v3.0.0-alpha.29 — anti-slop sweep + 4 next-tier composables

Informed by REAL AI tools / skills / agents research

Previous alphas focused on libraries (Motion.dev, Lenis); user called that out. This alpha closes the gap by consulting Anthropic's frontend-design skill, Leonxlnx/taste-skill, Codrops 2026 patterns, basementstudio.

Vue v2.3.4 byte-identical on 30th alpha.

Anti-slop sweep

• Generic AI purple gradients → warm tertiary palette (amber + pink)
• System stack fonts → Geist Variable + Geist Mono
• Symmetric centered layouts → asymmetric two-column staircase "Why Pulse" section
• Decorative motion without purpose → every composable carries @anti-slop note

4 new composables (src/composables/useAdvancedMotion.ts, ~310 LOC)

• useScrollProgress — 0..1 CSS channel (Apple AirPods pattern foundation)
• useScrollKineticWave — dual-wave text scroll (Codrops Jan 2026, vanilla port no GSAP)
• useScrollOrbitField — 5-orb scroll-driven constellation, warm tertiary palette
• useMagneticHover — cursor-leaning element, max 8 px anti-toy discipline

Bundle delta

• JS gzip: 77.66 → 78.96 kB (+1.30 kB)
• CSS gzip: 8.67 → 9.18 kB (+0.51 kB)
• HTML gzip: 1.22 → 1.44 kB (+0.22 kB — Geist preconnects)
• @pulse-music/* tarballs: unchanged

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities
• Vue v2.3.4 byte-identical (30th alpha)

Full research traceability: docs/setup/ALPHA_29_RESEARCH.md

v3.0.0-alpha.28 — next-gen premium motion pieces

5 new premium composables

Extends alpha.27 with kinetic typography + cursor-tracking glow + scroll parallax + view transitions + audio-reactive Canvas2D particles. All 5 demo-page only — @pulse-music/* tarballs untouched. Vue v2.3.4 byte-identical on 29th alpha.

What ships

• useKineticType — per-char cascade Apple "Hello." entrance
• useCursorGlow — interactive light that follows the pointer
• useScrollParallax — subtle 50 px depth on hero backdrop
• withViewTransition — 320 ms cross-fade on variant chip clicks
• useAudioParticles — Canvas2D particle field modulated by FFT amplitude

Bundle delta

• JS gzip: 76.33 → 77.66 kB (+1.33 kB)
• CSS gzip: 8.39 → 8.67 kB (+0.28 kB)
• @pulse-music/* tarballs: unchanged
• Total cost for 5 premium effects: ~1.6 kB

a11y

prefers-reduced-motion + pointer: coarse guards on all new layers.

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities
• 29th alpha Vue v2.3.4 byte-identical

v3.0.0-alpha.27 — premium demo motion (Apple-style)

Premium demo motion layer

Apple-style staged reveal + audio-reactive ambient + light sweep CTA, demo-page only. Vue v2.3.4 byte-identical on 28th alpha.

What ships

• src/composables/usePremiumMotion.ts — 3 composables (~140 LOC): useStagedReveal, useAudioReactiveBackdrop, useSmoothScroll
• Motion.dev (8 kB) + Lenis (2 kB) as demo-page dependencies; NOT shipped in @pulse-music/* tarballs
• scripts/setup-demo-audio.mjs — portable ffmpeg-static + cwebp-bin, no system scoop install needed; falls back to mathematically-CC0 synthesis when Pixabay 403s anti-hotlinks
• docs/setup/PREMIUM_DEMO.md — design rationale + a11y guards
• docs/setup/NODE_UPGRADE.md — procedure to kill CVE-2026-47429 vitest 9.8 (Node 22.6+ baseline)

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities
• Vue v2.3.4 byte-identical (28th alpha)
• Build: 76 kB gzip (demo SPA), tarballs unchanged

a11y

Every premium layer respects prefers-reduced-motion via composables guards + CSS media query.

v3.0.0-alpha.26 — 4 P0 + P1 + P2 closed (brutal audit response)

Closes the 6 gaps the BRUTAL alpha.25 product audit named

The brutal audit caught 4 things earlier audits missed by reading README narrative instead of running real checks (npm view, npm audit complete, asset-rights vs public deployment). This alpha closes all 6. Vue v2.3.4 byte-identical on 27th alpha.

