chore(tooling): default web templates to cf

docs/how-to/create-a-repository.md

@@ -55,7 +55,7 @@ install from the versioned snapshot under `.lvbt/web-platform`, so no registry l
 - Rename the root package in `package.json`.
 - Rename `packages/example`, `apps/site`, or `apps/app` to your first real package or app, or
   scaffold one with `turbo gen workspace` and delete the sample. Deployable templates also need the
-  Worker name in `apps/*/wrangler.jsonc` and, for a site, `site` in `astro.config.ts`.
+  Worker name in `apps/deploy/cloudflare.config.ts` and, for a site, `site` in `astro.config.ts`.
 - Replace the scopes in `.lvbt/commit-scopes.txt` with this repository's boundaries.
 - `.github/workflows/ci.yml` runs a job named `Validate`. Keep that name: the organization ruleset
   requires it on every pull request. Add steps to the job.

docs/reference/examples.md

@@ -45,13 +45,13 @@ files.
 
 `with-astro` and `with-vite-react` carry everything above, minus `packages/example`, plus:
 
-| Path                           | Purpose                                                                                              |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------- |
-| `apps/site` or `apps/app`      | The application: source under `src/`, unit tests under `tests/`, end-to-end tests under `tests/e2e/` |
-| `apps/*/wrangler.jsonc`        | A static-assets Worker serving `dist/`; `pnpm run deploy` deploys every app that has one             |
-| `apps/*/playwright.config.ts`  | Spreads `@lasvegasfortransit/playwright-config` and starts the app's `preview` server                |
-| `.github/workflows/deploy.yml` | Validates, then runs `pnpm run deploy` on every push to `main` with the Cloudflare secrets           |
-| root `preview` and `deploy`    | `turbo run preview` and `lvbt deploy`                                                                |
+| Path                               | Purpose                                                                                              |
+| ---------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| `apps/site` or `apps/app`          | The application: source under `src/`, unit tests under `tests/`, end-to-end tests under `tests/e2e/` |
+| `apps/deploy/cloudflare.config.ts` | The `cf` Worker project, which serves the app's built static assets                                  |
+| `apps/*/playwright.config.ts`      | Spreads `@lasvegasfortransit/playwright-config` and starts the app's `preview` server                |
+| `.github/workflows/deploy.yml`     | Validates, then runs `pnpm run deploy` on every push to `main` with the Cloudflare secrets           |
+| root `preview` and `deploy`        | `turbo run preview` and `lvbt deploy`; CI builds the app and dry-runs `cf deploy`                    |
 
 The Astro example also adds `prettier-plugin-astro` to its Prettier config and extends
 `@lasvegasfortransit/typescript-config/astro.json`; the React example extends `react-library.json`

docs/reference/release-0-6-1.md

@@ -0,0 +1,14 @@
+# Repository tooling 0.6.1
+
+The Astro and Vite templates now deploy through `cf` from a separate `apps/deploy` package. This
+package reads the app's built static assets, preserving the existing Worker name, compatibility
+date, preview URLs, observability, and missing-page behavior. New templates contain one deploy
+target, so `lvbt deploy` cannot publish a second copy through Wrangler.
+
+`lvbt deploy` builds the app before invoking `cf deploy`. New repositories must provide
+`CLOUDFLARE_ACCOUNT_ID` and an account-owned `CLOUDFLARE_API_TOKEN` in their production GitHub
+environment. `cf` is still in beta; its Wrangler build adapter remains an explicit dependency of the
+deploy package. The required repository check builds the app and dry-runs its Cloudflare bundle.
+
+The source and new templates pin patched `brace-expansion`, `fast-uri`, and both supported `undici`
+major lines to avoid high-severity transitive advisories in the current toolchain.

