@tryvitris/website-harness 0.1.0-beta.8 → 1.0.0

package/README.md

@@ -6,8 +6,10 @@ The package is [`@tryvitris/website-harness`](https://www.npmjs.com/package/@try
 
 ## Create a website
 
+An optional separate business admin is available through `vitris admin setup|status|verify`; new-site `--admin` prepares follow-up instructions. See the [admin integration guide](docs/ADMIN.md) for pinned packages, local plan/apply, backend grants and the separate customer-account Cloudflare rollout.
+
 ```bash
-npx --package @tryvitris/website-harness@0.1.0-beta.8 vitris site create \
+npx --package @tryvitris/website-harness@1.0.0 vitris site create \
   --dir acme --slug acme --name "Acme Shop" \
   --from https://old-site.example --template "Still & Field" \
   --content-file ./acme-notes.md
@@ -50,6 +52,8 @@ For example, ask your agent to “improve the mobile layout,” “review the vi
 
 ## Develop the harness
 
+Customer sites build and verify locally, then upload the exact finished bundle directly to Cloudflare Pages. Use `npm run deploy:preview` for a hosted preview and `npm run deploy` for explicitly requested production publication. GitHub stores source; hosted deployment automation is opt-in. See [Cloudflare setup](docs/CLOUDFLARE.md) for new sites and migration of existing sites.
+
 ```bash
 npm ci
 npx playwright install chromium

package/agent/refs/admin.md

@@ -0,0 +1,11 @@
+# Optional business admin
+
+Only prepare an admin when requested or when the operator opts in with site creation `--admin`. Continue the website's prepare → CURRENT → work → complete workflow and verified local-preview stop. Admin rollout does not bypass website consent or release gates.
+
+Read the installed harness's `docs/ADMIN.md` and the published admin's packaged `agent/WORKFLOW.md`, `agent/refs/harness.md`, and `agent/refs/cloudflare.md`. Use the pinned **0.1.0-alpha.1** release. Run `vitris admin setup --site WEBSITE --dir SIBLING_ADMIN --domain admin.customer-domain.com --website HTTPS_SITE_ORIGIN --tenant EXISTING_TENANT_ID --backend-origin HTTPS_BACKEND --plan`. Review `artifacts/admin/setup-plan.json`, then repeat with `--apply` and a dedicated environment `VITRIS_ADMIN_API_TOKEN`. Reuse the published installer; never reproduce it or silently overwrite an installation.
+
+Setup is local scaffolding and public connection metadata only. Preserve forms, origins, tenants, existing accounts/records, authored source and workflow progress. Never infer compatibility from scaffolding: an older deployed backend needs its own reviewed API upgrade. `vitris admin status` is local metadata; `vitris admin verify --site WEBSITE --dir ADMIN` checks deployed identity and authoritative reads with the dedicated credential, without printing records. Failures must remain visible, with no demo fallback.
+
+Default scopes: leads:read and analytics:read. Add --lead-write to both setup commands only for explicit status-write authorization. Prepare a complete hashed grant map with `vitris admin grant`; preserve unrelated grants. Store only SHA-256 in backend ADMIN_CONNECTIONS, and upload the raw token to the admin as HARNESS_API_TOKEN through secret stdin. Never commit configuration or credentials.
+
+Prepare explicit, separate customer-account provisioning, D1 migrations, owner bootstrap, Cloudflare Email Service onboarding, authentication, DNS/TLS and deployment steps. Never deploy/migrate a shared backend as a side effect. Sites without collection need an explicitly provisioned backend and separately reviewed form/analytics activation; they have no historical data to import. Production demo login is forbidden. Test submissions and notification captures remain isolated and read-only; preview traffic is excluded from analytics. Clearly label synthetic fixtures and stub services. Pages, Media, page builders and arbitrary HTML editing remain outside scope.

