abqari 1.1.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd411b1e1b18a824d5cee74ee6e557c7135fc973f6fc9edb4f4c806edff7cadf
-  data.tar.gz: bb34137c4de0ffb733d1b911f6e523df2cde7b933d196e07d0e4ca4a4fb91460
+  metadata.gz: b9d5e9a272de668ea9e75b33d47fd252c9a46413c6873c15d077a938f3817004
+  data.tar.gz: 0d55679d1de17c940765b5a04c81e15980e1929a590fab878b36e65fdc877195
 SHA512:
-  metadata.gz: b1c8ea8aa8cad1f13f9dc3eddd81fbbedf891d024b6998f8a1f7aacf7c45c66ce783bea05174d983973c46eac5318372addd0d8b590e29871723f29f1d71a40c
-  data.tar.gz: 2820827176cec3ecaaf08ad2ceb70c15b506435368154e24d2afc7ea544f2fe959613da696e2bb05eb81eff3011d4c37e07081565e1c4fa2ae2e901073b4e5c8
+  metadata.gz: 27ecd3e0f352ce9970cd85256badd8973bcd950092fa67cd56de2f9820862eef89740b3995d8c3e7f692259a9f50d49da1d41e3a76d7912c0873d650b46d101a
+  data.tar.gz: 77b4d04a24911bf1705cb074ce4515bd130ee5db2340e1c988c81a5a707c54014bf5a62cc94ca1d83139747d7c87595a3c7c2607a79ae9b2f953c926b7f16d43

data/CHANGELOG.md

@@ -9,6 +9,129 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _Nothing yet._
 
+## [1.2.0] — 2026-10-11
+
+Upgrade if you serve the generated CSP: Chrome has been blocking
+Abqari's own speculation rules, so nothing was prerendered and every
+page logged a CSP violation, plus a Permissions-Policy error about
+`interest-cohort`. Upgrade too if you deploy to Render, which ignores
+`_headers` (`abqari headers` prints the rules it needs), or through the
+shipped GitHub Actions workflows with `fonts:` set, which deployed
+sites without their fonts.
+
+On a host that ignores `_headers`, rebuild after upgrading and re-copy
+the CSP and Permissions-Policy: both changed. Workflow files are copied
+into each site at `abqari new`, so the font fix needs adding to existing
+sites by hand.
+
+### Added
+
+- **`speculation_rules.href_matches`** sets the URL patterns to
+  prerender: one pattern or a list. The default is unchanged: the posts
+  collection (`/posts/*`, or `/<slug>/*` with a custom `slug:`). A site
+  whose articles live in another collection prerendered nothing, which
+  is how Sanad's `/news/*` surfaced it. Changing it changes the CSP
+  hash (see Fixed).
+
+- **`abqari headers`** prints the built `_site/_headers` as Render
+  header rules, ready to paste into `render.yaml` or the dashboard's
+  Settings → Headers. Render static sites don't read `_headers`, so
+  without this the CSP, the security headers and the year-long
+  `immutable` cache on `/assets/*` were missing, and Render served
+  assets with `max-age=0` (fonts revalidated on every page, so text
+  flashed). It reads the built file rather than computing headers, so
+  the CSP hashes are the ones the site's bundled engine and config
+  produced. Run it with `bundle exec` from the site root.
+  `docs/deploying.md` now covers Render's headers, the git-ignored
+  `vendor/fonts/` and Render's missing AVIF encoder, and no longer
+  tells Render users to `apt-get` packages.
+
+### Fixed
+
+- **Chrome logged a CSP violation on every page, and nothing was
+  prerendered.** "Applying inline speculation rules violates the
+  following Content Security Policy directive". The generated CSP
+  allowed the head's `<script type="speculationrules">` block only
+  through `'inline-speculation-rules'`, and Chrome ignores that keyword
+  once `script-src` also lists hashes, which it always does (the theme
+  bootstrap and the data-saver guard). It hid because nothing visibly
+  breaks: the page works, the dev server doesn't apply `_headers`, and
+  the unit tests checked the keyword and the hashes separately.
+
+  The block's body now comes from `Abqari::SpeculationRules`, which the
+  head partial emits and `HeadersFile` hashes, so the two can't drift.
+  The keyword stays for browsers that honour it. With unchanged config
+  the body is byte-identical to 1.1.x, so a hash already pasted into a
+  host's settings keeps working. A site that overrides `_head.html.erb`
+  keeps matching too, until it sets `href_matches`; then its block
+  needs to emit `<%== Abqari::SpeculationRules.script(site) %>`.
+  `test/csp_inline_scripts_test.rb` now checks every inline script on a
+  built page against the built policy.
+
+- **Chrome logged a Permissions-Policy error about `interest-cohort`
+  on every page.** The generated `Permissions-Policy` still opted out
+  of FLoC, which Google has dropped. It's gone; `camera`, `microphone`
+  and `geolocation` stay off.
+
+- **Builds on Render logged dozens of false "Slow page" warnings, each
+  blaming a "plugin filter".** One build flagged about 45 pages at
+  500ms+, while the same 270 pages render in about 5ms each locally.
+  There were three causes. The render pool was sized by
+  `Etc.nprocessors`, which in a container reports the host's CPUs
+  rather than the quota, so dozens of threads queued for one GVL.
+  Pages were timed by wall-clock, which counted that queueing and any
+  CPU throttling as the page's own time. And the plugin-filter cause
+  was attached to every slow page whenever any `:post_process` hook was
+  registered, without being timed. It hid because a developer machine
+  has the CPUs it reports.
+
+  Pages are now timed by their thread's CPU time, and the warning says
+  "of CPU". The pool follows the cgroup CPU quota when there is one,
+  capped at 4 (`Renderer::MAX_RENDER_THREADS`): rendering holds the
+  GVL, and a 270-page site built no faster on 8 threads than on 1. A
+  plugin filter is named only when it used at least a quarter of the
+  page's time, and with that time ("plugin filter 340ms"). Time a page
+  spends blocked on I/O no longer counts toward the threshold.
+
+- **Sites deployed through the shipped GitHub Actions workflows had no
+  custom fonts.** The scaffold git-ignores `vendor/fonts/`, so a CI
+  checkout has no font files until `bin/fetch-fonts` runs, and
+  `deploy-cloudflare.yml`, `deploy-github-pages.yml` and
+  `deploy-render.yml` went straight to `bin/build`. The build passed,
+  the head (correctly) omitted the missing font stylesheet, and the
+  site shipped in fallback fonts. It hid because the developer's own
+  checkout has the fonts, so local builds look right.
+
+  The workflows now run `bundle exec bin/fetch-fonts` before building;
+  it's a no-op for a site with no `fonts:`. **Existing sites keep their
+  own copies of the workflows and must add the step themselves**, or
+  commit `vendor/fonts/`. Render's own build doesn't use these
+  workflows: its build command needs `bin/fetch-fonts` too (see
+  `docs/deploying.md`).
+
+- **Editing a plugin while `bin/serve` was running broke every page with
+  an unexplained `NoMethodError`.** Add a helper in `plugins/`, save a
+  layout that calls it, and the next rebuild failed every page with
+  `undefined method '…' for an instance of Abqari::RenderContext` until
+  the server was restarted. Plugins load once, at `Site.new`, and the
+  dev server builds its Site once, so neither a plugin nor anything it
+  `require`s from the site's `lib/` is ever reloaded. `plugins/` wasn't
+  even watched, so the server had no idea anything had changed. It hid
+  because the plugin itself was fine: `bin/build` and a freshly started
+  `bin/serve` both load it and work.
+
+  `bin/serve` now watches `plugins/`. When a plugin, or a `lib/` file a
+  plugin required, changes, it logs a one-line warning naming the file
+  and saying to restart. A build that fails while that Ruby is stale
+  ends its error output with the same reminder, because by then the
+  first warning has usually scrolled away. The server deliberately
+  doesn't reload or re-exec itself: a half-saved plugin would then take
+  it down instead of logging an error. Tracking lives in
+  `Site#stale_ruby_sources`.
+
+  `docs/plugins.md` also said a stale plugin's old *and* new callbacks
+  both fire on each rebuild. Only the old ones do.
+
 ## [1.1.2] — 2026-10-09
 