examples/basic/.claude/settings.json

@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.6.0"
+        "ref": "v0.6.1"
       }
     }
   },

examples/basic/package.json

@@ -21,8 +21,8 @@
     "*": "prettier --write --ignore-unknown"
   },
   "devDependencies": {
-    "@lasvegasfortransit/cli": "0.6.0",
-    "@lasvegasfortransit/prettier-config": "0.6.0",
+    "@lasvegasfortransit/cli": "0.6.1",
+    "@lasvegasfortransit/prettier-config": "0.6.1",
     "lint-staged": "catalog:",
     "markdownlint-cli2": "catalog:",
     "markdownlint-rule-relative-links": "catalog:",

examples/basic/packages/example/package.json

@@ -16,9 +16,9 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "@lasvegasfortransit/eslint-config": "0.6.0",
-    "@lasvegasfortransit/typescript-config": "0.6.0",
-    "@lasvegasfortransit/vitest-config": "0.6.0",
+    "@lasvegasfortransit/eslint-config": "0.6.1",
+    "@lasvegasfortransit/typescript-config": "0.6.1",
+    "@lasvegasfortransit/vitest-config": "0.6.1",
     "@types/node": "catalog:",
     "eslint": "catalog:",
     "typescript": "catalog:",

examples/basic/pnpm-workspace.yaml

@@ -16,7 +16,11 @@ minimumReleaseAge: 1440
 # Temporary transitive pins for published security fixes not yet selected by
 # their direct dependents.
 overrides:
+  brace-expansion: 5.0.12
+  fast-uri: 3.1.8
   sharp: 0.35.4
+  'undici@^7.0.0': 7.29.1
+  'undici@^8.0.0': 8.10.2
   smol-toml: 1.8.0
   svgo: 4.1.0
 

examples/with-astro/.claude/settings.json

@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.6.0"
+        "ref": "v0.6.1"
       }
     }
   },

examples/with-astro/.gitignore

@@ -7,6 +7,7 @@ blob-report/
 **/playwright/.cache/
 .turbo/
 .wrangler/
+.cloudflare/
 .env
 .env.*
 !.env.example

examples/with-astro/README.md

@@ -15,17 +15,18 @@ pnpm check       # the same check CI runs
 pnpm dev         # the site at http://127.0.0.1:4321
 ```
 
-Then rename the root package and the Worker in `apps/site/wrangler.jsonc`, set `site` in
+Then rename the root package and the Worker in `apps/deploy/cloudflare.config.ts`, set `site` in
 `apps/site/astro.config.ts`, and replace the scopes in `.lvbt/commit-scopes.txt` with this
 repository's boundaries.
 
 ## Layout
 
 - `apps/site` is the Astro site: pages under `src/pages`, layouts under `src/layouts`, Tailwind in
   `src/styles/global.css`, unit tests under `tests/`, end-to-end tests under `tests/e2e/`
+- `apps/deploy` holds the `cf` Worker configuration and reads `apps/site/dist` after the site build
 - `packages/` for libraries the site shares with other apps
 
-`pnpm run deploy` builds and deploys every app with a `cloudflare.config.ts` or Wrangler config;
+`pnpm run deploy` builds the site and deploys the canonical `cf` project in `apps/deploy`;
 `.github/workflows/deploy.yml` does the same on every push to `main`.
 
 Lint, format, TypeScript, and test settings extend the `@lasvegasfortransit/*` packages from

examples/with-astro/apps/deploy/cloudflare.config.ts

@@ -0,0 +1,16 @@
+import { defineConfig } from 'cf/config';
+
+// Set CLOUDFLARE_ACCOUNT_ID in the deploy environment before publishing.
+export default defineConfig({
+  worker: {
+    name: 'lvbt-site',
+    compatibilityDate: '2026-08-31',
+    previewUrls: true,
+    assets: {
+      notFoundHandling: '404-page',
+    },
+    observability: {
+      enabled: true,
+    },
+  },
+});

examples/with-astro/apps/deploy/eslint.config.js

@@ -0,0 +1,3 @@
+import { config } from '@lasvegasfortransit/eslint-config/base';
+
+export default config;

examples/with-astro/apps/deploy/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@lasvegasfortransit/deploy",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "lint": "eslint . --max-warnings 0",
+    "check-types": "tsc --noEmit",
+    "test": "node --test",
+    "validate": "cf deploy --dry-run"
+  },
+  "devDependencies": {
+    "@lasvegasfortransit/eslint-config": "0.6.1",
+    "@lasvegasfortransit/site": "workspace:*",
+    "@lasvegasfortransit/typescript-config": "0.6.1",
+    "cf": "catalog:",
+    "eslint": "catalog:",
+    "typescript": "catalog:",
+    "wrangler": "catalog:"
+  }
+}

examples/with-astro/apps/deploy/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "extends": "@lasvegasfortransit/typescript-config/base.json",
+  "include": ["*.config.ts"]
+}

examples/with-astro/apps/deploy/wrangler.config.ts

@@ -0,0 +1,8 @@
+import { defineWranglerConfig } from 'wrangler/experimental-config';
+
+export default defineWranglerConfig({
+  types: {
+    generate: false,
+  },
+  assetsDirectory: '../site/dist',
+});

examples/with-astro/apps/site/package.json

@@ -21,10 +21,10 @@
   },
   "devDependencies": {
     "@astrojs/check": "catalog:",
-    "@lasvegasfortransit/eslint-config": "0.6.0",
-    "@lasvegasfortransit/playwright-config": "0.6.0",
-    "@lasvegasfortransit/typescript-config": "0.6.0",
-    "@lasvegasfortransit/vitest-config": "0.6.0",
+    "@lasvegasfortransit/eslint-config": "0.6.1",
+    "@lasvegasfortransit/playwright-config": "0.6.1",
+    "@lasvegasfortransit/typescript-config": "0.6.1",
+    "@lasvegasfortransit/vitest-config": "0.6.1",
     "@playwright/test": "catalog:",
     "@types/node": "catalog:",
     "eslint": "catalog:",

examples/with-astro/docs/development/reference/glossary.md

@@ -51,7 +51,7 @@ request. The required status is named `Validate`.
 deploy this repository, with a fix printed for anything missing.
 
 <a id="platform-manifest"></a>**Platform manifest**: `platform.json`, next to an app's production
-`wrangler.jsonc`, which lists everything the app needs in production: its database, bucket, bot
-check, admin sign-in, email domain, secrets, and the values that must never be set there.
+configuration, which lists everything the app needs in production: its database, bucket, bot check,
+admin sign-in, email domain, secrets, and the values that must never be set there.
 `pnpm preflight --production` checks production against it, and `pnpm bootstrap --production` sets
 up what is missing.

examples/with-astro/docs/development/tutorials/start-here.md

@@ -34,7 +34,7 @@ prints one line per check:
   ok    git hooks      core.hooksPath is .githooks
   ok    commit scopes  .lvbt/commit-scopes.txt is present
   ok    GitHub CLI     gh is installed and signed in
-  ok    Cloudflare     wrangler is signed in; deployables: apps/site
+  ok    Cloudflare cf  ready for: apps/deploy
 preflight: all 7 checks passed
 ```
 
