@getvitops/cli 6.0.0 → 8.0.0

package/CHANGELOG.md

@@ -1,5 +1,227 @@
 # @getvitops/cli
 
+## 8.0.0
+
+### Major Changes
+
+- Rebuild the lightbox on one dialog + the existing carousel, fixing the flicker on
+  prev/next and the stutter on open.
+
+  **Breaking (`css`/`bricks` and `tailwind` formats — `.lightbox-dialog`'s markup
+  contract changed):**
+
+  - `<Gallery />` now emits ONE `<dialog class="lightbox-dialog">` per gallery,
+    wrapping a `<Carousel />`, instead of one dialog per image. A `.gallery__trigger`
+    is now a plain `<a href="#slide-id">`, not a `command="show-modal"` button.
+  - `.lightbox-dialog__content` / `__image` / `__nav` / `__nav-button` /
+    `__caption` are gone. The dialog's child is `.lightbox-dialog__track` (a
+    `.carousel`) — prev/next, dots, arrow keys and swipe are the carousel's,
+    reused rather than reimplemented. `.lightbox-dialog__close` is unchanged.
+  - `<wc-gallery>` no longer builds nav buttons or steps between images — the
+    nested `<wc-carousel>` does. It fires `gallery-open` (unchanged shape) and
+    re-emits the carousel's own stepping as `gallery-change`.
+  - `packages/core/src/web-components/utils/gallery.ts` dropped `keyToAction` and
+    `swipeAction` (the carousel's own key/swipe handling covers both now).
+    `stepIndex`/`preloadTargets` are unchanged.
+
+  **Why:** stepping used to close one `<dialog>` and open another, which made
+  `animation.css`'s top-layer driver play a full exit-then-entry transition on
+  every step — visible as a flicker on prev/next, by construction, not a bug to
+  tune away. Opening also awaited the full image's `decode()` before starting the
+  view-transition morph, so the dialog visibly stalled on a slow network. One
+  dialog containing one carousel makes the first failure mode unrepresentable
+  (stepping is a scroll, not a close/open pair) and removes the wait for the
+  second (the morph starts immediately, painting the thumbnail as a CSS
+  background placeholder until the full image arrives).
+
+  **Also improved, not just fixed:** the no-JS fallback is no longer a _stripped_
+  lightbox — it's a genuine one. Each trigger is ordinary fragment navigation
+  (`:has(:target)` in `lightbox.css` reveals the dialog), which needs no Invoker
+  Commands polyfill in any engine, and it now has working prev/next with no
+  JavaScript at all — the previous per-dialog fallback had no way to express that.
+
+  **Migration:** a consumer using `<Gallery />` needs no changes — the component's
+  props are unchanged. Anyone who hand-authored `.lightbox-dialog` markup (per
+  `docs/concepts/patterns.md` / `docs/css/classes.md`) must move to the new single-
+  dialog-wrapping-a-carousel shape; see `patterns.astro`'s "Gallery, hand-authored"
+  demo for the reference markup. `<wc-gallery>` consumers listening for
+  `gallery-change` keep the same event shape (`{ index, total }`).
+
+### Minor Changes
+
+- Add Google Business Profile reviews: fetch, cache, render.
+
+  - **`vitops reviews`** (new CLI command) fetches a client's GBP reviews (legacy v4 API — the only
+    one that has them) and writes them to `.vitops/reviews.json`, meant to be committed so a build
+    never needs a live Google credential. `--dry` prints the plan; `--check` diffs against the cache
+    without writing. Requires the same `VITOPS_GOOGLE_CLIENT_ID`/`_CLIENT_SECRET`/`_REFRESH_TOKEN` (or
+    ADC login) `search setup` uses, scoped to `business.manage` — **and the calling GCP project must
+    be allowlisted by Google first**, a separate one-time approval from every other Google API here.
+  - **`site.reviews`** (config): which `organization.locations` to fetch, and per-location
+    `featured`/`minRating`/`sort`/`limit` selection. `schema` (JSON-LD) and `avatars` both default to
+    **off** — see the migration notes below.