 ### Fixed
@@ -987,7 +1110,8 @@ run a real working author / publisher site.
   commonmarker ≥ 2.4 ships precompiled 4.0 binaries, which is what
   the `~> 2.4` floor bought.
 
-[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.1.2...HEAD
+[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.2.0...HEAD
+[1.2.0]: https://github.com/grantrayner/abqari/compare/v1.1.2...v1.2.0
 [1.1.2]: https://github.com/grantrayner/abqari/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/grantrayner/abqari/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/grantrayner/abqari/compare/v1.0.0...v1.1.0

data/README.md

@@ -11,7 +11,7 @@ optional overrides), while the engine — layouts, themes, helpers, asset
 pipeline — lives in the dependency. Forking the engine is also
 supported for users who want to own all the code.
 
-> **Status:** v1.1.2 — see
+> **Status:** v1.2.0 — see
 > [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md).
 > Distributed via RubyGems (`gem install abqari`) and as a Bundler
 > path/git source. The API follows [semver](https://semver.org/) from
@@ -174,7 +174,7 @@ Test that it worked:
 abqari version
 ```
 
-You should see a version number, e.g. `abqari 1.1.2`. If you get
+You should see a version number, e.g. `abqari 1.2.0`. If you get
 `command not found`, see [Troubleshooting](#troubleshooting) below.
 
 ### Step 3 — Create your first site
@@ -460,7 +460,7 @@ Edit `Gemfile`:
 ```ruby
 source 'https://rubygems.org'
 
-gem 'abqari', '~> 1.1'
+gem 'abqari', '~> 1.2'
 
 group :development do
   gem 'listen', '~> 3.8'    # optional, for the dev-server file watcher
@@ -470,7 +470,7 @@ end
 Or — pin to a git ref while tracking pre-release work:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.2'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.2.0'
 ```
 
 Install the libvips C library once (hard dep for the image pipeline):
@@ -1631,6 +1631,8 @@ bin/fetch-fonts
 
 Abqari downloads the woff2 files to `vendor/fonts/`, generates a `fonts.css` with rewritten URLs, and serves everything from `/assets/fonts/` at build time. The stylesheet is fingerprinted like any other asset (`/assets/fonts/fonts.<hash>.css`), so changing `fonts:` and re-running `bin/fetch-fonts` busts the immutable cache. The head partial links it whenever `fonts:` is configured and the fetch has run.
 
+`vendor/fonts/` is git-ignored, so every deploy has to fetch the fonts too, or the site ships in fallback fonts with a green build. The shipped GitHub Actions workflows run `bin/fetch-fonts` before `bin/build`; on a host that builds from its own command (Render), add it there. Or commit `vendor/fonts/` instead. See [deploying.md → Fonts](https://github.com/grantrayner/abqari/blob/main/docs/deploying.md#fonts).
+
 If you override the head partial, link the stylesheet with `<%= asset_path('fonts/fonts.css') %>`. An unhashed copy still ships at `/assets/fonts/fonts.css`, but `_headers` caches it for a year, so returning visitors won't see font changes.
 
 ## Icons
@@ -1763,7 +1765,7 @@ Every build emits the files a static host needs to serve a real site:
 | `feed.xml` | RSS 2.0 feed of latest posts |
 | `feed.json` | JSON Feed 1.1 |
 | `robots.txt` | Per-environment — `Disallow: /` in dev/staging, real one in production |
-| `_headers` | Security headers (CSP, HSTS, Permissions-Policy, etc.) + asset cache-control. Read by Cloudflare Pages and Netlify |
+| `_headers` | Security headers (CSP, HSTS, Permissions-Policy, etc.) + asset cache-control. Read by Cloudflare Pages and Netlify. Render ignores it — `bundle exec abqari headers` prints the same rules to paste in (see [deploying.md](https://github.com/grantrayner/abqari/blob/main/docs/deploying.md#headers-render-ignores-_headers)) |
 | `_redirects` | 301 mappings for any post with `redirect_from:` |
 | `manifest.json` | Web app manifest, populated from your site title + locale. Override colours/names under `manifest:` in `site.yml` |
 | `/.well-known/security.txt` | Generated when `security_contact:` is set |
@@ -1784,7 +1786,7 @@ Abqari generates a stub HTML page at `/old-tutorial/` with a `<meta refresh>` an
 
 **SEO meta** — every page's `<head>` includes canonical URL, Open Graph tags, Twitter card tags, RSS/JSON Feed alternates, and (for posts) JSON-LD `Article` structured data. All driven from `site.config` and frontmatter — no manual tagging required.
 
-**Security headers** — the default `_headers` ships with a strict CSP (`'self'` only — works because Abqari has no inline scripts/styles), HSTS (1 year), `Referrer-Policy`, `Permissions-Policy` (camera/mic/geolocation/FLoC all off), `X-Content-Type-Options`, and `frame-ancestors 'none'`.
+**Security headers** — the default `_headers` ships with a strict CSP (`'self'` only, with each of Abqari's few inline scripts pinned by SHA-256 rather than allowed by `'unsafe-inline'`), HSTS (1 year), `Referrer-Policy`, `Permissions-Policy` (camera/mic/geolocation off), `X-Content-Type-Options`, and `frame-ancestors 'none'`.
 
 The policy is *built* from the features you've configured — enabling Plausible adds `plausible.io`, setting `newsletter.action` adds that provider's origin, and so on. You never hand-write it. Two keys extend it when the engine can't infer what you need:
 
@@ -1879,8 +1881,14 @@ for readers on slow or data-saving connections. Tune or disable:
 speculation_rules:
   enabled: true          # false to omit entirely
   eagerness: moderate    # conservative / moderate / eager
+  href_matches: /news/*  # default: the posts collection (/posts/*); one pattern or a list
 ```
 