package/agent/refs/launch.md

@@ -1,13 +1,15 @@
-# Launch (optional)
-
-Only when the operator asks after `preview_ready`.
-
-1. `gh repo create ORG/SLUG --source . --private --push` (or push to existing remote).
-2. Set the real `launch.json.publicOrigin` and Cloudflare Pages build command to `npm ci && npx playwright install chromium && npm run build && npm run preflight`, output `dist`, production `main`. Set `VITRIS_SITE_ENVIRONMENT=production` on the production branch. Preview branches use `preview` and remain diagnostic. A direct `wrangler pages deploy` must follow a successful current preflight on the exact `dist` bytes.
-3. Register tenant in harness `/ops`: owner email (`launch.json` → `ownerEmail`), `pages_project`, `github_owner`, `github_repo`.
-4. Fill `launch.json` → `github`, `publicOrigin` when known.
-5. Owner admin: `{backendOrigin}/app/login` with `ownerEmail`.
-
-Do not merge secrets into git. Use `.env` for Cloudflare tokens.
+# Launch (optional)
+
+For a separately requested business admin at `admin.customer-domain.com`, read `admin.md` and the installed harness's `docs/ADMIN.md`. Use `vitris admin setup --plan` and reviewed `--apply`; verify the actual deployed backend with `vitris admin verify`. Local scaffolding does not enable collection/authentication or deploy infrastructure. Keep the sibling admin's Cloudflare provisioning and release separate from website publication.
+
+Only when the operator asks after `preview_ready`. Build and verify locally, then upload the exact staged bundle directly to Cloudflare Pages. GitHub stores source and history; hosted deployment automation is opt-in.
+
+1. Commit authored source and the lockfile to the customer's private repository when requested. Keep `dist/`, `agent/release-bundles/`, `agent/release-candidate.json`, `agent/releases/`, captures and credentials out of Git.
+2. Authenticate with the operator's own `npx wrangler login` and confirm the account. For a new site create a Pages Direct Upload project with `npx wrangler pages project create PROJECT`. Set `launch.json.pagesProject` and the real production `launch.json.publicOrigin`. Install Chromium locally for preflight. Run `npm run deploy:preview` and accept the hosted preview; run `npm run deploy` only for explicit production publication. Ordinary deployment builds and verifies locally, stages the exact checked files, uploads them, records their identity and checks the hosted URL. Preservation sites support temporary previews only.
+3. For existing Git-connected Pages projects, disable automatic production and preview branch deployments before local uploads. Review and disable existing automatic GitHub deployment workflows as well. Preserve project names, domains, launch configuration, authored files and workflow progress. Installing or upgrading the harness does not migrate package scripts or remote settings. See the installed harness's `docs/CLOUDFLARE.md`.
+4. Backend tenant registration, contact forms, administration sign-in, custom domains and DNS are separate configured features. If publishing through the authenticated backend Worker, retain the exact verified bundle signing and attestation contract and review that path before migration. Direct Pages uploads do not provision tenants or forms.
+5. Hosted automation is opt-in. `deployment/github-actions.yml.example` is inactive until an operator chooses and installs it under `.github/workflows/` with protected secrets. Cloudflare Git builds are another optional alternative. Enable one publication path per site; preserve preflight and bundle integrity checks in every ordinary path.
+
+Do not merge secrets into git. Use `.env` for Cloudflare tokens.
 
