@loopress/cli 0.27.0 → 0.28.0

package/dist/lib/app-manifest.d.ts

@@ -7,8 +7,11 @@ export type AppEntry = {
     scripts: string[];
     styles: string[];
 };
+export declare const CROSS_ORIGIN_POLICIES: readonly ["same-origin", "same-site"];
+export type CrossOriginPolicy = (typeof CROSS_ORIGIN_POLICIES)[number];
 export type AppConfigFile = {
     assetsDir?: string;
+    crossOrigin?: CrossOriginPolicy;
     entry?: AppEntry;
     mountSelector?: string;
     name?: string;
@@ -16,6 +19,7 @@ export type AppConfigFile = {
 };
 export type AppManifest = {
     buildId: string;
+    crossOrigin?: CrossOriginPolicy;
     entry: AppEntry;
     files: AppFile[];
     mountSelector: string;

package/dist/lib/app-manifest.js

@@ -2,6 +2,9 @@ import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { extname, join } from 'node:path';
 import { walkFiles } from './readdir-tolerant.js';
+// Cross-Origin-Resource-Policy the server sends with the app's files. Mirrors the server's
+// AppManifest::SUPPORTED_CROSS_ORIGIN; `cross-origin` is the browser default, i.e. the field unset.
+export const CROSS_ORIGIN_POLICIES = ['same-origin', 'same-site'];
 export const APP_CONFIG_FILENAME = 'loopress.app.json';
 const DEFAULT_ASSETS_DIR = 'dist';
 // Static assets a bundler emits, mirrors the server's AppsDirectory::ALLOWED_EXTENSIONS.
@@ -89,6 +92,10 @@ export function parseAppConfig(raw, appDir) {
     if (config.routing !== undefined && config.routing !== 'hash') {
         throw new Error(`${join(appDir, APP_CONFIG_FILENAME)}: routing "${config.routing}" is not supported, only "hash" works without a server rewrite`);
     }
+    if (config.crossOrigin !== undefined && !CROSS_ORIGIN_POLICIES.includes(config.crossOrigin)) {
+        const supported = CROSS_ORIGIN_POLICIES.map((policy) => JSON.stringify(policy)).join(' or ');
+        throw new Error(`${join(appDir, APP_CONFIG_FILENAME)}: crossOrigin "${config.crossOrigin}" is not supported, use ${supported}`);
+    }
     return config;
 }
 // Assembles the full manifest for one app directory: reads loopress.app.json, hashes the
@@ -129,6 +136,7 @@ export async function loadAppManifest(appDir, dirName) {
         distDir,
         manifest: {
             buildId: computeBuildId(files),
+            ...(config.crossOrigin && { crossOrigin: config.crossOrigin }),
             entry,
             files,
             mountSelector: config.mountSelector ?? `#loopress-app-${name}`,

package/dist/lib/base.js

@@ -35,11 +35,11 @@ export class LoopressCommand extends Command {
     }
     get wp() {
         if (!this.wpClient) {
-            const { token, url } = this.siteConfig;
+            const { name, token, url } = this.siteConfig;
             if (!token) {
                 this.error(`No credentials configured for ${url}. Run \`lps project config\` to add them.`);
             }
-            this.wpClient = new WpClient(url, token);
+            this.wpClient = new WpClient(url, token, name);
         }
         return this.wpClient;
     }
@@ -65,12 +65,21 @@ export class LoopressCommand extends Command {
     // `dryRun` is excluded since rotating writes a new credential, a real side effect a
     // --dry-run run promises not to cause. `Rotate` overrides this to a no-op: its own `run()`
     // already rotates unconditionally, so the background check would only redo the same work.
+    // CI is excluded too: rotating revokes the old password, but a runner's config.json (a CI
+    // secret copy) is thrown away at the end of the job, so every later run would get a 401.
     async maybeAutoRotate() {
         if (this.dryRun)
             return;
         const { token } = this.siteConfig;
         if (!token || !isAppPasswordStale(this.siteConfig.addedAt))
             return;
+        // Set by `lps promote --dry-run` around its delegated pull: a preview must not revoke anything.
+        if (process.env.LOOPRESS_NO_AUTO_ROTATE)
+            return;
+        if (process.env.CI) {
+            this.warn(`The app password for "${this.siteConfig.name}" is older than 90 days. Auto-rotation is skipped in CI, run \`lps project rotate\` where this config.json lives, then update the CI secret.`);
+            return;
+        }
         try {
             const rotated = await rotateAppPassword({ ...this.siteConfig, token });
             this.siteConfig = rotated;

