ZUnfurl

ZUnfurl is an open-source, static-first brand-site framework built on Astro, with optional Sanity CMS and a read-only Shopify retail catalog foundation.

What is ZUnfurl?

ZUnfurl is an Apache-2.0 licensed, static-first website framework that packages four delivery profiles — A1 (pure static brand site), A2 (static site with a contact form), B (brand site with Sanity CMS), and C (retail catalog foundation with Sanity CMS and a read-only Shopify Storefront API mapping) — into a single configurable template repository. It takes a gcss.project.json config (project name, brand, domain, profile, locales) as input and produces a static Astro storefront, an optional Sanity Studio workspace, a Cloudflare Worker for contact forms and webhooks, and GitHub Actions workflow files. The framework is authored by Noodle Freeman and is currently at version 0.3.0-preview.1, explicitly labeled as a preview that does not promise production SLAs.

Key Features

• Four delivery profiles — A1/A2/B/C map to static-brand, cms-brand, and retail profiles; the default is cms-brand so new projects don't require Shopify, webhooks, or catalog permissions until explicitly switched.
• Astro static generation — The storefront is built with Astro and TypeScript, producing a fully static site deployable on Cloudflare Workers; local npm run preview only serves built assets and is not a Sanity draft preview.
• Optional Sanity Studio — B and C profiles include an editable content CMS with page and product operation manuals; A profiles create no Sanity project.
• Read-only Shopify mapping — The C profile reads product catalog and media facts via Shopify Storefront API; cart, checkout, payment, order, tax, shipping, fulfillment, real-time price, and inventory are explicitly out of scope.
• Cloudflare Worker with idempotent webhooks — The Worker serves static assets, a health check, a lightweight contact form, and a webhook entry point; SQLite-backed Durable Objects coordinate atomic contact quotas and de-duplicate identical webhook event IDs.
• Guarded GitHub Actions — preview.yml runs CI without production secrets; deploy.yml only triggers manually from main, requires PRODUCTION_DEPLOYMENT_ARMED=true, and rejects templateMode=true.
• Customer-owned platform boundaries — Client repos are created directly in the customer's GitHub Organization; GitHub, Cloudflare, domain, Sanity, Shopify, and Resend accounts remain customer property, with the maintainer using member credentials removed after handoff.
• Multi-locale and environment conventions — Locales are part of the project config, and .env.example scopes variables to the selected profile (A1 needs no external services; B and C require Sanity; C adds Shopify).

Who is it for?

• Agencies and web studios — Use the A1/A2/B/C model to scope client brand sites from static-only to CMS-driven without forking the base template; each project gets a private repo with a unified startup and full handoff manual.
• Retail and consumer brands — Use the C profile to stand up a catalog foundation that maps Shopify product data read-only while content editors update product stories in Sanity.
• Static-first development teams — Adopt the repository as a reference implementation of Astro + Sanity + Cloudflare Workers, including type-checked configuration, supply-chain gates, and profile-isolated test fixtures (test:phase5 covers all four profiles).

Use cases

• Agency client launches: Initialize each client repo from the template, run init:project with a config file, enforce dry-run and audit, then hand off with docs; customers own all production accounts.
• Retailers with a content-managed catalog: Switch to retail profile to map Shopify products and media into a static storefront, letting editors manage product content in Sanity without touching code.
• Marketers needing a simple contact form: Use A2 to deploy a static site plus a Worker-powered contact form with Resend and Turnstile, without creating a CMS project.

How does ZUnfurl work?

Create a private repository from the public template (via GitHub's Use this template), clone it, and run npm run init:project against a client config. The CLI first audits and generates a dry-run plan; only after review does the --write flag apply controlled changes, followed by npm run project:scan for verification. Deployments are manual from main with explicit production arming, and the framework does not auto-deploy on push.

FAQ

Is ZUnfurl free?

Yes, the source code is open source under the Apache-2.0 license. There is no paid tier or hosted SaaS; you deploy the framework to your own GitHub, Cloudflare, Sanity, and Shopify accounts.

Does the C retail profile include checkout?

No. The retail profile only maps product catalog and media facts via the Shopify Storefront API in read-only mode. Cart, checkout, payments, orders, tax, shipping, and fulfillment are deliberately not part of the template.

What Node version is required?

The repository requires Node 22.12.0 or Node 24, and npm 11.9.0 as pinned by the lockfile. Development commands use npm ci and npm run dev.

Can I preview Sanity drafts?

Not yet. Authenticated editorial draft preview is on the roadmap. Local astro preview and PR CI checks only serve the built static output and do not include draft-aware content preview.

Who owns the production accounts?

The customer owns all external accounts (GitHub, Cloudflare, domain, Sanity, Shopify, Resend). The maintainer works with member-level access during development and removes access after handoff, as documented in the project startup handoff guide.