whale-igniter 1.5.4 → 1.6.0

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to Whale Igniter are documented here.
 
+## 1.6.0 - 2026-07-14
+
+### Added
+
+- Added GitHub Actions CI for builds, tests, production dependency audits, security scanning, package validation, and committed `dist/` freshness.
+- Added npm Trusted Publishing through GitHub Actions OIDC, restricted to version tags in the protected `npm` environment and published with provenance.
+- Added migration coverage for Markdown-backed decisions and refinements, including legacy JSON compatibility, duplicate handling, and malformed legacy stores.
+- Added launch metadata to generated landings: description, Open Graph and Twitter cards, canonical/social image support, and a themed inline favicon.
+- Added configurable contact form actions plus native required, email, and minimum-length validation.
+
+### Changed
+
+- Updated the release workflow to Node.js 24 and current GitHub Actions, without long-lived npm publishing tokens or release-build dependency caches.
+- Rebuilt and reconciled committed `dist/` output with `src/`; CI now rejects stale or untracked build artifacts.
+- Removed internal planning documents from the public repository and documented the verified release process.
+
+### Release history note
+
+- An older source commit was titled `Release 1.6.0`, but no `v1.6.0` tag, GitHub Release, or npm version was created from it. Version `1.6.0` in this entry is the first real published release with that number.
+
 ## 1.5.4 - 2026-07-08
 
 ### Security

package/README.md

@@ -4,6 +4,7 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/whale-igniter"><img alt="npm" src="https://img.shields.io/npm/v/whale-igniter?color=%230034D3&labelColor=%23F2ECE1&style=flat-square"></a>
+  <a href="https://github.com/luisviol/whale-igniter/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/luisviol/whale-igniter/ci.yml?branch=main&label=CI&style=flat-square"></a>
   <a href="./LICENSE"><img alt="MIT" src="https://img.shields.io/badge/license-MIT-%230034D3?labelColor=%23F2ECE1&style=flat-square"></a>
   <img alt="node" src="https://img.shields.io/badge/node-%E2%89%A520-%230034D3?labelColor=%23F2ECE1&style=flat-square">
   <img alt="local first" src="https://img.shields.io/badge/local--first-agent%20memory-%230034D3?labelColor=%23F2ECE1&style=flat-square">
@@ -224,6 +225,24 @@ Whale Igniter has no telemetry or analytics.
 
 ---
 
+## Development and releases
+
+Start from a clean checkout and use the locked dependency graph:
+
+```bash
+npm ci
+npm run build
+npm test
+npm audit --omit=dev --audit-level=high
+npm run security:scan
+```
+
+`dist/` is versioned because the CLI and MCP smoke tests execute it directly. Every source change that affects compiled output must include the matching `dist/` change. CI rebuilds the package and fails if `dist/` is modified or if the build creates an untracked distribution file.
+
+npm releases are published only by `.github/workflows/publish.yml`, triggered from a GitHub Release whose tag matches `v<package.json version>`. The GitHub `npm` environment must provide the `NPM_TOKEN` secret. The workflow installs from `package-lock.json`, audits production dependencies, runs `prepublishOnly`, and publishes with npm provenance. Do not run `npm publish` from a development checkout.
+
+---
+
 ## Credits
 
 Brand assets reference JetBrains Mono (SIL Open Font License 1.1) and Special Elite (Apache License 2.0). No font binaries are shipped.