 For an explicitly requested quick publish, use `vitris deploy --quick --environment production` (`npm run deploy:quick` in newly scaffolded sites). This rebuilds and deploys without browser, graph or launch review gates. Compilation, Cloudflare credentials, staged-file integrity and an HTTP smoke check still run. Receipts record build-only verification. Preservation sites use `--environment preview` and also skip screenshot comparisons. Ordinary deployment retains full preflight.

package/bin/api/cli/api.js

@@ -11,7 +11,7 @@ import {
   runDoctor,
   shareSite,
   synthesizeSite
-} from "../../chunks/chunk-WNE543KF.js";
+} from "../../chunks/chunk-YXJAQYDE.js";
 import {
   applyOperations,
   buildSiteDraft,
@@ -31,14 +31,14 @@ import {
 } from "../../chunks/chunk-A2XMAPVW.js";
 import {
   createSite
-} from "../../chunks/chunk-DYKLM4I3.js";
+} from "../../chunks/chunk-UFTVWTEZ.js";
 import "../../chunks/chunk-2NW7KSPA.js";
 import {
   buildAdapterConfig,
   runPreserve,
   runSite,
   statusSite
-} from "../../chunks/chunk-FEFLSJM5.js";
+} from "../../chunks/chunk-LZC37OJZ.js";
 import "../../chunks/chunk-R2WRQDVE.js";
 import "../../chunks/chunk-34H54KEY.js";
 import {

package/bin/api/cli.js

@@ -1,14 +1,14 @@
 import {
   runCli
-} from "../chunks/chunk-QQOMS2DL.js";
-import "../chunks/chunk-WNE543KF.js";
+} from "../chunks/chunk-SEMH6MCV.js";
+import "../chunks/chunk-YXJAQYDE.js";
 import "../chunks/chunk-FGSQE3DU.js";
 import "../chunks/chunk-WMJVLMU2.js";
 import "../chunks/chunk-A2XMAPVW.js";
-import "../chunks/chunk-DYKLM4I3.js";
+import "../chunks/chunk-UFTVWTEZ.js";
 import "../chunks/chunk-2NW7KSPA.js";
 import "../chunks/chunk-3OKR5AZJ.js";
-import "../chunks/chunk-FEFLSJM5.js";
+import "../chunks/chunk-LZC37OJZ.js";
 import "../chunks/chunk-R2WRQDVE.js";
 import "../chunks/chunk-34H54KEY.js";
 import "../chunks/chunk-JCRGE6AL.js";

package/bin/chunks/{chunk-FEFLSJM5.js → chunk-LZC37OJZ.js}

@@ -253,7 +253,7 @@ function scaffoldNestedSite(opts) {
   for (const [key, value] of Object.entries(pkg.scripts)) pkg.scripts[key] = value.replaceAll("__SLUG__", opts.slug);
   writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
-  for (const file2 of ["site.json", "README.md", "AGENTS.md"]) {
+  for (const file2 of ["site.json", "README.md", "AGENTS.md", "deployment/github-actions.yml.example"]) {
     const p = join2(dest, file2);
     if (!existsSync2(p)) continue;
     if (file2 === "site.json") {

package/bin/chunks/{chunk-QQOMS2DL.js → chunk-SEMH6MCV.js}

@@ -11,7 +11,7 @@ import {
   runDoctor,
   shareSite,
   synthesizeSite
-} from "./chunk-WNE543KF.js";
+} from "./chunk-YXJAQYDE.js";
 import {
   verifySite
 } from "./chunk-WMJVLMU2.js";
@@ -20,7 +20,7 @@ import {
 } from "./chunk-A2XMAPVW.js";
 import {
   createSite
-} from "./chunk-DYKLM4I3.js";
+} from "./chunk-UFTVWTEZ.js";
 import {
   explainStage
 } from "./chunk-3OKR5AZJ.js";
@@ -28,7 +28,7 @@ import {
   runSite,
   statusSite,
   workflowArgvFromFlags
-} from "./chunk-FEFLSJM5.js";
+} from "./chunk-LZC37OJZ.js";
 import {
   EXIT_CODES
 } from "./chunk-JCRGE6AL.js";
@@ -50,9 +50,9 @@ import {
 } from "./chunk-T6PE4KN4.js";
 
 // src/cli/index.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { resolve as resolve2 } from "node:path";
-import { spawnSync } from "node:child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
 