+  - **`@getvitops/utils/reviews`** (new subpath): the pure plan/select/merge functions plus the GBP
+    fetcher and cache reader/writer, mirroring `./indexing`'s pure/IO split.
+  - **`<ReviewCard>`** (new Astro component, `@getvitops/astro`): one review card from a cache entry.
+    No web component — nothing here needs progressive enhancement. Composes the existing
+    `schemas/Review.astro` for JSON-LD only when both `schema` and `itemReviewed` are passed.
+  - **`<Marquee>`** (new Astro component): the tier-3 wrapper `wc-marquee`/`marquee.css` was missing.
+  - **`.review` pattern** (`css`/`bricks` and `tailwind` formats): a new config-generated
+    `patterns.items.review` entry plus `packages/core/css/patterns/review.css` for the structural
+    parts (rating, identity, body, reply, source link). Two new semantic icon names, `star` and
+    `star-half`, across every icon set.
+
+  **Migration:** no breaking change. A site adding `site.reviews` should read the "Google reviews"
+  section in AGENTS.md before enabling `schema` — Google's structured-data policy treats a business
+  marking up reviews of itself as ineligible for review rich results and risks a manual action, which
+  is why it defaults off.
+
+- Repo-wide simplification pass: de-boilerplate the CLI, dedupe shared cache/plan
+  primitives in `@getvitops/utils`, drop dead code, and tighten dependency hygiene.
+
+  No breaking changes. (`vitops icons`'s `--site` flag was briefly going to be renamed to
+  `--input` for consistency with the other `Config`-anchored commands — deferred rather than
+  spending a major bump on a rename with no other breaking change riding along; it stays
+  `--site` for now.)
+
+  **Fixed:**
+
+  - `@getvitops/core`'s 12 runtime deps (`lit`, both `@oddbird` polyfills, both
+    `@webcomponents` packages, `colorjs.io`, etc.) were listed as `dependencies` despite
+    being bundled into `dist/elements.js`/`dist/polyfills.js`/`dist/deferred.js` — a
+    consumer installed them twice for nothing. Moved to `devDependencies`; no change to
+    what ships.
+  - Deleted `old-css-lib/` (59 files), superseded by `packages/core/css/` since the
+    in-memory bundling change — no consumer-facing effect, it was not part of any
+    published output.
+  - Deleted a dead Astro module (`packages/astro/src/scripts/deferred.ts`) that had
+    silently diverged from `packages/core/src/js/deferred.ts` and had zero importers.
+
+  **No consumer-facing change in `@getvitops/vite`** beyond the fixed-group version bump —
+  task-graph and caching fixes internal to this repo's own build.
+
+  Everything else (the `cli.ts` file split into `commands/{search,ads}.ts`, shared
+  `json-store.ts`/`plan-format.ts` helpers in `@getvitops/utils`, a `.github/actions/setup`
+  composite action, restatement-comment cleanup) is internal refactoring with no change to
+  any published API, CLI flag, or generated output.
+
+### Patch Changes
+
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies [a84839b]
+  - @getvitops/generator@8.0.0
+  - @getvitops/utils@8.0.0
+
+## 7.0.0
+
+### Minor Changes
+
+- c0c092b: `vitops search` now works from a `gcloud` login, and attributes API usage per site.
+
+  **Being logged in is enough.** With no `VITOPS_GOOGLE_*` set, an Application Default Credentials
+  login is used — the credential `gcloud auth application-default login` already wrote. It needs the
+  Search Console scopes, which are not in the default ADC set:
+
+  ```
+  gcloud auth application-default login \
+    --scopes=openid,https://www.googleapis.com/auth/siteverification,\
+  https://www.googleapis.com/auth/webmasters,https://www.googleapis.com/auth/cloud-platform
+  ```
+
+  Explicit `VITOPS_GOOGLE_*` vars still win. Ambient credentials are only a fallback, because a stale
+  local login silently overriding a deliberate CI secret is the worst available precedence.