+Set `href_matches` when your main content isn't in `posts` — a site
+whose articles live in a `news` collection prerenders nothing until it
+does. The generated CSP pins the rules block by hash, so changing any
+of these changes the CSP; on a host that ignores `_headers`, re-copy it.
+
 Run `bin/audit` after building — it checks every page for missing
 descriptions, broken links, missing alt text, and other SEO and
 accessibility problems before you deploy.
@@ -2416,7 +2424,7 @@ Run a single test file: `bundle exec ruby -Ilib -Itest test/helpers_test.rb`. Ru
 
 ## Livereload
 
-`bin/serve` watches `content/`, `app/`, `themes/`, `config/`, `lib/`, and `data/` for changes. On change:
+`bin/serve` watches `content/`, `app/`, `themes/`, `config/`, `lib/`, `data/`, and `plugins/` for changes. On change:
 
 1. The build runs incrementally (no `_site/` wipe; mtime-aware copies skip unchanged work).
 2. The build version bumps and the watcher classifies the change scope.
@@ -2424,6 +2432,8 @@ Run a single test file: `bundle exec ruby -Ilib -Itest test/helpers_test.rb`. Ru
    - **Swaps the `<link rel="stylesheet">` href** in place if only CSS files changed (preserves scroll position and form state), or
    - **Reloads the page** if anything else changed.
 
+**Ruby isn't reloaded.** Plugins, and anything they `require` from `lib/`, load once when `bin/serve` starts. When one of those files changes, the server logs a one-line warning naming it; restart `bin/serve` to load the new code. If a build fails while that code is stale, the failure output ends with the same reminder, because the usual symptom is `NoMethodError: undefined method '…' for an instance of Abqari::RenderContext` from a layout calling a helper the server hasn't loaded.
+
 **Watcher backend.** When the `listen` gem is installed (it's a development-group dep), the watcher uses native FS events (FSEvents on macOS, inotify on Linux) — zero overhead between changes. Without `listen`, it falls back to 500ms mtime polling. Both modes debounce events by 100ms so editor tools that fire two events per save don't double-rebuild.
 
 **Transport.** Server-Sent Events (SSE) over plain HTTP — no WebSocket dep, works through any proxy. The browser opens a single persistent EventSource per tab; the server pushes events with sub-50ms median latency. Connection auto-reconnects if the dev server restarts. The script is only injected when `ABQARI_ENV=development`, so production builds are clean.
@@ -2444,6 +2454,8 @@ end
 
 Lifecycle events: `:before_build`, `:after_load_pages`, `:after_generate`, `:after_build`. Filters: `:post_process(html, site, page)`. Full reference in [`docs/plugins.md`](https://github.com/grantrayner/abqari/blob/main/docs/plugins.md).
 
+`bin/serve` doesn't reload plugins, so restart it after editing one. It warns you when it sees the change (see [Livereload](#livereload)).
+
 ## Performance
 
 Build-time and runtime perf are already tuned for typical sites (~50–200 pages). What's baked in:
@@ -2546,13 +2558,14 @@ bin/audit                  # verify nothing regressed
 ```
 
 `abqari new` scaffolds the Gemfile pinned to the current major.minor
-(`gem 'abqari', '~> 1.1'` as of this release), so `bundle update abqari`
-picks up patch releases and bumping the pin is the deliberate action of
-taking a feature release. To track a fork or an unreleased branch
+(`gem 'abqari', '~> 1.2'` as of this release). Bundler reads that as
+`>= 1.2, < 2.0`, so `bundle update abqari` takes minor and patch
+releases but never a major one, which is the release that can need
+changes to your site. To track a fork or an unreleased branch
 instead, swap the line for a git source:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.2'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.2.0'
 ```
 
 The cadence: read [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md) before each upgrade,

data/app/views/partials/_head.html.erb

@@ -325,12 +325,14 @@
   <% end %>
 
   <%# Speculation Rules — prerender posts the user is likely to click
-      (any `/posts/<slug>/` link in the current document). Modern
-      browsers (Chrome, Edge) act on this for measurably-faster
-      navigations; other browsers safely ignore it. The generated
-      `_headers` CSP adds `'inline-speculation-rules'` to script-src so
-      this typed JSON block is allowed under strict CSP (see
-      HeadersFile#apply_speculation_rules). Toggle off with
+      (any `/posts/<slug>/` link in the current document, or whatever
+      `speculation_rules.href_matches` names). Modern browsers (Chrome,
+      Edge) act on this for measurably-faster navigations; other
+      browsers safely ignore it. The body comes from
+      Abqari::SpeculationRules so the generated `_headers` CSP can pin
+      its exact SHA-256 — Chrome ignores `'inline-speculation-rules'`
+      once script-src carries hashes. Emit it byte-for-byte: any change
+      here (even whitespace) breaks the hash. Toggle off with
       `speculation_rules.enabled: false` in config.
 
