@getvitops/generator 6.0.0 → 8.0.0

package/CHANGELOG.md

@@ -1,5 +1,423 @@
 # @getvitops/generator
 
+## 8.0.0
+
+### Major Changes
+
+- Rebuild the lightbox on one dialog + the existing carousel, fixing the flicker on
+  prev/next and the stutter on open.
+
+  **Breaking (`css`/`bricks` and `tailwind` formats — `.lightbox-dialog`'s markup
+  contract changed):**
+
+  - `<Gallery />` now emits ONE `<dialog class="lightbox-dialog">` per gallery,
+    wrapping a `<Carousel />`, instead of one dialog per image. A `.gallery__trigger`
+    is now a plain `<a href="#slide-id">`, not a `command="show-modal"` button.
+  - `.lightbox-dialog__content` / `__image` / `__nav` / `__nav-button` /
+    `__caption` are gone. The dialog's child is `.lightbox-dialog__track` (a
+    `.carousel`) — prev/next, dots, arrow keys and swipe are the carousel's,
+    reused rather than reimplemented. `.lightbox-dialog__close` is unchanged.
+  - `<wc-gallery>` no longer builds nav buttons or steps between images — the
+    nested `<wc-carousel>` does. It fires `gallery-open` (unchanged shape) and
+    re-emits the carousel's own stepping as `gallery-change`.
+  - `packages/core/src/web-components/utils/gallery.ts` dropped `keyToAction` and
+    `swipeAction` (the carousel's own key/swipe handling covers both now).
+    `stepIndex`/`preloadTargets` are unchanged.
+
+  **Why:** stepping used to close one `<dialog>` and open another, which made
+  `animation.css`'s top-layer driver play a full exit-then-entry transition on
+  every step — visible as a flicker on prev/next, by construction, not a bug to
+  tune away. Opening also awaited the full image's `decode()` before starting the
+  view-transition morph, so the dialog visibly stalled on a slow network. One
+  dialog containing one carousel makes the first failure mode unrepresentable
+  (stepping is a scroll, not a close/open pair) and removes the wait for the
+  second (the morph starts immediately, painting the thumbnail as a CSS
+  background placeholder until the full image arrives).
+
+  **Also improved, not just fixed:** the no-JS fallback is no longer a _stripped_
+  lightbox — it's a genuine one. Each trigger is ordinary fragment navigation
+  (`:has(:target)` in `lightbox.css` reveals the dialog), which needs no Invoker
+  Commands polyfill in any engine, and it now has working prev/next with no
+  JavaScript at all — the previous per-dialog fallback had no way to express that.
+
+  **Migration:** a consumer using `<Gallery />` needs no changes — the component's
+  props are unchanged. Anyone who hand-authored `.lightbox-dialog` markup (per
+  `docs/concepts/patterns.md` / `docs/css/classes.md`) must move to the new single-
+  dialog-wrapping-a-carousel shape; see `patterns.astro`'s "Gallery, hand-authored"
+  demo for the reference markup. `<wc-gallery>` consumers listening for
+  `gallery-change` keep the same event shape (`{ index, total }`).
+
+### Minor Changes
+
+- Add Google Business Profile reviews: fetch, cache, render.
+
+  - **`vitops reviews`** (new CLI command) fetches a client's GBP reviews (legacy v4 API — the only
+    one that has them) and writes them to `.vitops/reviews.json`, meant to be committed so a build
+    never needs a live Google credential. `--dry` prints the plan; `--check` diffs against the cache
+    without writing. Requires the same `VITOPS_GOOGLE_CLIENT_ID`/`_CLIENT_SECRET`/`_REFRESH_TOKEN` (or
+    ADC login) `search setup` uses, scoped to `business.manage` — **and the calling GCP project must
+    be allowlisted by Google first**, a separate one-time approval from every other Google API here.
+  - **`site.reviews`** (config): which `organization.locations` to fetch, and per-location
+    `featured`/`minRating`/`sort`/`limit` selection. `schema` (JSON-LD) and `avatars` both default to
+    **off** — see the migration notes below.
+  - **`@getvitops/utils/reviews`** (new subpath): the pure plan/select/merge functions plus the GBP
+    fetcher and cache reader/writer, mirroring `./indexing`'s pure/IO split.
+  - **`<ReviewCard>`** (new Astro component, `@getvitops/astro`): one review card from a cache entry.
+    No web component — nothing here needs progressive enhancement. Composes the existing
+    `schemas/Review.astro` for JSON-LD only when both `schema` and `itemReviewed` are passed.
+  - **`<Marquee>`** (new Astro component): the tier-3 wrapper `wc-marquee`/`marquee.css` was missing.
+  - **`.review` pattern** (`css`/`bricks` and `tailwind` formats): a new config-generated
+    `patterns.items.review` entry plus `packages/core/css/patterns/review.css` for the structural
+    parts (rating, identity, body, reply, source link). Two new semantic icon names, `star` and
+    `star-half`, across every icon set.