+
+  Beyond convenience, this removes a documented footgun: an OAuth client you create yourself sits in
+  _Testing_ publishing status, where Google **expires the refresh token after 7 days**. The Cloud SDK
+  client is published, so an ADC credential doesn't rot between onboarding runs.
+
+  **New: `site.google.project`** — the Google Cloud project API usage is attributed to, sent as
+  `x-goog-user-project`. One project per site is what keeps each site's usage and billing separate,
+  and it is the same field Maps or anything else will read later, rather than a `quotaProject` here
+  and a `mapsProject` there.
+
+  It is **required for a user credential and wrong for a service account**, which is why it is not
+  sent unconditionally. A user credential authenticates through a shared OAuth client that owns no
+  project, so Google refuses the call outright — measured: `403 "requires a quota project, which is
+not set by default"`. A service account already belongs to a project, and pointing it at a
+  different one would newly require `serviceusage.services.use` there, turning a working CI
+  credential into a 403 for no benefit.
+
+  Using it needs both APIs (`searchconsole.googleapis.com`, `siteverification.googleapis.com`)
+  enabled on that project, and `serviceusage.services.use` for the identity — one grant per site,
+  which suits an agency administering many sites from one admin identity.
+
+  An ADC credential with no `site.google.project` is now **refused before any request is made**,
+  naming the file the credential came from and the project gcloud recorded with it:
+
+  ```
+  ✖ this Google credential comes from ~/.config/gcloud/application_default_credentials.json,
+    which authenticates through a shared OAuth client that owns no project — so it needs
+    "site.google.project" in site.json to say which project the API usage belongs to.
+    gcloud recorded "acme-web" as the quota project for that login, so that is probably the value.
+  ```
+
+  That is the mistake waiting for the _second_ site: the command gets copied from whatever
+  onboarded the first one, the field is left out, and Google's own answer names neither the config
+  field nor the credential.
+
+  **Fixed: an ADC file in `GOOGLE_APPLICATION_CREDENTIALS` no longer hard-exits.** That variable is
+  Google's own convention _and_ where gcloud writes ADC, so the same variable carries two kinds of
+  credential. Parsing an `authorized_user` file as a service account failed with `service account
+JSON is missing client_email or private_key` — while holding a credential the command already knew
+  how to use. It is now discriminated on `type`, the field Google's own libraries switch on.
+
+  **Also fixed — `search setup --dry` and `--check` are not offline.** The docs implied otherwise. The
+  state gather runs before the planner, so both read from Cloudflare and Google and both need
+  credentials. They still create and change nothing; `notify --dry` remains genuinely request-free.
+
+  New in `@getvitops/utils/indexing`: `parseAdcUser`, `adcQuotaProject`, `adcCredentialsPath` (pure,
+  so what is decidable is asserted without a filesystem), plus `googleHeaders` and the `GoogleAuth` /
+  `GoogleAuthLike` types. The seven exported Google request functions now take a token **or** a
+  `{ token, quotaProject }` — a bare string still works everywhere, so nothing needs changing.
+
+### Patch Changes
+
+- **Added — `utils`.** `itemListGraph()`, a pure schema.org `ItemList` JSON-LD builder — a sibling
+  of `breadcrumbGraph()`/`localBusinessGraph()`. Extracted from `@getvitops/astro`'s `<Carousel />`
+  so any consumer can build a valid `ItemList` (Google's "all-in-one page" carousel format:
+  `ListItem.item` carrying `@type`/`name`/`url`) for content that isn't one of the six Google
+  carousel rich-result types (`Article`/`Recipe`/`Movie`/`Course`/`Restaurant`/`Product`) — the
+  entity type is no longer constrained to that set.
+
+  **Changed — `astro`.** `<Carousel />`'s `CarouselItem['type']` now accepts any string, not just
+  the six carousel rich-result types — non-breaking, the union only widens. It's a thin wrapper
+  over `itemListGraph()` now; behaviour for existing callers is unchanged.
+
+  No consumer-facing change in this release outside `utils` and `astro` — `generator`, `cli` and
+  `vite` still ship in this release only because the six share one version.