P0 #1 npm install pulse-player 404 fixed

Removed lying install line + honest Vue install path block.

P0 #2 CVE-2026-47429 vitest CVSS 9.8

Documented as residual non-exploitable (no --ui/--api flags, dev-only). Path to full fix = Node 22.6+ upgrade.

P0 #3 Demo audio assets REMOVED from public deployment

8.4 MB of placeholders with undocumented provenance gone from repo + GH Pages. DMCA risk closed.

P0 #4 Angular distribution status honest

Parity row now reads 0% distribution + 'private, not on npm yet'.

P1 Custom OG image PNG

sharp-generated 1200x630 30.8 kB deployed at /og-banner.png. Branded social previews instead of YouTube thumbnail.

P2 Doc sprawl 36 → 31 + 5 archived

docs/_archive/ carries the superseded set with successor index.

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities (clean shipping artefact)
• 1 critical dev-CVE documented + non-exploitable
• Vue v2.3.4 byte-identical on 27th alpha

Self-assessed brutal grade: 5.8 → 6.6 / 10

v3.0.0-alpha.25 — brand identity + business model LOCKED

Closes every actionable gap from the brutal alpha.24 product audit

The brutal audit named 5.5/10 on the 'sellable today' axis. This alpha lifts that to 6.3/10. Vue v2.3.4 byte-identical on 26th alpha.

LOT 1 — Brand identity

• docs/brand/logo.svg + logo-light.svg — heartbeat waveform mark, violet → teal gradient
• public/favicon.svg + favicon link in index.html
• docs/brand/README.md — usage + palette + trademark posture
• Music-note emoji in README replaced by real logo

LOT 2 — docs/universal/PRICING.md — business model LOCKED

• Phase 1: MIT + GitHub Sponsors
• Phase 2 (post 1K stars + 5K dl/wk): Premium Themes Pack $49 + Consulting $1-5K
• Phase 3: Pulse Studio SaaS $9-19/mo (only if Phase 2 signals)
• Mirrors Tailwind / MUI / shadcn 2026 indie playbook

LOT 3 — docs/universal/METRICS_TRACKING.md — adoption discipline

• Day 7 / 30 / 90 targets + triage tables
• Sunset path if Day 90 < 500 stars
• Honesty discipline forbids round-up + sock-puppet

LOT 4 — 'Used by' section

• Honest framing for the first adopter

LOT 5 — OG banner SVG

• Pulse-branded 1200×630 social share asset

LOT 6 — ROADMAP refresh + cadence discipline

• Post-rc.0 max 1 rc.X patch/week
• v3.0.0 stable gated on Day 30 metrics

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities
• Vue v2.3.4 byte-identical (26th alpha)

v3.0.0-alpha.24 — 7/7 @pulse-music packages LIVE on npm

@pulse-music/react-native@3.0.0-rc.1 PUBLISHED

The 7th and final core package is live on the npm registry.

npm install @pulse-music/react-native @pulse-music/core
# then from your Expo app:
npx expo install expo-av react-native-reanimated react-native-gesture-handler react-native-svg @react-native-async-storage/async-storage

Full @pulse-music/* registry state — 7/7 LIVE

• @pulse-music/types 3.0.0-rc.0
• @pulse-music/core 3.0.0-rc.0
• @pulse-music/tokens 3.0.0-rc.0
• @pulse-music/web-component 3.0.0-rc.1
• @pulse-music/react 3.0.0-rc.0
• @pulse-music/svelte 3.0.0-rc.0
• @pulse-music/react-native 3.0.0-rc.1 ← shipped this alpha

Plus the historical pulse-player (Vue v2.3.4 reference) at 2.3.4.