 // src/cli/events.ts
 var EventStream = class {
@@ -270,6 +270,106 @@ async function formsCommand(command, opts) {
   }
 }
 
+// src/cli/admin.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+import { createRequire } from "node:module";
+import { spawnSync } from "node:child_process";
+import { parseManifest } from "@tryvitris/website-admin-contracts";
+
+// src/admin/connection.ts
+async function readConnection(manifest, token, resource, test = false, transport = fetch) {
+  if (!manifest.backend || !/^[a-zA-Z0-9_-]{32,200}$/.test(token)) throw Error("A dedicated VITRIS_ADMIN_API_TOKEN and backend connection are required");
+  const url = new URL(`/api/admin/v1/${encodeURIComponent(manifest.backend.tenantId)}/${resource}`, manifest.backend.origin);
+  if (test) url.searchParams.set("mode", "test");
+  const response = await transport(url, { redirect: "manual", signal: AbortSignal.timeout(12e3), headers: { authorization: `Bearer ${token}`, "x-vitris-installation": manifest.installationId, "x-vitris-site-origin": manifest.site.origin } });
+  if (!response.ok) throw Error(`Admin v1 ${resource} rejected (${response.status}); connection is not verified`);
+  const reader = response.body?.getReader();
+  if (!reader) throw Error("Empty backend response");
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.length;
+    if (size > 4e6) {
+      await reader.cancel();
+      throw Error("Backend response too large");
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.length;
+  }
+  const data = JSON.parse(new TextDecoder().decode(bytes));
+  if (data?.schemaVersion !== 1 || data.installationId !== manifest.installationId || data.tenantId !== manifest.backend.tenantId || data.siteOrigin !== manifest.site.origin) throw Error("Backend contract or installation identity mismatch");
+  if (resource === "status") {
+    if (!Array.isArray(data.scopes)) throw Error("Invalid backend scopes");
+  } else {
+    if (data.source !== "connected" || !Array.isArray(data.rows) || data.rows.length > 200) throw Error("Invalid backend records");
+    if (resource === "leads" && data.rows.some((r) => ["id", "name", "email", "message", "created_at", "status"].some((k) => typeof r?.[k] !== "string"))) throw Error("Invalid lead response");
+    if (resource === "analytics" && data.rows.some((r) => typeof r?.day !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(r.day) || ["views", "visitors", "enquiries"].some((k) => typeof r[k] !== "number" || !Number.isFinite(r[k]) || r[k] < 0))) throw Error("Invalid analytics response");
+  }
+  return data;
+}
+
+// src/cli/admin.ts
+function mergeAdminGrant(existing, addition) {
+  const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+  if (!object(existing) || !object(addition) || Object.keys(addition).length !== 1) throw Error("Expected complete grant map and one installation grant");
+  for (const [id, raw] of Object.entries({ ...existing, ...addition })) {
+    const g = raw;
+    if (!/^[a-z][a-z0-9-]{0,50}$/.test(id) || !object(g) || typeof g.tenantId !== "string" || !/^[a-zA-Z0-9_-]{1,100}$/.test(g.tenantId) || typeof g.tokenHash !== "string" || !/^[a-f0-9]{64}$/.test(g.tokenHash) || typeof g.siteOrigin !== "string" || new URL(g.siteOrigin).origin !== g.siteOrigin || !g.siteOrigin.startsWith("https://") || !Array.isArray(g.scopes) || g.scopes.some((s) => !["leads:read", "analytics:read", "leads:write"].includes(s)) || Object.keys(g).some((k) => !["tenantId", "siteOrigin", "tokenHash", "scopes"].includes(k))) throw Error("Invalid hashed grant; raw credentials are forbidden");
