@meddleware/vitepress-theme 0.0.1 → 0.0.2

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.2] - 2026-11-01
+
+### Changed
+
+- The fixture's accessibility gate is the shared sweep (`defineA11ySuite`): besides axe at AA and AAA in every colour mode × season it now
+  checks reflow at 320 px, 200% text, forced colours, reduced motion and the keyboard (focus visible and not hidden behind the fixed navigation bar).
+- `SECURITY.md` is part of the published files.
+- **The footer no longer lies under the sidebar.** VitePress's own footer hides on a page with a sidebar; ours stays (it holds the legal links), and the fixed full-height sidebar covered its left edge from 60rem, so the © link could not be seen when focused (WCAG 2.4.11). On such a page the footer now starts where the content does, with VitePress's own offsets. Three width tests in every browser hold it.
+- VitePress 2.0.0-alpha.21 (peer and development pin; the landmark edits and the fixture sweep pass unchanged).
+
 ## [0.0.1] - 2026-10-31
 
 ### Added

package/SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Scope
+
+This policy covers `@meddleware/vitepress-theme`: the VitePress theme and site config for MeddleWare documentation sites. It runs at
+build time (the config, and a Vite plugin that edits two components of VitePress's default theme as they compile) and in the browser
+(the theme's components and CSS). It makes no network requests of its own and handles no user data.
+
+It does not cover a consuming site, VitePress, or the content a site publishes.
+
+## What it guarantees
+
+The theme maps VitePress's colours onto the design tokens and fixes two landmark problems in the default theme; its accessibility
+checks are automated (axe, WCAG 2.2 AA and AAA) over a fixture site and are not a substitute for testing a real site with assistive
+technology. The landmark edits are exact string replacements that fail the build, naming the file, if VitePress changes the text they
+rely on.
+
+## Supply chain
+
+Releases are published from this repository's `npm-publish.yml` with npm trusted publishing (OIDC and provenance); tokens are not
+used. The Vite plugin runs in a consumer's build, so a compromised release could run code there: report anything that suggests
+tampering.
+
+## Supported versions
+
+Only the latest published npm version receives fixes.
+
+## Reporting a vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities. Use GitHub's private vulnerability reporting for this
+repository, or email dev@meddleware.co.uk.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/vitepress-theme",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "type": "module",
   "description": "The Meddleware VitePress theme and config: the default theme mapped onto the design tokens (colour mode, seasons, WCAG AAA contrast), a footer, and a shared site config.",
   "license": "0BSD",
@@ -18,7 +18,8 @@
   "files": [
     "src",
     "dist",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "exports": {
     ".": {
@@ -52,15 +53,15 @@
     "shots": "SHOTS=1 playwright test"
   },
   "peerDependencies": {
-    "@meddleware/design-tokens": "^0.1.12",
-    "@meddleware/ui": "^0.1.36",
-    "vitepress": "2.0.0-alpha.20",
+    "@meddleware/design-tokens": "^0.1.13",
+    "@meddleware/ui": "^0.1.38",
+    "vitepress": "2.0.0-alpha.21",
     "vue": "^3.5.0"
   },
   "devDependencies": {
-    "@meddleware/design-tokens": "^0.1.12",
-    "@meddleware/frontend-config": "^0.0.1",
-    "@meddleware/ui": "^0.1.36",
+    "@meddleware/design-tokens": "^0.1.13",
+    "@meddleware/frontend-config": "^0.0.2",
+    "@meddleware/ui": "^0.1.38",
     "@playwright/test": "~1.64.1",
     "@types/node": "~26.6.5",
     "@vue/eslint-config-typescript": "^14.9.0",
@@ -76,7 +77,7 @@
     "stylelint": "^17.16.0",
     "stylelint-config-standard": "^40.0.0",
     "typescript": "~6.0.0",
-    "vitepress": "2.0.0-alpha.20",
+    "vitepress": "2.0.0-alpha.21",
     "vitest": "~5.0.5",
     "vue": "^3.5.44",
     "vue-eslint-parser": "^10.4.1",

package/src/MeddlewareLayout.vue

@@ -1,17 +1,22 @@
 <script setup lang="ts">
 // The default layout with the Meddleware footer: the copyright line and the contact of the organisation, in a `contentinfo` landmark.
-import DefaultTheme from 'vitepress/theme'
+import DefaultTheme, { useLayout } from 'vitepress/theme'
 import { AppFooter, CopyrightLine } from '@meddleware/ui'
 
 const { Layout } = DefaultTheme
+// VitePress's own footer hides itself on a page with a sidebar. This one stays (it carries the legal links), so on such a page it starts
+// where the content does, as the content does (theme.css), instead of lying under the fixed sidebar (WCAG 2.4.11).
+const { hasSidebar } = useLayout()
 </script>
 
 <template>
   <Layout>
     <template #layout-bottom>
-      <AppFooter>
-        <CopyrightLine symbol-variant="kopimi" organisation-name="Meddleware" rights-statement="jam" />
-      </AppFooter>
+      <div class="mw-layout-footer" :class="{ 'has-sidebar': hasSidebar }">
+        <AppFooter>
+          <CopyrightLine symbol-variant="kopimi" organisation-name="Meddleware" rights-statement="jam" />
+        </AppFooter>
+      </div>
     </template>
   </Layout>
 </template>

package/src/theme.css

@@ -150,3 +150,17 @@ a.VPFeature .title,
 a.VPFeature .link-text {
   text-decoration: underline;
 }
+
+/* The footer is below the page content, and the sidebar is fixed and runs the full height of the viewport (from 60rem): on a page that has
+ * one, the footer starts where the content does (the same offsets as VitePress's VPContent), or its links are covered. */
+@media (width >= 60rem) {
+  .mw-layout-footer.has-sidebar {
+    padding-inline-start: var(--vp-sidebar-width);
+  }
+}
+
+@media (width >= 90rem) {
+  .mw-layout-footer.has-sidebar {
+    padding-inline-start: calc((100% - var(--vp-layout-max-width)) / 2 + var(--vp-sidebar-width));
+  }
+}