chore: publish LVBT repository standard v0.4.4

.claude/settings.json

@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.4.1"
+        "ref": "v0.4.4"
       }
     }
   },

.gitignore

@@ -13,3 +13,5 @@ blob-report/
 .dev.vars
 .dev.vars.*
 .DS_Store
+# Agent worktrees are other checkouts of this repository.
+.claude/worktrees/

.lvbt/web-platform.json

@@ -1,9 +1,9 @@
 {
   "formatVersion": 1,
   "preset": "lvbt-web",
-  "release": "v0.4.1",
-  "commit": "0577d597f03f1036d49c497a5424ec643b75c5d1",
-  "contentHash": "15acec6a3332eb5a2817da55147a740549eea1b921c5dbc640658cc6226ea224",
+  "release": "v0.4.4",
+  "commit": "ffa587b3cc0c217bfd407e202aa45ac5390a1586",
+  "contentHash": "64c6ddc7019e327d9f6f9ffe276a694ed0b47fafea249f51ee8fee4c99fe7298",
   "executables": [
     "examples/with-astro/.githooks/commit-msg",
     "examples/with-astro/.githooks/pre-commit",

.lvbt/web-platform/examples/with-astro/.claude/settings.json

@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.4.1"
+        "ref": "v0.4.4"
       }
     }
   },

.lvbt/web-platform/examples/with-astro/.gitignore

@@ -13,4 +13,6 @@ blob-report/
 .dev.vars
 .dev.vars.*
 .DS_Store
+# Agent worktrees are other checkouts of this repository.
+.claude/worktrees/
 .astro/

.lvbt/web-platform/examples/with-astro/.markdownlint-cli2.jsonc

@@ -13,6 +13,7 @@
     // Playwright output.
     "**/test-results",
     "**/playwright-report",
+    // Agent worktrees are other checkouts of this repository.
     ".claude/worktrees",
     "node_modules",
     "**/node_modules",

.lvbt/web-platform/examples/with-astro/apps/site/package.json

@@ -21,10 +21,10 @@
   },
   "devDependencies": {
     "@astrojs/check": "catalog:",
-    "@lasvegasfortransit/eslint-config": "0.4.1",
-    "@lasvegasfortransit/playwright-config": "0.4.1",
-    "@lasvegasfortransit/typescript-config": "0.4.1",
-    "@lasvegasfortransit/vitest-config": "0.4.1",
+    "@lasvegasfortransit/eslint-config": "0.4.4",
+    "@lasvegasfortransit/playwright-config": "0.4.4",
+    "@lasvegasfortransit/typescript-config": "0.4.4",
+    "@lasvegasfortransit/vitest-config": "0.4.4",
     "@playwright/test": "catalog:",
     "@types/node": "catalog:",
     "eslint": "catalog:",

.lvbt/web-platform/examples/with-astro/package.json

@@ -23,8 +23,8 @@
     "*": "prettier --write --ignore-unknown"
   },
   "devDependencies": {
-    "@lasvegasfortransit/cli": "0.4.1",
-    "@lasvegasfortransit/prettier-config": "0.4.1",
+    "@lasvegasfortransit/cli": "0.4.4",
+    "@lasvegasfortransit/prettier-config": "0.4.4",
     "lint-staged": "catalog:",
     "markdownlint-cli2": "catalog:",
     "markdownlint-rule-relative-links": "catalog:",

.lvbt/web-platform/examples/with-vite-react/.claude/settings.json

@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.4.1"
+        "ref": "v0.4.4"
       }
     }
   },

.lvbt/web-platform/examples/with-vite-react/.gitignore

@@ -13,3 +13,5 @@ blob-report/
 .dev.vars
 .dev.vars.*
 .DS_Store
+# Agent worktrees are other checkouts of this repository.
+.claude/worktrees/