       The CSP-pinned inline guard JS below honours `prefers-reduced-data`
@@ -339,18 +341,8 @@
       can act on it. This avoids burning bandwidth on metered users.
       The script gets its own SHA256 entry in HeadersFile so strict CSP
       stays clean. %>
-  <% spec_cfg = site.config['speculation_rules'] || {} %>
-  <% if spec_cfg.fetch('enabled', true) %>
-  <%
-    eagerness  = %w[conservative moderate eager].include?(spec_cfg['eagerness'].to_s) ? spec_cfg['eagerness'].to_s : 'moderate'
-    posts_slug = site.collection_config('posts')['slug'].to_s
-    posts_path = posts_slug.empty? ? 'posts' : posts_slug
-  %>
-  <script type="speculationrules" id="abqari-spec-rules">
-  { "prerender": [{ "source": "document",
-    "where": { "href_matches": "/<%= posts_path %>/*" },
-    "eagerness": "<%= eagerness %>" }] }
-  </script>
+  <% if Abqari::SpeculationRules.enabled?(site) %>
+  <script type="speculationrules" id="abqari-spec-rules"><%== Abqari::SpeculationRules.script(site) %></script>
   <script><%== Abqari::SpeculationRulesGuard::SCRIPT %></script>
   <% end %>
 

data/lib/abqari/cli/headers.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'optparse'
+
+module Abqari
+  module CLI
+    # `abqari headers` — print the built `_site/_headers` as rules for
+    # hosts that don't read that file.
+    #
+    # Render static sites ignore `_headers`: the CSP, the security
+    # headers and the year-long `immutable` cache on `/assets/*` all
+    # have to be entered in the dashboard or `render.yaml`. Without the
+    # cache rule Render serves assets with `max-age=0`, so fonts are
+    # revalidated on every page and text flashes in the fallback font.
+    #
+    # It reads the BUILT file rather than computing headers itself, so
+    # the CSP hashes are the ones the site's own bundled engine and
+    # config produced. The global `abqari` on PATH may be a different
+    # version, and one hash (speculation rules) depends on config.
+    #
+    #   bin/build && bundle exec abqari headers
+    #   bundle exec abqari headers path/to/_site
+    class Headers
+      DEFAULT_PATH = File.join('_site', '_headers')
+
+      def self.run(argv)
+        new.run(argv)
+      end
+
+      def run(argv)
+        rest = build_parser.parse(argv)
+        path = resolve(rest.first || DEFAULT_PATH)
+
+        unless File.file?(path)
+          warn "No headers file at #{path}. Run `bin/build` first (it writes _site/_headers)."
+          return false
+        end
+
+        rules = parse(File.read(path, encoding: 'UTF-8'))
+        if rules.empty?
+          warn "#{path} has no header rules."
+          return false
+        end
+
+        puts render_yaml(rules)
+        true
+      end
+
+      # `_headers` blocks: an unindented path line, then indented
+      # `Name: value` lines. Same shape HeadersFile writes, for both the
+      # generated policy and a `headers:` override in site.yml.
+      def parse(text)
+        path = nil
+        text.each_line.with_object([]) do |line, rules|
+          next if line.strip.empty? || line.lstrip.start_with?('#')
+
+          if line.match?(/\A\S/)
+            path = line.strip
+          elsif path
+            name, value = line.strip.split(/:\s*/, 2)
+            rules << { 'path' => path, 'name' => name, 'value' => value.to_s } unless name.to_s.empty?
+          end
+        end
+      end
+
+      private
+
+      def resolve(path)
+        File.directory?(path) ? File.join(path, '_headers') : path
+      end
+
+      # JSON strings are valid YAML double-quoted scalars, so the CSP's
+      # quotes, colons and semicolons survive a paste untouched.
+      def render_yaml(rules)
+        lines = rules.flat_map do |rule|
+          ["  - path: #{rule['path'].to_json}",
+           "    name: #{rule['name']}",
+           "    value: #{rule['value'].to_json}"]
+        end
+        <<~YAML
+          # Render doesn't read _site/_headers. Paste this block under your static
+          # site in render.yaml, or add each rule (Path, Name, Value) in the
+          # dashboard under Settings → Headers.
+          #
+          # The Content-Security-Policy pins SHA-256 hashes of Abqari's inline
+          # scripts, and one depends on config. After upgrading abqari or changing
+          # config/site.yml, rebuild, re-run this, and re-copy any rule that changed.
+          headers:
+          #{lines.join("\n")}
+        YAML
+      end
+
+      def build_parser
+        OptionParser.new do |opts|
+          opts.banner = <<~BANNER
+            Usage: abqari headers [path]
+
+            Prints the built _site/_headers (or the _headers file / output
+            directory at [path]) as Render header rules, ready for render.yaml
+            or the dashboard's Settings → Headers. Run bin/build first.
+          BANNER
+          opts.on('-h', '--help', 'Show this message') { puts opts; exit }
+        end
+      end
+    end
+  end
+end

data/lib/abqari/cli.rb

@@ -5,6 +5,7 @@
 require_relative '../abqari'
 require_relative 'cli/new'
 require_relative 'cli/theme'
+require_relative 'cli/headers'
 
 module Abqari
   # Tiny subcommand dispatcher for the `abqari` global executable.
@@ -29,6 +30,7 @@ module Abqari
     COMMANDS = {
       'new'     => 'Abqari::CLI::New',
       'theme'   => 'Abqari::CLI::Theme',
+      'headers' => 'Abqari::CLI::Headers',
       'version' => :builtin_version,
       '-v'      => :builtin_version,
       '--version' => :builtin_version,
@@ -43,6 +45,7 @@ module Abqari
       Commands:
         new <projectname>    Scaffold a new Abqari site in ./<projectname>/
         theme eject <name>   Copy an engine theme into this site for editing
+        headers [path]       Print the built _site/_headers as Render header rules
         version              Print the engine version
         help                 Show this message
 

data/lib/abqari/headers_file.rb

@@ -4,6 +4,7 @@ require 'uri'
 
 require_relative 'theme_bootstrap'
 require_relative 'plausible_script'
+require_relative 'speculation_rules'
 
 module Abqari
   class HeadersFile
@@ -26,7 +27,7 @@ module Abqari
     BASE_HEADERS = {
       'X-Content-Type-Options'    => 'nosniff',
       'Referrer-Policy'           => 'strict-origin-when-cross-origin',
-      'Permissions-Policy'        => 'camera=(), microphone=(), geolocation=(), interest-cohort=()',
+      'Permissions-Policy'        => 'camera=(), microphone=(), geolocation=()',
       'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains'
     }.freeze
 