package/dist/commands/createLanding.js

@@ -63,7 +63,7 @@ export async function createLandingCommand(options = {}) {
         await fs.ensureDir(path.dirname(contentAbs));
         await fs.writeJson(contentAbs, content, { spaces: 2 });
     }
-    await fs.writeFile(htmlAbs, renderHtml(content, sections), "utf8");
+    await fs.writeFile(htmlAbs, renderHtml(content, sections, theme), "utf8");
     await fs.writeFile(cssAbs, renderCss(theme, {
         includeProof: sections.includes("proof"),
         includeContact: sections.includes("contact")
@@ -300,7 +300,7 @@ function validateLandingContent(value) {
     if (!isRecord(value))
         return { ok: false, error: "expected a JSON object" };
     const input = value;
-    for (const key of ["brand", "eyebrow", "title", "subtitle"]) {
+    for (const key of ["brand", "eyebrow", "title", "subtitle", "description", "canonicalUrl", "socialImage"]) {
         if (input[key] !== undefined && typeof input[key] !== "string") {
             return { ok: false, error: `${key} must be a string` };
         }
@@ -354,6 +354,7 @@ function defaultLandingContent(title, sections) {
         eyebrow: "Launch-ready landing",
         title: `${title} turns interest into qualified conversations.`,
         subtitle: "A focused page with clear benefits, trust signals and a path that is easy to scan.",
+        description: `${title} helps visitors understand the offer, evaluate proof, and take the next step.`,
         cta: {
             label: "Start a conversation",
             href: ctaTarget
@@ -382,7 +383,8 @@ function defaultLandingContent(title, sections) {
             eyebrow: "Contact",
             title: "Tell us what you want to launch.",
             body: "Share a few details and we will follow up with next steps.",
-            submitLabel: "Send message"
+            submitLabel: "Send message",
+            action: "#"
         }
     };
 }
@@ -392,6 +394,7 @@ function sampleLandingContent() {
         eyebrow: "Nutrition planning",
         title: "Meal planning for athletes who train hard.",
         subtitle: "Build training-aware menus, grocery lists, and coach-ready exports without rebuilding spreadsheets.",
+        description: "Plan athlete meals, grocery lists, and coach-ready exports around each training block.",
         cta: {
             label: "Request early access",
             href: "#contact"
@@ -427,11 +430,12 @@ function sampleLandingContent() {
 function mergeLandingContent(base, next) {
     return {
         ...base,
-        ...definedPick(next, ["brand", "eyebrow", "title", "subtitle"]),
+        ...definedPick(next, ["brand", "eyebrow", "title", "subtitle", "description", "canonicalUrl", "socialImage"]),
+        description: next.description ?? next.subtitle ?? base.description,
         cta: { ...base.cta, ...definedPick(next.cta ?? {}, ["label", "href"]) },
         features: next.features ?? base.features,
         proof: { ...base.proof, ...definedPick(next.proof ?? {}, ["eyebrow", "title", "quote", "byline"]) },
-        contact: { ...base.contact, ...definedPick(next.contact ?? {}, ["eyebrow", "title", "body", "submitLabel"]) }
+        contact: { ...base.contact, ...definedPick(next.contact ?? {}, ["eyebrow", "title", "body", "submitLabel", "action"]) }
     };
 }
 function definedPick(source, keys) {
@@ -442,7 +446,7 @@ function definedPick(source, keys) {
     }
     return out;
 }
-function renderHtml(content, sections) {
+function renderHtml(content, sections, theme) {
     const header = sections.includes("header") ? `${indent(renderSection("header", content, sections), 4)}\n` : "";
     const footer = sections.includes("footer") ? `\n${indent(renderSection("footer", content, sections), 4)}` : "";
     const mainBlocks = sections
@@ -455,6 +459,14 @@ function renderHtml(content, sections) {
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>${escapeHtml(content.brand)}</title>
+    <meta name="description" content="${escapeAttr(content.description)}" />
+    <meta property="og:type" content="website" />
+    <meta property="og:title" content="${escapeAttr(content.title)}" />
+    <meta property="og:description" content="${escapeAttr(content.description)}" />
+    <meta name="twitter:card" content="${content.socialImage ? "summary_large_image" : "summary"}" />
+    <meta name="twitter:title" content="${escapeAttr(content.title)}" />
+    <meta name="twitter:description" content="${escapeAttr(content.description)}" />
+${content.canonicalUrl ? `    <link rel="canonical" href="${escapeAttr(content.canonicalUrl)}" />\n    <meta property="og:url" content="${escapeAttr(content.canonicalUrl)}" />\n` : ""}${content.socialImage ? `    <meta property="og:image" content="${escapeAttr(content.socialImage)}" />\n    <meta name="twitter:image" content="${escapeAttr(content.socialImage)}" />\n` : ""}    <link rel="icon" href="${renderFaviconData(theme)}" type="image/svg+xml" />
     <link rel="stylesheet" href="./styles.css" />
   </head>
   <body>
@@ -527,18 +539,19 @@ ${indent(content.features.map(renderFeature).join("\n"), 6)}
       <h2 id="contact-title">${escapeHtml(content.contact.title)}</h2>
       <p class="lede">${escapeHtml(content.contact.body)}</p>
     </div>
-    <form class="contact-form">
+    <form class="contact-form" action="${escapeAttr(content.contact.action)}" method="post">
+      <p class="form-help" id="contact-form-help">All fields are required.</p>
       <label>
         Name
-        <input name="name" type="text" autocomplete="name" required />
+        <input name="name" type="text" autocomplete="name" placeholder="Ada Lovelace" aria-describedby="contact-form-help" required />
       </label>
       <label>
         Email
-        <input name="email" type="email" autocomplete="email" required />
+        <input name="email" type="email" autocomplete="email" placeholder="ada@example.com" aria-describedby="contact-form-help" required />
       </label>
       <label>
         Message
-        <textarea name="message" rows="4" required></textarea>
+        <textarea name="message" rows="4" minlength="10" placeholder="Tell us what you want to launch." aria-describedby="contact-form-help" required></textarea>
       </label>
       <button class="button" type="submit">${escapeHtml(content.contact.submitLabel)}</button>
     </form>
@@ -583,6 +596,10 @@ function escapeHtml(value) {
 function escapeAttr(value) {
     return escapeHtml(value).replace(/'/g, "&#39;");
 }
+function renderFaviconData(theme) {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="12" fill="${theme.identity.accent}"/><path d="M14 18l9 28 9-18 9 18 9-28" fill="none" stroke="${theme.identity.onAccent}" stroke-width="6" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+    return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
 function printLandingHints(args) {
     console.log();
     console.log(ui.section("Next edits"));
@@ -594,7 +611,7 @@ function printLandingHints(args) {
         `${ui.kv("copy", contentHint, { keyWidth: 8 })}`,
         `${ui.kv("design", "try --theme atlas | harbor | aurora", { keyWidth: 8 })}`,
         `${ui.kv("scope", `trim sections with --sections ${args.sections.join(",")}`, { keyWidth: 8 })}`,
-        `${ui.kv("dev", "wire the form action in src/index.html", { keyWidth: 8 })}`
+        `${ui.kv("launch", "set contact.action, canonicalUrl, and a 1200x630 socialImage", { keyWidth: 8 })}`
     ];
     console.log(ui.indent(lines.join("\n")));
 }
@@ -750,6 +767,10 @@ blockquote {
 }
 