+  }
+  for (const id of Object.keys(addition)) if (Object.hasOwn(existing, id) && JSON.stringify(existing[id]) !== JSON.stringify(addition[id])) throw Error("Grant already exists with different authority; rotate explicitly");
+  return { ...existing, ...addition };
+}
+async function adminCommand(command, options) {
+  try {
+    const site = resolve2(options.site || ".");
+    if (command === "grant") {
+      if (!options.dir || !options.grants || !options.out || options.dryRun) throw Error("admin grant requires --dir, --grants COMPLETE_MAP_FILE and --out NEW_IGNORED_FILE");
+      const addition = JSON.parse(readFileSync2(resolve2(options.dir, ".vitris/backend-grant.json"), "utf8"));
+      const manifest2 = parseManifest(JSON.parse(readFileSync2(resolve2(options.dir, "admin.config.json"), "utf8")));
+      const grant = addition[manifest2.installationId];
+      if (!grant || grant.tenantId !== manifest2.backend?.tenantId || grant.siteOrigin !== manifest2.site.origin) throw Error("Grant and installation identity differ");
+      const merged = mergeAdminGrant(JSON.parse(readFileSync2(resolve2(options.grants), "utf8")), addition);
+      writeFileSync2(resolve2(options.out), JSON.stringify(merged, null, 2) + "\n", { flag: "wx", mode: 384 });
+      return { ok: true, exitCode: 0, summary: "Merged hashed grants into the new local file. No backend secret changed; review and install explicitly through secret stdin." };
+    }
+    if (command === "setup") {
+      if (!options.dir || !options.domain || !options.tenant || !!options.plan === !!options.apply) throw Error("admin setup requires --dir, --domain, --tenant and exactly one of --plan or --apply");
+      if (options.dryRun) throw Error("Use --plan for local setup planning; --dry-run does not write a setup plan");
+      const args = ["setup", "--site", site, "--dir", resolve2(options.dir), "--domain", options.domain, "--tenant", options.tenant, options.apply ? "--apply" : "--plan"];
+      if (options.website) args.push("--website", options.website);
+      if (options.backendOrigin) args.push("--backend-origin", options.backendOrigin);
+      if (options.leadWrite) args.push("--lead-write");
+      const entry = createRequire(import.meta.url).resolve("@tryvitris/website-admin-harness/cli");
+      const output = spawnSync(process.execPath, [entry, ...args], { encoding: "utf8", windowsHide: true, maxBuffer: 1024 * 1024 });
+      if (output.status !== 0) throw Error(output.error?.message || output.stderr.trim() || "Admin setup failed");
+      return { ok: true, exitCode: 0, summary: output.stdout.trim() };
+    }
+    if (!["status", "verify"].includes(command)) throw Error("Use vitris admin setup|status|verify|grant");
+    const launch = JSON.parse(readFileSync2(resolve2(site, "launch.json"), "utf8"));
+    if (command === "status") return { ok: true, exitCode: 0, summary: launch.admin ? "Local admin metadata exists. Backend, authentication and deployment are unverified; run admin verify with --dir." : "No admin connection. Read docs/ADMIN.md; scaffolding alone does not enable collection.", data: { connection: launch.admin || null, verified: false } };