.lvbt/web-platform/examples/with-vite-react/.markdownlint-cli2.jsonc

@@ -13,6 +13,7 @@
     // Playwright output.
     "**/test-results",
     "**/playwright-report",
+    // Agent worktrees are other checkouts of this repository.
     ".claude/worktrees",
     "node_modules",
     "**/node_modules",

.lvbt/web-platform/examples/with-vite-react/apps/app/package.json

@@ -17,10 +17,10 @@
     "react-dom": "catalog:"
   },
   "devDependencies": {
-    "@lasvegasfortransit/eslint-config": "0.4.1",
-    "@lasvegasfortransit/playwright-config": "0.4.1",
-    "@lasvegasfortransit/typescript-config": "0.4.1",
-    "@lasvegasfortransit/vitest-config": "0.4.1",
+    "@lasvegasfortransit/eslint-config": "0.4.4",
+    "@lasvegasfortransit/playwright-config": "0.4.4",
+    "@lasvegasfortransit/typescript-config": "0.4.4",
+    "@lasvegasfortransit/vitest-config": "0.4.4",
     "@playwright/test": "catalog:",
     "@tailwindcss/vite": "catalog:",
     "@types/node": "catalog:",

.lvbt/web-platform/examples/with-vite-react/package.json

@@ -23,8 +23,8 @@
     "*": "prettier --write --ignore-unknown"
   },
   "devDependencies": {
-    "@lasvegasfortransit/cli": "0.4.1",
-    "@lasvegasfortransit/prettier-config": "0.4.1",
+    "@lasvegasfortransit/cli": "0.4.4",
+    "@lasvegasfortransit/prettier-config": "0.4.4",
     "lint-staged": "catalog:",
     "markdownlint-cli2": "catalog:",
     "markdownlint-rule-relative-links": "catalog:",

.lvbt/web-platform/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lasvegasfortransit/cli",
-  "version": "0.4.1",
+  "version": "0.4.4",
   "description": "The lvbt command every LVBT repository runs for bootstrap, preflight, and deploy, plus the production platform setup, the shared git hooks, and the lvbt-contributions agent plugin.",
   "license": "MIT",
   "type": "module",

.lvbt/web-platform/packages/cli/platform.schema.json

@@ -76,7 +76,7 @@
     "steps": {
       "type": "array",
       "minItems": 1,
-      "description": "Numbered, click-by-click steps to find or create the value. Write each as one complete sentence.",
+      "description": "Numbered, click-by-click steps to find or create the value. Write each as one complete sentence. Never ask for a second copy before the first is pasted; the last step copies this value for the prompt.",
       "items": { "type": "string", "minLength": 1 }
     },
     "cloudflare": {
@@ -284,6 +284,10 @@
           "type": "boolean",
           "description": "Setup mints a random value instead of asking for one."
         },
+        "sensitive": {
+          "type": "boolean",
+          "description": "false for a value that is not a credential, such as an account ID, a team domain, or an Access audience tag. Setup then asks for it with visible input and shows its value in the report and its output. Defaults to true: the value is typed hidden and never shown."
+        },
         "from": {
           "enum": ["cloudflare.accountId"],
           "description": "Setup copies a value the manifest already knows."

.lvbt/web-platform/packages/cli/plugins/lvbt-contributions/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lvbt-contributions",
-  "version": "0.4.1",
+  "version": "0.4.4",
   "description": "Create readable LVBT GitHub issues and pull requests through the organization workflow.",
   "author": {
     "name": "Las Vegans for Better Transit",

.lvbt/web-platform/packages/cli/plugins/lvbt-contributions/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lvbt-contributions",
-  "version": "0.4.1",
+  "version": "0.4.4",
   "description": "Create readable LVBT GitHub issues and pull requests through the organization workflow.",
   "author": {
     "name": "Las Vegans for Better Transit",

