Prepare npm release and public playground

[natanelia]

What changed

• harden npm packaging, provenance, and rerunnable release automation
• add a GitHub Pages build/deploy workflow for the City Ops playground
• rewrite release-facing README content and synchronize compatibility metadata
• add security and contribution policies for the public repository

Why

ArrowBase v0.1.0 needs a minimal, verified npm artifact and a public playground that demonstrates parity before performance claims.

Validation

• pnpm check (74 files, 713 tests before docs hardening)
• release/docs contracts (74 files, 714 tests after hardening)
• pnpm playground:check
• pnpm playground:build:pages
• pnpm playground:e2e (desktop + mobile)
• pnpm build && pnpm verify:package-exports
• npm pack --dry-run --json (28 files, 849 KB)
• clean temporary consumer install and root ESM import
• production dependency audit: no known vulnerabilities
• tracked tree and Git history credential-pattern scan: no matches

Summary by CodeRabbit

• New Features

  • Added automated deployment of the hosted Playground to GitHub Pages.
  • Added a Pages-specific Playground build configuration.
  • Added npm package provenance support and package export verification.

• Documentation

  • Added contributor and security policies.
  • Updated installation, development, release, compatibility, and hosted Playground guidance.

• Release Improvements

  • Improved npm publishing with trusted publishing and provenance.
  • Updated compatibility reporting to 294/294 exports.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64aaa9e0-af31-4075-b26e-42ac549eda9f

📥 Commits

Reviewing files that changed from the base of the PR and between 8ec3d41 and 51bb6ff.

📒 Files selected for processing (14)

• .github/workflows/pages.yml
• .github/workflows/release.yml
• CHANGELOG.md
• CONTRIBUTING.md
• README.md
• RELEASE_NOTES.md
• SECURITY.md
• apps/showcase/package.json
• docs/RELEASING.md
• docs/showcase.md
• package.json
• scripts/verify-release.mjs
• tests/release-readiness.test.ts
• tests/showcase-docs.test.ts

---

📝 Walkthrough

Walkthrough

The changes add a GitHub Pages workflow for the showcase, update npm publishing for trusted provenance, tighten release metadata and validation, and add contributor, security, README, release, and hosted-playground documentation.

Changes

Hosted playground deployment

Layer / File(s)	Summary
Pages build and artifact flow apps/showcase/package.json, package.json, .github/workflows/pages.yml, tests/showcase-docs.test.ts	Adds a Pages-specific showcase build, wires the root build command, runs playground checks, uploads apps/showcase/dist, and validates the workflow markers.
Pages trigger and deployment .github/workflows/pages.yml, docs/showcase.md, scripts/verify-release.mjs	Adds push/manual triggers, permissions, concurrency, GitHub Pages deployment, hosted-playground limitations, and release verification markers.

npm release workflow

Layer / File(s)	Summary
Package metadata and release validation package.json, scripts/verify-release.mjs, tests/release-readiness.test.ts, tests/showcase-docs.test.ts	Updates the package homepage, published files, provenance metadata, required release files, compatibility expectations, and package/workflow assertions.
Trusted npm publishing .github/workflows/release.yml	Adds the npm environment, updates action versions and caching, verifies package exports, reuses existing releases, and publishes with npm provenance.
Release process and compatibility records docs/RELEASING.md, CHANGELOG.md, RELEASE_NOTES.md	Documents bootstrap and trusted publishing procedures and updates the recorded compatibility target and export count.

Project documentation and policies

Layer / File(s)	Summary
Contributor and security guidance CONTRIBUTING.md, SECURITY.md	Adds development, pull-request, licensing, supported-version, and vulnerability-reporting guidance.
README and runtime guidance README.md	Refreshes project descriptions, requirements, installation, development commands, playground usage, and performance guidance.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/npm-release-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}