+
+  **Migration:** no breaking change. A site adding `site.reviews` should read the "Google reviews"
+  section in AGENTS.md before enabling `schema` — Google's structured-data policy treats a business
+  marking up reviews of itself as ineligible for review rich results and risks a manual action, which
+  is why it defaults off.
+
+- Repo-wide simplification pass: de-boilerplate the CLI, dedupe shared cache/plan
+  primitives in `@getvitops/utils`, drop dead code, and tighten dependency hygiene.
+
+  No breaking changes. (`vitops icons`'s `--site` flag was briefly going to be renamed to
+  `--input` for consistency with the other `Config`-anchored commands — deferred rather than
+  spending a major bump on a rename with no other breaking change riding along; it stays
+  `--site` for now.)
+
+  **Fixed:**
+
+  - `@getvitops/core`'s 12 runtime deps (`lit`, both `@oddbird` polyfills, both
+    `@webcomponents` packages, `colorjs.io`, etc.) were listed as `dependencies` despite
+    being bundled into `dist/elements.js`/`dist/polyfills.js`/`dist/deferred.js` — a
+    consumer installed them twice for nothing. Moved to `devDependencies`; no change to
+    what ships.
+  - Deleted `old-css-lib/` (59 files), superseded by `packages/core/css/` since the
+    in-memory bundling change — no consumer-facing effect, it was not part of any
+    published output.
+  - Deleted a dead Astro module (`packages/astro/src/scripts/deferred.ts`) that had
+    silently diverged from `packages/core/src/js/deferred.ts` and had zero importers.
+
+  **No consumer-facing change in `@getvitops/vite`** beyond the fixed-group version bump —
+  task-graph and caching fixes internal to this repo's own build.
+
+  Everything else (the `cli.ts` file split into `commands/{search,ads}.ts`, shared
+  `json-store.ts`/`plan-format.ts` helpers in `@getvitops/utils`, a `.github/actions/setup`
+  composite action, restatement-comment cleanup) is internal refactoring with no change to
+  any published API, CLI flag, or generated output.
+
+### Patch Changes
+
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies [a84839b]
+  - @getvitops/utils@8.0.0
+
+## 7.0.0
+
+### Major Changes
+
+- aad43b7: A gallery/lightbox that is a fully working modal lightbox with **zero JavaScript**, plus
+  `ImageMetadata` support in `<Carousel />`.
+
+  Only `@getvitops/core`, `generator` and `astro` change here. This changeset makes **no
+  consumer-facing change** to `utils`, `cli` or `vite` — they still ship in this release because
+  the six share one version, but from a different changeset (`localbusiness-schema.md`) that
+  touches `utils` and `generator` for an unrelated reason.
+
+  **Breaking — `css`/`bricks`/`tailwind` (all formats):** the `.lightbox` thumbnail grid is now
+  `.gallery`, so it composes with the dialog it opens (`.lightbox-dialog`, unchanged) rather than
+  sharing its name. `vitops lint --fix` cannot cover this: `movedTokens()` renames colour token
+  names only, and there is no class-rename mechanism in `@getvitops/cli`. Migrate by hand:
+
+  | Old                | New               |
+  | ------------------ | ----------------- |
+  | `.lightbox`        | `.gallery`        |
+  | `.lightbox__item`  | `.gallery__item`  |
+  | `.lightbox__thumb` | `.gallery__thumb` |
+
+  `.lightbox-dialog` and its `__content` / `__image` / `__close` / `__nav` / `__nav-button` /
+  `__caption` parts are unchanged.
+
+  **Added — `css`/`bricks`/`tailwind` (all formats):** `patterns/gallery.css` — the `.gallery` grid,
+  now on the token cascade (`--br-gallery` etc.) it only half-had before.
+
+  **Added — `wc`:** `<wc-gallery>` (`@getvitops/core/elements`). Wraps a `.gallery` grid of
+  `command="show-modal"` triggers and the `.lightbox-dialog`s they open. With no JS, each trigger is
+  a real Invoker Commands button for its own dialog — open and close both work. `<wc-gallery>` adds
+  what the fallback deliberately cannot contain: prev/next, arrow keys, swipe (horizontal to step,
+  vertical to dismiss), an announced image counter, neighbour preload, and a thumbnail → full-image
+  `document.startViewTransition` morph where supported. Prev/next can't exist in the fallback — a
+  second `show-modal` invoker inside an already-open dialog stacks a second modal rather than
+  replacing the first — so it is generated by the element, never authored, the same rule
+  `<wc-tree>`'s search field follows.
+
+  **Added — `astro`:** `<Gallery />` (`@getvitops/astro/components/Gallery.astro`) — emits a
+  `.gallery` grid plus one `.lightbox-dialog` per image and its own `<wc-gallery>`; do not wrap it in
+  one. Images take `string | ImageMetadata`, rendered through a new internal `<ResponsiveImage />`