@@ -47,9 +47,9 @@ pnpm check
 ```
 
 This is the same command CI runs: formatting, documentation links, the repository-shape rules, then
-lint, typecheck, and tests for every package. On a fresh clone it passes. When it fails, the output
-names the package and file; `pnpm check:fix` repairs everything a machine can (formatting and
-auto-fixable lint findings).
+lint, typecheck, tests, a site build, and a Cloudflare deploy dry run. On a fresh clone it passes.
+When it fails, the output names the package and file; `pnpm check:fix` repairs formatting and
+auto-fixable lint findings.
 
 ## 3. Make a change and commit it
 

examples/with-astro/package.json

@@ -23,8 +23,8 @@
     "*": "prettier --write --ignore-unknown"
   },
   "devDependencies": {
-    "@lasvegasfortransit/cli": "0.6.0",
-    "@lasvegasfortransit/prettier-config": "0.6.0",
+    "@lasvegasfortransit/cli": "0.6.1",
+    "@lasvegasfortransit/prettier-config": "0.6.1",
     "lint-staged": "catalog:",
     "markdownlint-cli2": "catalog:",
     "markdownlint-rule-relative-links": "catalog:",

examples/with-astro/pnpm-workspace.yaml

@@ -16,7 +16,11 @@ minimumReleaseAge: 1440
 # Temporary transitive pins for published security fixes not yet selected by
 # their direct dependents.
 overrides:
+  brace-expansion: 5.0.12
+  fast-uri: 3.1.8
   sharp: 0.35.4
+  'undici@^7.0.0': 7.29.1
+  'undici@^8.0.0': 8.10.2
   smol-toml: 1.8.0
   svgo: 4.1.0
 

examples/with-vite-react/.claude/settings.json

@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.6.0"
+        "ref": "v0.6.1"
       }
     }
   },

examples/with-vite-react/.gitignore

@@ -7,6 +7,7 @@ blob-report/
 **/playwright/.cache/
 .turbo/
 .wrangler/
+.cloudflare/
 .env
 .env.*
 !.env.example

examples/with-vite-react/README.md

@@ -15,17 +15,17 @@ pnpm check       # the same check CI runs
 pnpm dev         # the site at http://127.0.0.1:4321
 ```
 
