@marvalt/digivalt-core 0.2.33 → 0.2.35

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.35] - 2026-09-23
+
+### Fixed
+- WordPress generation rejects a payload that does not contain the configured front page, restores the previous `wordpress-data.json`, and returns failure so the build exits. A two-page multi-frontend payload that includes the front page still passes. Fixture mode (`VITE_IS_LOVABLE`) skips the check.
+
+**Publish/deploy:** publish **`@marvalt/digivalt-core@0.2.35`**. Then bump consumer apps (including **digivalt-landing**, whose lockfile still pins 0.2.32) and redeploy. No WordPress plugin publish.
+
+## [0.2.34] - 2026-09-22
+
+### Added
+- `digivalt-init` reports the app's dependency lockfile in preflight, warns when `.gitignore` excludes `package-lock.json`, and gives a manual action when no supported lockfile exists.
+- Cloudflare Pages setup and AI scaffold guidance now require committing the package-manager lockfile so deployments install the tested dependency tree.
+- Init smoke coverage for missing and ignored lockfiles.
+
+**Publish/deploy:** publish **`@marvalt/digivalt-core@0.2.34`**. Consumer apps should upgrade and rerun `npx digivalt-init`; no WordPress plugin publish is required.
+
 ## [0.2.33] - 2026-09-19
 
 ### Added

package/README.md

@@ -51,6 +51,7 @@ What init now does:
 - refreshes `scripts/generate.ts` when it matches an older DigiVAlt-managed version
 - warns instead of overwriting custom build logic or custom generator scripts
 - warns when a local `wpRegistry.tsx` / `createAppRegistry` is present; use the published `/registry` helpers when practical
+- reports a missing dependency lockfile or a `package-lock.json` excluded by `.gitignore`; commit the lockfile before Cloudflare Pages deployment
 - reports stale legacy workarounds such as alias-link scripts and old root package generator imports
 
 When to rerun it:

package/bin/init.cjs

@@ -51,6 +51,15 @@ const LEGACY_BUILD_MARKERS = [
   '@marvalt/digivalt-core',
 ];
 
+const LOCKFILE_NAMES = [
+  'package-lock.json',
+  'npm-shrinkwrap.json',
+  'pnpm-lock.yaml',
+  'yarn.lock',
+  'bun.lock',
+  'bun.lockb',
+];
+
 function getArgValue(flag) {
   const index = args.indexOf(flag);
   return index >= 0 ? args[index + 1] : undefined;
@@ -223,6 +232,24 @@ function findLocalRegistryFiles(srcDir) {
   return matches;
 }
 
+function packageLockIsIgnored() {
+  const gitignore = readTextIfExists(path.join(targetDir, '.gitignore'));
+  if (!gitignore) return false;
+
+  let ignored = false;
+  for (const rawLine of gitignore.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#')) continue;
+
+    const negated = line.startsWith('!');
+    const pattern = (negated ? line.slice(1) : line).replace(/^\//, '');
+    if (pattern === 'package-lock.json') {
+      ignored = !negated;
+    }
+  }
+  return ignored;
+}
+
 function inspectTargetApp(targetPackageJsonPath, templateGenerateScript) {
   const packageJson = readJson(targetPackageJsonPath);
   const scripts = packageJson.scripts || {};
@@ -295,6 +322,8 @@ function inspectTargetApp(targetPackageJsonPath, templateGenerateScript) {
     legacyRootImport: Boolean(generateScriptContent && generateScriptContent.includes("import { generators } from '@marvalt/digivalt-core';")),
     legacyViteConfigs,
     localRegistryFiles: findLocalRegistryFiles(path.join(targetDir, 'src')),
+    lockfiles: LOCKFILE_NAMES.filter((name) => fs.existsSync(path.join(targetDir, name))),
+    packageLockIgnored: packageLockIsIgnored(),
   };
 }
 
@@ -305,6 +334,7 @@ function printPreflight(status) {
   console.log(`- scripts.build: ${status.buildState}`);
   console.log(`- scripts.build:dev: ${status.buildDevState}`);
   console.log(`- scripts/generate.ts: ${status.generateState}`);
+  console.log(`- dependency lockfile: ${status.lockfiles.length > 0 ? status.lockfiles.join(', ') : 'missing'}`);
 
   if (status.legacyHackFiles.length > 0 || status.legacyPostinstall || status.legacyRootImport || status.legacyViteConfigs.length > 0) {
     console.log('- legacy DigiVAlt wiring detected: yes');
@@ -477,6 +507,18 @@ function collectLegacyWarnings(status) {
       `Local WordPress registry detected (${status.localRegistryFiles.join(', ')}). Prefer \`@marvalt/digivalt-core/registry\`; existing files were not overwritten.`
     );
   }
+
+  if (status.packageLockIgnored) {
+    report.warnings.push(
+      '`package-lock.json` is ignored by `.gitignore`. Remove that rule and commit the lockfile so Cloudflare Pages installs the tested dependency tree.'
+    );
+  }
+
+  if (status.lockfiles.length === 0) {
+    report.manualActions.push(
+      'Generate and commit a dependency lockfile before deploying (for npm: run `npm install` and commit `package-lock.json`).'
+    );
+  }
 }
 
 function printList(title, items) {
@@ -503,9 +545,10 @@ function printSummary() {
   console.log('2. Copy `.env.local.example` to `.env.local`, fill secrets, and keep `.env.example` as the team-facing public template.');
   console.log('3. Copy `.dev.vars.example` to `.dev.vars` if you need local Wrangler secrets.');
   console.log('4. Confirm `wrangler.toml` matches your Cloudflare Pages project name.');
-  console.log('5. Run `npm run build` to verify static generation now runs before `vite build`.');
-  console.log('6. Run `node scripts/deploy-secrets.js` when you are ready to sync allowed env vars to Cloudflare Pages.');
-  console.log('7. Run `node scripts/deploy-pages.js` (or `npm run deploy:pages`) to build and deploy via Wrangler.');
+  console.log('5. Commit your dependency lockfile so Cloudflare Pages installs the same dependency tree.');
+  console.log('6. Run `npm run build` to verify static generation now runs before `vite build`.');
+  console.log('7. Run `node scripts/deploy-secrets.js` when you are ready to sync allowed env vars to Cloudflare Pages.');
+  console.log('8. Run `node scripts/deploy-pages.js` (or `npm run deploy:pages`) to build and deploy via Wrangler.');
 }
 
 try {

package/dist/generators/wp-guard.d.ts

@@ -0,0 +1,11 @@
+export type WordPressPayloadCheck = {
+    ok: true;
+    warnEmptyChrome: boolean;
+} | {
+    ok: false;
+    expectedSlug?: string;
+    pageCount: number;
+    receivedSlugs: string[];
+};
+/** Reject a WordPress payload that cannot be the app's front page. */
+export declare function checkWordPressPayload(payload: unknown): WordPressPayloadCheck;