@nera-static/nera 1.1.0 → 1.3.0

package/README.md

@@ -19,11 +19,12 @@ npm run dev            # or: nera dev
 | Command | What it does |
 |---|---|
 | `nera new <name>` | Scaffold a new thin Nera site (one dependency: `@nera-static/nera`). Add `--theme <name>` to start from a theme. |
-| `nera build` | Render `pages/` → `public/`. |
-| `nera dev` | Build, serve `public/`, and rebuild on change with live reload. |
+| `nera build` | Render `pages/` → `public/`. With `--check`, then run `nera check` on the result — one command for CI. |
+| `nera dev` | Build, serve `public/`, and rebuild on change with live reload. Watches `pages/`, `config/`, `theme/` and a local theme (`theme: ./themes/<name>`). |
 | `nera serve` | Serve the already-built `public/` folder. |
 | `nera update` | Update the site's Nera packages. On a legacy cloned site, `nera update --migrate` converts it to the thin model. |
-| `nera validate` | Check the site (layouts, includes, YAML) before publishing; exits non-zero on any error. |
+| `nera validate` | Check the site's sources (layouts, includes, YAML) before publishing; exits non-zero on any error. |
+| `nera check` | Check the built `public/` for accessibility, privacy and legal-notice problems (see below). Build first. |
 
 A scaffolded site is a thin project — no vendored engine, no clone. It lists one
 dependency and its scripts call the CLI:
@@ -55,6 +56,61 @@ later stays hidden behind them. Each starter file carries a
 (`theme-shadowed`) while such a file hides a theme's. Delete it to use the
 theme's version, or delete the marker line to keep yours.
 
+## Checking the built site
+
+```bash
+nera build --check    # build, then check — what a CI job runs
+nera check            # check an existing public/ without rebuilding
+```
+
+`nera validate` reads the sources; `nera check` reads the **built** output — the
+page a visitor gets, with its layout, navigation, footer, scripts, stylesheets
+and fonts — and reports what a parser can find there:
+
+- **Accessibility** (`a11y-*`, WCAG 2.2 AA where machine-decidable): `<html
+  lang>`, `<title>`, one `<h1>`, heading jumps, `alt` text, form labels, link
+  names, `<main>`, a skip link, named navigations, duplicate ids, zoom blocked
+  by the viewport.
+- **Privacy** (`privacy-*`, DSGVO / TDDDG): resources loaded from another host
+  (Google Fonts, YouTube, analytics, …), `http://` resources, and — opt-in —
+  scripts using cookies or browser storage.
+- **Legal notice** (`legal-*`, DDG / MStV): every page links to the imprint and
+  the privacy policy, and those pages do not cite a superseded law (TMG, TTDSG,
+  § 55 RStV).
+
+Every finding is a **warning** by default, so `nera check` exits `0`; it exits
+`1` only when a rule you promoted to `error` fires. Without `public/` it stops
+with "run `nera build` first". A template problem is reported once, with the
+number of pages it appears on.
+
+These are hints, not legal advice, and a clean run is not proof of compliance:
+automated checks find only part of the accessibility problems (about a third of
+WCAG failures), and contrast, focus visibility or whether a law applies to your
+site are not checked. Every report ends with that reminder.
+
+Configure it in `config/validate.yaml` (optional):
+
+```yaml
+rules:
+  a11y-img-alt: error         # promote: fails the check
+  a11y-target-blank: warning  # enable an opt-in rule
+  a11y-skip-link: off         # disable
+legal:
+  imprint: { de: /de/impressum.html, en: /en/imprint.html }
+  privacy: { de: /de/datenschutz.html, en: /en/privacy.html }
+privacy:
+  allowed_hosts: [cdn.example.org]   # third-party hosts you have accounted for
+```
+
+Silence a rule on one page with `validate_ignore: [a11y-h1]` in its frontmatter.
+Your own host is `origin` in `config/app.yaml`, else `app_origin` in
+`config/canonical-links.yaml`. Without `legal.*` config, the imprint and privacy
+links are found by their text in German and English only (*Impressum*,
+*Imprint*, *Datenschutz*, *Privacy*, …); pages in other languages need
+`legal.imprint.<lang>` / `legal.privacy.<lang>`. The full rule tables, with the
+WCAG criterion or law behind each rule, are in the
+[`@nera-static/validate` README](https://github.com/seebaermichi/nera-validate#checking-the-built-output).
+
 ## Migrating a cloned (legacy) site
 
 Older Nera sites were git clones that vendored the engine under `src/`. Inside

package/bin/nera.js

@@ -5,6 +5,7 @@ import { runDev } from '../src/commands/dev.js'
 import { runServe } from '../src/commands/serve.js'
 import { runUpdate } from '../src/commands/update.js'
 import { runValidate } from '../src/commands/validate.js'
+import { runCheck } from '../src/commands/check.js'
 
 const [, , command, ...rest] = process.argv
 
@@ -12,11 +13,12 @@ const usage = `Nera — the static site generator CLI
 
 Usage:
   nera new <name>    scaffold a new Nera site (--theme <name> to start from a theme)
-  nera build         render pages/ → public/
+  nera build         render pages/ → public/ (--check to check the output after)
   nera dev           build, serve and live-reload
   nera serve         serve the built public/ folder
   nera update        update Nera packages (or migrate a cloned site with --migrate)
   nera validate      check the site (layouts, includes, YAML) before publish
+  nera check         check the built public/ (accessibility, privacy, legal hints)
 `
 
 try {
@@ -25,7 +27,7 @@ try {
         await runNew(rest)
         break
     case 'build':
-        await runBuild(rest)
+        process.exitCode = await runBuild(rest)
         break
     case 'dev':
         await runDev(rest)
@@ -39,6 +41,9 @@ try {
     case 'validate':
         process.exit(runValidate())
         break
+    case 'check':
+        process.exit(runCheck())
+        break
     default:
         console.log(usage)
         // No command → help (exit 0); an unknown command → error (exit 1).

