@warpgogol/werkstatt-shared 0.8.1 → 0.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warpgogol/werkstatt-shared",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": false,
   "type": "module",
   "engines": {
@@ -1343,6 +1343,15 @@
       "default": "./src/share/scripts/index.ts"
     }
   },
+  "scripts": {
+    "lint": "pnpm exec eslint \"src/**/*.ts\"",
+    "typecheck": "pnpm exec tsc -p tsconfig.json --noEmit",
+    "build": "pnpm exec tsc -p tsconfig.json --noEmit",
+    "build:check": "pnpm exec tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "pnpm exec tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -1382,12 +1391,5 @@
     "typescript-eslint": "8.65.0",
     "vitest": "^4.1.10"
   },
-  "scripts": {
-    "lint": "pnpm exec eslint \"src/**/*.ts\"",
-    "typecheck": "pnpm exec tsc -p tsconfig.json --noEmit",
-    "build": "pnpm exec tsc -p tsconfig.json --noEmit",
-    "build:check": "pnpm exec tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest"
-  }
-}
+  "packageManager": "pnpm@11.10.0"
+}

package/src/share/image-provider.ts

@@ -219,6 +219,8 @@ export interface ImageVariantEntry {
    * stale derived variants (same contract as video.variants.generate RFC-0210).
    */
   sourceHash?: string;
+  /** RFC-0928: WebP quality used by image.variants.generate (minimum 90). */
+  quality?: number;
 }
 
 /** Top-level manifest written by `image.variants.generate` and read by createBuildPortableProvider. */

package/src/share/middleware/access-protection.ts

@@ -4,7 +4,7 @@
 <keywords>middleware, access-protection, basic-auth, pin, dev, alt, RFC-0899</keywords>
 <responsibilities>
   <item>Check Host header against dev.* and alt.* patterns — pass through for main domain.</item>
-  <item>Require Basic Auth (username: access, password: ACCESS_PIN env var) for dev/alt hosts.</item>
+  <item>Require Basic Auth (username: warp, password: ACCESS_PIN env var) for dev/alt hosts.</item>
   <item>Set X-Robots-Tag: noindex, nofollow, noai, noimageai on ALL dev/alt responses (including 401).</item>
   <item>Use constant-time string comparison for auth check to prevent timing attacks.</item>
   <item>Pass through when ACCESS_PIN is unset (allows new sites before protection is configured).</item>
@@ -45,6 +45,16 @@ function isDevOrAltHost(host: string): boolean {
   return host.startsWith("dev.") || host.startsWith("alt.");
 }
 
+/**
+ * Paths exempt from access protection on dev/alt subdomains.
+ * Browsers fetch these without sending Basic Auth credentials, causing 401 console errors.
+ */
+const PUBLIC_STATIC_EXEMPTIONS = ["/manifest.webmanifest"];
+
+function isExemptPath(pathname: string): boolean {
+  return PUBLIC_STATIC_EXEMPTIONS.includes(pathname);
+}
+
 /**
  * RFC-0899: Check access protection for a request. Called from the Worker entry point
  * (worker.ts) before passing to the Astro handler. This is necessary because Astro
@@ -66,6 +76,9 @@ export function checkAccessProtection(
   const host = request.headers.get("host") ?? "";
   if (!isDevOrAltHost(host)) return null;
 
+  const url = new URL(request.url);
+  if (isExemptPath(url.pathname)) return null;
+
   const pin = (env.ACCESS_PIN as string | undefined) ?? undefined;
 
   // No PIN set — allow access (caller should add X-Robots-Tag)
@@ -73,7 +86,7 @@ export function checkAccessProtection(
 
   // Check Basic Auth
   const auth = request.headers.get("authorization") ?? "";
-  const expected = `Basic ${btoa(`access:${pin}`)}`;
+  const expected = `Basic ${btoa(`warp:${pin}`)}`;
 
   if (auth && constantTimeEqual(auth, expected)) {
     return null; // Authenticated — pass through
@@ -144,6 +157,13 @@ export const accessProtectionMiddleware = defineMiddleware(async (context: any,
     return next();
   }
 
+  const url = new URL(context.request.url);
+  if (isExemptPath(url.pathname)) {
+    const response = await next();
+    response.headers.set("X-Robots-Tag", NOINDEX_HEADER);
+    return response;
+  }
+
   const pin = await resolveAccessPin();
 
   // No PIN set — allow access but still set noindex headers
@@ -155,7 +175,7 @@ export const accessProtectionMiddleware = defineMiddleware(async (context: any,
 
   // Check Basic Auth BEFORE calling next()
   const auth = context.request.headers.get("authorization") ?? "";
-  const expected = `Basic ${btoa(`access:${pin}`)}`;
+  const expected = `Basic ${btoa(`warp:${pin}`)}`;
 
   if (auth && constantTimeEqual(auth, expected)) {
     const response = await next();

package/src/share/middleware/tests/access-protection.test.ts

@@ -25,7 +25,7 @@ describe("RFC-0899: access protection middleware", () => {
     ) => Promise<Response>;
   }
 
