@nera-static/nera 1.2.0 → 1.3.0

package/README.md

@@ -19,11 +19,12 @@ npm run dev            # or: nera dev
 | Command | What it does |
 |---|---|
 | `nera new <name>` | Scaffold a new thin Nera site (one dependency: `@nera-static/nera`). Add `--theme <name>` to start from a theme. |
-| `nera build` | Render `pages/` → `public/`. |
+| `nera build` | Render `pages/` → `public/`. With `--check`, then run `nera check` on the result — one command for CI. |
 | `nera dev` | Build, serve `public/`, and rebuild on change with live reload. Watches `pages/`, `config/`, `theme/` and a local theme (`theme: ./themes/<name>`). |
 | `nera serve` | Serve the already-built `public/` folder. |
 | `nera update` | Update the site's Nera packages. On a legacy cloned site, `nera update --migrate` converts it to the thin model. |
-| `nera validate` | Check the site (layouts, includes, YAML) before publishing; exits non-zero on any error. |
+| `nera validate` | Check the site's sources (layouts, includes, YAML) before publishing; exits non-zero on any error. |
+| `nera check` | Check the built `public/` for accessibility, privacy and legal-notice problems (see below). Build first. |
 
 A scaffolded site is a thin project — no vendored engine, no clone. It lists one
 dependency and its scripts call the CLI:
@@ -55,6 +56,61 @@ later stays hidden behind them. Each starter file carries a
 (`theme-shadowed`) while such a file hides a theme's. Delete it to use the
 theme's version, or delete the marker line to keep yours.
 
+## Checking the built site
+
+```bash
+nera build --check    # build, then check — what a CI job runs
+nera check            # check an existing public/ without rebuilding
+```
+
+`nera validate` reads the sources; `nera check` reads the **built** output — the
+page a visitor gets, with its layout, navigation, footer, scripts, stylesheets
+and fonts — and reports what a parser can find there:
+
+- **Accessibility** (`a11y-*`, WCAG 2.2 AA where machine-decidable): `<html
+  lang>`, `<title>`, one `<h1>`, heading jumps, `alt` text, form labels, link
+  names, `<main>`, a skip link, named navigations, duplicate ids, zoom blocked
+  by the viewport.
+- **Privacy** (`privacy-*`, DSGVO / TDDDG): resources loaded from another host
+  (Google Fonts, YouTube, analytics, …), `http://` resources, and — opt-in —
+  scripts using cookies or browser storage.
+- **Legal notice** (`legal-*`, DDG / MStV): every page links to the imprint and
+  the privacy policy, and those pages do not cite a superseded law (TMG, TTDSG,
+  § 55 RStV).
+
+Every finding is a **warning** by default, so `nera check` exits `0`; it exits
+`1` only when a rule you promoted to `error` fires. Without `public/` it stops
+with "run `nera build` first". A template problem is reported once, with the
+number of pages it appears on.
+
+These are hints, not legal advice, and a clean run is not proof of compliance:
+automated checks find only part of the accessibility problems (about a third of
+WCAG failures), and contrast, focus visibility or whether a law applies to your
+site are not checked. Every report ends with that reminder.
+
+Configure it in `config/validate.yaml` (optional):
+
+```yaml
+rules:
+  a11y-img-alt: error         # promote: fails the check
+  a11y-target-blank: warning  # enable an opt-in rule
+  a11y-skip-link: off         # disable
+legal:
+  imprint: { de: /de/impressum.html, en: /en/imprint.html }
+  privacy: { de: /de/datenschutz.html, en: /en/privacy.html }
+privacy:
+  allowed_hosts: [cdn.example.org]   # third-party hosts you have accounted for
+```
+
+Silence a rule on one page with `validate_ignore: [a11y-h1]` in its frontmatter.
+Your own host is `origin` in `config/app.yaml`, else `app_origin` in
+`config/canonical-links.yaml`. Without `legal.*` config, the imprint and privacy
+links are found by their text in German and English only (*Impressum*,
+*Imprint*, *Datenschutz*, *Privacy*, …); pages in other languages need
+`legal.imprint.<lang>` / `legal.privacy.<lang>`. The full rule tables, with the
+WCAG criterion or law behind each rule, are in the
+[`@nera-static/validate` README](https://github.com/seebaermichi/nera-validate#checking-the-built-output).
+
 ## Migrating a cloned (legacy) site
 
