@piercebarney/whs-eleventy 2026.9.28 → 2026.9.30

package/lib/compliance.js

@@ -109,6 +109,28 @@ const fromDoctor = (id, extra = "", { strict = false, missingIsFail = false } =
 // ---- per-chapter checks ------------------------------------------------
 // Each returns { status, note }. Keep them mechanical; hand judgement to MANUAL.
 
+// Used by `privacy` below: the third-party list must render from
+// _data/thirdparties.js — either a Nunjucks `for...in` loop or a JS
+// `.map()`/`.forEach()` iteration.
+const THIRD_PARTY_LOOP = /for\s+t\s+in\s+thirdparties|thirdparties\s*\.\s*(?:map|forEach)\s*\(/;
+
+function hasThirdPartyLoop() {
+  if (grepSrc(THIRD_PARTY_LOOP).length) return true;
+  // A privacy page can be a root-level template (a flat-layout adopted
+  // project's own convention, outside grepSrc's src/static/scripts roots
+  // entirely). Check top-level files at the project root too — never
+  // recursive, so node_modules/.git/etc. are never walked (readdirSync with
+  // no recursion, filtered to isFile()).
+  try {
+    return fs
+      .readdirSync(ROOT, { withFileTypes: true })
+      .filter((e) => e.isFile() && /\.(js|njk)$/.test(e.name))
+      .some((e) => THIRD_PARTY_LOOP.test(fs.readFileSync(path.join(ROOT, e.name), "utf8")));
+  } catch {
+    return false;
+  }
+}
+
 const CHECKS = {
   "repo-hygiene": () => {
     const docs = ["README.md", "CLAUDE.md"].filter((f) => has(f));
@@ -445,14 +467,14 @@ const CHECKS = {
     // The privacy page may be a standalone src/privacy.njk or a pages.json
     // entry rendered by a src/pages/ shell — check the built output, with a
     // source fallback for when _site isn't built yet.
-    const built = has("_site/privacy/index.html");
+    const built = has("_site/privacy/index.html") || has("_site/privacy.html");
     const source =
       has("src/privacy.njk") ||
       /["']slug["']\s*:\s*["']privacy["']/.test(read("src/content/pages.json") || "");
     if (!built && !source) return { status: FAIL, note: "no privacy page" };
     // The third-party disclosure must be generated from _data/thirdparties.js,
     // never hand-maintained — the loop lives in the privacy shell or an include.
-    if (grepSrc(/for\s+t\s+in\s+thirdparties/).length === 0)
+    if (!hasThirdPartyLoop())
       return {
         status: FAIL,
         note: "privacy third-party list not rendered from _data/thirdparties.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.28",
+  "version": "2026.9.30",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,45 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-09-30 [non-breaking]
+
+### packages/whs-eleventy
+
+`privacy` in `lib/compliance.js`'s third-party-loop gate
+(`grepSrc(/for\s+t\s+in\s+thirdparties/)`) only recognized Nunjucks
+`for...in` syntax and only scanned `src/`, `static/`, `scripts/` — so a
+root-level, JS-class (`.11ty.js`) privacy page rendering its disclosure list
+via `.map()`/`.forEach()` could pass only by coincidence, via an unrelated
+file elsewhere in the scanned roots happening to contain a matching Nunjucks
+loop. Now also recognizes `.map()`/`.forEach()` iteration, and falls back to
+a non-recursive scan of top-level project-root files when the shared scan
+finds nothing. This resolves the concrete reported case — the check now
+reaches and validates the actual root-level privacy page's own rendering
+instead of passing via a coincidental match — without claiming full
+precision: Eleventy supports too many valid page-rendering shapes for the
+check to reliably identify "the one file that renders this page" in general.
+Local to `privacy`; `grepSrc`'s shared defaults and its other six call sites
+are untouched. Resolves
+`feedback/2026-09-23-privacy-thirdparty-check-scans-wrong-file.md`.
+
+---
+
+## 2026-09-29 [non-breaking]
+
+### packages/whs-eleventy
+
+`privacy` in `lib/compliance.js`'s built-output signal only matched a
+directory-style permalink (`_site/privacy/index.html`), so a project with a
+flat `privacy.html` permalink failed the chapter despite having a real,
+working privacy page — the same directory-assumption class as the earlier
+`check-links.js` relative-resolution fix. Now also accepts `_site/privacy.html`,
+mirroring how the adjacent source-level signal in the same chapter already
+carries multiple fallbacks for the same question. No `feedback/` file this
+time: found and fixed while reviewing a real project's migration report, not
+filed by an adopting session. Fixed in `41881c2`.
+
+---
+
 ## 2026-09-28 [non-breaking]
 
 ### packages/whs-eleventy

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-09-28 · **Status:** active
+**Version:** 2026-09-30 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -1467,7 +1467,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-09-28  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-09-30  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above