+    if (!options.dir) throw Error("admin verify requires --dir ADMIN_DIRECTORY");
+    const manifest = parseManifest(JSON.parse(readFileSync2(resolve2(options.dir, "admin.config.json"), "utf8")));
+    if (!launch.admin || manifest.installationId !== launch.admin.installationId || manifest.site.id !== launch.admin.siteId || manifest.adminOrigin !== launch.admin.url || manifest.site.origin !== launch.admin.siteOrigin || manifest.backend?.tenantId !== launch.admin.tenantId) throw Error("Website and admin installation identities differ");
+    const token = process.env.VITRIS_ADMIN_API_TOKEN || "";
+    const status = await readConnection(manifest, token, "status");
+    if (!["leads:read", "analytics:read"].every((scope) => status.scopes.includes(scope))) throw Error("Default read scopes are missing");
+    const leads = await readConnection(manifest, token, "leads");
+    const tests = await readConnection(manifest, token, "leads", true);
+    const analytics = await readConnection(manifest, token, "analytics");
+    return { ok: true, exitCode: 0, summary: "Admin v1 data connection verified. Authentication, collection and deployment require separate acceptance checks.", data: { verified: true, productionLeads: leads.rows.length, testSubmissions: tests.rows.length, analyticsDays: analytics.rows.length, scopes: status.scopes } };
+  } catch (error) {
+    return { ok: false, exitCode: EXIT_CODES.PRECONDITION_FAILED, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
 // src/cli/index.ts
 function parseArgs(args) {
   const command = [];
@@ -309,9 +409,9 @@ function parseArgs(args) {
 }
 function resolvePrecedence(flags, siteRoot) {
   const merged = {};
-  if (siteRoot && existsSync2(resolve2(siteRoot, "launch.json"))) {
+  if (siteRoot && existsSync2(resolve3(siteRoot, "launch.json"))) {
     try {
-      const launch = JSON.parse(readFileSync2(resolve2(siteRoot, "launch.json"), "utf8"));
+      const launch = JSON.parse(readFileSync3(resolve3(siteRoot, "launch.json"), "utf8"));
       if (typeof launch.ownerEmail === "string") merged.owner = launch.ownerEmail;
       if (typeof launch.slug === "string") merged.slug = launch.slug;
       if (typeof launch.name === "string") merged.name = launch.name;
@@ -320,9 +420,9 @@ function resolvePrecedence(flags, siteRoot) {
   }
   if (flags.config && typeof flags.config === "string") {
     try {
-      const configPath = resolve2(flags.config);
+      const configPath = resolve3(flags.config);
       if (existsSync2(configPath)) {
-        const cfg = JSON.parse(readFileSync2(configPath, "utf8"));
+        const cfg = JSON.parse(readFileSync3(configPath, "utf8"));
         for (const [k, v] of Object.entries(cfg)) {
           if (typeof v === "string" || typeof v === "boolean") merged[k] = v;
         }
@@ -354,7 +454,7 @@ async function runCli(argv) {
   }
   const stream = new EventStream(outputMode);
   if (flags.version || flags.v) {
-    stream.log(`@tryvitris/website-harness v${JSON.parse(readFileSync2(resolve2(findHarnessRoot(), "package.json"), "utf8")).version}`);
+    stream.log(`@tryvitris/website-harness v${JSON.parse(readFileSync3(resolve3(findHarnessRoot(), "package.json"), "utf8")).version}`);
     return EXIT_CODES.SUCCESS;
   }
   if (flags.help || flags.h || command.length === 0) {
@@ -363,6 +463,7 @@ async function runCli(argv) {
 Usage: vitris <command> [options]
 
