Add & redesign friggframework.org marketing site under website/

[seanspeaks]

Summary

Migrates the friggframework.org marketing site into the Frigg core monorepo (from lefthook--demo-frigg-application) so it can be iterated on alongside the framework and deployed from Netlify, and rebuilds the page for the current framework story.

What's here

• website/ — the marketing site as a single, self-contained static page (inline CSS + vanilla JS, no build step, no framework runtime), plus the Netlify serverless functions in website/friggframework-api/ (subscribe, submission-created).
• netlify.toml (repo root) — base = "website", functions dir, and the original api. / feedback. redirects preserved from the previous deploy config.

Redesign highlights

• New positioning: agents build the integrations; every integration is also an MCP tool your agents can call (typed capabilities / mcp-tool surface); own your stack and your pipes; wisdom of the crowd; zero-to-production in an afternoon; notes on easy adoption.
• A "woven pipes" design (nod to Frigg, weaver of the clouds): animated weave canvas, a live agent-session terminal, a real integration-icon marquee, editorial "the shift" blocks, and a numbered zero-to-prod timeline.
• Full light / dark / system theme toggle via CSS custom-property tokens (prefers-color-scheme default + persisted data-theme override).
• Self-hosted fonts (woff2) — no external font requests. Existing GA + PostHog analytics preserved.
• The signup form keeps the exact field names + form-name the submission-created function reads, so the Netlify Forms flow is unchanged.
• Pruned ~8.7 MB of now-unused vendor assets (Bootstrap, jQuery, plugins, legacy fonts, old css/js); site dropped from ~9.8 MB to ~1.4 MB.

Notes for reviewers

• This is a website-only change (new website/ dir + root netlify.toml); it touches no packages. I intentionally did not add the release/prerelease labels so it doesn't trigger an npm prerelease — add them only if your release tooling expects them here.
• Build verified locally in both themes; all asset references resolve.

Test plan

• netlify.toml base/publish/functions resolve correctly in a Netlify build
• Light/dark/system toggle works and persists
• Signup form submission is captured by Netlify Forms and reaches the submission-created function
• Redirects (api. / feedback.) behave as before

🤖 Generated with Claude Code

---

Generated by Claude Code

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35143847	Triggered	PostHog Project API Key	e082e5d	website/index.html	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[graphite-app]

The contentType property is not a valid option for the fetch API. This will be silently ignored, causing the Zapier webhook request to be sent without the correct Content-Type header, which may cause the webhook to fail.

const res = await fetch(process.env.WEBHOOK_URL, {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        email: payload.email.trim(),
        slackInvite: payload.slackInvite,
        emailUpdates: payload.emailUpdates
    })
})

Suggested change

	const res = await fetch(process.env.WEBHOOK_URL, {
	method: 'POST',
	body: JSON.stringify({email: payload.email.trim(),
	slackInvite: payload.slackInvite,
	emailUpdates: payload.emailUpdates}),
	contentType: 'application/json'
	})
	const res = await fetch(process.env.WEBHOOK_URL, {
	method: 'POST',
	headers: {'Content-Type': 'application/json'},
	body: JSON.stringify({email: payload.email.trim(),
	slackInvite: payload.slackInvite,
	emailUpdates: payload.emailUpdates})
	})

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

[seanspeaks]

Already resolved in the current head — subscribe.js sends headers: { 'Content-Type': 'application/json' }, not the invalid contentType option, so the request goes out with the correct content type.

---

Generated by Claude Code

[graphite-app]

The function does not return a response. Netlify Functions must return an object with statusCode, headers, and body properties, or the function will fail.

Fix by adding a return statement:

const res = await fetch('https://api.friggframework.org/subscribe', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json;charset=utf-8'
    },
    body: JSON.stringify({email, slackInvite, emailUpdates})
})
console.log(res)
return {
    statusCode: 200,
    body: JSON.stringify({ message: 'processed' })
}

Suggested change

	exports.handler = async function (event, context, callback) {
	const payload = JSON.parse(event.body).payload
	console.log(JSON.parse(event.body))
	console.log(payload)
	console.log(payload.data["slack-invite"])
	const email = payload.data.email
	const slackInvite = !!payload.data["slack-invite"]
	const emailUpdates = !!payload.data["update-emails"]
	console.log(email, slackInvite, emailUpdates)
	const res = await fetch('https://api.friggframework.org/subscribe', {
	method: 'POST',
	headers: {
	'Content-Type': 'application/json;charset=utf-8'
	},
	body: JSON.stringify({email, slackInvite, emailUpdates})
	})
	console.log(res)
	}
	exports.handler = async function (event, context, callback) {
	const payload = JSON.parse(event.body).payload
	console.log(JSON.parse(event.body))
	console.log(payload)
	console.log(payload.data["slack-invite"])
	const email = payload.data.email
	const slackInvite = !!payload.data["slack-invite"]
	const emailUpdates = !!payload.data["update-emails"]
	console.log(email, slackInvite, emailUpdates)
	const res = await fetch('https://api.friggframework.org/subscribe', {
	method: 'POST',
	headers: {
	'Content-Type': 'application/json;charset=utf-8'
	},
	body: JSON.stringify({email, slackInvite, emailUpdates})
	})
	console.log(res)
	return {
	statusCode: 200,
	body: JSON.stringify({ message: 'processed' })
	}
	}

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

[seanspeaks]

Already handled in the current head — submission-created.js ends with return { statusCode: 200, body: JSON.stringify({ message: 'processed' }) }, so it returns a valid Netlify Functions response object.

