porchlight v0.5.2

porchlight v0.5.2

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• Videos play only when you can see them. A video in the timeline scrolls off your screen and it pauses on its own — no stray sound, nothing playing you can't find. When it scrolls back into view it starts playing again exactly as you left it: quiet if you had it muted, with sound if you turned the sound on.
• One video at a time, everywhere. Start a video anywhere in the app and any other playing video pauses by itself — you never have to hunt down which one was making noise.
• The sound is always the video you're looking at. If a video has sound, it's the one on your screen — the "where is that sound coming from?" puzzle in the timeline is gone for good.
• Scrolling just works. Browsing photos, paging through a post, or scrolling the feed never interrupts itself with a surprise video — playback follows your eyes, not a timer.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.5.2 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.5.2

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.5.2.

Assets

• porchlight-0.5.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.5.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.5.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.5.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.5.2.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.5.1

porchlight v0.5.1

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• Your porch light is named in your notifications. Replies, mentions, reactions, and new group moments now arrive on your lock screen with your porch's own name as the main line — never an app name — followed by who sent what: reactions carry the emoji exactly as chosen, replies and mentions carry the sentence that mentions you, and photos arrive without a stray half-written file. This is the first cut the hub composes a notification for, so everything a notification says was written by your own porch.
• Videos play at their real shape. Square videos no longer get cropped into a wide frame — every video plays at its true shape, and only very tall phone videos gently fill a tidy portrait box. Open one full-screen and it shows its natural shape from edge to edge.
• Your mute choice stays yours. Unmute a video anywhere — in the feed or full-screen — and it stays unmuted: paging away and back, scrolling the timeline, or switching screens never brings the sound down without you saying so.
• Reactions remember your favorites. A Frequently Used tab now sits in the emoji picker, keeping the emoji you use most, in order of use, shared across all your devices — and the emoji search finds them all again (💯 included).
• Saved moments repair themselves. If a photo fails to load — a slow connection or a momentary blip — the hub quietly tries again moments later and fills the picture in when it arrives. No reload, no error card, no half-finished pictures.
• No phantom errors. A "family server is unreachable" message only appears when every attempt has truly been spent — momentary slowness while opening the app just shows the loading screen, and a warning that flashes and vanishes on its own is gone. When the message is earned, it reads the same every time it appears.
• Your post arrives already lifted. The moment you publish, your own hand-raise is on it from the first view — and taking a vote back clears it everywhere right away, every click answered by the porch.
• The porch light arrives with the page. The dusk boot now shows the porch-light-at-dusk scene: preloads a display-sized still lantern and reuses it across repeat visits without waiting on the app bundle or revalidating the image on every open. The lantern fades in over 300ms when its image loads instead of appearing abruptly; six slow orbiting fireflies glow softly without tails against the quiet navy canvas. Reduced-motion visitors see the still mark immediately after loading.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.5.1 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.5.1

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.5.1.

Assets

• porchlight-0.5.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.5.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.5.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.5.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.5.1.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.5.0

porchlight v0.5.0

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• Release notes render formatted. The console's Updates card and porchlight update show the pending release's notes with real headings, bullets, bold, and links instead of raw markdown symbols. This is the first cut carried by the new renderer, so the screen still running the old release shows the lines below plainly until the update applies; from the next update onward, they render formatted.
• Share opens the compose card. Porchlight is a share target on phones: choose the app's icon in the system share sheet and a shared photo or text opens the composer with it already filled in, so sharing from anywhere else starts the post in the right room without re-picking. On phones, sharing a photo from inside the app hands the original file to the device's share dialog, and the bulk-download end card on every platform rides the real originals zip.
• React with any emoji on comments. Every comment row now carries a smile control beside Reply: pick an emoji to react, tap the chip again to take back just your own, and hover or long-press a chip to see who reacted, by name. Comments that were deleted stay untouched — reactions belong to live conversations.
• Replies answer the comment they answer. Replying to a comment places the reply inside that comment's own tree and opens the composer in context, right beneath the comment — never a stray row at the bottom of the page. Every reply and edit field fills the composer's full width.
• Lift shows its count. The Lift arrow carries the post's up-vote total (silent at zero), and your own vote colors the arrow itself — green for Lift, red for Lower — shown only on hover or on the action you have taken. Lower stays silent, and no other count appears anywhere.
• Group notifications are on by default. New group notification settings start on, and a member who has never touched theirs receives group moments without a visit to settings; every toggle a member has set keeps exactly the value they left.
• Turn on notifications from inside the app. While the installed app is open with notifications off, a small banner offers the one-tap walked flow to enable them; dismissing it keeps it quietly away for two weeks.
• The install nudge waits for real use. On phones, the Android install prompt and the iOS guidance card hold until the app has been used for at least two minutes in the current session, so the ask arrives to members already using the hub — and never again to someone who already installed.
• Freshness notices recover themselves. If a waiting note hangs past the reconnect window, the check-for-updates refetch fires on its own when the connection returns — no stuck card, no manual reload.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.5.0 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.5.0