package/dist/lib/bootstrap-full-install.js

@@ -14,24 +14,55 @@ export async function bootstrapLoopressFull(wp, siteUrl, log) {
     const zipPath = await downloadLatestFullZip();
     log('Creating a temporary admin account to install it...');
     const admin = await createTempAdmin(wp);
+    // The temp account is a real administrator; it must never outlive this function, including
+    // when the process is interrupted mid-install (Ctrl-C, or a hung/killed headless browser).
+    // removeTempAdmin() memoises a single deletion so the normal path and either signal handler
+    // all await the same in-flight promise instead of racing or deleting twice.
+    let cleanupPromise;
+    const removeTempAdmin = async () => {
+        cleanupPromise ??= deleteTempAdmin(wp, admin);
+        return cleanupPromise;
+    };
+    const onSignal = (signal) => {
+        // Finish (or start) the deletion, surface a manual-removal hint if it fails since the normal
+        // error path below won't run, then re-raise the signal with our handler gone so Node's
+        // default termination runs with the right exit code.
+        removeTempAdmin()
+            .catch((error) => {
+            log(`Could not remove the temporary admin account "${admin.username}"; remove it manually in wp-admin. (${error.message})`);
+        })
+            .finally(() => {
+            process.removeListener('SIGINT', onSignal);
+            process.removeListener('SIGTERM', onSignal);
+            process.kill(process.pid, signal);
+        });
+    };
+    process.once('SIGINT', onSignal);
+    process.once('SIGTERM', onSignal);
     let installError;
-    try {
-        log('Installing and activating Loopress Full...');
-        await runBrowserInstall(admin, siteUrl, zipPath);
-    }
-    catch (error) {
-        installError = error;
-    }
-    if (!installError) {
-        log('Loopress Full installed and activated.');
-    }
-    log('Removing the temporary admin account...');
     let cleanupError;
     try {
-        await deleteTempAdmin(wp, admin);
+        try {
+            log('Installing and activating Loopress Full...');
+            await runBrowserInstall(admin, siteUrl, zipPath);
+            log('Loopress Full installed and activated.');
+        }
+        catch (error) {
+            installError = error;
+        }
+        log('Removing the temporary admin account...');
+        try {
+            await removeTempAdmin();
+        }
+        catch (error) {
+            cleanupError = error;
+        }
     }
-    catch (error) {
-        cleanupError = error;
+    finally {
+        // Only stop guarding once the deletion has settled: a signal during the removal above must
+        // still trigger (or await) cleanup rather than terminating the process with the account live.
+        process.removeListener('SIGINT', onSignal);
+        process.removeListener('SIGTERM', onSignal);
     }
     const manualFallback = `Install it manually: upload ${zipPath} at ${siteUrl}/wp-admin/plugin-install.php?tab=upload`;
     if (installError && cleanupError) {

package/dist/lib/dev-watch.d.ts

@@ -1,5 +1,5 @@
 import { type LoopressLocalConfig } from '../utils/loopress-config.js';
-export type ResourceType = 'api' | 'hooks' | 'pages' | 'plugins' | 'snippets';
+export type ResourceType = 'api' | 'hooks' | 'pages' | 'parts' | 'plugins' | 'snippets' | 'templates';
 export declare const RESOURCE_TYPES: ResourceType[];
 export type WatchTarget = {
     commandId: string;

