Add CI pipelines, pre-commit secret guard, untrack docs/

- .github/workflows/test.yml: typecheck + vitest on Node 20 & 22, push/PR/manual
- .github/workflows/build.yml: chained workflow_run trigger, only runs on Test success,
  compiles dist/ and uploads as a workflow artifact
- scripts/check-secrets.mjs: pre-commit guard against historical real Wave tokens +
  auth-context literals without placeholder prefixes
- scripts/install-git-hooks.mjs: auto-wires the hook on `npm install` via `prepare`
- Untrack docs/: api-map + captured-queries kept locally only; reverse-engineering
  notes are sensitive enough not to publish even in a private repo
- Switch author email to GitHub no-reply (publish-safe)

Author: LunaParker

.github/workflows/build.yml

@@ -0,0 +1,67 @@
+name: Build
+
+# Pipeline 2 of 2 — compile TypeScript → dist/ and upload it as a workflow artifact
+# you can download for distribution. Triggers only when the Test pipeline succeeds
+# on `main` (so PR builds don't produce artifacts and broken main never publishes).
+# Can also be invoked manually via the Actions tab.
+
+on:
+  workflow_run:
+    workflows: [Test]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Compile + upload dist
+    runs-on: ubuntu-latest
+
+    # When invoked via `workflow_run`, we only run if the upstream Test workflow passed.
+    # `workflow_dispatch` bypasses this guard so you can always run a manual build.
+    if: >-
+      ${{
+        github.event_name == 'workflow_dispatch' ||
+        github.event.workflow_run.conclusion == 'success'
+      }}
+
+    steps:
+      - name: Checkout
+        # For workflow_run triggers, default checkout pulls the workflow file commit,
+        # not the head of the triggering run. Pin to the SHA that the Test workflow ran on.
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Set up Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify entry point exists
+        run: |
+          test -f dist/server.js \
+            && echo "dist/server.js OK ($(stat -c%s dist/server.js 2>/dev/null || stat -f%z dist/server.js) bytes)" \
+            || (echo "MISSING dist/server.js after build" && exit 1)
+
+      - name: Upload dist artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-${{ github.event.workflow_run.head_sha || github.sha }}
+          path: dist/
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/test.yml

@@ -0,0 +1,50 @@
+name: Test
+
+# Pipeline 1 of 2 — typecheck + vitest suite. Runs on every push/PR.
+# All vitest tests are written against mocked fetch / stubbed puppeteer drivers, so
+# no production Wave credentials are touched here. The Build workflow (pipeline 2)
+# is chained off this one and only runs if Test passes on `main`.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Node ${{ matrix.node }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['20', '22']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      # We deliberately use `npm ci --ignore-scripts` to skip the `prepare` hook —
+      # CI runners don't need a pre-commit hook installed and the install script's
+      # /.git check would fail anyway on a fresh checkout-with-no-hooks-dir.
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Type-check
+        run: npm run typecheck
+
+      - name: Run tests
+        run: npm test

.gitignore

@@ -45,3 +45,10 @@ Thumbs.db
 # ─── Misc local-only ─────────────────────────────────────────────────────────
 NOTES.md
 *.local
+
+# ─── Reverse-engineering notes — kept locally, not for the public repo ───────
+# `docs/` documents Wave's internal endpoints + verbatim GraphQL queries we
+# captured during development. Useful reference for you, sensitive if leaked
+# (could be used to abuse Wave's internal API). Kept out of git deliberately.
+docs/
+

README.md

@@ -188,7 +188,7 @@ You can use, modify, and redistribute this freely. There's no warranty; if it br
 
 Brief pointers if you want to hack on this:
 
-- Source layout, API map, and captured GraphQL operations: see [docs/api-map.md](./docs/api-map.md) and [docs/captured-queries.md](./docs/captured-queries.md)
+- Source layout, API map, and captured GraphQL operations live in `docs/` locally — gitignored on purpose so the reverse-engineering reference doesn't get committed to a public mirror.
 - Run the test suite: `npm test` (or `npm run test:coverage` for an HTML coverage report in `coverage/`)
 - Smoke-test against a live Wave account: `WAVE_AUTH_TOKEN=... npm run smoke`
 - An experimental browser-driven login flow is available via `npx waveapps-mcp login` — it uses puppeteer-core + the stealth plugin to try to get past Google's OAuth check. Often blocked; the manual `paste` flow above is more reliable.