-  function makeContext(host: string, authHeader?: string) {
+  function makeContext(host: string, authHeader?: string, pathname = "/") {
     const headers = new Map<string, string>();
     headers.set("host", host);
     if (authHeader) headers.set("authorization", authHeader);
@@ -34,6 +34,7 @@ describe("RFC-0899: access protection middleware", () => {
         headers: {
           get: (name: string) => headers.get(name.toLowerCase()) ?? null,
         },
+        url: `https://${host}${pathname}`,
       },
     };
   }
@@ -42,10 +43,11 @@ describe("RFC-0899: access protection middleware", () => {
     handler: (context: unknown, next: () => Promise<Response>) => Promise<Response>,
     host: string,
     authHeader?: string,
+    pathname = "/",
   ): Promise<Response & { _nextCalled: boolean }> {
     let nextCalled = false;
     const nextResponse = new Response("page content", { status: 200 });
-    const result = await handler(makeContext(host, authHeader), async () => {
+    const result = await handler(makeContext(host, authHeader, pathname), async () => {
       nextCalled = true;
       return nextResponse;
     });
@@ -80,7 +82,7 @@ describe("RFC-0899: access protection middleware", () => {
 
   it("passes through dev.* with correct Basic Auth", async () => {
     mockEnv.ACCESS_PIN = "1234";
-    const expected = `Basic ${btoa("access:1234")}`;
+    const expected = `Basic ${btoa("warp:1234")}`;
     const handler = await loadMiddleware();
     const res = await runMiddleware(handler, "dev.example.com", expected);
     expect(res._nextCalled).toBe(true);
@@ -90,7 +92,7 @@ describe("RFC-0899: access protection middleware", () => {
 
   it("returns 401 for dev.* with wrong PIN", async () => {
     mockEnv.ACCESS_PIN = "1234";
-    const wrong = `Basic ${btoa("access:9999")}`;
+    const wrong = `Basic ${btoa("warp:9999")}`;
     const handler = await loadMiddleware();
     const res = await runMiddleware(handler, "dev.example.com", wrong);
     expect(res._nextCalled).toBe(false);
@@ -120,4 +122,21 @@ describe("RFC-0899: access protection middleware", () => {
     const res = await runMiddleware(handler, "example.com");
     expect(res.headers.get("X-Robots-Tag")).toBe(null);
   });
+
+  it("exempts /manifest.webmanifest from auth on dev.* when PIN is set", async () => {
+    mockEnv.ACCESS_PIN = "1234";
+    const handler = await loadMiddleware();
+    const res = await runMiddleware(handler, "dev.example.com", undefined, "/manifest.webmanifest");
+    expect(res._nextCalled).toBe(true);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("X-Robots-Tag")).toBe("noindex, nofollow, noai, noimageai");
+  });
+
+  it("exempts /manifest.webmanifest from auth on alt.* when PIN is set", async () => {
+    mockEnv.ACCESS_PIN = "1234";
+    const handler = await loadMiddleware();
+    const res = await runMiddleware(handler, "alt.example.com", undefined, "/manifest.webmanifest");
+    expect(res._nextCalled).toBe(true);
+    expect(res.status).toBe(200);
+  });
 });

package/src/share/tests/create-dev-props-validator.test.ts

@@ -1,38 +0,0 @@
-import { test, expect } from "vitest";
-import { createDevPropsValidator } from "../dev-props-validator.ts";
-
-/*
-<MODULE_CONTRACT>
-<purpose>
-  RFC-0262: end-to-end test of createDevPropsValidator against the real
-  packages/werkstatt-site/src/domain/ui/sections/hero manifest (this test runs from within the
-  actual monorepo checkout, so workspace-root discovery resolves for real).
-</purpose>
-</MODULE_CONTRACT>
-*/
-
-test("createDevPropsValidator: passes valid Europa (hero-section) props", async () => {
-  const validate = createDevPropsValidator();
-  await validate("Europa", { header: { heading: "Hello" } }, "hero-block"); // cosmic-literals-ignore: fixture cosmicName exercising the real hero-section manifest
-});
-
-test("createDevPropsValidator: throws PAGE-PROPS-01 on an undeclared prop key", async () => {
-  const validate = createDevPropsValidator();
-  try {
-    await validate(
-      "Europa", // cosmic-literals-ignore: fixture cosmicName exercising the real hero-section manifest
-      { header: { heading: "Hello" }, totallyUnknownField: true },
-      "hero-block",
-    ); // cosmic-literals-ignore: fixture cosmicName exercising the real hero-section manifest
-    expect.fail("should have thrown");
-  } catch (error) {
-    expect(error).toBeInstanceOf(Error);
-    expect((error as Error).message).toMatch(/PAGE-PROPS-01/);
-    expect((error as Error).message).toMatch(/hero-block/);
-  }
-});
-
-test("createDevPropsValidator: an unknown planetName resolves no schema and does not throw", async () => {
-  const validate = createDevPropsValidator();
-  await validate("NotARealPlanet", { anything: true }, null);
-});