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.5.0.

Assets

• porchlight-0.5.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.5.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.5.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.5.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.5.0.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.4.1

porchlight v0.4.1

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• PORCH-093/094: posts and comments have a lifecycle. The author can Edit or Delete their own posts and comments from the card and detail ··· menus; the network owner may also delete anything inside the networks they own, and a group's managing member may delete posts in their group (posts only, attributed to them). Edits are silent — no edited marker, badge, or history, and the content re-renders in place on connected devices. The edit composer opens with the post's content exactly as it stands (never a blank form), carries a Cancel button that abandons the edit, and includes the location control: a post can move between the general timeline and a group on its own network, and delivery follows the new target immediately. Deletes cascade — comments, replies, reactions, votes, and notifications go together; photo and video renditions are removed at delete while the originals hold a 30-day restore window the owner console can reverse (restore re-materializes the post or comment with everything it lost); after 30 days a tombstone hard-purges once and restore is refused.
• PORCH-095: the loading experience is quieter and unmistakably Porchlight — a lantern boot screen climbs navy until the hub is ready, and in-app waits carry reserved-space loader marks instead of jumping layouts, with a spinner sweep on the remaining waits.
• PORCH-096: the compose card always names its room — the location control pre-fills from where the member already is (a group's "+ New post" opens the composer pre-set to that group, and nothing is ambiguous about where a moment will land).

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.4.1 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.4.1

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.4.1.

Assets

• porchlight-0.4.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.4.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.4.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.4.1.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.4.1.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.4.0

porchlight v0.4.0

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• The update surfaces now speak for the cut itself (PORCH-077): the console's Updates card and porchlight update show the pending release's notes verbatim — the GitHub release body first, then this changelog line — so these lines render on those surfaces whenever a newer release is pending. Never generated, never summarized.
• PORCH-090/091: reaction chips are live — every rendered chip on every ReactionBar surface (timeline card, post-detail card, conversation column) is a button that answers "who": tap to join, tap again to remove just your own row, tap once more to re-join; the count is PEOPLE (distinct members per emoji, derived at render), and hover/long-press/focus reveals the reactors by name. Served reads carry reactor attribution with origin-containment intact.
• PORCH-088/089: the group's settings consolidate behind the group header's top-right options menu — the managing member writes presentation and moderation (avatar, color, member visibility, post removal), every member sees and manages their subset (per-group notifications, membership privacy), and the members roster plus the public/private row move into menu views.
• PORCH-084/085: the ruled reply order — comment roots render newest-first with each root's replies chronological right behind its threaded root, on the served reads and the card slices alike (one comparator home, so the rendered order never disagrees with the served order), and the reply composer appears on demand.
• PORCH-086: the link-preview embed facade answers the first tap — the whole compact card is the play act, so one tap on it swaps in the provider player (Apple Music, GitHub, and the rest ride the same surface) without the second-tap dance; GitHub links paint their og:image card on first paint; and the timeline crash the preview facade could drag the page into is fixed.
• PORCH-087: the per-network notification row says what it does — ON means "this network's moments reach you as usual," OFF means "quiet: this network's notifications are paused." The persisted mute flag and hub semantics are untouched.
• PORCH-083: bulk original download — one zip of an album's or a post set's original bytes, served flat from the audited original path on both album and post surfaces.
• PORCH-082: the photo viewer pairs its utilities — Get original and Share live in the viewer's top-right overlay (translucent scrim, tap/hover reveal), and the per-image Get original/Share text utility retires on every media surface.
• PORCH-081: the timeline is live — new moments arrive over the hub's socket feed and the polling cadence is gone.
• PORCH-078/080: share and invite — post detail carries the native share dialog with friendly share text (the copy-fallback outcome reports at the touchpoint), the share act re-enters both ··· card menus through one handler, and the install instructions show the app icon as the outcome.
• PORCH-079: the OG image generator — shared post and invite links unfurl with server-composed, cached images built on the porchlight base art.
• Hub reliability: push subscription registration replaces atomically (the endpoint-keyed upsert converges concurrent registrations on one row), push delivery outcomes land in the hub log on every boot, and VAPID subjects heal to the hub's own DNS host — the form Apple's relay accepts — with the vapid.* boot events logged where hubs keep their logs.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.4.0 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.4.0