.lvbt/web-platform/packages/cli/src/cli.mjs

@@ -19,7 +19,7 @@ import { check } from './lib/check/index.mjs';
 import { bootstrap, deploy, preflight } from './lib/operate.mjs';
 
 const usage = `Usage:
-  lvbt bootstrap [--production [--filter <app>]]
+  lvbt bootstrap [--production [--filter <app>] [--rotate <SECRET>[,<SECRET>...]]]
   lvbt preflight [--production [--filter <app>]]
   lvbt check [filenames|contract|debt|platform ...] [--staged]
   lvbt deploy [--filter <app>] [--dry-run]
@@ -29,6 +29,8 @@ Options:
                 report whether production has it, without changing anything
   --staged      For check filenames: check the staged tree instead of the working tree
   --filter      For deploy and --production: only the app directory named (apps/site)
+  --rotate      For bootstrap --production: replace the named secrets' stored values
+                on every target. Without it, a value that is already set is kept
   --dry-run     For deploy: build, then run wrangler deploy --dry-run
 `;
 

.lvbt/web-platform/packages/cli/src/lib/arguments.mjs

@@ -6,7 +6,7 @@ export class CliError extends Error {
 }
 
 const flags = new Set(['--dry-run', '--staged', '--production', '--help']);
-const valued = new Set(['--filter']);
+const valued = new Set(['--filter', '--rotate']);
 
 /** `<command> [positional...] [--flag] [--option value]`. Unknown options are an error. */
 export function parseArguments(argv) {

.lvbt/web-platform/packages/cli/src/lib/check/contract.mjs

@@ -1,4 +1,4 @@
-import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 /**
@@ -129,8 +129,16 @@ function packageFailures(root, directory) {
   return failures;
 }
 
-function dependsOnAstro(manifest) {
-  return Boolean(manifest.dependencies?.astro ?? manifest.devDependencies?.astro);
+// Astro loads its configuration from the first of these it finds in the project's root.
+const ASTRO_CONFIGS = ['mjs', 'js', 'ts', 'mts', 'cjs', 'cts'].map((ext) => `astro.config.${ext}`);
+
+/**
+ * An Astro project depends on astro and has its own configuration. A library that only imports
+ * Astro's types, such as an integration or components, has nothing for `astro sync` to generate.
+ */
+function isAstroProject(root, directory, manifest) {
+  if (!manifest.dependencies?.astro && !manifest.devDependencies?.astro) return false;
+  return ASTRO_CONFIGS.some((name) => existsSync(path.join(root, directory, name)));
 }
 
 /**
@@ -144,7 +152,7 @@ function astroFailures(root, directories) {
   let astro = false;
   for (const directory of directories) {
     const manifest = JSON.parse(readFileSync(path.join(root, directory, 'package.json'), 'utf8'));
-    if (!dependsOnAstro(manifest)) continue;
+    if (!isAstroProject(root, directory, manifest)) continue;
     astro = true;
     if (!manifest.scripts?.sync) {
       failures.push(

.lvbt/web-platform/packages/cli/src/lib/operate.mjs

@@ -196,6 +196,11 @@ async function machineFindings(cwd) {
  * read-only readiness report for every platform manifest.
  */
 export async function preflight({ cwd, options = {} }) {
+  if (options.rotate !== undefined)
+    throw new CliError(
+      'preflight never changes anything; use --rotate with pnpm bootstrap --production.',
+      2,
+    );
   const machine = await machineFindings(cwd);
   if (options.production) {
     try {
@@ -214,6 +219,8 @@ export async function preflight({ cwd, options = {} }) {
  * then set up everything the platform manifests declare.
  */
 export async function bootstrap({ cwd, options = {} }) {
+  if (options.rotate !== undefined && !options.production)
+    throw new CliError('--rotate replaces production secrets, so it needs --production.', 2);
   process.stdout.write('pnpm install\n');
   const install = spawnSync('pnpm', ['install'], { cwd, stdio: 'inherit' });
   if (install.status !== 0)