@@ -208,21 +209,19 @@ module Abqari
     end
 
     # The `<script type="speculationrules">` block the head emits is an
-    # inline script as far as CSP is concerned, so `script-src` must
-    # carry `'inline-speculation-rules'` (Chrome's keyword for exactly
-    # this) or the block is rejected — no prerender, plus a console
-    # error on every page. Its content is config-dependent (posts slug,
-    # eagerness), so a static hash can't cover it. On by default; the
-    # head gates on `speculation_rules.enabled` not being false.
+    # inline script as far as CSP is concerned. `'inline-speculation-rules'`
+    # is Chrome's keyword for exactly this, but Chrome stops honouring
+    # it once script-src lists a hash — and the base policy always does
+    # — so the block is pinned by its own SHA-256 as well. The body is
+    # config-dependent, so the hash is computed per build from the same
+    # SpeculationRules.script the head emits.
     def apply_speculation_rules(policy)
+      policy['script-src'] << "'#{SpeculationRules.sha256(@site)}'"
       policy['script-src'] << "'inline-speculation-rules'"
     end
 
     def speculation_rules_enabled?
-      cfg = @site.config['speculation_rules']
-      return true unless cfg.is_a?(Hash)
-
-      cfg['enabled'] != false
+      SpeculationRules.enabled?(@site)
     end
 
     # Plausible: external tracker + inline init script. Both need explicit

data/lib/abqari/hooks.rb

@@ -102,10 +102,15 @@ module Abqari
   # `Abqari::Hooks.register` to wire themselves into the lifecycle.
   #
   # Why `load` instead of `require`: `require` caches by path, so a
-  # plugin edit isn't reloaded on subsequent Site.new calls. `load`
-  # re-executes every time — important for the dev-server case where
-  # editing a plugin file should re-register its hooks on the next
-  # incremental rebuild.
+  # second Site.new in the same process (the test suite, an embedder)
+  # would silently skip a plugin it had already seen. `load` re-executes
+  # every time.
+  #
+  # The dev server constructs its Site once, so a plugin edited while
+  # `bin/serve` runs is never re-loaded — and neither is anything the
+  # plugin `require`d. `snapshot` and `changed_since` exist so the
+  # server can say so instead of failing with an unexplained
+  # NoMethodError on the next render.
   #
   # The hook table is NOT cleared between reloads. A plugin that
   # registers in its top-level body will accumulate duplicate
@@ -132,5 +137,55 @@ module Abqari
         raise
       end
     end
+
+    # The site's Ruby as this process has it loaded: every plugin file,
+    # plus every file under the site's `lib/` in `$LOADED_FEATURES` —
+    # in practice, what the plugins required. Maps path → mtime.
+    #
+    # Paths are realpaths because `require_relative` records realpaths
+    # in `$LOADED_FEATURES`; on macOS the temp dir alone (/var →
+    # /private/var) is enough to make a naive prefix match miss.
+    def snapshot(site_root)
+      root = realpath(site_root)
+      return {} unless root
+
+      (plugin_paths(root) | loaded_lib_paths(site_root, root)).each_with_object({}) do |path, mtimes|
+        mtime = mtime_of(path)
+        mtimes[path] = mtime if mtime
+      end
+    end
+
+    # Site-relative paths of Ruby that differs on disk from `snapshot`:
+    # edited, deleted, or a plugin file added after it was taken.
+    def changed_since(snapshot, site_root)
+      root = realpath(site_root)
+      return [] unless root
+
+      edited = snapshot.reject { |path, mtime| mtime_of(path) == mtime }.keys
+      added  = plugin_paths(root) - snapshot.keys
+      (edited + added).map { |path| path.delete_prefix("#{root}/") }.sort
+    end
+
+    def plugin_paths(root)
+      Dir.glob(File.join(root, PLUGIN_GLOB))
+    end
+
+    def loaded_lib_paths(site_root, root)
+      prefixes = [File.expand_path(site_root), root].uniq.map { |r| File.join(r, 'lib', '') }
+      $LOADED_FEATURES.select { |f| prefixes.any? { |p| f.start_with?(p) } }
+                      .filter_map { |f| realpath(f) }
+    end
+
+    def realpath(path)
+      File.realpath(path)
+    rescue SystemCallError
+      nil
+    end
+
+    def mtime_of(path)
+      File.mtime(path)
+    rescue SystemCallError
+      nil
+    end
   end
 end

data/lib/abqari/renderer.rb

@@ -18,21 +18,84 @@ module Abqari
     # Below this many pages, parallelism hurts more than it helps.
     PARALLEL_THRESHOLD = 16
 
+    # Render threads can only overlap file I/O: ERB, markdown and the
+    # post-processors are Ruby and hold the GVL. Past a handful they
+    # add contention, not throughput — a 270-page site built in ~1.07s
+    # on 1, 2, 4 or 8 threads, and 1.18s on 14.
+    MAX_RENDER_THREADS = 4
+
+    # Where a container's CPU quota is exposed. `Etc.nprocessors` reports
+    # the host's CPUs (or the cpuset), not the quota, so a build
+    # container on a large host would otherwise start dozens of threads
+    # to share a fraction of one CPU.
+    CGROUP_ROOT = '/sys/fs/cgroup'
+
     # Default page-size for `paginate: true`. Overridable per-site via
     # `pagination.per_page` config.
     PAGINATION_DEFAULT = 10
 
     # Slow-page detection. When a single page's `write` (render +
-    # post-process + file write) takes longer than this, the renderer
-    # logs a warning with the URL, elapsed time, and a short list of
+    # post-process + file write) uses more CPU than this, the renderer
+    # logs a warning with the URL, the time, and a short list of
     # heuristic causes (output size, image count, code-block count,
-    # TOC presence). End-of-build summary surfaces the slowest few.
+    # TOC presence, a measured plugin filter). End-of-build summary
+    # surfaces the slowest few.
     #
     # Default 500ms — high enough to ignore the normal per-page
     # baseline (~5–50ms), low enough to catch real outliers. Override
     # with `ABQARI_SLOW_PAGE_MS=N` (set to 0 to disable detection).
     SLOW_PAGE_THRESHOLD_MS = (ENV['ABQARI_SLOW_PAGE_MS'] || '500').to_i
 