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities
• Vue v2.3.4 byte-identical (25th consecutive alpha)

See Discussion #24 for the RN install snippet + known rc.1 limitations.

v3.0.0-alpha.23 — post-publish professional polish

Post-publish professional polish

8 lots in autonomy. The cheap-but-high-leverage credibility signals every OSS product carries once it's actually on npm.

What ships

• GitHub Releases populated for v3.0.0-rc.0 + v3.0.0-alpha.22
• CodeQL workflow — security-extended query pack, weekly cron
• OpenGraph + JSON-LD meta on the live demo (rich social previews)
• CITATION.cff — 'Cite this repository' button on the repo home
• First GitHub Discussion #24 open — 'rc.0 is live, feedback wanted'
• release-please manifest sync — was 0.0.0 stale, now real versions
• apps/demo-react-native dep reorg — moves Expo to devDeps → npm audit --omit=dev back to 0 vulnerabilities (was 10 moderate)
• publishConfig.access: public explicit on all 7 publishable packages

Quality gate

• 139/139 unit tests
• 0 prod vulnerabilities
• Vue v2.3.4 byte-identical (24th consecutive alpha)
• 6 GitHub Actions workflows active (CI + visual + a11y + coverage + release-please + CodeQL)

See CHANGELOG.md for the full per-LOT log.

v3.0.0-alpha.22 — React Native renderer ships

@pulse-music/react-native rc.1 — first real renderer

The 1-week RN sprint from REACT_NATIVE_RUNTIME_SETUP.md is collapsed into this alpha. Sentinel-throw stubs replaced with the real renderer powered by expo-av + react-native-reanimated.

What ships

• Audio playback via expo-av Audio.Sound
• 9 mood themes mirrored from @pulse-music/tokens
• Ambient EQ — 12 bars via Reanimated, off the UI thread
• Pulso heartbeat — concentric rings
• Inline player card + basic FAB + usePulseAudioRN hook
• PulseEngineRN class + singleton helpers
• Expo SDK 56 demo app at apps/demo-react-native/ — boots on Android emulator

Deliberately deferred (subsequent patches)

• Real FFT (waiting for react-native-audio-api iOS GA)
• Backdrop blur (expo-blur next patch)
• FAB drag-to-reposition (PanGestureHandler next patch)
• prefers-reduced-motion wiring

Intentionally absent

• Drag-to-resize, fullscreen API, guided demo tour (web-only concepts)

Quality gate

• 139/139 unit tests (was 132 in rc.0)
• @pulse-music/react-native: 10 sentinel tests → 17 real engine + parity tests
• Vue v2.3.4 byte-identical on its 23rd alpha

Publish status

@pulse-music/react-native carries version 3.0.0-rc.1 in code. The currently-published rc.0 (sentinels) gets superseded on the next npm publish --otp=XXXXXX run.

See CHANGELOG.md for the full per-alpha narrative.

v3.0.0-rc.0 — first npm publish (@pulse-music/* LIVE)

First npm publish — 6 packages LIVE on the registry

End of the 21-tag alpha cycle. @pulse-music/* packages are now installable from npm.

Published packages

Package	Version
@pulse-music/types	3.0.0-rc.0
@pulse-music/core	3.0.0-rc.0
@pulse-music/tokens	3.0.0-rc.0
@pulse-music/web-component	3.0.0-rc.1
@pulse-music/react	3.0.0-rc.0
@pulse-music/svelte	3.0.0-rc.0

@pulse-music/web-component jumped to rc.1 because the first publish landed in a ghost state. Documented in CHANGELOG.

Try it now

npm install @pulse-music/react @pulse-music/core

• Live demo: https://yamadablog.github.io/pulse-player/
• YouTube walkthrough: https://youtu.be/q_FJ1GWaCc8
• Full CHANGELOG entry: see CHANGELOG.md

Quality gate

• 132/132 unit tests + 2 visual + 2 a11y CI strict
• 0 vulnerabilities
• Vue v2.3.4 reference bit-for-bit identical (22 alphas)
• Axe-core WCAG 2.1 AA strict