@piercebarney/whs-eleventy 2026.9.22 → 2026.9.23

package/lib/check-links.js

@@ -14,20 +14,32 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { parse } = require("node-html-parser");
-const { projectRequire, tryProjectRequire } = require("./_project.js");
+const { tryProjectRequire } = require("./_project.js");
 
 const SITE = "_site";
-const site = projectRequire("src/_data/site.js");
-const thirdparties = projectRequire("src/_data/thirdparties.js");
+const site = tryProjectRequire("src/_data/site.js", null);
+const thirdparties = tryProjectRequire("src/_data/thirdparties.js", null);
+
+const errors = [];
+const err = (file, msg) => errors.push(`${file}: ${msg}`);
+
+// Reported exactly once, here — every origin-dependent check below skips
+// silently on a missing site/thirdparties, relying on these two lines to
+// explain why, rather than one err() per guarded call site.
+if (!site) err("src/_data/site.js", "missing — cannot verify links against the site's own origin");
+if (!thirdparties) {
+  err("src/_data/thirdparties.js", "missing — cannot verify declared third-party origins");
+}
+const canCheckOrigins = !!(site && thirdparties);
 
 // The /glossary/#slug check runs only when add-ons/glossary/ is applied
 // (it ships src/_data/glossary.js). No file → no glossary → the check is inert.
 const glossary = tryProjectRequire("src/_data/glossary.js");
 const glossarySlugs = new Set(glossary ? glossary.map((t) => t.slug) : []);
 const declaredOrigins = thirdparties
-  .flatMap((t) => [t.origin, ...(t.cspOrigins || [])])
-  .filter(Boolean);
-const allowedOrigins = new Set([site.url, ...declaredOrigins]);
+  ? thirdparties.flatMap((t) => [t.origin, ...(t.cspOrigins || [])]).filter(Boolean)
+  : [];
+const allowedOrigins = new Set([...(site ? [site.url] : []), ...declaredOrigins]);
 
 // Privacy/ad opt-out destinations that policy prose links to, plus the
 // search-engine webmaster consoles the /audit/ page links to. All are
@@ -55,9 +67,6 @@ const REQUIRED_LD = {
   Article: ["headline"],
 };
 
-const errors = [];
-const err = (file, msg) => errors.push(`${file}: ${msg}`);
-
 // ---- CSP <-> origin manifest agreement -------------------------------------
 (function checkCsp() {
   let toml;
@@ -78,6 +87,7 @@ const err = (file, msg) => errors.push(`${file}: ${msg}`);
       }
     }),
   );
+  if (!thirdparties) return; // reported once, above, when the load failed
   // Every origin the CSP grants must be a declared party — matched against each
   // party's `origin` or its `cspOrigins` list. (The reverse isn't required: a
   // host / form processor is in thirdparties.js but is not a browser-resource
@@ -132,6 +142,7 @@ function checkRef(file, pageUrl, raw, { external = true, isHyperlink = false } =
 
   if (/^https?:\/\//i.test(v)) {
     if (!external) return;
+    if (!canCheckOrigins) return; // reported once, above, when the load failed
     let origin;
     try {
       origin = new URL(v).origin;
@@ -213,7 +224,7 @@ for (const f of htmlFiles) {
       } catch {
         origin = "";
       }
-      if (origin && origin !== site.url) {
+      if (canCheckOrigins && origin && origin !== site.url) {
         const rel2 = (a.getAttribute("rel") || "").toLowerCase();
         if (!/\bnoopener\b|\bnoreferrer\b/.test(rel2)) {
           err(f, `external <a> without rel="noopener": ${href}`);
@@ -256,6 +267,7 @@ for (const f of htmlFiles) {
 // dynamically-built URL), but it catches the common case: a hardcoded
 // external origin in client JS that was never added to the manifest.
 (function checkJsOrigins() {
+  if (!canCheckOrigins) return; // reported once, above, when the load failed
   const jsFiles = allFiles.filter((f) => f.endsWith(".js") && !f.endsWith("links-report.json"));
   const ORIGIN_LITERAL = /(?:fetch|new\s+URL)\s*\(\s*[`'"](https?:\/\/[^`'"\s]+)[`'"]/g;
   for (const f of jsFiles) {