package/dist/lib/dev-watch.js

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs';
 import { join, sep } from 'node:path';
-export const RESOURCE_TYPES = ['snippets', 'pages', 'api', 'hooks', 'plugins'];
+export const RESOURCE_TYPES = ['snippets', 'templates', 'parts', 'pages', 'api', 'hooks', 'plugins'];
 // `only` narrows the default set, `skip` then removes from whatever that set is, same
 // precedence a combined `--only=a,b --skip=b` reads as: watch a, b, then drop b.
 export function resolveResourceTypes(only, skip = []) {
@@ -18,6 +18,8 @@ export function buildWatchTargets(types, localConfig, cwd) {
         hooks: { commandId: 'hook:push', path: join(rootDir, localConfig.hooksDir ?? 'hooks'), type: 'hooks' },
         pages: { commandId: 'page:push', path: join(rootDir, localConfig.pageDir ?? 'pages'), type: 'pages' },
         plugins: { commandId: 'plugin:push', path: join(cwd, 'loopress.json'), type: 'plugins' },
+        parts: { commandId: 'template:push', path: join(rootDir, localConfig.partDir ?? 'parts'), type: 'parts' },
+        templates: { commandId: 'template:push', path: join(rootDir, localConfig.templateDir ?? 'templates'), type: 'templates' },
         snippets: { commandId: 'snippet:push', path: join(rootDir, localConfig.snippetsDir ?? 'snippets'), type: 'snippets' },
     };
     return types

package/dist/lib/diff-command.d.ts

@@ -41,6 +41,7 @@ export declare abstract class DiffCommand extends LoopressCommand {
     private wpForEnvironment;
 }
 export declare function resourceDiffCommand(resource: string, options: {
+    command?: string;
     description: string;
     pathNoun: string;
 }): typeof DiffCommand;

package/dist/lib/diff-command.js

@@ -143,12 +143,14 @@ export class DiffCommand extends LoopressCommand {
         if (!env.token) {
             this.error(`No credentials configured for "${envName}". Run \`lps project config\` to add them.`);
         }
-        return new WpClient(env.url, env.token);
+        return new WpClient(env.url, env.token, env.name);
     }
 }
 // Builds the `lps <resource> diff` command class for one directory-backed resource. They differ
 // only in wording and which provider they target, so the whole body lives here.
+// `command` is the CLI topic when it isn't the resource key (e.g. `theme style` for theme-styles).
 export function resourceDiffCommand(resource, options) {
+    const command = options.command ?? resource;
     class ResourceDiff extends DiffCommand {
         static args = {
             path: Args.string({ description: `Path to ${options.pathNoun} (overrides project config)` }),
@@ -156,9 +158,9 @@ export function resourceDiffCommand(resource, options) {
         static description = options.description;
         static enableJsonFlag = true;
         static examples = [
-            `$ lps ${resource} diff`,
-            `$ lps ${resource} diff --env staging`,
-            `$ lps ${resource} diff --env staging --against production`,
+            `$ lps ${command} diff`,
+            `$ lps ${command} diff --env staging`,
+            `$ lps ${command} diff --env staging --against production`,
         ];
         static flags = { ...DiffCommand.againstFlag };
         async run() {