+    # Pages are timed by the CPU their own thread used, not wall-clock.
+    # Wall-clock includes every other render thread's turn on the GVL
+    # and any CPU throttling, so on a container with a small quota a
+    # 5ms page read as 500ms+ and dozens of pages were reported slow.
+    # The trade: time spent blocked on I/O no longer counts, which
+    # suits a warning whose every listed cause is CPU work.
+    PAGE_CLOCK = defined?(Process::CLOCK_THREAD_CPUTIME_ID) ? Process::CLOCK_THREAD_CPUTIME_ID : Process::CLOCK_MONOTONIC
+
+    # A plugin filter is named as a cause only when it accounts for at
+    # least this share of the slow page's time. It used to be named on
+    # every slow page whenever any `:post_process` hook was registered.
+    PLUGIN_FILTER_SHARE = 0.25
+    PLUGIN_FILTER_MS = :abqari_plugin_filter_ms
+
+    class << self
+      def render_threads
+        [available_cpus, MAX_RENDER_THREADS].min
+      end
+
+      def available_cpus(cgroup_root: CGROUP_ROOT)
+        [Etc.nprocessors, cgroup_cpu_limit(cgroup_root)].compact.min
+      end
+
+      # CPUs granted by the cgroup quota, rounded up, or nil when there
+      # is no quota (or no cgroup to read). v2 first, then v1.
+      def cgroup_cpu_limit(root)
+        v2 = read_cgroup(File.join(root, 'cpu.max'))
+        quota, period = v2 ? v2.split : v1_quota(root)
+        return nil if quota.nil? || quota == 'max' || quota.to_i <= 0 || period.to_i <= 0
+
+        [(quota.to_f / period.to_i).ceil, 1].max
+      end
+
+      private
+
+      def v1_quota(root)
+        %w[cpu cpu,cpuacct].each do |dir|
+          quota = read_cgroup(File.join(root, dir, 'cpu.cfs_quota_us'))
+          return [quota, read_cgroup(File.join(root, dir, 'cpu.cfs_period_us'))] if quota
+        end
+        nil
+      end
+
+      def read_cgroup(path)
+        File.read(path).strip
+      rescue SystemCallError
+        nil
+      end
+    end
+
     # Files whose mtime invalidates every cached page render.
     # `app/views/layouts/` is NOT here — layout files are handled
     # per-layout via `layout_deps_mtime(name)` so editing one layout
@@ -296,7 +359,7 @@ module Abqari
       queue = Thread::Queue.new
       pages.each { |page| queue << page }
 
-      thread_count = [Etc.nprocessors, pages.size].min
+      thread_count = [self.class.render_threads, pages.size].min
       threads = Array.new(thread_count) do
         Thread.new do
           loop do
@@ -335,7 +398,7 @@ module Abqari
       # so plugin output sees the same shape browsers will. Runs BEFORE
       # livereload injection + minification so plugin transformations
       # are minified along with the rest of the page.
-      html = Hooks.run_filter(:post_process, html, @site, page)
+      html = run_plugin_filters(html, page)
       html = inject_livereload(html) if @site.env == :development
       html = Minifier.minify(html) if minify_html?
       html
@@ -352,6 +415,17 @@ module Abqari
 
     private
 
+    # Plugin filters, timed on the page clock so the slow-page report
+    # can say whether they mattered. Read back by `render_one`, which
+    # zeroes the counter before each page.
+    def run_plugin_filters(html, page)
+      t0 = Process.clock_gettime(PAGE_CLOCK, :millisecond)
+      Hooks.run_filter(:post_process, html, @site, page)
+    ensure
+      spent = Process.clock_gettime(PAGE_CLOCK, :millisecond) - t0
+      Thread.current[PLUGIN_FILTER_MS] = (Thread.current[PLUGIN_FILTER_MS] || 0) + spent
+    end
+
     # Fail the build when two pages resolve to the same output file.
     # Without this, whichever page the (parallel) render loop writes
     # last silently wins — nondeterministically build-to-build — and
@@ -400,13 +474,14 @@ module Abqari
     # `SLOW_PAGE_THRESHOLD_MS`. Slow pages are collected for the
     # end-of-build summary.
     def render_one(page, errors, mutex, slow_pages = nil, slow_mutex = nil)
-      t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      Thread.current[PLUGIN_FILTER_MS] = 0
+      t0 = Process.clock_gettime(PAGE_CLOCK, :millisecond)
       page.write
-      elapsed_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0) * 1000).round
+      elapsed_ms = Process.clock_gettime(PAGE_CLOCK, :millisecond) - t0
 
       return unless slow_page?(elapsed_ms) && slow_pages && slow_mutex
 
-      causes = infer_slow_causes(page)
+      causes = infer_slow_causes(page, elapsed_ms: elapsed_ms, plugin_ms: Thread.current[PLUGIN_FILTER_MS])
       Log.warn(slow_page_note(page, elapsed_ms, causes))
       slow_mutex.synchronize { slow_pages << { page: page, ms: elapsed_ms, causes: causes } }
     rescue StandardError, PathSafe::Error => e
@@ -466,7 +541,7 @@ module Abqari
         advice: 'Set `toc: false` in the page\'s frontmatter to skip the TOC for one page, or raise `posts.show.toc.min_headings` to skip shorter pages globally.'
       },
       plugin_filter: {
-        label:  ->(_)    { 'plugin filter' },
+        label:  ->(meta) { "plugin filter #{meta[:ms]}ms" },
         impact: 'A plugin registered against the `:post_process` hook transforms the rendered HTML — the engine can\'t see inside the plugin code.',
         advice: 'Profile the offending plugin in `plugins/*.rb`, or temporarily disable it (rename to `*.rb.off`) to confirm it\'s the bottleneck.'
       }
@@ -478,7 +553,7 @@ module Abqari
     def slow_page_note(page, elapsed_ms, causes)
       url       = page.respond_to?(:url) && page.url ? page.url : page.source_path.to_s
       cause_str = causes.empty? ? '' : " — #{causes.map { |c| c[:label] }.join(' · ')}"
-      "Slow page: #{url} took #{format_ms(elapsed_ms)}#{cause_str}"
+      "Slow page: #{url} took #{format_ms(elapsed_ms)} of CPU#{cause_str}"
     end
 
     # Sample cheap heuristics that often correlate with slow renders.
@@ -490,7 +565,15 @@ module Abqari
     # cause-catalogue key, `label` is the populated short string for
     # the inline warning. The summary uses `type` to look up the
     # full impact + advice from `SLOW_PAGE_CAUSES`.
-    def infer_slow_causes(page)
+    def infer_slow_causes(page, elapsed_ms: 0, plugin_ms: 0)
+      causes = content_causes(page)
+      if plugin_ms.to_i.positive? && plugin_ms >= elapsed_ms * PLUGIN_FILTER_SHARE
+        causes << build_cause(:plugin_filter, ms: plugin_ms)
+      end
+      causes
+    end
+
+    def content_causes(page)
       causes = []
       return causes unless page.respond_to?(:output_path)
       path = page.output_path
@@ -505,7 +588,6 @@ module Abqari
       code_count = html.scan(/<pre\b/i).size
       causes << build_cause(:many_code_blocks, count: code_count) if code_count >= 10
       causes << build_cause(:toc) if html.include?('class="toc"') || html.include?("class='toc'")
-      causes << build_cause(:plugin_filter) if Hooks.registered_events.include?(:post_process)
       causes
     rescue StandardError
       # Cause inference is best-effort — never let a probe failure
@@ -532,7 +614,7 @@ module Abqari
       return if slow_pages.empty?
 