 Older Nera sites were git clones that vendored the engine under `src/`. Inside

package/bin/nera.js

@@ -5,6 +5,7 @@ import { runDev } from '../src/commands/dev.js'
 import { runServe } from '../src/commands/serve.js'
 import { runUpdate } from '../src/commands/update.js'
 import { runValidate } from '../src/commands/validate.js'
+import { runCheck } from '../src/commands/check.js'
 
 const [, , command, ...rest] = process.argv
 
@@ -12,11 +13,12 @@ const usage = `Nera — the static site generator CLI
 
 Usage:
   nera new <name>    scaffold a new Nera site (--theme <name> to start from a theme)
-  nera build         render pages/ → public/
+  nera build         render pages/ → public/ (--check to check the output after)
   nera dev           build, serve and live-reload
   nera serve         serve the built public/ folder
   nera update        update Nera packages (or migrate a cloned site with --migrate)
   nera validate      check the site (layouts, includes, YAML) before publish
+  nera check         check the built public/ (accessibility, privacy, legal hints)
 `
 
 try {
@@ -25,7 +27,7 @@ try {
         await runNew(rest)
         break
     case 'build':
-        await runBuild(rest)
+        process.exitCode = await runBuild(rest)
         break
     case 'dev':
         await runDev(rest)
@@ -39,6 +41,9 @@ try {
     case 'validate':
         process.exit(runValidate())
         break
+    case 'check':
+        process.exit(runCheck())
+        break
     default:
         console.log(usage)
         // No command → help (exit 0); an unknown command → error (exit 1).

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nera-static/nera",
-    "version": "1.2.0",
+    "version": "1.3.0",
     "description": "The Nera CLI — scaffold, build, preview and update a Nera static site with one command over the @nera-static/core engine",
     "type": "module",
     "bin": {
@@ -43,7 +43,7 @@
     },
     "dependencies": {
         "@nera-static/core": "^4.12.0",
-        "@nera-static/validate": "^1.0.0",
+        "@nera-static/validate": "^1.2.0",
         "chokidar": "^5.0.0",
         "semver": "^7.8.5",
         "vite": "^8.1.5"

package/src/commands/build.js

@@ -1,8 +1,12 @@
 import run from '@nera-static/core'
+import { runCheck } from './check.js'
 
 // Render the current site (pages/ → public/) using the shared engine. `run`
 // reads config and folders relative to the current working directory, so this
-// builds whichever site the CLI is invoked in.
-export async function runBuild() {
+// builds whichever site the CLI is invoked in. With `--check`, the fresh output
+// is then checked as by `nera check` — one command for CI. Returns the exit
+// code: the check's, or 0 for a plain build.
+export async function runBuild(args = []) {
     await run()
+    return args.includes('--check') ? runCheck() : 0
 }

package/src/commands/check.js

@@ -0,0 +1,12 @@
+import { validateOutput, hasErrors, formatOutputResults } from '@nera-static/validate'
+
+// Check the built output in public/ — accessibility, privacy and legal-notice
+// hints — and print the results. `nera validate` checks the sources; this checks
+// what the build produced, so it needs a build first: validateOutput throws
+// "run `nera build` first" when public/ is missing or holds no HTML. Returns the
+// exit code (1 on any error, 0 otherwise), like runValidate.
+export function runCheck({ cwd = process.cwd() } = {}) {
+    const results = validateOutput({ cwd })
+    console.log(formatOutputResults(results))
+    return hasErrors(results) ? 1 : 0
+}