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.4.0.

Assets

• porchlight-0.4.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.4.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.4.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.4.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.4.0.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.3.0

porchlight v0.3.0

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• Carries PORCH-071: the npm release route publishes the repository, not a hand-assembled staging tarball (Brian's Oct 14 directive: push the repo to npm). The payload is npm's own packing of the repo checkout (npm pack -w packages/cli after the bundling stage pre-stages the runtime closure under the workspace package directory): the registry manifest now carries the repo README and every declared file (the v0.1.1 no-readme listing does not recur), the detached zip-assembly publish route is retired, and the committed package.json version (0.3.0) is authoritative — a loud cut gate fails any run whose tag/version input disagrees with the committed manifests, so tag v-name = package.json version = registry manifest version with no post-registry drift. Route-of-record constraints carried unchanged: OIDC trusted publishing through .github/workflows/npm-publish.yml, zero long-lived NPM_TOKEN, publish before the GitHub release, CHANGELOG gate, the signed SHA256SUMS anchor (registry tarball and release asset are one file), the platform-complete sharp closure and the pruned sub-cap packed size (067 ac-1/ac-3 re-proven on the new tarball).
• PORCH-072: timeline surface trim — the "Family highlights" prominent band, the "Shared moments" heading block (and its supporting line), and the timeline header's create-post, search-moments, and albums buttons are off the surface (the client no longer loads the ranked feed; posting rides compose, search and albums stay on their ruled surfaces); the brand lockup is a single horizontal row, icon left, wordmark right, on every surface.
• PORCH-070: member profile photo from the Profile screen — upload, replace, and clear, with hub-side square crop and compression (no manual crop step; devices never transcode). The face rides the identity, so it renders across every network the member belongs to: timeline and reply headers, the WhoIsHere chooser, owner-console member rows. Renditions are content-addressed squares with long-lived caching and square geometry stamps; replacing retires the prior set whole and clearing reverts to initials, never touching authored content; a PDF or over-5 MB upload refuses in plain language; the member purge cascade retires the set with the account record.
• PORCH-069: timeline cards now keep Lift, Lower, Reply, and React in a compact icon row; Hide and Open conversation live in the header menu. Four latest root comments and their collapsed response counts expand in the feed; mobile posts have a 14px page-background gap instead of a divider.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.3.0 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.3.0

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.3.0.

Assets

• porchlight-0.3.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.3.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.3.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.3.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.3.0.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.2.0

