@taprootio/site-authoring 0.10.1 → 0.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taprootio/site-authoring",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Taproot site authoring CLI: sign in once in the browser, then pull, validate, push, preview, approve, and deploy a site from the terminal",
   "type": "module",
   "license": "ISC",
@@ -28,7 +28,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@taprootio/espalier": "4.16.0"
+    "@taprootio/espalier": "4.17.0"
   },
   "scripts": {
     "test": "node --test",

package/src/constants.js

@@ -1,5 +1,5 @@
 export const CLI_NAME = "@taprootio/site-authoring";
-export const CLI_VERSION = "0.10.1";
+export const CLI_VERSION = "0.10.2";
 export const CLI_BINARY_NAME = "taproot-site";
 export const RESULT_SCHEMA_VERSION = 1;
 export const CONFIG_FILE_NAME = "taproot-site.json";

package/src/content/components.js

@@ -256,6 +256,9 @@ const IMAGE_BANNER = Object.freeze({
   followingSpacing: enumOf("standard", "compact"),
   scrim: enumOf("auto", "none", "flat", "top", "bottom", "left", "right", "radial"),
   scrimStrength: enumOf("soft", "medium", "strong"),
+  // Finish a directional scrim's anchored edge at full alpha so the banner
+  // joins the adjoining band without a seam (Espalier 4.17.0 scrim-edge).
+  scrimEdge: enumOf("none", "flush"),
   bannerScheme: enumOf("auto", "light", "dark"),
   // Drop-shadow strength applied to the overlay text.
   textShadow: enumOf("none", "light", "medium", "strong"),
@@ -502,6 +505,7 @@ const COMPONENT_DEFINITIONS = Object.freeze({
       followingSpacing: "standard",
       scrim: "auto",
       scrimStrength: "medium",
+      scrimEdge: "none",
       bannerScheme: "auto",
       textShadow: "none",
       texture: "none",
@@ -512,6 +516,7 @@ const COMPONENT_DEFINITIONS = Object.freeze({
       "Set altText to describe meaningful banner imagery; leave it empty only when the image is decorative.",
       "Choose a scrim and scheme that keep overlay text readable across the image.",
       "For a full-bleed photograph with text aligned to the surrounding page well, set contentGutter to page. followingSpacing: compact reduces the top padding of an immediately following section so a bottom banner heading reads with its supporting paragraph. Use a banner-only contentPadding: none section followed by a standard text section; keep their theme contexts consistent. Defaults preserve frame-edge text and standard section spacing.",
+      "scrimEdge: flush finishes a directional scrim at full strength where it meets the page, so a full-bleed banner dissolves into the band below instead of ending at a visible line. It requires the arrangement above: a banner-only contentPadding: none section immediately followed by a section in the same theme context. It is inert when scrim is none, flat, or radial, and it stops being seamless when bannerScheme pins a polarity the page scheme does not share, because the scrim ink is then a derived color rather than the adjoining band's own. Default none; add it deliberately, per banner.",
       "Compose around the actual photograph: identify the meaningful subject and a quiet area for copy. Do not cover faces, product details, or high-detail edges. A focal point controls cropping, not text placement; inspect wide and compact crops separately. Keep the subject's face, ears, and other identifying details inside the compact frame, including at both ends of parallax travel. Adjust focus toward the subject rather than reusing a generic center; reduce motion or choose a roomier crop if preserving the subject requires it.",
       "Use contentPosition to place copy in that quiet area, not automatically in the center. Keep one dominant message and nearby supporting copy/actions; if the photo has no safe text area, use a split hero or a separate text section instead of forcing an overlay.",
       "Use the rule of thirds as a composition guide: consider the subject near one third and a compact text group in quiet space on the opposite side. Golden-ratio proportions are optional alternatives, not a proven engagement formula. Neither guide overrides legibility, the actual subject, or the compact crop. Current contentPosition values are edge/center anchors, not exact third or golden-ratio coordinates; do not invent unsupported positioning properties.",

package/src/transport.js

@@ -10,6 +10,7 @@ import {
   HTTP_TOO_MANY_REQUESTS,
   HTTP_UNAUTHORIZED,
   LIMITS,
+  LOCAL_API_BASE_URL,
   PLAN_LIMIT_REFUSAL_FIELD,
   PUBLISH_KEY_ENVIRONMENT_VARIABLE,
   REFUSAL_CAPABILITY_MISSING,
@@ -82,6 +83,18 @@ function isUndelivered(error) {
   return code !== undefined && UNDELIVERED_CAUSE_CODES.has(code);
 }
 
+/**
+ * The certificate-verification codes, named once. `describeTransportCause`
+ * softens them into a sentence and `localCertificateHint` decides whether a
+ * remediation belongs with them, so the list must not be restated in either.
+ */
+const CERTIFICATE_CAUSE_CODES = new Set([
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+]);
+
 /**
  * The underlying cause, named.
  *
@@ -94,12 +107,32 @@ function isUndelivered(error) {
 function describeTransportCause(error) {
   const code = transportCauseCode(error);
   if (code === undefined || !SAFE_CAUSE_CODE.test(code)) return undefined;
-  return code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || code === "SELF_SIGNED_CERT_IN_CHAIN"
-      || code === "UNABLE_TO_GET_ISSUER_CERT_LOCALLY" || code === "DEPTH_ZERO_SELF_SIGNED_CERT"
+  return CERTIFICATE_CAUSE_CODES.has(code)
     ? `${code}: the server's TLS certificate was not trusted`
     : code;
 }
 
+/**
+ * The one remediation this error has, and only where it is the answer.
+ *
+ * Against the local stack an untrusted certificate is nearly always setup, not
+ * an attack: mkcert installs its root into the system and browser trust stores
+ * and Node reads neither, so the CLI fails while the same host loads fine in
+ * Chrome. Naming the fix here saves the round-trip the bare cause code costs.
+ *
+ * Deliberately silent for every other origin. On production the same code
+ * means an interception or a genuinely broken chain, and printing "here is how
+ * to trust it" would be advice to disable the check that just did its job.
+ */
+function localCertificateHint(apiOrigin, error) {
+  const code = transportCauseCode(error);
+  if (code === undefined || !CERTIFICATE_CAUSE_CODES.has(code)) return "";
+  if (apiOrigin !== new URL(LOCAL_API_BASE_URL).origin) return "";
+  return " The local stack uses mkcert, whose root Node does not read from the system trust store."
+    + " Export NODE_EXTRA_CA_CERTS=\"$HOME/Library/Application Support/mkcert/rootCA.pem\""
+    + " (or NODE_USE_SYSTEM_CA=1 on Node 22.19+ or 24.6+) and run the command again.";
+}
+
 const SAFE_CAUSE_CODE = /^[A-Z0-9_]{1,64}$/u;
 
 // Exported because the credential store's pre-mint size projection has to
@@ -742,7 +775,8 @@ export class SiteApiClient {
           (ambiguous
             ? "A Taproot API mutation ended without an authoritative response."
             : "A Taproot API request failed before a response was received.")
-            + (cause === undefined ? "" : ` (${cause})`),
+            + (cause === undefined ? "" : ` (${cause})`)
+            + localCertificateHint(this.apiOrigin, error),
         );
       }
       if (response.status >= 200 && response.status < 300 && !response.redirected) {