package/dist/lib/resource-state.js

@@ -4,9 +4,10 @@ import { ACF_OBJECT_TYPES, acfEndpoint, getAcfKey } from '../utils/acf-format.js
 import { FORM_ENDPOINT, getFormId } from '../utils/form-format.js';
 import { getMenuSlug, MENU_ENDPOINT, MENU_LOCATIONS_ENDPOINT } from '../utils/menu-format.js';
 import { optionEndpoint, parseLocalOption } from '../utils/option-format.js';
-import { formatPageProblems, PAGES_ENDPOINT, readLocalPages } from '../utils/page-format.js';
+import { formatPageProblems, PAGES_ENDPOINT, readLocalHtmlFiles, readLocalPages } from '../utils/page-format.js';
 import { DEFAULT_POST_TYPES, SEO_REDIRECTS_ENDPOINT, SEO_SETTINGS_ENDPOINT, seoPostMetaEndpoint, } from '../utils/seo-format.js';
 import { normalizeSnippet, SNIPPETS_ENDPOINT, stripPhpOpeningTag } from '../utils/snippet-format.js';
+import { CHILD_THEME_ENDPOINT, parsePartFile, parseTemplateFile } from '../utils/template-format.js';
 import { canonicalGlobalStyles, getActiveThemeGlobalStyles, globalStylesEndpoint, THEME_STYLES_FILE_SUFFIX, } from '../utils/theme-styles-format.js';
 import { loadFiles } from './load-files.js';
 import { loadSnippets } from './load-snippets.js';
@@ -217,6 +218,45 @@ const pageProvider = {
     resource: 'page',
     title: 'Pages',
 };
+// ---- Templates and parts ---------------------------------------------------------------
+// Both live in the Loopress child theme (ChildThemeController), one GET answers for both. A
+// template or part edited in the Site Editor gets `siteEditor: 'customized'` on the remote side
+// only, so it always shows as drift: its database copy is what the site renders, not the file.
+async function childThemeState(wp, kind) {
+    const child = await wp.get(CHILD_THEME_ENDPOINT);
+    const files = child[kind];
+    const state = new Map(files.map(({ slug, ...rest }) => [slug, rest]));
+    for (const entry of child.customized) {
+        const [dir, slug] = entry.split('/', 2);
+        if (dir === kind)
+            state.set(slug, { ...state.get(slug), siteEditor: 'customized' });
+    }
+    return state;
+}
+const templateProvider = {
+    dirKind: 'template',
+    async local(dir) {
+        const { files, problems } = await readLocalHtmlFiles(dir, parseTemplateFile);
+        if (problems.length > 0)
+            throw new Error(formatPageProblems(problems));
+        return new Map(files.map(({ slug, ...rest }) => [slug, rest]));
+    },
+    remote: async (wp) => childThemeState(wp, 'templates'),
+    resource: 'template',
+    title: 'Templates',
+};
+const partProvider = {
+    dirKind: 'part',
+    async local(dir) {
+        const { files, problems } = await readLocalHtmlFiles(dir, parsePartFile);
+        if (problems.length > 0)
+            throw new Error(formatPageProblems(problems));
+        return new Map(files.map(({ slug, ...rest }) => [slug, rest]));
+    },
+    remote: async (wp) => childThemeState(wp, 'parts'),
+    resource: 'part',
+    title: 'Template parts',
+};
 // ---- SEO --------------------------------------------------------------------------------
 function canonicalRedirect(redirect) {
     return omit(redirect, REDIRECT_VOLATILE_KEYS);
@@ -426,6 +466,8 @@ export const RESOURCE_STATE_PROVIDERS = [
     acfProvider,
     apiProvider,
     hookProvider,
+    templateProvider,
+    partProvider,
     pageProvider,
     seoProvider,
     menuProvider,

package/dist/lib/rollback-command.d.ts

@@ -16,6 +16,7 @@ export type RollbackResult = {
     status: 'dry-run' | 'listed' | 'no-op' | 'success';
 };
 export declare function resourceRollbackCommand(resource: string, options: {
+    command?: string;
     description: string;
     pathNoun: string;
 }): typeof LoopressCommand;