 .eyebrow {
+  display: inline-flex;
+  width: fit-content;
+  max-width: 100%;
+  align-self: flex-start;
   margin: 0 0 calc(var(--space-grid) * 2);
   color: var(--color-accent-strong);
   font-size: 0.875rem;
@@ -982,6 +1003,12 @@ label {
   font-weight: 700;
 }
 
+.form-help {
+  margin: 0;
+  color: var(--color-muted);
+  font-size: 0.875rem;
+}
+
 input,
 textarea {
   width: 100%;

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "1.5.4";
+export const PACKAGE_VERSION = "1.6.0";

package/docs/ROADMAP.md

@@ -184,23 +184,24 @@ These are listed explicitly to defend focus over time.
 
 ---
 
-## Operational milestones (not engineering work)
+## Operational milestones
 
 These are tasks that depend on the project owner, not on the codebase:
 
-- **Publish to npm.** Code is ready. Requires an npm account and
-  `npm publish` from a clean checkout.
-- **Public repo.** Move from local zips to a versioned GitHub repo
-  with releases.
+- **npm releases.** Publishing is performed by the GitHub Release workflow,
+  with a matching `v<version>` tag, the protected `npm` environment, and
+  provenance. Local `npm publish` is not part of the release process.
+- **Public repo.** Keep CI, release tags, changelog, package version, source,
+  and committed `dist/` synchronized.
 - **Demo video.** Record the 5-minute "adopt a real repo and watch
   Claude Code work with full context" walkthrough referenced in the
   done criteria.
 - **Field test.** Adopt the tool in three real projects (own or
   partner teams) and feed observations into v1.1.
 
-Until those happen, v1.0 is "feature-complete and ready to ship" but
-not "released and validated in the wild."
+Release readiness is decided from the CI run attached to the release commit,
+not from a development checkout.
 
 ---
 
-_Last updated: v1.1 release._
+_Last updated: release hardening after v1.5.4._

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whale-igniter",
-  "version": "1.5.4",
+  "version": "1.6.0",
   "description": "CLI-first operational intelligence. Bootstraps and adopts AI-readable project context so agents like Claude Code, Codex and Cursor understand your design system from the first commit. Includes an MCP server, a file watcher, deterministic insights, and an opt-in AI bridge (Selene).",
   "type": "module",
   "main": "./dist/index.js",