+  helper: a plain string renders the same raw `<img>` every component here used before, unchanged;
+  an `astro:assets` import renders through `<Picture />` for AVIF/WebP derivatives.
+
+  **Changed — `astro`:** `<Carousel />`'s `CarouselSlide.src` now also accepts `ImageMetadata`,
+  through the same `<ResponsiveImage />` helper, plus a new `formats` prop. Every existing
+  string-`src` call site renders byte-identical markup — purely additive.
+
+  **Added — `wc`:** the Invoker Commands API (`<button command commandfor>`) polyfill
+  (`invokers-polyfill`, feature-detected via `@getvitops/core/polyfills`) — resolves the TODO
+  `polyfills.ts` carried since 4.0. `<wc-gallery>`'s fallback and `<Drawer />` (which already emitted
+  `command="show-modal"` unconditionally) both now get real cross-browser coverage rather than
+  depending on it being "too new to rely on yet." Fetched only in an engine that doesn't support the
+  API natively, so a current browser downloads none of it.
+
+  **Migration:** rename `.lightbox` → `.gallery` and `.lightbox__item`/`.lightbox__thumb` →
+  `.gallery__item`/`.gallery__thumb` wherever authored (see table above); everything else is
+  additive. Consumers using the CSS pattern with no JS need no other change — the fallback markup is
+  unchanged in shape, only the class names moved.
+
+- eb9ac79: `<wc-tree>` gains WAI-ARIA tree semantics and roving-tabindex keyboard navigation, and the
+  keyboard-navigation code behind it lands as shared utilities the next roving-tabindex component
+  (Dropdown, Tabs, Combobox) can reuse.
+
+  **Breaking — `wc` (`@getvitops/core`).** On upgrade, `<wc-tree>` now unwraps every branch's
+  `<details>`/`<summary>` into a plain, JS-owned structure (`role="tree"` on the root,
+  `role="treeitem"` on every item, `role="group"` on every nested list, a roving `tabindex`, and
+  `aria-expanded` mirroring expand state). This is a deliberate, named exception to the framework's
+  normal "parse the fallback and augment it in place" rule — the alternative, an ARIA-attribute
+  overlay left on top of the native `<details>`/`<summary>` structure, was tried first and rejected
+  because `<summary>` stays focusable regardless, which leaves a permanent duplicate `role="button"`
+  node inside every branch. The no-JS fallback is completely unaffected: it is still native nested
+  `<details>`, exactly as `<Tree />` has always rendered it, and `enhance={false}` still gets the
+  bare fragment with no `<wc-tree>` at all.
+
+  Two concrete things break for a consumer that reached into the enhanced DOM directly:
+  - A script holding a reference to the original `<details>`/`<summary>` nodes — including one
+    captured via `getElementById` before upgrade, since the flat markup shape's `<details>` carries
+    the item's `id` — loses that reference once JS runs. `tree-toggle` (mirroring the existing
+    `tree-filter` custom event) is the replacement surface for reacting to expand/collapse.
+  - `<wc-tree>` becomes a single tab stop. Tabbing through every row in a large tree no longer
+    works; arrow keys replace it (Up/Down between visible nodes, Right/Left to open/close a branch or
+    step in/out, Home/End, type-ahead), matching the WAI-ARIA tree pattern. Left/Right flip under
+    `direction: rtl`.
+
+  **Fixed — `wc` (`@getvitops/core`).** `<wc-carousel>`'s dot-nav arrow keys now follow writing
+  direction. In an RTL document, `ArrowLeft` moves the roving tabindex to the visually-left dot and
+  `ArrowRight` to the visually-right one — previously both were index-based and moved the focus ring
+  against the direction the dots are actually drawn in. `ArrowUp`/`ArrowDown` are unchanged and never
+  flip (`direction` is a horizontal-axis property). The prev/next buttons are unchanged too — they
+  still step to the previous/next slide in both directions, and only their glyph flips. Also fixed:
+  two arrow presses faster than the dot nav's smooth scroll can settle now reliably advance two dots
+  instead of sometimes landing on the same one twice.
+
+  **Changed — `css`/`bricks`/`tailwind` (all formats).** `patterns/tree.css` gains a `.tree__summary`
+  row class (the enhanced-state replacement for `<summary>`), a hand-rolled expand/collapse animation
+  replacing the native `<details>` one that no longer applies post-upgrade, and a focus ring scoped to
+  the row rather than the whole item (the roving tabindex now lands on `.tree__item`, whose box wraps
+  its entire subtree once expanded). Visually equivalent to before; no consumer class rename needed.
+
+  **Added — `wc` (`@getvitops/core`, internal).** `web-components/utils/keynav.ts` (generic
+  key-decoding + type-ahead primitives) and `utils/tree-nav.ts` (tree-specific navigation decisions)