porchlight v0.2.0

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• Carries PORCH-067: the bundled tarball's sharp closure is platform-complete — the platform binaries and their libvips trees for darwin-arm64, darwin-x64, linux-x64 (glibc), linuxmusl-x64, and win32-x64 ride the closure (win32 embeds libvips statically, the others carry the split trees), fetched by exact version at pack time so the tarball never depends on the packer runner's OS. v0.1.1 shipped the packer-runner platform only: non-linux hubs started fine but image media operations failed with a platform error. The first v0.2.0 pack (186.1 MB) failed the npm registry publish cap with 413 Payload Too Large (v0.1.1's known-good registry copy sat at 168.2 MB — the effective PUT ceiling is below 186 MB); the closure is now pruned to the media-necessary set of record: the ten sharp trees (ten of sharp's 26 optional-dep packages; the linux/win32 arches outside the supported set, freebsd, and webcontainers excluded; sharp-wasm32 is sharp's universal fallback, v0.1.1 already carried it) plus zero out-of-support binaries — ffprobe-static's ia32 binary trees (81.2 MB unpacked) pruned from the bundle. Packed tarball: 153.8 MB — 22.6 MB below v0.1.1's 176.4 MB release asset (−14.4 MB vs the 168.2 MB v0.1.1 registry copy) and 32.3 MB below the unpruned first pack; the growth mechanism is only the ten sharp trees, and the ffprobe prune more than pays for them.
• Carries PORCH-064: device notifications opt-in default — absent or freshly created settings rows resolve enabled=false, the send pipeline enforces the master switch first (no send attempt for any event without an explicit enable through the settings route), subscription lifecycle gates on the switch, and no backfill flips members who enabled earlier.
• Carries PORCH-065: address change owner re-auth — a hub moved to a new URL re-binds the owner through the device-link grant: the console's register-the-domain path verifies the new origin before any mutation, re-points every self-reference, and redirects to the self-grant consume route; porchlight reauth link / reauth status carry the machine-local CLI path.
• Carries PORCH-066: the owner console's hub address panel — one field, one submit; the pre-commit verification refuses an unreachable or foreign origin in plain language before any re-point, redirect auto-consumes the self-grant at the new origin, and the arrival lands the owner bound at the new address with no manual grant handling.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.2.0 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.2.0

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.2.0.

Assets

• porchlight-0.2.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.2.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.2.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.2.0.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.2.0.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

porchlight v0.1.1

porchlight v0.1.1

npm is the deploy and install surface: npm install -g porchlight.

Changelog

• First tagged release cut: published to registry.npmjs.org by the npm-publish workflow via OIDC trusted publishing (github.com/bjoshuanoah/porchlight + npm-publish.yml binding under Brian's npm account) — zero long-lived NPM_TOKEN in repository or CI secrets, provenance attestation on the publish.
• Carries PORCH-063: notification opt-in default — off-by-default settings rows and the walked enable flow.
• Carries PORCH-061: fresh owner bootstrap lands usable — every re-credential ceremony adopts the session it mints, and recovery re-credentials past the freshness gate.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.1.1 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.1.1

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.1.1.

Assets

• porchlight-0.1.1.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

[dry-run] porchlight v0.1.1-dryrun.4

porchlight v0.1.1-dryrun.4

⚠️ DRY-RUN: npm publish was skipped (workflow_dispatch mode=dry-run). Artifacts below are the exact release set minus registry publication.

npm is the deploy and install surface: npm install -g porchlight.

Changelog

dry-run: CHANGELOG.md has no '## v0.1.1-dryrun.4' section — a publish cut fails without one.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.1.1-dryrun.4 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.1.1-dryrun.4

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.1.1-dryrun.4.

Assets

• porchlight-0.1.1-dryrun.4.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.1.1-dryrun.4.tgz — MIT, mirrors the npm-published tarball
• porchlight-server-0.1.1-dryrun.4.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.1.1-dryrun.4.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.1.1-dryrun.4.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to npm-publish.yml)

[dry-run] porchlight v0.1.0-dryrun.2

porchlight v0.1.0-dryrun.2

⚠️ DRY-RUN: npm publish was skipped (workflow_dispatch mode=dry-run). Artifacts below are the exact release set minus registry publication.

npm is the deploy and install surface: npm install -g porchlight.

License

MIT — https://github.com/bjoshuanoah/porchlight/blob/main/LICENSE (every published package ships MIT).

Verify

git clone --branch v0.1.0-dryrun.2 https://github.com/bjoshuanoah/porchlight.git && cd porchlight
node scripts/release/verify-release.mjs --tag v0.1.0-dryrun.2

Prerequisites and manual steps: docs/release-verification.md in this repo at v0.1.0-dryrun.2.

Assets

• porchlight-0.1.0-dryrun.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-identity-0.1.0-dryrun.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-shared-0.1.0-dryrun.2.tgz — MIT, mirrors the npm-published tarball
• porchlight-social-0.1.0-dryrun.2.tgz — MIT, mirrors the npm-published tarball
• SHA256SUMS — sha256 of every tarball
• SHA256SUMS.bundle — Sigstore keyless signature of SHA256SUMS (identity pinned to this deploy workflow)