-Then rename the root package and the Worker in `apps/site/wrangler.jsonc`, set `site` in
-`apps/site/astro.config.ts`, and replace the scopes in `.lvbt/commit-scopes.txt` with this
-repository's boundaries.
+Then rename the root package and the Worker in `apps/deploy/cloudflare.config.ts`, and replace the
+scopes in `.lvbt/commit-scopes.txt` with this repository's boundaries.
 
 ## Layout
 
-- `apps/site` is the Astro site: pages under `src/pages`, layouts under `src/layouts`, Tailwind in
-  `src/styles/global.css`, unit tests under `tests/`, end-to-end tests under `tests/e2e/`
+- `apps/app` is the Vite app: source under `src/`, unit tests under `tests/`, and end-to-end tests
+  under `tests/e2e/`
+- `apps/deploy` holds the `cf` Worker configuration and reads `apps/app/dist` after the app build
 - `packages/` for libraries the site shares with other apps
 
-`pnpm run deploy` builds and deploys every app with a `cloudflare.config.ts` or Wrangler config;
+`pnpm run deploy` builds the app and deploys the canonical `cf` project in `apps/deploy`;
 `.github/workflows/deploy.yml` does the same on every push to `main`.
 
 Lint, format, TypeScript, and test settings extend the `@lasvegasfortransit/*` packages from

examples/with-vite-react/apps/app/package.json

@@ -17,10 +17,10 @@
     "react-dom": "catalog:"
   },
   "devDependencies": {
-    "@lasvegasfortransit/eslint-config": "0.6.0",
-    "@lasvegasfortransit/playwright-config": "0.6.0",
-    "@lasvegasfortransit/typescript-config": "0.6.0",
-    "@lasvegasfortransit/vitest-config": "0.6.0",
+    "@lasvegasfortransit/eslint-config": "0.6.1",
+    "@lasvegasfortransit/playwright-config": "0.6.1",
+    "@lasvegasfortransit/typescript-config": "0.6.1",
+    "@lasvegasfortransit/vitest-config": "0.6.1",
     "@playwright/test": "catalog:",
     "@tailwindcss/vite": "catalog:",
     "@types/node": "catalog:",

examples/with-vite-react/apps/deploy/cloudflare.config.ts

@@ -0,0 +1,16 @@
+import { defineConfig } from 'cf/config';
+
+// Set CLOUDFLARE_ACCOUNT_ID in the deploy environment before publishing.
+export default defineConfig({
+  worker: {
+    name: 'lvbt-app',
+    compatibilityDate: '2026-08-31',
+    previewUrls: true,
+    assets: {
+      notFoundHandling: 'single-page-application',
+    },
+    observability: {
+      enabled: true,
+    },
+  },
+});

examples/with-vite-react/apps/deploy/eslint.config.js

@@ -0,0 +1,3 @@
+import { config } from '@lasvegasfortransit/eslint-config/base';
+
+export default config;

examples/with-vite-react/apps/deploy/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@lasvegasfortransit/deploy",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "lint": "eslint . --max-warnings 0",
+    "check-types": "tsc --noEmit",
+    "test": "node --test",
+    "validate": "cf deploy --dry-run"
+  },
+  "devDependencies": {
+    "@lasvegasfortransit/eslint-config": "0.6.1",
+    "@lasvegasfortransit/app": "workspace:*",
+    "@lasvegasfortransit/typescript-config": "0.6.1",
+    "cf": "catalog:",
+    "eslint": "catalog:",
+    "typescript": "catalog:",
+    "wrangler": "catalog:"
+  }
+}

examples/with-vite-react/apps/deploy/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "extends": "@lasvegasfortransit/typescript-config/base.json",
+  "include": ["*.config.ts"]
+}

examples/with-vite-react/apps/deploy/wrangler.config.ts

@@ -0,0 +1,8 @@
+import { defineWranglerConfig } from 'wrangler/experimental-config';
+
+export default defineWranglerConfig({
+  types: {
+    generate: false,
+  },
+  assetsDirectory: '../app/dist',
+});