+  are new pure modules, and `utils/RovingTabindex.ts` is a new shared `ReactiveController` — modelled
+  on the existing `DragController` — that owns roving-tabindex bookkeeping for any keyboard-navigable
+  group. `<wc-carousel>`'s dot nav now runs on it too, and `<wc-gallery>` reuses `keynav.ts`'s
+  `stepIndex`. None of the three are in `@getvitops/core`'s public `exports` map. Only
+  `RovingTabindex` is re-exported from `web-components/index.ts`, the same way `DragController`
+  already is, not as new published API; `keynav.ts` and `tree-nav.ts` stay internal modules imported
+  directly by path (as `RovingTabindex.ts` and `gallery.ts` already do) since neither is consumed
+  outside the components that already import them directly.
+
+  **This changeset makes no consumer-facing change in `@getvitops/generator` beyond documentation
+  output.** `tiers.ts`'s `tree` entry gains `tree__summary` to its class list and describes the new
+  keyboard navigation and ARIA semantics — this changes what `vitops docs components` /
+  `concepts/components.md` render for the `tree` pattern, nothing else. `generator`'s real change in
+  this release is unrelated to `wc-tree` — see `localbusiness-schema.md`.
+
+### Minor Changes
+
+- c0c092b: `vitops search` now works from a `gcloud` login, and attributes API usage per site.
+
+  **Being logged in is enough.** With no `VITOPS_GOOGLE_*` set, an Application Default Credentials
+  login is used — the credential `gcloud auth application-default login` already wrote. It needs the
+  Search Console scopes, which are not in the default ADC set:
+
+  ```
+  gcloud auth application-default login \
+    --scopes=openid,https://www.googleapis.com/auth/siteverification,\
+  https://www.googleapis.com/auth/webmasters,https://www.googleapis.com/auth/cloud-platform
+  ```
+
+  Explicit `VITOPS_GOOGLE_*` vars still win. Ambient credentials are only a fallback, because a stale
+  local login silently overriding a deliberate CI secret is the worst available precedence.
+
+  Beyond convenience, this removes a documented footgun: an OAuth client you create yourself sits in
+  _Testing_ publishing status, where Google **expires the refresh token after 7 days**. The Cloud SDK
+  client is published, so an ADC credential doesn't rot between onboarding runs.
+
+  **New: `site.google.project`** — the Google Cloud project API usage is attributed to, sent as
+  `x-goog-user-project`. One project per site is what keeps each site's usage and billing separate,
+  and it is the same field Maps or anything else will read later, rather than a `quotaProject` here
+  and a `mapsProject` there.
+
+  It is **required for a user credential and wrong for a service account**, which is why it is not
+  sent unconditionally. A user credential authenticates through a shared OAuth client that owns no
+  project, so Google refuses the call outright — measured: `403 "requires a quota project, which is
+not set by default"`. A service account already belongs to a project, and pointing it at a
+  different one would newly require `serviceusage.services.use` there, turning a working CI
+  credential into a 403 for no benefit.
+
+  Using it needs both APIs (`searchconsole.googleapis.com`, `siteverification.googleapis.com`)
+  enabled on that project, and `serviceusage.services.use` for the identity — one grant per site,
+  which suits an agency administering many sites from one admin identity.
+
+  An ADC credential with no `site.google.project` is now **refused before any request is made**,
+  naming the file the credential came from and the project gcloud recorded with it:
+
+  ```
+  ✖ this Google credential comes from ~/.config/gcloud/application_default_credentials.json,
+    which authenticates through a shared OAuth client that owns no project — so it needs
+    "site.google.project" in site.json to say which project the API usage belongs to.
+    gcloud recorded "acme-web" as the quota project for that login, so that is probably the value.
+  ```
+
+  That is the mistake waiting for the _second_ site: the command gets copied from whatever
+  onboarded the first one, the field is left out, and Google's own answer names neither the config
+  field nor the credential.
+
+  **Fixed: an ADC file in `GOOGLE_APPLICATION_CREDENTIALS` no longer hard-exits.** That variable is
+  Google's own convention _and_ where gcloud writes ADC, so the same variable carries two kinds of
+  credential. Parsing an `authorized_user` file as a service account failed with `service account
+JSON is missing client_email or private_key` — while holding a credential the command already knew
+  how to use. It is now discriminated on `type`, the field Google's own libraries switch on.