package/dist/lib/rollback-command.js

@@ -33,7 +33,9 @@ function indentPatch(patch) {
 // anything, this runs the equivalent of `lps <resource> diff` between the environment's current
 // state and the state the original push expected to leave behind, and requires explicit
 // confirmation (the same interactive/`--yes` shape as guardProductionPush) when they differ.
+// `command` is the CLI topic when it isn't the resource key (e.g. `theme style` for theme-styles).
 export function resourceRollbackCommand(resource, options) {
+    const command = options.command ?? resource;
     class ResourceRollback extends LoopressCommand {
         static args = {
             path: Args.string({ description: `Path to ${options.pathNoun} (overrides project config)` }),
@@ -41,10 +43,10 @@ export function resourceRollbackCommand(resource, options) {
         static description = options.description;
         static enableJsonFlag = true;
         static examples = [
-            `$ lps ${resource} rollback`,
-            `$ lps ${resource} rollback --list`,
-            `$ lps ${resource} rollback --to 1732000000000`,
-            `$ lps ${resource} rollback --dry-run`,
+            `$ lps ${command} rollback`,
+            `$ lps ${command} rollback --list`,
+            `$ lps ${command} rollback --to 1732000000000`,
+            `$ lps ${command} rollback --dry-run`,
         ];
         static flags = {
             ...LoopressCommand.dryRunFlag,
@@ -105,7 +107,7 @@ export function resourceRollbackCommand(resource, options) {
             // an item present now but absent from the snapshot stays present after "restoring" it.
             if (restoreDiff.removed.length > 0) {
                 this.warn(`${pluralize(restoreDiff.removed.length, 'item')} present now but not in this snapshot will NOT be removed ` +
-                    `(${restoreDiff.removed.join(', ')}): restoring only creates and updates, the same as \`lps ${resource} push\`. Remove ${restoreDiff.removed.length === 1 ? 'it' : 'them'} by hand if that's part of undoing the original push.`);
+                    `(${restoreDiff.removed.join(', ')}): restoring only creates and updates, the same as \`lps ${command} push\`. Remove ${restoreDiff.removed.length === 1 ? 'it' : 'them'} by hand if that's part of undoing the original push.`);
             }
             if (this.dryRun) {
                 return { drift: driftSummary, id: snapshot.id, restored: summarize(restoreDiff), status: 'dry-run' };
@@ -125,7 +127,7 @@ export function resourceRollbackCommand(resource, options) {
                 // production guard and the drift confirmation above already covered what the delegated
                 // push's own guard would ask again, same reasoning as the top-level `lps push`
                 // delegating to each resource's push command in commands/push.ts.
-                await this.config.runCommand(`${resource}:push`, [tmpDir, '--env', this.siteConfig.name, '--yes']);
+                await this.config.runCommand(`${command.replaceAll(' ', ':')}:push`, [tmpDir, '--env', this.siteConfig.name, '--yes']);
             }
             finally {
                 // A cleanup failure here must never hide a real error from the push above: warn about

package/dist/lib/rotate-app-password.js

@@ -8,14 +8,14 @@ export function isAppPasswordStale(addedAt) {
 // the old one. Reversing this order risks locking the user out if the new one is somehow bad.
 export async function rotateAppPassword(env) {
     const [user] = env.token.split(':', 1);
-    const oldClient = new WpClient(env.url, env.token);
+    const oldClient = new WpClient(env.url, env.token, env.name);
     const old = await oldClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
     const created = await oldClient.post(APPLICATION_PASSWORDS_PATH, { name: 'Loopress' });
     if (!created.password) {
         throw new Error(`WordPress did not return a password when creating the new application password on ${env.url}.`);
     }
     const newToken = `${user}:${created.password}`;
-    const newClient = new WpClient(env.url, newToken);
+    const newClient = new WpClient(env.url, newToken, env.name);
     try {
         await newClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
     }

package/dist/lib/validate-local.js

@@ -4,6 +4,7 @@ import { configManager } from '../config/project-config.manager.js';
 import { parseLocalOption } from '../utils/option-format.js';
 import { readLocalPages } from '../utils/page-format.js';
 import { parseType } from '../utils/snippet-format.js';
+import { readLocalTemplates } from '../utils/template-format.js';
 import { loadSnippets } from './load-snippets.js';
 import { readdirTolerant } from './readdir-tolerant.js';
 // Directories holding one JSON document per resource. Snippets (code file plus JSON sidecar)
@@ -17,8 +18,10 @@ const DEFAULT_DIR = {
     menuDir: 'menus',
     optionsDir: 'options',
     pageDir: 'pages',
+    partDir: 'parts',
     seoDir: 'seo',
     snippetsDir: 'snippets',
+    templateDir: 'templates',
     themeStylesDir: 'theme',
 };
 // Inspects the local tracked files under `cwd` without contacting WordPress: JSON files parse
@@ -49,6 +52,9 @@ export async function validateLocal(cwd) {
     const pages = await readLocalPages(resolve('pageDir'));
     checked += pages.pages.length + pages.problems.length;
     problems.push(...pages.problems);
+    const templates = await readLocalTemplates(resolve('templateDir'), resolve('partDir'));
+    checked += templates.templates.length + templates.parts.length + templates.problems.length;
+    problems.push(...templates.problems);
     return { checked, problems, valid: problems.length === 0 };
 }
 // Recursive: both api/ and hooks/ files can live in a nested path-segment directory

