Split portraits by set, and automate Series Two card production

[ralyodio]

Two commits. The first makes room for the Hacking Legends art; the second generates it.

1. Split assets/portraits into per-set directories

Series One art was flat in assets/portraits/, so Series Two had nowhere to land without colliding on card_NNN.png numbering.

Directory	Set	Roster source
assets/portraits/legends/	Open Source Legends (Series One)	data/roster.locked.json
assets/portraits/hacking-legends/	Hacking Legends (Series Two)	src/data/hacking.ts

Numbering is per-set, so legends/card_001.png (Stallman) and hacking-legends/card_001.png (Mitnick) are both valid and unrelated. All 50 Series One portraits moved via git mv with no byte changes; the generator config, data/roster.locked.json and the generated dist/roster.json were repointed. Repo-wide grep for the old path returns zero hits.

2. Automate Series Two production

Series One was assembled by hand across four scripts plus a manual copy into public/cards/. scripts/hacking-legends.mjs does the same job as one resumable chain, driven straight off src/data/hacking.ts (imported directly — Node strips the types, so there is no second copy of the roster).

pnpm hacking all              # whole set
pnpm hacking all 1 5 12       # only these
pnpm hacking render           # no API calls, no spend

Stage	Output	Cost
portraits	assets/portraits-art/hacking-legends/	1 image call per card
render	dist/hacking/html/ (700x1043 @2x + source HTML)	free
enhance	dist/hacking/enhanced/	2 image calls per card
publish	public/cards/hacking/ at 500x745	free

Every stage skips existing output, so a failed batch is just re-run. An approved portrait in assets/portraits/hacking-legends/ always beats generated art and is never regenerated. Provider is chosen from whichever key is present — OpenAI gpt-image-2 (the current latest, up from Series One's gpt-image-1) or Gemini — and both model ids are env-overridable.

Card design

scripts/hacking-template.mjs keeps Series One's bones so the decks read as one product line, and differs only where the data does: an alias line, a DOMAINS panel instead of signature projects, and an explicit rarity rather than one derived from impact.

The set had a single impact score and no sub-stats, and Series One's code/community axes do not describe hackers. This adds technical / social / notoriety / influence to all 30 entries, rendered as the skill stack. They are editorial ratings, flagged as such in the type — the same kind of judgement Series One's ratings are, not sourced facts. Worth a review pass; they are easy to argue with.

One non-obvious fix: the finish pass fills empty space by inventing, and it invented something different on every back (a vignette on one card, a full portrait on another). Claiming that space with a crest watermark and the alias makes the backs uniform across the deck.

Site wiring

publish writes front/back into hacking.ts, so the roster page and its "artwork rendered" counter update themselves. RosterCard shows real art when a card has it and the existing data-only proof when it does not; the pending placeholder now matches the card aspect ratio so the grid stays even mid-series.

sharp

Now a real dependency. Three scripts already imported it while the file headers told you to npm install it by hand, so open-source-legends.mjs could not run from a clean checkout. publish needs it to resize — without that a face ships at 3MB against Series One's ~230KB.

Verification

• open-source-legends.mjs validate passes, and fails with the expected missing-portrait error when legends/ is moved aside.
• hacking-legends.mjs validate passes: 30 on the roster, no structural errors.
• tsc --noEmit and next build both clean.
• /hacking-legends rendered in a real browser: no broken images, counter reads 3/30.
• Sample run of cards 1, 5 and 12 is included, so the art is reviewable in the diff.

Not in this PR

• The remaining 27 cards. Run pnpm hacking all when the stat lines and the three sample cards look right.
• dist/hacking/ is gitignored, so the full-resolution faces are local only. Archive them before wiping if you want print masters.
• assets/portraits-art/ is still flat and shared between the decks. Series Two writes to a subdirectory; Series One's gen-portraits.mjs and render-cards.mjs still write to the root and would want the same treatment.
• public/cards/ is still flat and Series One only. Splitting it would change live image URLs in src/data/cards.ts, so it is a separate decision.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

1 finding(s)

MEDIUM: 1

Severity	Rule	Location
MEDIUM	js-credential-logged	scripts/migrate.mjs:16

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	sharp@​0.35.3

View full report