+
+  **Also fixed — `search setup --dry` and `--check` are not offline.** The docs implied otherwise. The
+  state gather runs before the planner, so both read from Cloudflare and Google and both need
+  credentials. They still create and change nothing; `notify --dry` remains genuinely request-free.
+
+  New in `@getvitops/utils/indexing`: `parseAdcUser`, `adcQuotaProject`, `adcCredentialsPath` (pure,
+  so what is decidable is asserted without a filesystem), plus `googleHeaders` and the `GoogleAuth` /
+  `GoogleAuthLike` types. The seven exported Google request functions now take a token **or** a
+  `{ token, quotaProject }` — a bare string still works everywhere, so nothing needs changing.
+
+- 2b50f9e: Extract the LocalBusiness JSON-LD builder out of `<LocalBusiness />` into a reusable
+  `localBusinessGraph()`, and add the location fields listing platforms (GBP, Bing Places, Apple
+  Business Connect) actually need.
+
+  **Added — `@getvitops/utils`.** `localBusinessGraph(options)` (+ its `LocalBusinessGraphOptions`,
+  `OpeningHoursSpecification` and `SpecialHoursSpecification` types) is now exported from
+  `@getvitops/utils`, alongside the existing `organizationGraph`/`articleGraph`/`breadcrumbGraph`/
+  `faqGraph` builders — same module, same shape, usable anywhere a JSON-LD graph is built outside an
+  Astro component.
+
+  **Added — `authoring`/`config` (`@getvitops/generator`).** Four new `organization.locations.<slug>`
+  fields: `hoursSpecial` (dated deviations from the recurring `hours` — holiday hours, a one-off
+  closure), `photos` (`ImageRefSchema[]` → JSON-LD `image`), `sameAs` (this location's own listing
+  URLs, distinct from `organization.sameAs`, which is the company overall), and `listings` (external
+  listing ids keyed by platform — `google` | `bing` | `apple` — not consumed by the generator today;
+  recorded so a future listings-sync command has a stable id to match against).
+
+  **Changed — `astro`.** `<LocalBusiness />`'s `Props` type is now `LocalBusinessGraphOptions`
+  (re-exported, not redefined) rather than a local interface that had drifted from what the builder
+  actually accepted. No markup or prop-name change for an existing consumer.
+
+- a6a8b39: `radii.pill` / `--br-pill` is gone. `999px` is a shape, not a design decision, so it no longer
+  has a config-editable token of its own — it's now the `rounded-full` utility, named and valued
+  to match Tailwind's own class, alongside a new `rounded-none`.
+
+  **Breaking — `css`/`bricks` only** (the tailwind format never emitted `--br-pill`; Tailwind
+  already ships `rounded-full`/`rounded-none` natively and always has). A consumer who overrode
+  `--br-pill` directly, or set `radii.pill` in their own `design-system.json` expecting it to
+  reshape the switch track, the facet-list count or the badge-indicator bubble, has to migrate:
+  - The switch track, facet count and badge indicator each already had their own consumer hook
+    (`--br-switch-track`, `--br-count`, `--br-badge-indicator`) and now fall back straight to the
+    literal `999px` instead of chaining through `--br-pill`. Override the specific hook instead of
+    the removed shared one.
+  - `.badge` is unaffected — it already resolved to `999px` and still does, now via its own
+    override (`patterns.items.badge.overrides.br`) rather than a shared primitive.
+  - Anything that wants a fully round corner outside those three patterns should reach for
+    `class="rounded-full"` (or `rounded-none` to zero one out) rather than a `--br-*` variable.
+
+  This is **not** reachable by `vitops lint --fix` — its token-rename table is built from colour
+  role names, and there is no equivalent static table for a shape primitive going away — so this
+  entry is the migration.
+
+  `radii.circle` / `--br-circle` (50%) is untouched: `status`, the radio and the switch thumb all
+  depend on it, and Tailwind has no equivalent to defer to.
+
+- 7b391b3: Add `<wc-counter>` — animates a number from a start value to the value already in its fallback
+  text, on intersection. The stat/percentage figure in a media tile ("0 → 94%"), a KPI row, a
+  metrics band.
+
+  No consumer-facing change in this release outside `core`, `generator` and `astro` — `utils`,
+  `cli` and `vite` still ship in this release only because the six share one version.
+
+  **Added — `css`/`bricks`/`tailwind` (all formats):** `.counter` / `.counter__value` /
+  `.counter__presentation` (`patterns/counter.css`). A registered `--_n` custom property drives the
+  count via a plain CSS `@keyframes` animation — the interpolation and the easing curve are CSS's,
+  never duplicated in JS.
+
+  **Added — `wc` (`@getvitops/core`).** `<wc-counter>` parses the final value out of its own
