Pouya LajevardiandClaude Opus 5
7514a49803
Amends D1 to pin the major explicitly (v7.x) rather than inherit it. The ^5.0.0 pin was recalled rather than checked and was two majors stale the day it was written, which meant shipping a framework carrying high-severity XSS advisories. CLAUDE.md now requires every version pin to be verified against the registry, and R11 requires re-checking at each build-order boundary. npm audit now reports 0 vulnerabilities, down from 16. Every Astro advisory is cleared; the residual 10 all traced to @lhci/cli, which is removed — it was the sole source of 7 high-severity findings, 0.15.1 is latest so there was no clean upgrade, and it cannot run without pages or a lighthouserc. Re-added at build step 7 with a freshly verified pin. Content collections migrated to the Content Layer API: src/content.config.ts, loader: glob(), z from astro/zod. Two review passes found seven defects in the fix itself, all now closed: - z.coerce.date() read an unquoted 20260801 as epoch milliseconds and yielded 1970-01-01 silently; the first replacement then accepted 2026-13-45 as an Invalid Date and rolled 2026-02-30 over to 2026-03-02. Dates are now anchored, date-only, parsed as UTC and round-tripped. - The title bound applied the SEO spec's 50-60 to the headline rather than the rendered <title>, which guaranteed 68-78 on every article and rejected all five planned launch headlines. Articles are now the documented exception: the headline is the <title>, no suffix. - An article could ship an image with no alt text, or whitespace-only alt. - Two schema comments asserted controls nothing enforced; both are now real refinements, each tested with a failing and a passing case. - PRACTICE_SLUGS and PRACTICE_AREAS could drift silently; a compile-time check now catches both directions. - eslint.config.js imported globals and @eslint/js undeclared, resolving by hoisting accident. - scripts/deploy-local.sh claimed parity with CI while skipping npm run check and two credential guards — on the only path this site can ship today. Accessibility linting is on (36 jsx-a11y rules) before step 1 writes the layout. An earlier claim in §7 that none was possible was wrong twice, and is corrected in AGENTS.md entry (t) along with the reasoning. Opens Q30 and Q31 for two unregistered claims in src/data/site.ts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF
55 lines
2.5 KiB
JavaScript
55 lines
2.5 KiB
JavaScript
import { defineConfig } from 'astro/config';
|
|
import mdx from '@astrojs/mdx';
|
|
import sitemap from '@astrojs/sitemap';
|
|
|
|
// Canonical origin. Drives canonical URLs, OG tags, and the sitemap.
|
|
const SITE = process.env.PUBLIC_SITE_URL ?? 'https://adr.smlcompany.ca';
|
|
|
|
export default defineConfig({
|
|
site: SITE,
|
|
|
|
// Static output is the point of this rebuild — see docs/04-seo-spec.md.
|
|
// Do not switch to a server adapter without an AGENTS.md Change Log entry.
|
|
output: 'static',
|
|
|
|
// Directory-style URLs with a trailing slash, matched by the CloudFront
|
|
// trailing-slash function. See docs/06-deployment.md.
|
|
trailingSlash: 'always',
|
|
build: { format: 'directory', inlineStylesheets: 'auto' },
|
|
|
|
// Astro 7 changed this default from `true` to `'jsx'`. Measured, not assumed
|
|
// (AGENTS.md entry (t)): in an .astro template, an inline pair split across
|
|
// two lines renders as `<em>inline</em><strong>pair</strong>` under 'jsx' and
|
|
// `<em>inline</em> <strong>pair</strong>` under `true`. The space is silently
|
|
// deleted — no error, no warning; you find out by reading the page.
|
|
//
|
|
// MDX prose is NOT affected either way; the hazard is .astro markup only.
|
|
// Held at the HTML-aware behaviour because hand-written templates on a
|
|
// text-heavy site are exactly where a wrapped line meets an inline tag.
|
|
// Revisit only with a measurement, not a preference. See R12.
|
|
compressHTML: true,
|
|
|
|
integrations: [
|
|
mdx(),
|
|
sitemap({
|
|
filter: (page) => !page.includes('/legal/'),
|
|
changefreq: 'monthly',
|
|
// No `lastmod`. It was `new Date()`, which stamped every URL with the
|
|
// build time — telling crawlers all 17 pages changed whenever one did.
|
|
// Google discounts lastmod it judges unreliable, so that spent the signal
|
|
// docs/04-seo-spec.md wants rather than sending it. Step 7 can reinstate
|
|
// it per-entry from an article's `updatedDate` via `serialize`.
|
|
}),
|
|
],
|
|
|
|
// No `image` block: `astro/assets/services/sharp` is already Astro's default
|
|
// service, so setting it was dead configuration. The conventions it used to
|
|
// sit under — explicit width/height on every image, never base64-inline —
|
|
// live in CLAUDE.md, which is where they are actually enforced (by review).
|
|
|
|
// No `prefetch` block at all — removed 2026-08-26, see AGENTS.md entry (r).
|
|
// Any prefetch setting ships Astro's prefetch script to every page, against
|
|
// CLAUDE.md's "default to zero JS", for a marginal gain on a small static site
|
|
// already served from CloudFront. Revisit only against real Lighthouse numbers.
|
|
});
|