Legal release (Privacy, Terms, changelog)¶

Critical process. A legal update must never require hunting four places again.

Use this document for every Privacy Policy, Terms of Service, or public changelog change.

Before you edit anything¶

Read the banner in content/legal/README.md.

Single source of truth (edit only here in last.vet-web):

Asset	Path
Changelog JSON	`content/legal-changelog.json`
Current Privacy Policy	`LASTVET_PRIVACY_POLICY.md`
Current Terms of Service	`LASTVET_TERMS_OF_SERVICE.md`
Prior version archives	`content/legal/privacy-vX.Y.md`, `content/legal/terms-vX.Y.md`

Never edit by hand:

Copy	Why
`last.vet-api/src/content/legal-changelog.json`	Generated by `npm run legal:sync-api`
Live HTML on last.vet / my.last.vet	Deployed from this repo
Privacy notice email body	Rendered from API copy of the same JSON

Release checklist (in order)¶

1. Edit content (this repo only)¶

[ ] Update content/legal-changelog.json (new entry at top per document)
[ ] Update LASTVET_PRIVACY_POLICY.md and/or LASTVET_TERMS_OF_SERVICE.md
[ ] Version and Effective Date headers in markdown must match the new changelog entry
[ ] Archive prior markdown to content/legal/privacy-vX.Y.md / terms-vX.Y.md if superseding
[ ] Archive routes under app/(site)/privacy/archive/ and terms/archive/ if new archive pages are needed

2. Validate and sync locally¶

From last.vet-web:

npm run legal:release

This runs validation and copies legal-changelog.json to ../last.vet-api.

3. Commit and push last.vet-web → `main`¶

[ ] Push triggers last.vet (Cloudflare Git on last-vet-web)
[ ] Push triggers my.last.vet (.github/workflows/deploy-my-last-vet.yml on last-vet-my)
[ ] CI runs npm run legal:validate on legal-touched PRs
[ ] CI runs npm run legal:smoke on both domains after deploy

4. Commit and push last.vet-api (if JSON changed)¶

[ ] Push so privacy notice emails use the same changelog copy
[ ] Redeploy API to ECS: last.vet-api/infra/scripts/deploy-api-image.sh (production/staging as appropriate)

5. Verify live¶

npm run legal:smoke

Or manually:

https://last.vet/legal/changelog
https://my.last.vet/legal/changelog
https://last.vet/privacy and /terms (version header matches)

What deploys where¶

Surface	Cloudflare / runtime	Deploy trigger
https://last.vet	Pages project `last-vet-web`	Cloudflare Git build on push to `main`
https://my.last.vet	Pages project `last-vet-my`	GitHub Actions `deploy-my-last-vet.yml` on push to `main`
Privacy notice email	`last.vet-api` (ECS)	API image deploy after JSON sync

Secrets (Bitwarden + GitHub)¶

Cloudflare deploy credentials are shared with onset-web (same Last 1 Enterprises account).

Secret	Bitwarden SM (`lastvet` project)	GitHub (`Last-1-Enterprises/last.vet-web`)
`CLOUDFLARE_API_TOKEN`	Yes	Yes (Actions)
`CLOUDFLARE_ACCOUNT_ID`	Yes	Yes (Actions)

Refresh GitHub secrets from Bitwarden:

last.vet-web/scripts/sync-github-cloudflare-secrets.sh

Manifest: lastvet-gates/bitwarden/secrets-manifest.json

CI workflows¶

Workflow	When	Purpose
Validate legal content	PR / push touching legal paths	Blocks markdown ↔ changelog drift
Deploy my.last.vet	Every push to `main`	Builds + deploys `last-vet-my`, smoke-tests both domains

npm scripts¶

Command	Purpose
`npm run legal:validate`	Fail if markdown headers ≠ changelog JSON (and API copy if sibling repo present)
`npm run legal:sync-api`	Copy JSON to `last.vet-api`
`npm run legal:smoke`	Live HTTP check on last.vet + my.last.vet
`npm run legal:release`	`validate` + `sync-api`

Every npm run build and npm run build:my runs validation first.

Optional: auto-sync JSON to API via CI¶

Add GitHub secret LAST1_REPO_PAT (write access to last.vet-api) to enable future automation. Until then, npm run legal:release + manual API push is required.

Incident: email went out but website looked stale¶

Usually my.last.vet was not redeployed (separate Pages project). last.vet may already be current. Always run npm run legal:smoke after a legal release.