       slow_pages.sort_by! { |sp| -sp[:ms] }
-      Log.info("Slow pages (>#{SLOW_PAGE_THRESHOLD_MS}ms): #{slow_pages.size}")
+      Log.info("Slow pages (>#{SLOW_PAGE_THRESHOLD_MS}ms CPU): #{slow_pages.size}")
       slow_pages.first(5).each do |sp|
         url       = sp[:page].respond_to?(:url) && sp[:page].url ? sp[:page].url : sp[:page].source_path
         cause_str = sp[:causes].empty? ? '' : "  (#{sp[:causes].map { |c| c[:label] }.join(' · ')})"

data/lib/abqari/server.rb

@@ -22,7 +22,13 @@ module Abqari
     PORT_RANGE = (1..65_535).freeze
     POLL_INTERVAL = 0.5
     DEBOUNCE = 0.1
-    WATCH_GLOBS = ['content/**/*', 'app/**/*', 'themes/**/*', 'config/**/*', 'lib/**/*', 'data/**/*'].freeze
+    # `plugins/` is here so a plugin edit is noticed at all. Plugins
+    # load once at Site.new, so the change can only be reported (see
+    # #warn_stale_ruby), not picked up.
+    WATCH_GLOBS = ['content/**/*', 'app/**/*', 'themes/**/*', 'config/**/*', 'lib/**/*', 'data/**/*',
+                   'plugins/**/*'].freeze
+    # More than this and the stale-Ruby warning stops being one line.
+    STALE_RUBY_LISTED = 3
     CSS_PATTERN = /\.css\z/.freeze
 
     # How long to hold an SSE connection open before sending a no-op
@@ -377,6 +383,7 @@ module Abqari
       @mutex.synchronize do
         count = changed_paths.size
         Log.info "Change detected (#{count} file#{'s' unless count == 1}). Rebuilding…"
+        warn_stale_ruby if changed_paths.any? { |p| p.end_with?('.rb') }
         @site.build(incremental: true)
         @scope = changed_paths.all? { |p| p =~ CSS_PATTERN } ? 'css' : 'all'
         @version = Time.now.to_f
@@ -392,6 +399,26 @@ module Abqari
     rescue StandardError => e
       Log.error "Build failed: #{e.class}: #{e.message}"
       e.backtrace&.first(5)&.each { |line| Log.debug "  #{line}" }
+      warn_stale_ruby(after_failure: true)
+    end
+
+    # The change warning alone isn't enough: the usual sequence is
+    # edit the plugin, then edit the layout that calls the new helper,
+    # and by the time every page fails with `undefined method ... for
+    # an instance of Abqari::RenderContext` the warning has scrolled
+    # away. So a failed build repeats it, as an error, last.
+    def warn_stale_ruby(after_failure: false)
+      stale = @site.stale_ruby_sources
+      return if stale.empty?
+
+      files = stale.first(STALE_RUBY_LISTED).join(', ')
+      files += " and #{stale.size - STALE_RUBY_LISTED} more" if stale.size > STALE_RUBY_LISTED
+      if after_failure
+        Log.error "Restart bin/serve: #{files} changed after it started, and it is still running " \
+                  'the old Ruby, so helpers added since are undefined.'
+      else
+        Log.warn "#{files} changed, but bin/serve loads Ruby once at startup — restart it to pick that up."
+      end
     end
 
     # ----------------------------------------------------------------

data/lib/abqari/site.rb

@@ -102,6 +102,15 @@ module Abqari
       # the registrations land in the global hook table and fire on
       # subsequent `Hooks.run` / `run_filter` calls during build.
       PluginLoader.load_from(site_root)
+      # Taken after loading so it covers what the plugins required.
+      @ruby_snapshot = PluginLoader.snapshot(site_root)
+    end
+
+    # Site Ruby (plugins/, and lib/ files they required) that changed on
+    # disk after this Site loaded it. Ruby loads once per process, so a
+    # long-lived Site — the dev server's — keeps running the old code.
+    def stale_ruby_sources
+      PluginLoader.changed_since(@ruby_snapshot, site_root)
     end
 
     # ------------------------------------------------------------------

data/lib/abqari/speculation_rules.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'digest'
+require 'base64'
+
+module Abqari
+  # The `<script type="speculationrules">` block in the head, built here
+  # rather than in `_head.html.erb` so HeadersFile hashes the exact bytes
+  # the page carries and the two can't drift.
+  #
+  # The hash is what lets the block run. Chrome stops honouring the
+  # `'inline-speculation-rules'` keyword once script-src lists any hash,
+  # and ours always does (ThemeBootstrap, SpeculationRulesGuard), so on
+  # its own the keyword left every page logging a CSP violation with
+  # nothing prerendered. The keyword stays in the policy for browsers
+  # that do honour it.
+  #
+  # Unlike the other inline scripts, the body depends on config (the
+  # URL patterns and eagerness), so its hash is per-site, not a constant.
+  module SpeculationRules
+    EAGERNESS         = %w[conservative moderate eager].freeze
+    DEFAULT_EAGERNESS = 'moderate'
+
+    module_function
+
+    def enabled?(site)
+      cfg = site.config['speculation_rules']
+      !cfg.is_a?(Hash) || cfg['enabled'] != false
+    end
+
+    # The surrounding whitespace is what the inline template produced
+    # before the body moved here. Keeping it byte-identical means a hash
+    # already copied into a host that ignores `_headers` (Render) stays
+    # valid across the upgrade for any site that doesn't change config.
+    def script(site)
+      "\n  { \"prerender\": [{ \"source\": \"document\",\n    \"where\": #{where(href_matches(site))},\n    " \
+        "\"eagerness\": #{json(eagerness(site))} }] }\n  "
+    end
+
+    def sha256(site)
+      "sha256-#{Base64.strict_encode64(Digest::SHA256.digest(script(site)))}"
+    end
+
+    # `speculation_rules.href_matches:` — one URL pattern or a list.
+    # Defaults to the posts collection, which is all the engine knows is
+    # article-shaped; a site whose main content is a custom collection
+    # (`/news/*`) names it here.
+    def href_matches(site)
+      patterns = Array(settings(site)['href_matches']).map { |p| p.to_s.strip }.reject(&:empty?)
+      patterns.empty? ? ["/#{posts_path(site)}/*"] : patterns
+    end
+
+    def eagerness(site)
+      value = settings(site)['eagerness'].to_s
+      EAGERNESS.include?(value) ? value : DEFAULT_EAGERNESS
+    end
+
+    def where(patterns)
+      clauses = patterns.map { |p| "{ \"href_matches\": #{json(p)} }" }
+      clauses.one? ? clauses.first : "{ \"or\": [#{clauses.join(', ')}] }"
+    end
+
+    # Same slug the posts collection resolves to (Site#collection_config
+    # takes it straight from config; the defaults carry none).
+    def posts_path(site)
+      collections = site.config['collections']
+      posts = collections.is_a?(Hash) ? collections['posts'] : nil
+      slug = posts.is_a?(Hash) ? posts['slug'].to_s : ''
+      slug.empty? ? 'posts' : slug
+    end
+
+    def settings(site)
+      cfg = site.config['speculation_rules']
+      cfg.is_a?(Hash) ? cfg : {}
+    end
+
+    # Patterns come from site config, but this lands raw inside a
+    # <script>, so a stray `</script>` must not be able to close it.
+    def json(value)
+      Helpers.script_safe_json(value)
+    end
+  end
+end

