Rounds 9+10 — rc.2 packaging + consumer smoke CI + demo perf + self-hosted fonts

.github/workflows/consumer-smoke.yml

@@ -0,0 +1,43 @@
+name: Consumer smoke (packed artefacts)
+
+# Audit №5 root-cause closure : the rc.0/rc.1 npm publish shipped
+# stale dist/ files importing the pre-rename @pulse/* scope. Every CI
+# suite was green because everything ran on workspace SOURCES — no job
+# ever installed a tarball the way a real user does. This workflow
+# packs each buildable package (plus the root Vue lib), installs the
+# tarballs into throwaway consumer projects, vite-builds an entry that
+# imports the public surface, and asserts no stale-scope strings in
+# the output bundles. If this is red, DO NOT PUBLISH.
+
+on:
+  push:
+    branches: [main, 'feat/**']
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: consumer-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  smoke:
+    name: Pack → install → build (4 consumers)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --no-audit --prefer-offline
+
+      - name: Build workspace packages
+        run: npm run build:packages
+
+      - name: Consumer smoke
+        run: npm run test:consumer

NOTICE.md

@@ -78,6 +78,21 @@ Attribution is also displayed in the demo footer ("Music: Kevin MacLeod — inco
 
 If the incompetech download fails at deploy time, the pipeline falls back to the in-repo composed tracks (`scripts/synth-demo-tracks.mjs` — original works of this repository, MIT). Maintainer overrides via the `PULSE_TRACK1_URL` / `PULSE_TRACK2_URL` repository variables must keep this section + the footer credit accurate for whatever they point at.
 
+### 3ter. Demo typefaces — self-hosted Geist (round-10, 2026-06-11)
+
+The demo page (NOT the library) ships two variable typefaces under
+`public/fonts/`, self-hosted since round 10 (previously loaded from the
+Google Fonts CDN — removed for GDPR + first-paint performance):
+
+- **Geist** (`Geist-Variable.woff2`) and **Geist Mono**
+  (`GeistMono-Variable.woff2`) — © The Geist Project Authors
+  (Vercel), licensed under the **SIL Open Font License 1.1**.
+  Full licence text shipped alongside at `public/fonts/OFL.txt`.
+  Source: <https://github.com/vercel/geist-font>.
+
+The OFL permits bundling, redistribution and self-hosting provided the
+licence accompanies the fonts — it does here.
+
 ## 4. Trademarks and brand names
 
 pulse-player references the following brand names purely for descriptive

index.html

@@ -13,15 +13,38 @@
     />
     <link rel="canonical" href="https://yamadablog.github.io/pulse-player/" />
 
-    <!-- Display typefaces — Geist Sans + Geist Mono. Variable fonts,
-         single TTF subset each. Breaks the system-stack-only sloppiness
-         flagged in Anthropic's frontend-design skill anti-rules. -->
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <!-- Display typefaces — Geist Sans + Geist Mono, SELF-HOSTED
+         (round 10, audit №6 P2). Previously loaded from the Google
+         Fonts CDN : a third-party request on the first-text-paint path
+         + a GDPR exposure (visitor IP shipped to Google). The official
+         Vercel variable WOFF2 files (SIL OFL 1.1 — licence shipped at
+         fonts/OFL.txt) now serve from the same origin : one connection,
+         no DNS/TLS round-trip to fonts.gstatic.com, no tracking.
+         font-display: swap preserved — text paints in the fallback
+         stack immediately. -->
     <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700;800&family=Geist+Mono:wght@400;500;600&display=swap"
+      rel="preload"
+      href="%BASE_URL%fonts/Geist-Variable.woff2"
+      as="font"
+      type="font/woff2"
+      crossorigin
     />
+    <style>
+      @font-face {
+        font-family: 'Geist';
+        src: url('%BASE_URL%fonts/Geist-Variable.woff2') format('woff2');
+        font-weight: 100 900;
+        font-style: normal;
+        font-display: swap;
+      }
+      @font-face {
+        font-family: 'Geist Mono';
+        src: url('%BASE_URL%fonts/GeistMono-Variable.woff2') format('woff2');
+        font-weight: 100 900;
+        font-style: normal;
+        font-display: swap;
+      }
+    </style>
 
     <!-- Open Graph (Bluesky / LinkedIn / Discord / Facebook) -->
     <meta property="og:type" content="website" />
@@ -66,7 +89,7 @@
         "applicationCategory": "DeveloperApplication",
         "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD" },
         "license": "https://opensource.org/licenses/MIT",
-        "softwareVersion": "3.0.0-rc.0",
+        "softwareVersion": "3.0.0-rc.2",
         "downloadUrl": "https://www.npmjs.com/package/@pulse-music/react",
         "video": "https://youtu.be/q_FJ1GWaCc8",
         "url": "https://yamadablog.github.io/pulse-player/"

package.json

@@ -89,7 +89,8 @@
     "check:lib-identical": "node scripts/check-lib-byte-identical.mjs",
     "ci": "npm run type-check && npm run lint && npm run test && npm run test:packages && npm run build && npm run audit && npm run check:lib-identical",
     "prepublishOnly": "npm run ci && npm run build:lib",
-    "prepare": "husky 2>/dev/null || true"
+    "prepare": "husky 2>/dev/null || true",
+    "test:consumer": "node scripts/consumer-smoke.mjs"
   },
   "peerDependencies": {
     "pinia": "^2.1.0",