 Commands:
+  admin setup|status|verify             Separate business admin; explicit cloud rollout
   forms inspect|setup|status            Inventory, provision, and check contact forms
   doctor                                Check environment, dependencies, and site health
   site create --dir DIR --slug SLUG    Scaffold a new customer site repo (--from URL or --blank)
@@ -391,6 +492,7 @@ Options:
   --template-release RELEASE            Optional template revision
   --content TEXT                        Additional business content or instructions
   --content-file FILE                   UTF-8 content file (instead of --content)
+  --admin                               New-site opt-in: prepare sibling admin next steps
   --backend-origin URL                  Backend origin for a new site
   --site DIR                            Site directory path (default: current directory)
   --json                                Output single structured JSON result at completion
@@ -413,7 +515,10 @@ Options:
   const secondary = command[1];
   let result;
   try {
-    if (primary === "forms") {
+    if (primary === "admin") {
+      const value = (key) => typeof opts[key] === "string" ? opts[key] : void 0;
+      result = await adminCommand(secondary || "status", { site: siteRoot, dir: value("dir"), domain: value("domain"), website: value("website"), tenant: value("tenant"), backendOrigin: value("backend-origin"), plan: !!opts.plan, apply: !!opts.apply, leadWrite: !!opts["lead-write"], grants: value("grants"), out: value("out"), dryRun });
+    } else if (primary === "forms") {
       const list = (name) => typeof opts[name] === "string" ? opts[name].split(",").map((s) => s.trim()).filter(Boolean) : void 0;
       result = await formsCommand(secondary || "status", { site: siteRoot, tenant: typeof opts.tenant === "string" ? opts.tenant : void 0, backendOrigin: typeof opts["backend-origin"] === "string" ? opts["backend-origin"] : void 0, origins: list("origins"), recipients: list("recipients"), mode: typeof opts.mode === "string" ? opts.mode : void 0, apply: !!opts.apply, testKeys: !!opts["test-keys"], cloudflare: !!opts.cloudflare, worker: typeof opts.worker === "string" ? opts.worker : void 0, config: typeof opts["forms-config"] === "string" ? opts["forms-config"] : void 0, dryRun });
     } else if (primary === "doctor") {
@@ -425,6 +530,7 @@ Options:
     } else if (primary === "site" && secondary === "create") {
       result = await createSite({
         ...siteInputsFromFlags(opts),
+        admin: !!opts.admin,
         dir: typeof opts.dir === "string" ? opts.dir : "",
         slug: typeof opts.slug === "string" ? opts.slug : "",
         name: typeof opts.name === "string" ? opts.name : void 0,
@@ -559,14 +665,14 @@ Options:
       if (sub === "doctor") {
         result = await runDoctor({ provider: "cloudflare", operation: "pages" });
       } else if (sub === "whoami") {
-        const probe = spawnSync(process.platform === "win32" ? "npx.cmd" : "npx", ["wrangler", "whoami"], { encoding: "utf8" });
+        const probe = spawnSync2(process.platform === "win32" ? "npx.cmd" : "npx", ["wrangler", "whoami"], { encoding: "utf8" });
         result = {
           ok: probe.status === 0,
           exitCode: probe.status === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.CONFIG_OR_CLI_ERROR,
           summary: probe.stdout || probe.stderr
         };
       } else if (sub === "login") {
-        const probe = spawnSync(process.platform === "win32" ? "npx.cmd" : "npx", ["wrangler", "login"], { stdio: "inherit" });
+        const probe = spawnSync2(process.platform === "win32" ? "npx.cmd" : "npx", ["wrangler", "login"], { stdio: "inherit" });
         result = {
           ok: probe.status === 0,
           exitCode: probe.status === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.GENERIC_ERROR,
@@ -580,7 +686,7 @@ Options:
         };
       }
     } else if (primary === "knowledge" && secondary === "explain") {
-      const explained = explainStage(resolve2(typeof opts.site === "string" ? opts.site : "."), typeof opts.stage === "string" ? opts.stage : "direction");
+      const explained = explainStage(resolve3(typeof opts.site === "string" ? opts.site : "."), typeof opts.stage === "string" ? opts.stage : "direction");
       result = { ok: true, exitCode: EXIT_CODES.SUCCESS, summary: explained.text, data: explained };
     } else if (primary === "share") {
       result = await shareSite({