package/dist/lib/wp-client.d.ts

@@ -1,4 +1,7 @@
 export declare const REQUEST_TIMEOUT_MS = 30000;
+export declare const LOCAL_ENVIRONMENT_NAME = "local";
+export declare function isLocalEnvironment(environmentName: string | undefined): boolean;
+export declare function assertSecureSiteUrl(siteUrl: string, environmentName: string | undefined): void;
 /**
  * HTTP client for a WordPress site's REST API.
  * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
@@ -6,7 +9,7 @@ export declare const REQUEST_TIMEOUT_MS = 30000;
 export declare class WpClient {
     private readonly siteUrl;
     private readonly client;
-    constructor(siteUrl: string, token: string);
+    constructor(siteUrl: string, token: string, environmentName?: string);
     delete<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
     get<T>(path: string, options?: RequestOptions): Promise<T>;
     getAll<T>(path: string, options?: RequestOptions & {

package/dist/lib/wp-client.js

@@ -1,6 +1,29 @@
 import got from 'got';
 import { Buffer } from 'node:buffer';
 export const REQUEST_TIMEOUT_MS = 30_000;
+// The one environment allowed to talk plain HTTP: Loopress's local dev environment, identified
+// by its config name (the same "local" environment `lps dev` targets), never by the URL's host.
+// Locality is a property of the configured environment, not of a hostname, so a real remote site
+// can never opt into cleartext just by resolving to a `.local`/loopback-looking name.
+export const LOCAL_ENVIRONMENT_NAME = 'local';
+export function isLocalEnvironment(environmentName) {
+    return environmentName === LOCAL_ENVIRONMENT_NAME;
+}
+// Throws when a URL would send credentials in cleartext: http:// for any environment other than
+// the local one. The trust boundary is here, at the client, so a hand-edited config.json or
+// loopress.json cannot bypass the check the interactive prompt also applies.
+export function assertSecureSiteUrl(siteUrl, environmentName) {
+    let parsed;
+    try {
+        parsed = new URL(siteUrl);
+    }
+    catch {
+        throw new Error(`Invalid site URL: ${siteUrl}`);
+    }
+    if (parsed.protocol === 'http:' && !isLocalEnvironment(environmentName)) {
+        throw new Error(`Refusing to send credentials over plain HTTP for the "${environmentName ?? 'unknown'}" environment: the Application Password would travel in cleartext. Use HTTPS. Plain HTTP is allowed only for the "${LOCAL_ENVIRONMENT_NAME}" environment.`);
+    }
+}
 /**
  * HTTP client for a WordPress site's REST API.
  * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
@@ -8,8 +31,9 @@ export const REQUEST_TIMEOUT_MS = 30_000;
 export class WpClient {
     siteUrl;
     client;
-    constructor(siteUrl, token) {
+    constructor(siteUrl, token, environmentName) {
         this.siteUrl = siteUrl;
+        assertSecureSiteUrl(siteUrl, environmentName);
         this.client = got.extend({
             headers: { Authorization: `Basic ${Buffer.from(token).toString('base64')}` },
             prefixUrl: `${siteUrl}/wp-json`,

package/dist/types/plugin.d.ts

@@ -12,4 +12,11 @@ export type WpNativePlugin = {
     status: 'active' | 'inactive' | 'network-active';
     version: string;
 };
-export type PluginManifest = Record<string, string>;
+export type PluginPin = string | {
+    active?: boolean;
+    version: string;
+};
+export type PluginManifest = Record<string, PluginPin>;
+export declare const pinVersion: (pin: PluginPin) => string;
+export declare const pinActive: (pin: PluginPin) => boolean;
+export declare const pinVersions: (manifest: PluginManifest) => Record<string, string>;