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-music/core",
-  "version": "3.0.0-rc.0",
+  "version": "3.0.0-rc.2",
   "description": "Framework-agnostic audio engine for pulse-player — Web Audio + state machine + typed event bus. Pure TypeScript, no DOM, no framework imports.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,8 @@
   "scripts": {
     "build": "tsup",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@pulse-music/types": "*"

packages/react/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-music/react",
-  "version": "3.0.0-rc.0",
+  "version": "3.0.0-rc.2",
   "description": "React 18 / 19 wrapper for pulse-player — hooks + JSX components built on @pulse-music/web-component.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,8 @@
   "scripts": {
     "build": "tsup",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",

packages/svelte/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-music/svelte",
-  "version": "3.0.0-rc.0",
+  "version": "3.0.0-rc.2",
   "description": "Svelte 5 wrapper for pulse-player. Plain TypeScript hook + Svelte classic-store contract over @pulse-music/web-component.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,8 @@
   "scripts": {
     "build": "tsup",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
   },
   "peerDependencies": {
     "svelte": "^5.56.3"

packages/tokens/package.json

@@ -29,7 +29,8 @@
   "scripts": {
     "build": "tsup",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
   },
   "publishConfig": {
     "access": "public"

packages/types/package.json

@@ -20,7 +20,8 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsup"
+    "build": "tsup",
+    "prepublishOnly": "npm run build"
   },
   "publishConfig": {
     "access": "public"

packages/web-component/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-music/web-component",
-  "version": "3.0.0-rc.1",
+  "version": "3.0.0-rc.2",
   "description": "Universal Web Component renderer for pulse-player — Lit-based `<pulse-player>` and `<pulse-fab>`. Works in React, Vue, Angular, Svelte, Solid, vanilla JS, or plain HTML.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,8 @@
   "scripts": {
     "build": "tsup",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@pulse-music/core": "*",

packages/web-component/src/PulseFab.ts

@@ -22,11 +22,11 @@ import { baseStyles, fabStyles } from './styles'
  * Events: same as `<pulse-player>` (events bubble + compose, so a
  * single parent listener covers both elements).
  *
- * Status: v3.0.0-alpha.2 SKELETON. Renders the disc + play/pause +
- * variant. Drag-to-reposition, radial menu, pulso heartbeat
- * keyframes land in subsequent alphas. The Lit controller pattern is
- * in place — adding drag is additive logic, not architectural
- * refactor.
+ * Status: v3.0.0-rc — feature-complete (round-10 docstring refresh;
+ * the "SKELETON" note dated from alpha.2 and was stale). Renders the
+ * disc + play/pause + variant, with drag-to-reposition (`draggable`,
+ * persisted to localStorage), the radial menu (`show-menu`) and the
+ * pulso heartbeat ring all implemented below.
  */
 @customElement('pulse-fab')
 export class PulseFabElement extends LitElement {

packages/web-component/src/PulsePlayer.ts

@@ -31,12 +31,13 @@ import { GITHUB_SVG, STREAM_SVG } from './icons'
  *   - `accent-color`   : CSS color (default unset — inherits theme)
  *   - `tracks`         : JSON array of Track objects (optional override)
  *
- * Status: v3.0.0-alpha.2 SKELETON. Renders the minimum chrome
- * (artwork, title, play/pause, progress, time). Full v2.3.4 parity
- * (ambient EQ, drag-to-resize, three responsive states, social icons,
- * `prev` / `next` controls) lands in subsequent alphas. The Lit
- * controller pattern is already in place — adding more chrome is
- * additive markup, not architectural refactor.
+ * Status: v3.0.0-rc — feature-complete chrome (round-10 docstring
+ * refresh; the "SKELETON" note below dated from alpha.2 and was stale).
+ * Renders artwork, title, play/pause, `prev`/`next`, progress, time,
+ * drag-to-resize handle, three responsive width states, and optional
+ * GitHub/Spotify social icons. Remaining gap vs the Vue v2.3.4
+ * reference: the 64-bar ambient EQ backdrop (the 4-bar condensed
+ * visualiser is wired via the engine's `eqBars`).
  */
 @customElement('pulse-player')
 export class PulsePlayerElement extends LitElement {

public/fonts/OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2024 The Geist Project Authors (https://github.com/vercel/geist-font)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.