package/bin/chunks/{chunk-DYKLM4I3.js → chunk-UFTVWTEZ.js}

@@ -151,7 +151,9 @@ Preserved custom website from ${fromArg}.
 2. npx playwright install chromium
 3. npm run go
 4. npm run preview
-5. npm run deploy (temporary Cloudflare preview)
+5. npm run deploy (build and verify locally, then upload a temporary Cloudflare preview)
+
+Local builds and direct uploads are the default. GitHub stores source; no deployment workflow runs automatically. Keep dist/ and release bundles out of Git.
 
 Custom source: preserved/. Verification: agent/reviews/preserve.json. See AGENTS.md and the installed harness docs/PRESERVE.md. Run vitris forms inspect and vitris forms setup to register and connect contact forms; backendOrigin alone does not enable submission or notifications. See docs/CONTACT-FORMS.md.
 `);
@@ -161,10 +163,14 @@ Run npm run go to capture and verify the existing client-facing site. Keep its a
 
 Repair source in preserved/ when agent/reviews/preserve.json reports a failure; run npm run go again. Never change reference screenshots or hashes to make a check pass. Do not overwrite source by recapturing. onboarding/preserve.json records the source and captured routes. Contact forms require explicit registration and public launch.json forms bindings. backendOrigin alone does not enable delivery. Default previews show a notice without submitting. See docs/CONTACT-FORMS.md.
 
-Use npm run deploy for a temporary Cloudflare preview after verification. Production and customer domains are outside this mode. Scaffold a later redesign separately from the same source URL.
+Use npm run deploy to build and verify locally and directly upload a temporary Cloudflare preview. Keep dist/ and release bundles out of Git. Hosted automation is opt-in; deployment/github-actions.yml.example is inactive by default. Production and customer domains are outside this mode. Scaffold a later redesign separately from the same source URL.
 `);
   }
-  const workflow = join(dest, ".github", "workflows", "deploy.yml");
+  if (mode === "preserve") {
+    const instructions = join(dest, "AGENTS.md");
+    writeFileSync(instructions, readFileSync(instructions, "utf8") + "\nFor a requested sibling business admin, read agent/refs/admin.md and the installed harness docs/ADMIN.md. Use vitris admin setup --plan then reviewed --apply. Preserve current forms and backend identity; cloud provisioning, authentication and deployment remain separate.\n");
+  }
+  const workflow = join(dest, "deployment", "github-actions.yml.example");
   if (existsSync(workflow)) {
     if (mode === "preserve") {
       writeFileSync(workflow, `name: Preserve preview
@@ -198,6 +204,18 @@ jobs:
     copyMarkdown: gathered.copyMarkdown
   });
   persistSiteInputs(dest, inputs);
+  if (opts.admin) {
+    writeFileSync(join(dest, "ADMIN-SETUP.md"), `# Optional business admin
+
+Read node_modules/@tryvitris/website-harness/docs/ADMIN.md and agent/refs/admin.md.
+
+Prepare a separate sibling installation after confirming the exact website origin, existing tenant ID and backend origin:
+
+vitris admin setup --site . --dir ../${slug}-admin --domain admin.CUSTOMER_DOMAIN --website https://www.CUSTOMER_DOMAIN --tenant EXISTING_TENANT_ID --backend-origin https://BACKEND --plan
+
+Review artifacts/admin/setup-plan.json, then repeat with --apply and a dedicated VITRIS_ADMIN_API_TOKEN in the operator environment. This opt-in has created instructions only. No backend, grant, account, collection, authentication, DNS or cloud resources have been changed.
+`);
+  }
   const graphPath = join(dest, "agent", "graph.yaml");
   if (existsSync(graphPath)) {
     const graph = parseGraphYaml(readFileSync(graphPath, "utf8"));
@@ -210,7 +228,7 @@ jobs:
   return {
     ok: true,
     exitCode: EXIT_CODES.SUCCESS,
-    summary: `Created site ${slug} at ${dest}`,
+    summary: `Created site ${slug} at ${dest}${opts.admin ? "; optional admin next steps: ADMIN-SETUP.md" : ""}`,
     data: { dest, slug, name }
   };
 }

package/bin/chunks/{chunk-WNE543KF.js → chunk-YXJAQYDE.js}

@@ -14,7 +14,7 @@ import {
   runCreativeProfile,
   startDesignReview,
   submitFeedback
-} from "./chunk-FEFLSJM5.js";
+} from "./chunk-LZC37OJZ.js";
 import {
   verifyPreservedSite
 } from "./chunk-R2WRQDVE.js";