@piercebarney/whs-eleventy 2026.9.29 → 2026.10.1

package/lib/compliance.js

@@ -18,7 +18,7 @@ const path = require("node:path");
 const { execSync } = require("node:child_process");
 const { parse: parseHtml } = require("node-html-parser");
 const { runRepoChecks } = require("./doctor.js");
-const { ROOT, resolveStandard } = require("./_project.js");
+const { ROOT, resolveStandard, tryProjectRequire } = require("./_project.js");
 
 const SITE = path.join(ROOT, "_site");
 const CACHE = path.join(ROOT, ".cache", "compliance.json");
@@ -109,6 +109,28 @@ const fromDoctor = (id, extra = "", { strict = false, missingIsFail = false } =
 // ---- per-chapter checks ------------------------------------------------
 // Each returns { status, note }. Keep them mechanical; hand judgement to MANUAL.
 
+// Used by `privacy` below: the third-party list must render from
+// _data/thirdparties.js — either a Nunjucks `for...in` loop or a JS
+// `.map()`/`.forEach()` iteration.
+const THIRD_PARTY_LOOP = /for\s+t\s+in\s+thirdparties|thirdparties\s*\.\s*(?:map|forEach)\s*\(/;
+
+function hasThirdPartyLoop() {
+  if (grepSrc(THIRD_PARTY_LOOP).length) return true;
+  // A privacy page can be a root-level template (a flat-layout adopted
+  // project's own convention, outside grepSrc's src/static/scripts roots
+  // entirely). Check top-level files at the project root too — never
+  // recursive, so node_modules/.git/etc. are never walked (readdirSync with
+  // no recursion, filtered to isFile()).
+  try {
+    return fs
+      .readdirSync(ROOT, { withFileTypes: true })
+      .filter((e) => e.isFile() && /\.(js|njk)$/.test(e.name))
+      .some((e) => THIRD_PARTY_LOOP.test(fs.readFileSync(path.join(ROOT, e.name), "utf8")));
+  } catch {
+    return false;
+  }
+}
+
 const CHECKS = {
   "repo-hygiene": () => {
     const docs = ["README.md", "CLAUDE.md"].filter((f) => has(f));
@@ -445,14 +467,39 @@ const CHECKS = {
     // The privacy page may be a standalone src/privacy.njk or a pages.json
     // entry rendered by a src/pages/ shell — check the built output, with a
     // source fallback for when _site isn't built yet.
-    const built = has("_site/privacy/index.html") || has("_site/privacy.html");
+    const builtPath = has("_site/privacy/index.html")
+      ? "_site/privacy/index.html"
+      : has("_site/privacy.html")
+        ? "_site/privacy.html"
+        : null;
     const source =
       has("src/privacy.njk") ||
       /["']slug["']\s*:\s*["']privacy["']/.test(read("src/content/pages.json") || "");
-    if (!built && !source) return { status: FAIL, note: "no privacy page" };
+    if (!builtPath && !source) return { status: FAIL, note: "no privacy page" };
+
+    // Prefer checking the built page's own rendered HTML for every declared
+    // third party's name — what a user actually sees, independent of which
+    // source file or templating approach produced it. Falls back to the
+    // source-level pattern only when there's no built output yet, or
+    // nothing declared to check against.
+    if (builtPath) {
+      const thirdparties = tryProjectRequire("src/_data/thirdparties.js", null);
+      if (Array.isArray(thirdparties) && thirdparties.length) {
+        const html = read(builtPath) || "";
+        const missing = thirdparties
+          .filter((t) => t?.name && !html.includes(t.name))
+          .map((t) => t.name);
+        return missing.length
+          ? { status: FAIL, note: `privacy page missing disclosure for: ${missing.join(", ")}` }
+          : {
+              status: PASS,
+              note: "privacy page present; built output discloses every declared third party",
+            };
+      }
+    }
     // The third-party disclosure must be generated from _data/thirdparties.js,
     // never hand-maintained — the loop lives in the privacy shell or an include.
-    if (grepSrc(/for\s+t\s+in\s+thirdparties/).length === 0)
+    if (!hasThirdPartyLoop())
       return {
         status: FAIL,
         note: "privacy third-party list not rendered from _data/thirdparties.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.29",
+  "version": "2026.10.1",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,56 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-10-01 [non-breaking]
+
+### packages/whs-eleventy
+
+Supersedes yesterday's (2026-09-30) `hasThirdPartyLoop()` widening, which was
+correct but unreachable: the standard's own reference `audit.njk` template
+independently contains a matching loop pattern for its unrelated Content &
+Links tab, so `privacy`'s broad source scan always found that coincidental
+match first, before the new fallback logic could ever run — this affected
+every project descended from the template, not just the one that reported
+it. `privacy` in `lib/compliance.js` now checks the built privacy page's own
+rendered HTML for every third party declared in `src/_data/thirdparties.js`,
+by name — what a user actually sees, independent of which source file or
+templating syntax produced it — falling back to yesterday's source-pattern
+mechanism (unchanged, still present) only when there's no built output yet
+or nothing is declared to check against. Confirmed against the reference
+template itself: `privacy` still PASSes, now for the correct reason (built
+output discloses every declared party) instead of the coincidental
+`audit.njk` match. Resolves
+`feedback/2026-09-23-privacy-thirdparty-check-scans-wrong-file.md` (the
+original report) and
+`feedback/2026-09-24-privacy-thirdparty-fix-still-short-circuits-on-audit-loop.md`
+(the follow-up that diagnosed why the 2026-09-30 fix didn't work). Fixed in
+`56f5c67`.
+
+---
+
+## 2026-09-30 [non-breaking]
+
+### packages/whs-eleventy
+
+`privacy` in `lib/compliance.js`'s third-party-loop gate
+(`grepSrc(/for\s+t\s+in\s+thirdparties/)`) only recognized Nunjucks
+`for...in` syntax and only scanned `src/`, `static/`, `scripts/` — so a
+root-level, JS-class (`.11ty.js`) privacy page rendering its disclosure list
+via `.map()`/`.forEach()` could pass only by coincidence, via an unrelated
+file elsewhere in the scanned roots happening to contain a matching Nunjucks
+loop. Now also recognizes `.map()`/`.forEach()` iteration, and falls back to
+a non-recursive scan of top-level project-root files when the shared scan
+finds nothing. This resolves the concrete reported case — the check now
+reaches and validates the actual root-level privacy page's own rendering
+instead of passing via a coincidental match — without claiming full
+precision: Eleventy supports too many valid page-rendering shapes for the
+check to reliably identify "the one file that renders this page" in general.
+Local to `privacy`; `grepSrc`'s shared defaults and its other six call sites
+are untouched. Resolves
+`feedback/2026-09-23-privacy-thirdparty-check-scans-wrong-file.md`.
+
+---
+
 ## 2026-09-29 [non-breaking]
 
 ### packages/whs-eleventy

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-09-29 · **Status:** active
+**Version:** 2026-10-01 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -1467,7 +1467,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-09-29  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-10-01  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above