package/lib/compliance.js

@@ -198,6 +198,13 @@ const CHECKS = {
   },
 
   styling: () => {
+    const njkRoots = ["src", "static", "scripts"].map((d) => path.join(ROOT, d));
+    const anyNjk = njkRoots.some((r) => walk(r).some((f) => f.endsWith(".njk")));
+    if (!anyNjk)
+      return {
+        status: MANUAL,
+        note: "no .njk files found — can't verify against a non-.njk layout",
+      };
     const shift = grepSrc(/style=(["']).*?\1/, [".njk"]);
     return shift.length
       ? { status: FAIL, note: `inline style= in ${shift.join(", ")}` }
@@ -350,8 +357,14 @@ const CHECKS = {
         (f) =>
           /\.(css|js|njk)$/.test(f) && f !== "src/_data/brand.js" && f !== "src/tokens.css.njk",
       );
+    const existing = targets.filter((rel) => has(rel));
+    if (existing.length === 0)
+      return {
+        status: MANUAL,
+        note: "no static/style.css, scripts/og-card.js|icons.js, or src/ found — can't verify against a non-standard-layout project",
+      };
     const bad = [];
-    for (const rel of targets) {
+    for (const rel of existing) {
       const t = read(rel);
       if (!t) continue;
       for (const line of t.split("\n")) {
@@ -489,6 +502,11 @@ const CHECKS = {
   },
 
   "domain-tests": () => {
+    if (!has("static/calc"))
+      return {
+        status: MANUAL,
+        note: "no static/calc/ — can't verify against a non-standard-layout project",
+      };
     const mods = walk(path.join(ROOT, "static/calc"))
       .filter((f) => f.endsWith(".js"))
       .map((f) => path.basename(f, ".js"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.22",
+  "version": "2026.9.23",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,58 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-09-23 — Republish 2026-09-22-2 as a clean bare-date version [non-breaking]
+
+### packages/whs-eleventy
+
+No new content beyond what's already documented below. This bump republishes
+everything already documented under the 2026-09-22-2 entry (the
+`check-links.js` no-`src/`-layout crash fix) as a clean bare-date version,
+specifically to trigger the npm publish of `@piercebarney/whs-eleventy` that
+the 2026-09-22-2 same-day-suffix mechanism deliberately does not trigger on
+its own (per that suffix's own documented exception in `CLAUDE.md`'s
+Versions section: a suffixed pin gets no git tag and no npm publish).
+
+This release also newly documents a second, separately-landed fix shipping
+in the same publish: `styling`, `brand-source`, and `domain-tests` in
+`lib/compliance.js` each built their scan-target list from hardcoded
+standard-layout paths and treated "found zero files to scan" as "found zero
+violations" — a false `PASS` on a project whose layout doesn't match the
+standard yet, rather than the `MANUAL`/can't-verify result the other checks
+correctly report in the same situation. Found on a real adoption and filed
+as `feedback/2026-09-22-compliance-silent-pass-on-nonstandard-layout.md`;
+fixed in `96aeac2` by checking whether each check's target(s) exist at all
+before scanning — an existing-but-empty target (e.g. `static/calc/` with no
+modules yet) still correctly reports `PASS`.
+
+`core.md`, `stacks/*.md`, `index.json`, and every `standard-version:` pin
+move from `2026-09-22-2` to `2026-09-23`; `packages/whs-eleventy/package.json`
+moves to the corresponding npm version, `2026.9.23`. No `core.md` chapter,
+`stacks/*.md`, or `index.json` content changed.
+
+---
+
+## 2026-09-22-2 [non-breaking]
+
+### packages/whs-eleventy
+
+`check-links.js` had the same crash class as `doctor.js`'s already-fixed
+`MODULE_NOT_FOUND`: an unconditional module-top-level
+`projectRequire("src/_data/site.js")` (and `thirdparties.js`) that throws on
+a project with no `src/` tree, instead of reporting the missing layout as a
+finding — found while reconciling a real adoption's migration backlog and
+filed as `feedback/2026-09-22-check-links-same-crash-unfixed.md`. Fixed in
+`e73de7d`: the two missing-file conditions are now reported exactly once,
+and each dependent origin-validation check (internal-link/anchor/asset/
+JSON-LD) skips silently rather than crashing or false-positiving. This is a
+same-day suffix release — per `CLAUDE.md`'s Versions section it deliberately
+does **not** get a git tag or npm publish; `packages/whs-eleventy/package.json`
+stays at `2026.9.22`, which does not yet include this fix, until a future
+bare-date promotion release republishes it. No `core.md` chapter,
+`stacks/*.md`, or `index.json` content changed.
+
+---
+
 ## 2026-09-22 [non-breaking]
 
 ### packages/whs-eleventy

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-09-22 · **Status:** active
+**Version:** 2026-09-23 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -1467,7 +1467,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-09-22  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-09-23  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above