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nera-static/nera",
-    "version": "1.1.0",
+    "version": "1.3.0",
     "description": "The Nera CLI — scaffold, build, preview and update a Nera static site with one command over the @nera-static/core engine",
     "type": "module",
     "bin": {
@@ -42,8 +42,8 @@
         "access": "public"
     },
     "dependencies": {
-        "@nera-static/core": "^4.9.0",
-        "@nera-static/validate": "^1.0.0",
+        "@nera-static/core": "^4.12.0",
+        "@nera-static/validate": "^1.2.0",
         "chokidar": "^5.0.0",
         "semver": "^7.8.5",
         "vite": "^8.1.5"

package/src/commands/build.js

@@ -1,8 +1,12 @@
 import run from '@nera-static/core'
+import { runCheck } from './check.js'
 
 // Render the current site (pages/ → public/) using the shared engine. `run`
 // reads config and folders relative to the current working directory, so this
-// builds whichever site the CLI is invoked in.
-export async function runBuild() {
+// builds whichever site the CLI is invoked in. With `--check`, the fresh output
+// is then checked as by `nera check` — one command for CI. Returns the exit
+// code: the check's, or 0 for a plain build.
+export async function runBuild(args = []) {
     await run()
+    return args.includes('--check') ? runCheck() : 0
 }

package/src/commands/check.js

@@ -0,0 +1,12 @@
+import { validateOutput, hasErrors, formatOutputResults } from '@nera-static/validate'
+
+// Check the built output in public/ — accessibility, privacy and legal-notice
+// hints — and print the results. `nera validate` checks the sources; this checks
+// what the build produced, so it needs a build first: validateOutput throws
+// "run `nera build` first" when public/ is missing or holds no HTML. Returns the
+// exit code (1 on any error, 0 otherwise), like runValidate.
+export function runCheck({ cwd = process.cwd() } = {}) {
+    const results = validateOutput({ cwd })
+    console.log(formatOutputResults(results))
+    return hasErrors(results) ? 1 : 0
+}

package/src/commands/dev.js

@@ -1,5 +1,6 @@
 import fssync from 'fs'
-import run from '@nera-static/core'
+import path from 'path'
+import run, { resolveSiteModel } from '@nera-static/core'
 import { startServer } from './serve.js'
 
 // Build once, serve `public/`, then rebuild on any change to the site's
@@ -19,13 +20,8 @@ export async function runDev(args = []) {
 
     const { default: chokidar } = await import('chokidar')
 
-    // Presentation lives under theme/ in the current layout, or the deprecated
-    // root views/ on an unmigrated site — watch whichever exists.
-    const watchDirs = [
-        'pages',
-        'config',
-        fssync.existsSync('theme') ? 'theme' : 'views',
-    ].filter((d) => fssync.existsSync(d))
+    const watched = new Set(watchTargets())
+    const watcher = chokidar.watch([...watched], { ignoreInitial: true })
 
     // Serialise rebuilds: coalesce changes that land mid-build into one re-run.
     let building = false
@@ -42,22 +38,59 @@ export async function runDev(args = []) {
             console.error('❌ Build error:', err.message)
         }
         building = false
+        // config/app.yaml may now name a different local theme — start
+        // watching it too. A dropped one stays watched; that only costs an
+        // extra rebuild if it is edited.
+        for (const dir of watchTargets()) {
+            if (!watched.has(dir)) {
+                watched.add(dir)
+                watcher.add(dir)
+            }
+        }
         if (queued) {
             queued = false
             await rebuild()
         }
     }
 
-    chokidar
-        .watch(watchDirs, { ignoreInitial: true })
-        .on('all', async (event, filePath) => {
-            console.log(`↻ ${event} ${filePath} — rebuilding`)
-            await rebuild()
-        })
+    watcher.on('all', async (event, filePath) => {
+        console.log(
+            `↻ ${event} ${path.relative(process.cwd(), filePath)} — rebuilding`
+        )
+        await rebuild()
+    })
 
     return server
 }
 
+// What a rebuild depends on: pages/, config/, the site's presentation folder
+// — theme/ in the current layout, or the deprecated root views/ on an
+// unmigrated site — and a LOCAL theme (`theme: ./themes/classic`, or the same
+// via NERA_THEME), which lives outside all of those. The theme is resolved
+// through core, so the watcher follows exactly the spec the build uses. Only
+// the theme's payload folders are watched, never its root: `theme: .` makes
+// the root the site itself, and watching public/ would rebuild forever. An
+// installed theme package under node_modules is left alone: it changes only on
+// npm install, and watching node_modules is expensive.
+export function watchTargets(cwd = process.cwd()) {
+    const dirs = [
+        'pages',
+        'config',
+        fssync.existsSync(path.join(cwd, 'theme')) ? 'theme' : 'views',
+    ].map((d) => path.join(cwd, d))
+
+    const { theme } = resolveSiteModel({ cwd })
+    if (theme && !theme.root.split(path.sep).includes('node_modules')) {
+        dirs.push(
+            theme.viewsRoot,
+            theme.assetsRoot,
+            path.join(theme.root, 'config')
+        )
+    }
+
+    return [...new Set(dirs)].filter((d) => fssync.existsSync(d))
+}
+
 const parsePort = (args) => {
     const i = args.indexOf('--port')
     const val = i >= 0 ? Number(args[i + 1]) : NaN