash.com/photo-1507525428034-b723cf961d3e?w=2400&q=80
+    alt: Gentle waves washing onto an empty beach at sunset
+    width: 2400
+    height: 1595
+  - src: https://images.unsplash.com/photo-1518837695005-2083093ee35b?w=2400&q=80
+    alt: Deep blue ocean water under a pale sky
+    width: 2400
+    height: 1600
+  - src: https://images.unsplash.com/photo-1470071459604-3b5ec3a7fe05?w=2400&q=80
+    alt: Mist rolling over green cliffs at sunrise
+    width: 2400
+    height: 1430
+---
+
+The Pacific coast from above and at eye level, for a hotel group's new coastal lodges.
+
+Shot on large-format film and printed in the studio. Prints from this series are available in editions of 25 and 10.

package/dist/templates/atelier/content/collections/projects/white-city.mdoc

@@ -0,0 +1,32 @@
+---
+status: published
+title: White City
+date: 2025-06-01
+year: 2025
+client: Monograph, Halden Press
+role: Photography
+excerpt: "Modernist facades in noon sun: a study of edges, shadows and the colour white."
+image: https://images.unsplash.com/photo-1487958449943-2429e8be8625?w=1600&q=80
+imageAlt: White City, cover photograph
+gallery:
+  - src: https://images.unsplash.com/photo-1487958449943-2429e8be8625?w=2400&q=80
+    alt: A white angular building against a bright, clear sky
+    width: 2400
+    height: 1600
+  - src: https://images.unsplash.com/photo-1477959858617-67f85cf4f1df?w=2400&q=80
+    alt: A city skyline stretching to the lake at golden hour
+    width: 2400
+    height: 1476
+  - src: https://images.unsplash.com/photo-1449824913935-59a10b8d2000?w=1920&q=80
+    alt: A downtown street lined with tall buildings and yellow cabs
+    width: 1920
+    height: 1280
+  - src: https://images.unsplash.com/photo-1512917774080-9991f1c4c750?w=2400&q=80
+    alt: A white modern villa with a pool framed by palms
+    width: 2400
+    height: 1600
+---
+
+Modernist facades in noon sun: a study of edges, shadows and the colour white.
+
+Shot on large-format film and printed in the studio. Prints from this series are available in editions of 25 and 10.

package/dist/templates/atelier/content/pages/about.json

@@ -0,0 +1,180 @@
+{
+  "$schema": "https://schema.openspace.dev/v1/page.json",
+  "id": "pg_0fq27dh81s",
+  "title": "About",
+  "slug": "about",
+  "seo": {
+    "description": "Elias Varga grew up in the Front Range and trained as an architect before turning to photography. Biography, press and clients."
+  },
+  "sections": [
+    {
+      "id": "sec_f0bnekkq85",
+      "preset": "about/story-split@1",
+      "label": "Story with portrait",
+      "layout": {
+        "mode": "stack",
+        "columns": {
+          "d": [
+            5,
+            7
+          ],
+          "m": [
+            12
+          ]
+        },
+        "align": "center",
+        "gap": "2xl"
+      },
+      "style": {
+        "colorTheme": "light"
+      },
+      "blocks": [
+        {
+          "id": "blk_js8zwd5hff",
+          "type": "image",
+          "v": 1,
+          "fields": {
+            "image": {
+              "src": "https://images.unsplash.com/photo-1539571696357-5a69c17a67c6?w=1040&q=80",
+              "alt": "Portrait of the photographer Elias Varga",
+              "width": 1040,
+              "height": 1560
+            },
+            "aspect": "4:5",
+            "lightbox": false
+          },
+          "column": 0,
+          "variant": "default"
+        },
+        {
+          "id": "blk_qfk3h8z7ve",
+          "type": "heading",
+          "v": 1,
+          "fields": {
+            "text": "Elias Varga",
+            "level": "h1",
+            "size": "h1",
+            "eyebrow": "About"
+          },
+          "column": 1,
+          "variant": "plain"
+        },
+        {
+          "id": "blk_83r60tpwnc",
+          "type": "text",
+          "v": 1,
+          "fields": {
+            "content": {
+              "type": "doc",
+              "content": [
+                {
+                  "type": "paragraph",
+                  "content": [
+                    {
+                      "type": "text",
+                      "text": "I grew up in Golden, Colorado, and spent my twenties drawing buildings for an architecture firm in Chicago. Photography started as a way to remember the places I was drawing. It became the work when I realised I cared more about how light moved across a wall than about the wall itself."
+                    }
+                  ]
+                },
+                {
+                  "type": "paragraph",
+                  "content": [
+                    {
+                      "type": "text",
+                      "text": "Since 2016 I have photographed mountains, coastlines and modernist buildings for publishers, architects and a handful of hotels. I shoot slowly, mostly on a large-format camera, and print every edition by hand in my studio in RiNo."
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "column": 1,
+          "variant": "default"
+        },
+        {
+          "id": "blk_g65wqxa9y4",
+          "type": "button",
+          "v": 1,
+          "fields": {
+            "label": "Get in touch",
+            "link": {
+              "type": "page",
+              "page": "pg_h72a8wvyfr"
+            },
+            "role": "secondary"
+          },
+          "column": 1,
+          "variant": "default"
+        }
+      ]
+    },
+    {
+      "id": "sec_st2tzbz12y",
+      "preset": "about/milestones@1",
+      "label": "Milestones timeline",
+      "layout": {
+        "mode": "stack",
+        "columns": {
+          "d": [
+            5,
+            7
+          ],
+          "m": [
+            12
+          ]
+        },
+        "gap": "2xl"
+      },
+      "style": {
+        "colorTheme": "light-accent"
+      },
+      "blocks": [
+        {
+          "id": "blk_xhsve10pt1",
+          "type": "heading",
+          "v": 1,
+          "fields": {
+            "text": "Exhibitions & books",
+            "level": "h2",
+            "size": "auto",
+            "eyebrow": "Selected",
+            "subheading": "Solo shows, publications and awards since 2018."
+          },
+          "column": 0,
+          "variant": "plain"
+        },
+        {
+          "id": "blk_sjqb42c4j3",
+          "type": "timeline",
+          "v": 1,
+          "fields": {
+            "items": [
+              {
+                "date": "2026",
+                "title": "Cordillera",
+                "text": "Solo exhibition at the Lowry Gallery, Denver, with a limited-run catalogue."
+              },
+              {
+                "date": "2025",
+                "title": "White City",
+                "text": "Monograph published by Halden Press; shortlisted for the Field & Form book prize."
+              },
+              {
+                "date": "2023",
+                "title": "Coastlines",
+                "text": "Group show at the Kessler Foundation for Photography, Portland."
+              },
+              {
+                "date": "2018",
+                "title": "First commission",
+                "text": "Twelve modernist houses in Palm Springs for The Modern House Review."
+              }
+            ]
+          },
+          "column": 1,
+          "variant": "vertical"
+        }
+      ]
+    }
+  ]
+}