wtclaude
e71ff4acd4
All checks were successful
PR checks / checks (pull_request) Successful in 9m36s
PLAN.md §13 phase 10, with four decisions of record — D47-D50, taking the count
to fifty. Three were straightforward; the CSP turned into the phase's real work,
because the thing meant to be a configuration flag was broken in a dependency and
broken silently.
D47 — search reaches the marketing pages, and the header gets a box.
Base.astro marks its <main> as a Pagefind body, so all ten join the index the
docs already query, and Search.astro opens it in a <dialog>. Nothing is fetched
until the dialog is opened (the bundle is 120 kB and these pages otherwise ship
almost no JavaScript). Pagefind titles a result from the first <h1>, and these
pages have editorial ones — "The app for a deployment you already use" — so the
index is given the page's short name instead. applyBrand.mjs now re-indexes after
a rewrite, closing a note phase 2 left for this phase.
D48 — the CSP is a real response header, sent by the container. Not a <meta>,
which ignores frame-ancestors, and not advice for someone's reverse proxy, which
puts the strictest promise in §6 outside what this repo tests. Three things
fought it, all the same shape — correct build, broken page, no error:
* Astro does not hash <script is:inline>, and Starlight ships six per docs
page, so the first build with CSP on had a strict header and a dead theme
switcher. The hashes are now generated into src/config/cspHashes.mjs and
checkCsp.mjs verifies every inline block against its own page's policy.
* Expressive Code writes ~3,700 inline style ATTRIBUTES, which cannot be
hashed, hence style-src-attr 'unsafe-inline' — scoped to that directive, so
script-src is untouched.
* @astrojs/node matched a request to a policy with pathname.includes(), a
substring test: /modules/ was served /docs/modules/building-a-module's
policy and rendered with its own stylesheet refused. scripts/serve.mjs keeps
the same _headers.json and matches by equality; test/headers.test.mjs starts
the server and reads the responses, because nothing that reads dist/ can see
this.
D49 — robots.txt allows everything and names the sitemap (there was no way to
find it: no robots.txt, and D9 rules out a search console). D50 — Organization
and SoftwareApplication, no ratings and no docs-wide Article markup.
checkA11y.mjs is the eleventh check: seven structural rules over all fifty pages,
verified by breaking each in turn. The walk at 390/768/1280 found no overflow
anywhere, the CSP violations above, a 17x17 consent checkbox (WCAG 2.2 SC 2.5.8
wants 24), and a skip link that moved the scroll but not the focus.
npm run verify is green: fourteen steps, both test suites, all eleven checks.
Co-Authored-By: Claude <noreply@anthropic.com>
55 lines
2.3 KiB
JSON
55 lines
2.3 KiB
JSON
{
|
|
"name": "runicgateway.com",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"license": "GPL-3.0-or-later",
|
|
"description": "The public marketing and documentation site for Runic Gateway",
|
|
"engines": {
|
|
"node": ">=22"
|
|
},
|
|
"scripts": {
|
|
"dev": "astro dev",
|
|
"build": "astro build",
|
|
"preview": "astro preview",
|
|
"start": "node scripts/applyBrand.mjs && node scripts/serve.mjs",
|
|
"check": "astro check",
|
|
"check:facts": "node scripts/checkFacts.mjs",
|
|
"check:tokens": "node scripts/checkTokens.mjs",
|
|
"check:brand": "node scripts/checkBrand.mjs",
|
|
"check:links": "node scripts/checkLinks.mjs",
|
|
"check:datasafety": "node scripts/playDataSafety.mjs --check",
|
|
"check:quickstart": "node scripts/checkQuickstart.mjs",
|
|
"check:reference": "node scripts/checkReference.mjs",
|
|
"check:sidebar": "node scripts/checkSidebar.mjs",
|
|
"check:screens": "node scripts/checkScreens.mjs",
|
|
"check:a11y": "node scripts/checkA11y.mjs",
|
|
"check:csp": "node scripts/checkCsp.mjs",
|
|
"play:datasafety": "node scripts/playDataSafety.mjs",
|
|
"beta": "node scripts/beta.mjs",
|
|
"test": "node --test test/beta.test.mjs test/legal.test.mjs",
|
|
"brand:assets": "node scripts/buildBrandAssets.mjs",
|
|
"screens:capture": "node scripts/captureScreens.mjs",
|
|
"csp:hashes": "node scripts/checkCsp.mjs --reset && astro build && node scripts/checkCsp.mjs --write && astro build && node scripts/checkCsp.mjs",
|
|
"verify": "npm run check:sidebar && npm run check:screens && npm run check:tokens && npm run check:brand && npm run check:datasafety && npm run check && npm test && npm run build && npm run check:links && npm run check:facts && npm run check:quickstart && npm run check:reference && npm run test:served && npm run check:a11y && npm run check:csp",
|
|
"test:served": "node --test test/headers.test.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@astrojs/node": "^11.1.4",
|
|
"@astrojs/starlight": "^0.41.7",
|
|
"@fontsource-variable/cinzel": "^5.3.0",
|
|
"@fontsource-variable/inter": "^5.3.0",
|
|
"astro": "^7.2.4",
|
|
"better-sqlite3": "^12.11.1",
|
|
"pagefind": "^1.5.2",
|
|
"sharp": "^0.35.3"
|
|
},
|
|
"devDependencies": {
|
|
"@astrojs/check": "^0.9.10",
|
|
"opentype.js": "^2.0.0",
|
|
"puppeteer-core": "^23.11.1",
|
|
"typescript": "^6.0.3",
|
|
"yaml": "^2.8.1"
|
|
}
|
|
}
|