+  `.counter__value` fallback text — never from a separate attribute, so the no-JS reading and the
+  animated reading can't disagree — and renders it back through `Intl.NumberFormat`, seeded from the
+  fallback text's own separators (a grouped `1,284` never animates through ungrouped intermediates).
+  `counter()` cannot do that part: no decimals, no locale grouping, which is the one thing here that
+  genuinely needs JavaScript.
+  - Triggers on intersection via a single shared `IntersectionObserver`, not on upgrade — a counter
+    below the fold that finished before the visitor scrolled to it would have done nothing.
+  - `prefers-reduced-motion: reduce` means don't animate at all, checked before the observer is even
+    created, with `patterns/counter.css`'s own reduced-motion query as a second belt.
+  - The accessible name stays the final value for the whole animation: `.counter__value` is toggled
+    to the framework's `.sr-only` utility while running, never hidden — `display: none`/`visibility:
+hidden` would pull it out of the accessible-name computation along with the visual hiding, and a
+    screen reader must never be read ~60 intermediate numbers. The animated text lives in a separate
+    `aria-hidden` presentation span it never reaches.
+  - `data-from` (default `0`), `data-duration` (ms, default `1200`), `data-easing` (`linear` |
+    `ease-in` | `ease-out` | `float-sine` | `float-bounce` — maps onto the real
+    `--custom-ease-*`/`--ease-float-*` tokens, so a curve edited in `animation.css` cannot drift out
+    of step with this element), `data-decimals` (inferred from the fallback text when absent).
+  - Never leaves an intermediate value on screen as the resting state: disconnecting mid-animation
+    restores the fallback immediately, and it was never mutated in the first place — only the
+    presentation span was ever written to.
+
+  **Added — `astro`.** `<Counter value="94%" />` emits its own `<wc-counter>` — do NOT wrap it in
+  one, same rule as `Gallery`/`Carousel`/`Tree`. `value` is the only source of the final figure;
+  there is no separate `to` prop, for the same one-source-of-truth reason the element itself parses
+  its fallback rather than taking a duplicate attribute. `enhance={false}` emits the bare fallback
+  for a page that cannot run `elements.js`.
+
+### Patch Changes
+
+- **Added — `utils`.** `itemListGraph()`, a pure schema.org `ItemList` JSON-LD builder — a sibling
+  of `breadcrumbGraph()`/`localBusinessGraph()`. Extracted from `@getvitops/astro`'s `<Carousel />`
+  so any consumer can build a valid `ItemList` (Google's "all-in-one page" carousel format:
+  `ListItem.item` carrying `@type`/`name`/`url`) for content that isn't one of the six Google
+  carousel rich-result types (`Article`/`Recipe`/`Movie`/`Course`/`Restaurant`/`Product`) — the
+  entity type is no longer constrained to that set.
+
+  **Changed — `astro`.** `<Carousel />`'s `CarouselItem['type']` now accepts any string, not just
+  the six carousel rich-result types — non-breaking, the union only widens. It's a thin wrapper
+  over `itemListGraph()` now; behaviour for existing callers is unchanged.
+
+  No consumer-facing change in this release outside `utils` and `astro` — `generator`, `cli` and
+  `vite` still ship in this release only because the six share one version.
+
+  **Fixed — `core` (`css`/`bricks`/`tailwind` build output, all formats).** The CSS and HTML
+  authored inside Lit's `css`/`html` tagged templates in `<wc-*>` component sources previously
+  survived JS minification verbatim — a JS minifier treats a template literal's cooked text as
+  opaque, so `elements.js` shipped ~690 lines of indented, unminified CSS (and the equivalent in
+  HTML) inside an otherwise-minified 886-line file. Two source-level build transforms now collapse
+  both before bundling: `postcss` + `postcss-lit` + `cssnano` for `css` templates, `minify-html-literals`
+  (`conservativeCollapse: true`, so whitespace between inline elements in light-DOM components never
+  collapses to zero) for `html` templates. `elements.js` drops from 886 lines / ~101 KB to 49 lines /
+  ~96 KB. A second build step deduplicates the 17 `@license` comment blocks (only 6 are textually
+  distinct) down to one verbatim copy of each — required by BSD-3/MIT/Apache-2.0's notice-retention
+  terms either way, just no longer repeated once per source file that carries it. No API change;
+  build-time only, and none of the added tooling (`postcss`, `postcss-lit`, `cssnano`,
+  `minify-html-literals`) is a runtime or published dependency.
+
+- Updated dependencies [c0c092b]
+- Updated dependencies
+- Updated dependencies [2b50f9e]
+  - @getvitops/utils@7.0.0
+
 ## 6.0.0
 
 ### Major Changes
@@ -707,28 +1125,20 @@
   {
     "designSystem": {
       "themes": {
-        "default": {
-          /* … */
-        },
+        "default": {/* … */},
       },
     },
     "organization": {
       "name": "Acme",
       "contact": "hq",
       "locations": {
-        "hq": {
-          /* … */
-        },
+        "hq": {/* … */},
       },
     },
     "site": {
       "defaultLocale": "en",
-      "domains": {
-        /* … */
-      },
-      "analytics": {
-        /* … */
-      },
+      "domains": {/* … */},
+      "analytics": {/* … */},
     },
   }
   ```
@@ -893,7 +1303,7 @@ open-fade-in"` composes slide and fade. Applied at zero specificity with identit
   Also new, and worth wiring at the same time — **`gitLastmod()` for real sitemap dates**:
 
   ```js
-  import vitops, { gitLastmod } from '@getvitops/astro';
+  import vitops, { gitLastmod } from "@getvitops/astro";
   vitops({ sitemap: { serialize: await gitLastmod() } });
   ```
 
@@ -1078,8 +1488,8 @@ open-fade-in"` composes slide and fade. Applied at zero specificity with identit
 
   ```js
   vitops({
-    analytics: { googleAnalytics: 'G-XXXXXXXXXX', plausible: 'acme.com' },
-    consent: { policyUrl: '/legal/cookies' },
+    analytics: { googleAnalytics: "G-XXXXXXXXXX", plausible: "acme.com" },
+    consent: { policyUrl: "/legal/cookies" },
   });
   ```
 
@@ -1219,7 +1629,7 @@ inset(0 100% 0 0)`, and `clip-path` clips **hit-testing** as well as painting
 
   ```js
   // astro.config.mjs
-  getvitops({ css: { input: 'company.json', format: 'css' } });
+  getvitops({ css: { input: "company.json", format: "css" } });
   ```
 
   ```
@@ -1270,11 +1680,11 @@ inset(0 100% 0 0)`, and `clip-path` clips **hit-testing** as well as painting
   getvitops({
     fonts: [
       {
-        name: 'League Spartan',
-        provider: 'fontsource',
-        cssVariable: '--font-league-spartan',
-        weights: ['100 900'],
-        subsets: ['latin'],
+        name: "League Spartan",
+        provider: "fontsource",
+        cssVariable: "--font-league-spartan",
+        weights: ["100 900"],
+        subsets: ["latin"],
         preload: true,
       },
     ],
@@ -2145,7 +2555,7 @@ inset(0 100% 0 0)`, and `clip-path` clips **hit-testing** as well as painting
   ```js
   // astro.config.mjs
   getvitops({
-    css: { input: 'design-system.json', format: 'css', out: 'src/styles' },
+    css: { input: "design-system.json", format: "css", out: "src/styles" },
     editor: true,
   });
   ```