package/dist/types/plugin.js

@@ -1 +1,4 @@
-export {};
+export const pinVersion = (pin) => (typeof pin === 'string' ? pin : pin.version);
+export const pinActive = (pin) => typeof pin === 'string' || pin.active !== false;
+// The version-only view the Composer sync endpoint expects.
+export const pinVersions = (manifest) => Object.fromEntries(Object.entries(manifest).map(([slug, pin]) => [slug, pinVersion(pin)]));

package/dist/types/project-config.generated.d.ts

@@ -39,6 +39,14 @@ export interface LoopressProjectConfiguration {
      * Directory where static HTML pages (one <slug>.html per WordPress page, managed by Loopress) are read from, relative to rootDir.
      */
     pageDir?: string;
+    /**
+     * Directory where block templates (one <slug>.html per template, written to the Loopress child theme of the active block theme) are read from, relative to rootDir. A static page uses one with its `template` header.
+     */
+    templateDir?: string;
+    /**
+     * Directory where block template parts (one <slug>.html per part, written to the Loopress child theme of the active block theme) are read from, relative to rootDir.
+     */
+    partDir?: string;
     /**
      * Directory where explicitly tracked WordPress options (wp_options rows) are read from and written to, relative to rootDir. Only options added via `lps option add` live here, this is never the whole options table.
      */
@@ -56,10 +64,19 @@ export interface LoopressProjectConfiguration {
      */
     projectId?: string;
     /**
-     * WordPress.org plugins managed by Loopress, installed via Composer + WPackagist on the site. Keys are plugin slugs. A value is either an exact version to pin (e.g. "9.4.2") or "latest" to track the newest release on every push. Removing an entry uninstalls the plugin on the next push. Ignored when a composer.json exists in rootDir (that file becomes authoritative).
+     * WordPress.org plugins managed by Loopress, installed via Composer + WPackagist on the site. Keys are plugin slugs. A value is either an exact version to pin (e.g. "9.4.2") or "latest" to track the newest release on every push, and the plugin is kept active. An object with "active": false keeps the plugin installed but inactive. Removing an entry uninstalls the plugin on the next push. Ignored when a composer.json exists in rootDir (that file becomes authoritative).
      */
     plugins?: {
-        [k: string]: string;
+        [k: string]: string | {
+            /**
+             * Exact version to pin, or "latest".
+             */
+            version: string;
+            /**
+             * false keeps the plugin installed but inactive. Defaults to true.
+             */
+            active?: boolean;
+        };
     };
     /**
      * WordPress.org themes managed by Loopress, installed via Composer + WPackagist on the site. Keys are theme slugs; values are an exact version or "latest". Loopress manages installed theme versions only, it never switches the active theme. Ignored when a composer.json exists in rootDir.

package/dist/utils/composer.d.ts

@@ -1,3 +1,5 @@
+import { type SyncIntent } from './plugin-sync.js';
+import { type MergeResult } from './plugins.js';
 export type ComposerJson = {
     config?: {
         'allow-plugins'?: Record<string, boolean>;
@@ -16,3 +18,15 @@ export type ComposerJson = {
 export declare function readComposerJson(): Promise<ComposerJson | null>;
 export declare function readComposerLock(): Promise<null | string>;
 export declare function getComposerManagedSlugs(composerJson: ComposerJson): string[];
+export type ComposerPullResult = MergeResult<string> & {
+    skipped: Array<{
+        reason: string;
+        slug: string;
+    }>;
+};
+export declare function pullIntoComposerJson(path: string, kind: 'plugin' | 'theme', incoming: Record<string, string>, { dryRun, log }: {
+    dryRun: boolean;
+    log: (message: string) => void;
+}): Promise<ComposerPullResult>;
+export declare function toIntent(require: Record<string, string>): SyncIntent;
+export declare function wpackagistRequire(composerJson: ComposerJson, kind: 'plugin' | 'theme'): Record<string, string>;