create-website-build-kit 0.1.18 → 0.1.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-website-build-kit",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Scaffold a production marketing site \u2014 Astro on Cloudflare Workers, with the gates, the migration playbook and the accessibility work already wired.",
   "keywords": [
     "astro",

package/template/CLAUDE.md

@@ -9,7 +9,9 @@ Astro (static) on Cloudflare Workers. Built from
 npm run dev                                  # localhost:4321 — no bindings, /api/* will not work
 npm run media                                # after adding or replacing any image
 npm run build:staging && npx wrangler dev    # localhost:8788, real KV + secrets
-npm run a11y                                 # accessibility check, one URL per family
+npm run a11y                                 # accessibility check, one URL per family, both schemes
+npx puppeteer browsers install chrome        # ...if that says Chrome is missing. npm 11 withholds
+#                                              install scripts, so the download may not have run
 npm run tells                                # what is undecided, and the design tells
 npm run check:copy                           # author notes that reached the rendered page
 npm run recon -- https://old-site.com        # inventory the old site BEFORE designing routes

package/template/docs/dependencies.md

@@ -27,12 +27,19 @@ one problem. Do not read the larger number as six separate holes.
 
 ## Where it comes from
 
-Accessibility testing is the whole chain. Each step declares the next:
+Browser-driven checking is the whole chain. Each step declares the next:
 
 ```
-pa11y-ci  →  pa11y ^9.1.1  →  puppeteer ^24.37.5  →  @puppeteer/browsers 2.13.2  →  extract-zip ^2.0.1
+puppeteer ^24.43.1  →  @puppeteer/browsers 2.13.2  →  extract-zip ^2.0.1
+pa11y-ci  →  pa11y ^9.1.1  →  puppeteer  →  (the same two)
 ```
 
+⚠ **`puppeteer` is declared here directly, and it did not used to be.** It arrived under
+`pa11y-ci`, which made it a dependency of this project only by accident of how pa11y was
+installed — run as `npx --yes pa11y-ci` instead and four scripts that import it outright would
+have had nothing to import. Declaring it changes nothing about the advisory below; the chain
+underneath is the same one.
+
 `extract-zip` is what unpacks the Chrome build that puppeteer downloads the first time you run
 `npm run a11y`.
 
@@ -65,9 +72,11 @@ requiring user interaction.
 More to the point:
 
 - It is a **development** dependency. It is not bundled, imported, or served.
-- **Nothing under `src/` references pa11y or puppeteer.** Only three scripts do —
-  `check-a11y.mjs`, `a11y-evidence.mjs` and `md-to-pdf.mjs` — and none of them run in a
-  deploy.
+- **Nothing under `src/` references pa11y or puppeteer.** Only the scripts do, and none of them
+  run in a deploy: `check-console.mjs`, `check-reflow.mjs`, `shots.mjs`, `md-to-pdf.mjs` and
+  `lib/schemes.mjs` import puppeteer; `check-a11y.mjs` and `a11y-evidence.mjs` spawn pa11y-ci.
+  ⚠ This list said "three scripts" and named two that do not import it while missing three that
+  do — a count nobody re-derives is a count that drifts.
 - A production install (`npm ci --omit=dev`) does not install it at all.
 
 ⚠ **This is a reason it is low risk, not a reason it is fine.** If you ever start running the