package/assets/css/animation.css

@@ -71,6 +71,15 @@
   animation-duration: var(--animation-duration-xslow);
 }
 
+/* The gallery/lightbox thumbnail → full-image morph (see patterns/lightbox.css)
+   needs a shorter duration than a whole-page navigation. Scoped to `*` because a
+   repo-wide `::view-transition-old/new` selector belongs at the engine layer, not
+   inside the one pattern partial that happens to use it first. */
+::view-transition-old(*),
+::view-transition-new(*) {
+  animation-duration: 0.3s;
+}
+
 /* ===========================================
  * Keyframes - Layout Stage (most expensive)
  * =========================================== */

package/assets/css/global.css

@@ -75,3 +75,31 @@ body {
     scroll-padding-block-start: var(--top-offset, 0);
   }
 }
+
+/* The focus ring must survive Windows High Contrast Mode, and as generated it
+   does not. Every pattern's `ring: true` state (`generate.ts`) emits `outline:
+   none; box-shadow: 0 0 0 3px <color>;` — a deliberate choice the rest of the
+   time, since a box-shadow ring can follow a border-radius where a native
+   outline cannot. But `forced-colors: active` forces `box-shadow` to `none`
+   unconditionally (CSS Color Adjust Module), and this framework already asked
+   for no native outline either — so a keyboard user in forced-colors mode gets
+   NO focus indicator at all, on every `:focus-visible` element in every
+   format. This is the single most severe instance of the class of bug
+   `forced-colors`/`prefers-contrast` coverage exists to catch (AGENTS.md's
+   design-system-gaps notes on `--surface-glass`/`--overlay`/role solids are
+   the same class, decorative rather than safety-critical).
+
+   `!important`, deliberately, for the same reason `:root`'s `font-size` above
+   gets it: this must win regardless of which pattern's `vitops.components`
+   rule set `outline: none`, and `!important` outranks a normal-priority
+   declaration regardless of cascade layer. The colour is the token every
+   other ring already uses (`--color-border-focus`, from `ui-primary`,
+   contrast-checked as a non-text boundary) — forced-colors mode remaps
+   `outline-color` to a system colour automatically, so this is really only
+   asserting THAT an outline renders, not which colour it renders in. */
+@media (forced-colors: active) {
+  :focus-visible {
+    outline: 2px solid var(--color-border-focus) !important;
+    outline-offset: 2px !important;
+  }
+}

package/assets/css/index.css

@@ -6,6 +6,7 @@
 @import './generated/type-tokens.css';
 @import './generated/tokens.css';
 @import './generated/typography.css';
+@import './generated/typography-headings.css';
 @import './layout.css';
 /* Must precede utilities.css: both are `vitops.utilities`, and utilities.css
    re-emits `.<bp>-flex` AFTER its own `.hidden` so `class="hidden md-flex"`
@@ -43,6 +44,7 @@
    panel surface navshell's desktop block has to undo. */
 @import './patterns/navshell.css';
 @import './patterns/notification.css';
+@import './patterns/gallery.css';
 @import './patterns/lightbox.css';
 @import './patterns/overlay.css';
 /* was forms.css */
@@ -52,6 +54,7 @@
 @import './patterns/table.css';
 @import './patterns/details.css';
 @import './patterns/comment.css';
+@import './patterns/review.css';
 @import './patterns/banner.css';
 @import './patterns/consent.css';
 @import './patterns/list.css';
@@ -69,6 +72,7 @@
 @import './patterns/text-effects.css';
 @import './patterns/svg.css';
 @import './patterns/marquee.css';
+@import './patterns/counter.css';
 @import './patterns/nav.css';
 @import './patterns/carousel.css';
 @import './patterns/copy.css';

package/assets/css/patterns/counter.css

@@ -0,0 +1,50 @@
+/**
+ * Counter — animates a number from a start value to the value already in its
+ * fallback text (`.counter__value`), e.g. the "0 → 94%" stat in a media tile.
+ * Consumes the generated token cascade (src/css/generated/tokens.css) only for
+ * `--custom-ease-out` (animation.css's engine layer).
+ *
+ * `<wc-counter>` owns the reading; this partial owns the interpolation. `--_n`
+ * is a registered custom property so the browser can smoothly animate it as a
+ * number — `counter()` cannot do decimals or locale grouping, so JS mirrors
+ * `--_n` into `.counter__presentation`'s text each frame via
+ * `Intl.NumberFormat`, formatted the same way the fallback text was. CSS still
+ * owns the interpolation, the easing curve and (as a second belt alongside the
+ * JS check) `prefers-reduced-motion`.
+ *
+ * `.counter__value` is toggled to the framework's `.sr-only` utility while
+ * running, not hidden — an element pulled out of the accessibility tree via
+ * `display: none`/`visibility: hidden` stops contributing to the accessible
+ * name, and that name must read the final value for the whole animation, not
+ * just at rest.
+ */
+@property --_n {
+  syntax: '<number>';
+  initial-value: 0;
+  inherits: false;
+}
+
+.counter__presentation {
+  display: none;
+}
+
+wc-counter[running] .counter__presentation {
+  display: inline;
+  animation: counter-run var(--counter-duration, 1.2s) var(--counter-easing, var(--custom-ease-out))
+    forwards;
+}
+
+@keyframes counter-run {
+  from {
+    --_n: var(--counter-from, 0);
+  }
+  to {
+    --_n: var(--counter-to);
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  wc-counter[running] .counter__presentation {
+    animation: none;
+  }
+}

package/assets/css/patterns/forms.css

@@ -287,7 +287,7 @@ input[type='color'] {
     position: relative;
     inline-size: var(--_switch-width);
     block-size: var(--_switch-height);
-    border-radius: var(--br-switch-track, var(--br-pill, 999px));
+    border-radius: var(--br-switch-track, 999px);
     background: var(--color-bg-surface-muted);
     transition: background-color 0.2s ease;
   }