@piercebarney/whs-eleventy 2026.10.2 → 2026.10.3

package/lib/compliance.js

@@ -241,14 +241,22 @@ const CHECKS = {
   },
 
   "client-logic": () => {
-    // executable inline <script> only — JSON-LD (type="application/ld+json") is data.
-    const re =
+    const scriptRe =
       /<script(?![^>]*\ssrc=)(?![^>]*type=["'](?:application\/ld\+json|application\/json)["'])[^>]*>[\s\S]*?\S[\s\S]*?<\/script>/i;
-    const inline = siteHtml().filter((f) => re.test(fs.readFileSync(f, "utf8")));
-    if (inline.length) return { status: FAIL, note: `inline <script> in ${inline.length} page(s)` };
+    const bad = [];
+    for (const f of siteHtml()) {
+      const html = fs.readFileSync(f, "utf8");
+      const inlineScript = scriptRe.test(html);
+      const inlineHandler = parseHtml(html)
+        .querySelectorAll("*")
+        .some((el) => Object.keys(el.attributes).some((a) => /^on/i.test(a)));
+      if (inlineScript || inlineHandler) bad.push(f);
+    }
+    if (bad.length)
+      return { status: FAIL, note: `inline <script> or on*= handler in ${bad.length} page(s)` };
     return {
       status: PASS,
-      note: "loaded modules; calc wiring in a typeof-document block; no inline script",
+      note: "loaded modules; calc wiring in a typeof-document block; no inline script or handler",
     };
   },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.10.2",
+  "version": "2026.10.3",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,25 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-10-03 [non-breaking]
+
+### packages/whs-eleventy
+
+`client-logic`'s CSP `script-src 'self'` check in `lib/compliance.js` only
+looked for inline `<script>` tags, missing inline `onclick=`/`onsubmit=`-style
+event-handler attributes — an equally real violation of the same policy that
+`check-links.js` (a separate mechanism, using real HTML attribute parsing)
+already caught correctly. A real project's compliance sweep showed PASS while
+`npm run check`'s links stage still failed on 109 handler findings — the sweep
+and the links stage disagreed about the same constraint. `client-logic` now
+uses the same attribute-parsing approach `check-links.js` already uses, so
+both mechanisms agree. Confirmed no regression on the reference template:
+zero inline handlers anywhere in its built output, both before and after the
+fix, independently verified twice. No `feedback/` file — found directly in
+this conversation. Fixed in `cfb79e1`.
+
+---
+
 ## 2026-10-02 [non-breaking]
 
 ### templates/commands

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-10-02 · **Status:** active
+**Version:** 2026-10-03 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -1467,7 +1467,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-10-02  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-10-03  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above