---

Generated by Claude Code

[seanspeaks]

Session handoff — on-site "Ask Frigg" assistant + Freya seam

This note is the context bundle for a new session that will wire the assistant to the Freya framework. The Freya repo isn't in this session's scope and can't be added retroactively, so the follow-up work needs a fresh session with the Freya repo added. Everything below is what that session needs to pick up cleanly.

What exists now (this PR)

The marketing site was migrated into website/ and rebuilt (see the PR description). On top of that, this session added an on-site AI assistant — a chat widget ("Ask Frigg") on both the homepage and the roadmap page, backed by a Netlify function running on the Netlify AI Gateway.

It already works end to end as a single grounded Claude call. Freya is the next iteration: replace the one-shot call with a Freya-driven loop that retrieves ADR / API / catalog data at runtime via tools/MCP instead of relying on the baked-in static knowledge blob.

Files to know

File	Role
website/friggframework-api/assistant.js	The Netlify function. Contains the model call, the rate limiter, and the static knowledge blob. This is where Freya plugs in.
website/index.html	Homepage. Widget markup + CSS + driver JS live near the end (search fa-launch, fa-panel, and the Assistant widget comment).
website/roadmap/index.html	Roadmap page. Same widget (shared styles/behavior).
website/roadmap/data/adrs.json	27 ADRs (num, id, title, status, date, theme, summary, url) — generated this session from docs/architecture-decisions/ on next.
website/roadmap/data/apis.json	224 APIs (slug, name, provider, category, description, status, complexity, built, library, logo, tags) + a categories array.
website/package.json	Added @anthropic-ai/sdk. @netlify/blobs already present (used by voting + rate limiter).

The Freya seam (the important part)

assistant.js is structured so the model interaction is isolated behind one function. Search the file for FREYA-SEAM. The contract to preserve:

• HTTP: POST /.netlify/functions/assistant with body { messages: [{role:'user'|'assistant', content:string}, ...] } → returns { reply: string, offline?: boolean, rateLimited?: boolean, retryAfter?: number }. The widget drops the last user turn from history on offline/rateLimited so failures don't poison context.
• Model boundary: async function answer(messages) takes the sanitized message array and returns the reply string. Today it's a single client.messages.create() over the AI Gateway (new Anthropic() auto-reads ANTHROPIC_API_KEY + ANTHROPIC_BASE_URL that Netlify injects). Swap the body of answer() for a Freya session and keep the (messages) => string shape — the handler, rate limiter, offline path, and both widgets need no changes.

Direction for the Freya version: retrieve, don't hardcode

Right now grounding is a curated static string (const KNOWLEDGE in assistant.js) plus a system prompt that tells the model to send people to /roadmap/ rather than recite lists. That was deliberate for a one-shot call, but the Freya assistant should fetch ADR / API / catalog info through data-retrieval tools/MCP at request time so answers stay accurate as the framework moves. Sources available:

• ADRs: authoritative source is docs/architecture-decisions/ on the next branch (27 ADRs). A pre-summarized copy is already served at /roadmap/data/adrs.json, which is the cheapest retrieval target for the assistant.
• API catalog: /roadmap/data/apis.json (224 APIs with the built/library flags that mark what's in api-module-library), or the Left Hook catalog MCP used this session, which exposes richer tools — list_apis, search_catalog, catalog_query, get_api, get_catalog_stats, compare_platforms, list_platforms, and get_lefthook_services (the last is where the Left Hook services/partnership grounding came from).
• Framework facts / stack: currently inline in KNOWLEDGE; fine to keep a small static core, but let Freya's tools override anything that can drift (versions, module availability, ADR status).

So the target architecture: small static system prompt (voice + rules + framework primitives) + Freya tool calls for anything that changes. Retire most of the KNOWLEDGE blob as tools replace it.

Config the new session should preserve

• ASSISTANT_MODEL env var selects the model. Default in code is claude-opus-4-8. For a public widget on gateway credits, set it to claude-haiku-4-5-20251001 (recommended) or claude-sonnet-4-5-20250929 in the Netlify env — no code change needed. (Open question for @seanspeaks: flip the code default to Haiku, or keep opus + env override?)
• Rate limiting: rolling per-IP window via Netlify Blobs (assistant-rate store), 12 req/min, MAX_MESSAGES/MAX_CHARS clamps, fails open if Blobs is unavailable. Keep this in front of any Freya loop — a tool-using agent is more expensive per turn, so the limiter matters more, not less.
• Graceful offline: if ANTHROPIC_API_KEY/ANTHROPIC_BASE_URL are absent or the call throws, the function returns a friendly offline reply (200, offline:true) pointing at docs/repo/roadmap. Preserve this so local dev and gateway outages don't 500.
• XSS: widget escapes all model output before rendering; only URLs, /roadmap/ paths, and `code` spans are formatted. If Freya returns richer content (citations, cards), extend the renderer carefully — don't inject raw HTML.

Steps for the new session

1. Start a fresh session and add the Freya repo to scope (list_repos → add_repo), plus this repo (friggframework/frigg) on branch claude/migrate-static-website-frigg-w5i6ub.
2. Read website/friggframework-api/assistant.js and find FREYA-SEAM.
3. Replace the body of answer(messages) with a Freya session; wire Freya tools to the retrieval sources above. Keep the handler contract, rate limiter, and offline path.
4. Trim KNOWLEDGE down to the static core as tools take over.
5. Test the offline path, rate-limit path, and a live tool-using exchange; re-screenshot the widget; commit to the same branch.

Still outstanding (deploy, not code)

• Merge this PR into next.
• Re-point the friggframework-org Netlify project to build from friggframework/frigg (base website) so continuous deploy works — a UI/OAuth step. The assistant only goes live once the site is deployed with the AI Gateway enabled (env vars injected); until then it shows the offline note.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
3.5% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud