@piercebarney/whs-eleventy 2026.9.22 → 2026.9.24

package/lib/check-links.js

@@ -14,20 +14,32 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { parse } = require("node-html-parser");
-const { projectRequire, tryProjectRequire } = require("./_project.js");
+const { tryProjectRequire } = require("./_project.js");
 
 const SITE = "_site";
-const site = projectRequire("src/_data/site.js");
-const thirdparties = projectRequire("src/_data/thirdparties.js");
+const site = tryProjectRequire("src/_data/site.js", null);
+const thirdparties = tryProjectRequire("src/_data/thirdparties.js", null);
+
+const errors = [];
+const err = (file, msg) => errors.push(`${file}: ${msg}`);
+
+// Reported exactly once, here — every origin-dependent check below skips
+// silently on a missing site/thirdparties, relying on these two lines to
+// explain why, rather than one err() per guarded call site.
+if (!site) err("src/_data/site.js", "missing — cannot verify links against the site's own origin");
+if (!thirdparties) {
+  err("src/_data/thirdparties.js", "missing — cannot verify declared third-party origins");
+}
+const canCheckOrigins = !!(site && thirdparties);
 
 // The /glossary/#slug check runs only when add-ons/glossary/ is applied
 // (it ships src/_data/glossary.js). No file → no glossary → the check is inert.
 const glossary = tryProjectRequire("src/_data/glossary.js");
 const glossarySlugs = new Set(glossary ? glossary.map((t) => t.slug) : []);
 const declaredOrigins = thirdparties
-  .flatMap((t) => [t.origin, ...(t.cspOrigins || [])])
-  .filter(Boolean);
-const allowedOrigins = new Set([site.url, ...declaredOrigins]);
+  ? thirdparties.flatMap((t) => [t.origin, ...(t.cspOrigins || [])]).filter(Boolean)
+  : [];
+const allowedOrigins = new Set([...(site ? [site.url] : []), ...declaredOrigins]);
 
 // Privacy/ad opt-out destinations that policy prose links to, plus the
 // search-engine webmaster consoles the /audit/ page links to. All are
@@ -55,9 +67,6 @@ const REQUIRED_LD = {
   Article: ["headline"],
 };
 
-const errors = [];
-const err = (file, msg) => errors.push(`${file}: ${msg}`);
-
 // ---- CSP <-> origin manifest agreement -------------------------------------
 (function checkCsp() {
   let toml;
@@ -78,6 +87,7 @@ const err = (file, msg) => errors.push(`${file}: ${msg}`);
       }
     }),
   );
+  if (!thirdparties) return; // reported once, above, when the load failed
   // Every origin the CSP grants must be a declared party — matched against each
   // party's `origin` or its `cspOrigins` list. (The reverse isn't required: a
   // host / form processor is in thirdparties.js but is not a browser-resource
@@ -125,13 +135,14 @@ function outputHas(urlPath) {
   return fs.existsSync(asFile + "/index.html") || fs.existsSync(asFile + ".html");
 }
 
-function checkRef(file, pageUrl, raw, { external = true, isHyperlink = false } = {}) {
+function checkRef(file, pageUrl, resolveBase, raw, { external = true, isHyperlink = false } = {}) {
   if (!raw) return;
   const v = raw.trim();
   if (v === "" || v.startsWith("data:") || v.startsWith("mailto:") || v.startsWith("tel:")) return;
 
   if (/^https?:\/\//i.test(v)) {
     if (!external) return;
+    if (!canCheckOrigins) return; // reported once, above, when the load failed
     let origin;
     try {
       origin = new URL(v).origin;
@@ -174,13 +185,15 @@ function checkRef(file, pageUrl, raw, { external = true, isHyperlink = false } =
     return;
   }
   // relative path — resolve against the page dir
-  const resolved = path.posix.join(pageUrl, v);
+  const resolved = path.posix.join(resolveBase, v);
   if (!outputHas(resolved)) err(file, `relative reference does not resolve: ${v}`);
 }
 
 for (const f of htmlFiles) {
   const rel = "/" + path.relative(SITE, f).replace(/\\/g, "/");
   const pageUrl = rel.replace(/index\.html$/, "");
+  const dir = path.posix.dirname(rel);
+  const resolveBase = dir === "/" ? "/" : dir + "/";
   const root = parse(fs.readFileSync(f, "utf8"));
 
   // CSP-safety: the strict CSP (script-src 'self'; style-src 'self') rejects
@@ -205,7 +218,7 @@ for (const f of htmlFiles) {
 
   root.querySelectorAll("a[href]").forEach((a) => {
     const href = a.getAttribute("href");
-    checkRef(f, pageUrl, href, { isHyperlink: true });
+    checkRef(f, pageUrl, resolveBase, href, { isHyperlink: true });
     if (/^https?:\/\//i.test(href || "")) {
       let origin;
       try {
@@ -213,7 +226,7 @@ for (const f of htmlFiles) {
       } catch {
         origin = "";
       }
-      if (origin && origin !== site.url) {
+      if (canCheckOrigins && origin && origin !== site.url) {
         const rel2 = (a.getAttribute("rel") || "").toLowerCase();
         if (!/\bnoopener\b|\bnoreferrer\b/.test(rel2)) {
           err(f, `external <a> without rel="noopener": ${href}`);
@@ -222,12 +235,18 @@ for (const f of htmlFiles) {
     }
   });
 
-  root.querySelectorAll("link[href]").forEach((l) => checkRef(f, pageUrl, l.getAttribute("href")));
-  root.querySelectorAll("script[src]").forEach((s) => checkRef(f, pageUrl, s.getAttribute("src")));
-  root.querySelectorAll("img[src]").forEach((i) => checkRef(f, pageUrl, i.getAttribute("src")));
+  root
+    .querySelectorAll("link[href]")
+    .forEach((l) => checkRef(f, pageUrl, resolveBase, l.getAttribute("href")));
+  root
+    .querySelectorAll("script[src]")
+    .forEach((s) => checkRef(f, pageUrl, resolveBase, s.getAttribute("src")));
+  root
+    .querySelectorAll("img[src]")
+    .forEach((i) => checkRef(f, pageUrl, resolveBase, i.getAttribute("src")));
   root
     .querySelectorAll('meta[property="og:image"], meta[name="twitter:image"]')
-    .forEach((m) => checkRef(f, pageUrl, m.getAttribute("content")));
+    .forEach((m) => checkRef(f, pageUrl, resolveBase, m.getAttribute("content")));
 
   root.querySelectorAll('script[type="application/ld+json"]').forEach((s, i) => {
     let data;
@@ -256,6 +275,7 @@ for (const f of htmlFiles) {
 // dynamically-built URL), but it catches the common case: a hardcoded
 // external origin in client JS that was never added to the manifest.
 (function checkJsOrigins() {
+  if (!canCheckOrigins) return; // reported once, above, when the load failed
   const jsFiles = allFiles.filter((f) => f.endsWith(".js") && !f.endsWith("links-report.json"));
   const ORIGIN_LITERAL = /(?:fetch|new\s+URL)\s*\(\s*[`'"](https?:\/\/[^`'"\s]+)[`'"]/g;
   for (const f of jsFiles) {

package/lib/compliance.js

@@ -198,6 +198,13 @@ const CHECKS = {
   },
 
   styling: () => {
+    const njkRoots = ["src", "static", "scripts"].map((d) => path.join(ROOT, d));
+    const anyNjk = njkRoots.some((r) => walk(r).some((f) => f.endsWith(".njk")));
+    if (!anyNjk)
+      return {
+        status: MANUAL,
+        note: "no .njk files found — can't verify against a non-.njk layout",
+      };
     const shift = grepSrc(/style=(["']).*?\1/, [".njk"]);
     return shift.length
       ? { status: FAIL, note: `inline style= in ${shift.join(", ")}` }
@@ -350,8 +357,14 @@ const CHECKS = {
         (f) =>
           /\.(css|js|njk)$/.test(f) && f !== "src/_data/brand.js" && f !== "src/tokens.css.njk",
       );
+    const existing = targets.filter((rel) => has(rel));
+    if (existing.length === 0)
+      return {
+        status: MANUAL,
+        note: "no static/style.css, scripts/og-card.js|icons.js, or src/ found — can't verify against a non-standard-layout project",
+      };
     const bad = [];
-    for (const rel of targets) {
+    for (const rel of existing) {
       const t = read(rel);
       if (!t) continue;
       for (const line of t.split("\n")) {
@@ -489,6 +502,11 @@ const CHECKS = {
   },
 
   "domain-tests": () => {
+    if (!has("static/calc"))
+      return {
+        status: MANUAL,
+        note: "no static/calc/ — can't verify against a non-standard-layout project",
+      };
     const mods = walk(path.join(ROOT, "static/calc"))
       .filter((f) => f.endsWith(".js"))
       .map((f) => path.basename(f, ".js"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.22",
+  "version": "2026.9.24",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,86 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-09-24 [non-breaking]
+
+### packages/whs-eleventy
+
+`check-links.js` resolved a relative reference (`favicon.svg`, `styles.css`,
+etc.) against `pageUrl`, a literal `index.html`-stripped path — correct for
+directory-style permalinks (`/foo/index.html` → `/foo/`) but wrong for a
+flat, non-directory permalink like `privacy.html`, where `pageUrl` stayed
+`/privacy.html` and `path.posix.join` then treated it as if it were a
+directory, producing false `relative reference does not resolve` findings
+for files that genuinely exist and resolve correctly in a real browser.
+`pageUrl` is also used for same-page `#anchor` lookups, where the literal
+value is exactly what's needed — so the fix doesn't touch `pageUrl` itself.
+Instead `checkRef()` now takes a separate `resolveBase` (the directory
+containing the page, via `path.posix.dirname`) used only for relative-
+reference resolution, leaving anchor lookups untouched. Found while
+covenant-in-color's adoption session ran the newly-fixed `npm run links` for
+the first time and filed as
+`feedback/2026-09-23-check-links-relative-resolution-non-directory-permalink.md`;
+fixed in `7edbc68`.
+
+This is the fourth `packages/whs-eleventy`-only fix shipped this week (the
+third, 2026.9.23, already published and live) — `core.md`, `stacks/*.md`,
+and `index.json` content are unchanged; only the doc pins and
+`packages/whs-eleventy/package.json` (now `2026.9.24`) moved.
+
+---
+
+## 2026-09-23 — Republish 2026-09-22-2 as a clean bare-date version [non-breaking]
+
+### packages/whs-eleventy
+
+No new content beyond what's already documented below. This bump republishes
+everything already documented under the 2026-09-22-2 entry (the
+`check-links.js` no-`src/`-layout crash fix) as a clean bare-date version,
+specifically to trigger the npm publish of `@piercebarney/whs-eleventy` that
+the 2026-09-22-2 same-day-suffix mechanism deliberately does not trigger on
+its own (per that suffix's own documented exception in `CLAUDE.md`'s
+Versions section: a suffixed pin gets no git tag and no npm publish).
+
+This release also newly documents a second, separately-landed fix shipping
+in the same publish: `styling`, `brand-source`, and `domain-tests` in
+`lib/compliance.js` each built their scan-target list from hardcoded
+standard-layout paths and treated "found zero files to scan" as "found zero
+violations" — a false `PASS` on a project whose layout doesn't match the
+standard yet, rather than the `MANUAL`/can't-verify result the other checks
+correctly report in the same situation. Found on a real adoption and filed
+as `feedback/2026-09-22-compliance-silent-pass-on-nonstandard-layout.md`;
+fixed in `96aeac2` by checking whether each check's target(s) exist at all
+before scanning — an existing-but-empty target (e.g. `static/calc/` with no
+modules yet) still correctly reports `PASS`.
+
+`core.md`, `stacks/*.md`, `index.json`, and every `standard-version:` pin
+move from `2026-09-22-2` to `2026-09-23`; `packages/whs-eleventy/package.json`
+moves to the corresponding npm version, `2026.9.23`. No `core.md` chapter,
+`stacks/*.md`, or `index.json` content changed.
+
+---
+
+## 2026-09-22-2 [non-breaking]
+
+### packages/whs-eleventy
+
+`check-links.js` had the same crash class as `doctor.js`'s already-fixed
+`MODULE_NOT_FOUND`: an unconditional module-top-level
+`projectRequire("src/_data/site.js")` (and `thirdparties.js`) that throws on
+a project with no `src/` tree, instead of reporting the missing layout as a
+finding — found while reconciling a real adoption's migration backlog and
+filed as `feedback/2026-09-22-check-links-same-crash-unfixed.md`. Fixed in
+`e73de7d`: the two missing-file conditions are now reported exactly once,
+and each dependent origin-validation check (internal-link/anchor/asset/
+JSON-LD) skips silently rather than crashing or false-positiving. This is a
+same-day suffix release — per `CLAUDE.md`'s Versions section it deliberately
+does **not** get a git tag or npm publish; `packages/whs-eleventy/package.json`
+stays at `2026.9.22`, which does not yet include this fix, until a future
+bare-date promotion release republishes it. No `core.md` chapter,
+`stacks/*.md`, or `index.json` content changed.
+
+---
+
 ## 2026-09-22 [non-breaking]
 
 ### packages/whs-eleventy

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-09-22 · **Status:** active
+**Version:** 2026-09-24 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -1467,7 +1467,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-09-22  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-09-24  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above