+
+  **Fixed — `core` (`css`/`bricks`/`tailwind` build output, all formats).** The CSS and HTML
+  authored inside Lit's `css`/`html` tagged templates in `<wc-*>` component sources previously
+  survived JS minification verbatim — a JS minifier treats a template literal's cooked text as
+  opaque, so `elements.js` shipped ~690 lines of indented, unminified CSS (and the equivalent in
+  HTML) inside an otherwise-minified 886-line file. Two source-level build transforms now collapse
+  both before bundling: `postcss` + `postcss-lit` + `cssnano` for `css` templates, `minify-html-literals`
+  (`conservativeCollapse: true`, so whitespace between inline elements in light-DOM components never
+  collapses to zero) for `html` templates. `elements.js` drops from 886 lines / ~101 KB to 49 lines /
+  ~96 KB. A second build step deduplicates the 17 `@license` comment blocks (only 6 are textually
+  distinct) down to one verbatim copy of each — required by BSD-3/MIT/Apache-2.0's notice-retention
+  terms either way, just no longer repeated once per source file that carries it. No API change;
+  build-time only, and none of the added tooling (`postcss`, `postcss-lit`, `cssnano`,
+  `minify-html-literals`) is a runtime or published dependency.
+
+- Updated dependencies [c0c092b]
+- Updated dependencies
+- Updated dependencies [aad43b7]
+- Updated dependencies [2b50f9e]
+- Updated dependencies [a6a8b39]
+- Updated dependencies [7b391b3]
+- Updated dependencies [eb9ac79]
+  - @getvitops/utils@7.0.0
+  - @getvitops/generator@7.0.0
+
 ## 6.0.0
 
 **No consumer-facing change in this package.** The major is the toolchain's shared version, bumped
@@ -550,28 +772,20 @@ carousel vocabulary, because they render live from the generator.
   {
     "designSystem": {
       "themes": {
-        "default": {
-          /* … */
-        },
+        "default": {/* … */},
       },
     },
     "organization": {
       "name": "Acme",
       "contact": "hq",
       "locations": {
-        "hq": {
-          /* … */
-        },
+        "hq": {/* … */},
       },
     },
     "site": {
       "defaultLocale": "en",
-      "domains": {
-        /* … */
-      },
-      "analytics": {
-        /* … */
-      },
+      "domains": {/* … */},
+      "analytics": {/* … */},
     },
   }
   ```
@@ -647,7 +861,7 @@ carousel vocabulary, because they render live from the generator.
   Also new, and worth wiring at the same time — **`gitLastmod()` for real sitemap dates**:
 
   ```js
-  import vitops, { gitLastmod } from '@getvitops/astro';
+  import vitops, { gitLastmod } from "@getvitops/astro";
   vitops({ sitemap: { serialize: await gitLastmod() } });
   ```
 
@@ -741,7 +955,7 @@ ffmpeg`, `apt install ffmpeg`, `winget install Gyan.FFmpeg`). The command fails
 
   ```js
   // astro.config.mjs
-  getvitops({ css: { input: 'company.json', format: 'css' } });
+  getvitops({ css: { input: "company.json", format: "css" } });
   ```
 
   ```
@@ -1228,15 +1442,15 @@ ffmpeg`, `apt install ffmpeg`, `winget install Gyan.FFmpeg`). The command fails
   which `@getvitops/astro` re-exports wholesale. So from `astro.config.mjs`:
 
   ```js
-  import { generateIconInclude } from '@getvitops/astro';
-  import icon from 'astro-icon';
+  import { generateIconInclude } from "@getvitops/astro";
+  import icon from "astro-icon";
 
   integrations: [
     icon({
       include: generateIconInclude({
-        ui: 'fa7-solid',
-        brand: 'simple-icons',
-        semantic: ['menu', 'close', 'search', 'github'],
+        ui: "fa7-solid",
+        brand: "simple-icons",
+        semantic: ["menu", "close", "search", "github"],
       }),
     }),
   ];