data/lib/abqari/templates/site_skeleton/.github/workflows/deploy-cloudflare.yml

@@ -19,6 +19,7 @@
 # What this does:
 #   - Installs Ruby + libvips, restores bundle cache
 #   - Installs Pagefind (used only if `search: true` in site.yml)
+#   - Fetches the self-hosted fonts (vendor/fonts/ is git-ignored)
 #   - Builds the site in production mode
 #   - Runs the audit, uploads report as artifact (audit failures don't block deploy)
 #   - Deploys _site/ to Cloudflare Pages via Wrangler
@@ -67,6 +68,14 @@ jobs:
         # Skips silently if pagefind is unused; bin/build only runs it when
         # `search: true` is set in config/site.yml.
 
+      - name: Fetch fonts
+        # vendor/fonts/ is git-ignored, so a fresh checkout has no font
+        # files and the build would ship the site in fallback fonts.
+        # No-op when config/site.yml has no `fonts:`.
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/fetch-fonts
+
       - name: Build site
         env:
           ABQARI_ENV: production

data/lib/abqari/templates/site_skeleton/.github/workflows/deploy-github-pages.yml

@@ -69,6 +69,14 @@ jobs:
           curl -LSf https://pagefind.app/install.sh | bash
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
+      - name: Fetch fonts
+        # vendor/fonts/ is git-ignored, so a fresh checkout has no font
+        # files and the build would ship the site in fallback fonts.
+        # No-op when config/site.yml has no `fonts:`.
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/fetch-fonts
+
       - name: Build site
         env:
           ABQARI_ENV: production

data/lib/abqari/templates/site_skeleton/.github/workflows/deploy-render.yml

@@ -5,9 +5,11 @@
 #
 # (A) Render's own GitHub integration (simplest — no workflow needed):
 #     In the Render dashboard, create a Static Site, connect this repo,
-#     set build command `bundle exec bin/build`, publish directory
-#     `_site`, environment variable `ABQARI_ENV=production`. Render
-#     polls GitHub and rebuilds on push.
+#     set build command
+#     `bundle install && bundle exec bin/fetch-fonts && bundle exec bin/build`,
+#     publish directory `_site`, environment variable
+#     `ABQARI_ENV=production`. Render polls GitHub and rebuilds on push.
+#     (`bin/fetch-fonts` because vendor/fonts/ is git-ignored.)
 #
 # (B) GitHub Actions → Render deploy hook (this workflow). Use when:
 #     - You want CI gates (audit, tests) to block deploys.
@@ -23,8 +25,9 @@
 #      - Variables (tab): add `ENABLE_RENDER = true`
 #
 # When triggered, Render fetches the latest commit and builds in its
-# own environment. This workflow only pings the deploy hook — it
-# doesn't push artifacts. If you need Actions-built artifacts shipped
+# own environment with the build command from option (A) — so that
+# command needs `bin/fetch-fonts` too. This workflow only pings the
+# deploy hook — it doesn't push artifacts. If you need Actions-built artifacts shipped
 # to Render, use Render's REST API directly (more setup; not covered).
 #
 # Three deploy options ship in this repo. Each is independently gated
@@ -63,6 +66,14 @@ jobs:
         with:
           bundler-cache: true
 
+      - name: Fetch fonts
+        # vendor/fonts/ is git-ignored, so a fresh checkout has no font
+        # files and the build would ship the site in fallback fonts.
+        # No-op when config/site.yml has no `fonts:`.
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/fetch-fonts
+
       - name: Build site (CI verification)
         # Build locally as a smoke test so Render's build won't run
         # against code that fails at our own gates. Doesn't ship the

data/lib/abqari/version.rb

@@ -14,5 +14,5 @@
 #
 # Keep this file dependency-free.
 module Abqari
-  VERSION = '1.1.2'
+  VERSION = '1.2.0'
 end

data/lib/abqari.rb

@@ -141,6 +141,7 @@ require_relative 'abqari/minifier'
 require_relative 'abqari/search'
 require_relative 'abqari/syntax_highlighter'
 require_relative 'abqari/theme_bootstrap'
+require_relative 'abqari/speculation_rules'
 require_relative 'abqari/speculation_rules_guard'
 require_relative 'abqari/plausible_script'
 require_relative 'abqari/visualizations'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: abqari
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.2.0
 platform: ruby
 authors:
 - Grant Rayner
@@ -228,6 +228,7 @@ files:
 - lib/abqari/audit/seo.rb
 - lib/abqari/bundle_assets.rb
 - lib/abqari/cli.rb
+- lib/abqari/cli/headers.rb
 - lib/abqari/cli/new.rb
 - lib/abqari/cli/theme.rb
 - lib/abqari/erbi_template.rb
@@ -281,6 +282,7 @@ files:
 - lib/abqari/site_config.rb
 - lib/abqari/site_loader.rb
 - lib/abqari/sitemap.rb
+- lib/abqari/speculation_rules.rb
 - lib/abqari/speculation_rules_guard.rb
 - lib/abqari/syndication.rb
 - lib/abqari/syntax_highlighter.rb