doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wip-census

Browse source
This commit is contained in:
Doxa Maps 2026-09-25 22:56:34 +00:00
parent 3cb89eae52
commit e285ee6095
2 changed files with 43 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
internal/generate-tree.mjs
View file

@ -693,7 +693,7 @@ function rootHtml(bundles, manifest) {
* "the plugin works"; a mounted element with no data is the failure that looks like success.
*/
function studioRootHtml(bakedToken, integrity = '') {
// THE TREE'S FRONT PAGE (<tree>/index.html) — Driver decision, card
// THE TREE'S FRONT PAGE (<tree>/index.html) — project decision, card
// BUILD-PLUGIN-STUDIO-IS-THE-OUTPUT-FRONT-PAGE: the output is ONE folder, and opening it opens the
// studio. It used to sit one level ABOVE the tree (public/index.html) with the staging-forge chooser
// at <tree>/index.html; both are replaced by this. Relative paths, so the folder stays
@ -1399,7 +1399,7 @@ function writeManifestAndHtml(root, bundles, tokenUrlExpr, bakedToken) {
// their URL, mounted NO element, and returned a confident HTTP 200.
//
// ★ WHY THAT 200 WAS EXPENSIVE, not merely useless: probing a chooser is INDISTINGUISHABLE
// from probing a broken feature. It cost the Driver a session ("none of the elements are
// from probing a broken feature. It cost the maintainer a session ("none of the elements are
// working" — they were; the page was a chooser presenting itself as the product) and cost an
// agent a false "the grid is completely inert" diagnosis. A page that answers 200 with no
// element is a lying instrument, and deleting it removes a whole class of wrong answer.
@ -1463,7 +1463,7 @@ function main() {
// They must be COPIED here or a clean build drops them and the wall falls back
// to text placeholders while the map fails to resolve its boundaries.
{
// STAGED IN A TEMP DIRECTORY, NOT public/assets (Driver decision, card BUILD-OUTPUT-IS-ONE-FOLDER:
// STAGED IN A TEMP DIRECTORY, NOT public/assets (project decision, card BUILD-OUTPUT-IS-ONE-FOLDER:
// public/ holds only the output folder + README.md). This step still gathers the sources
// (data/, plugin previews, the upg-100 boundaries) into one pool and copies the fetched
// allowlist into <tree>/assets below; the pool itself is a build intermediate. The web-root

42
internal/landing-preconditions.mjs
View file

@ -11,6 +11,12 @@
* Every one of those landings passed its own checks. Nothing refused them.
*
* PRECONDITIONS, in order (cheap first):
* 0. PUBLIC-SAFE this repo is published as-is, so nothing in the commit (source AND built tree) may
* match the public-safety census: a Mapbox or other key, a private key, a personal address,
* an internal host, tool or identity term. The PATTERNS live outside the repo
* (DOXA_CENSUS_FILE, default ../internal-tracker/public-census.tsv — they name what must not
* ship, so they cannot ship either); only the secret-shaped ones are built in. A landing that
* cannot read the list is refused, never waved through.
* 1. CLEAN the working tree equals HEAD for everything the checks read — otherwise they would judge
* files that are not in the commit.
* 2. ONE FOLDER public/ holds exactly the configured tree (vite.doxa-maps-build-config.json "name") and
@ -19,9 +25,11 @@
* 4. FRESH every composite rebuilds to exactly its committed bytes (check:composite-freshness).
*
* USAGE node internal/landing-preconditions.mjs exit 0 = may land · 1 = refused
* DOXA_SKIP_FRESHNESS=1 skips (4) — for a DRY check only; main-capture scan never sets it.
* DOXA_CENSUS_FILE=<tsv> the census list: "regex<TAB>excluded,paths<TAB>allowed-match regex" per line.
* DOXA_SKIP_FRESHNESS=1 skips (4) — for a DRY check only; the merge-queue check never sets it.
*/
import { spawnSync } from 'node:child_process'
import { readFileSync, existsSync } from 'node:fs'
import { resolve, dirname } from 'node:path'
import { fileURLToPath } from 'node:url'
import { TREE_NAME } from './_tree-name.mjs'
@ -32,7 +40,37 @@ const refuse = (why, detail = '') => {
if (detail) console.error(detail.split('\n').map((l) => ' ' + l).join('\n'))
process.exit(1)
}
const run = (cmd, args) => spawnSync(cmd, args, { cwd: ROOT, encoding: 'utf8', env: process.env })
const run = (cmd, args) => spawnSync(cmd, args, { cwd: ROOT, encoding: 'utf8', env: process.env, maxBuffer: 256 * 1024 * 1024 })
// 0. PUBLIC-SAFE
// Secret-shaped patterns are safe to name here; every identity/tool/host term comes from the outside list.
const BUILTIN = [
{ re: 'sk\\.eyJ', why: 'a Mapbox SECRET token' },
{ re: 'BEGIN (RSA|OPENSSH|EC) PRIVATE', why: 'a private key' },
{ re: 'oauth2:', why: 'a credential in a URL' },
]
const CENSUS_FILE = process.env.DOXA_CENSUS_FILE || resolve(ROOT, '..', 'internal-tracker', 'public-census.tsv')
if (!existsSync(CENSUS_FILE)) refuse(`the public-safety census list is missing (${CENSUS_FILE})`,
'This repo is published as-is; a landing that cannot run the census is not checked. Point DOXA_CENSUS_FILE at the list.')
const census = [...BUILTIN, ...readFileSync(CENSUS_FILE, 'utf8').split('\n')
.filter((l) => l.trim() && !l.startsWith('#'))
.map((l) => { const [re, excl = '', allow = ''] = l.split('\t'); return { re, excl: excl.split(',').filter(Boolean), allow } })]
.filter((c, i, all) => all.findIndex((d) => d.re === c.re) === i)
const hits = []
for (const c of census) {
const g = run('git', ['grep', '-I', '-n', '-o', '-E', '-e', c.re, 'HEAD', '--'])
if (g.status > 1) refuse(`census: git grep failed on /${c.re}/`, g.stderr.trim())
for (const line of g.stdout.split('\n').filter(Boolean)) {
const m = /^HEAD:([^:]+):(\d+):(.*)$/.exec(line)
if (!m || c.excl.includes(m[1])) continue
if (c.allow && new RegExp(c.allow).test(m[3])) continue
hits.push(`${m[1]}:${m[2]} ${c.why || `census pattern #${census.indexOf(c) + 1}`}`)
}
}
if (hits.length) refuse(`${hits.length} line(s) in this commit match the public-safety census — this repo is published as-is`,
hits.slice(0, 12).join('\n') + (hits.length > 12 ? `\n… and ${hits.length - 12} more` : '') +
'\nReword or remove them (the pattern list is in ' + CENSUS_FILE + ').')
console.log(`LANDING-PRECONDITIONS: 0 public-safe — ${census.length} census patterns, 0 matches in the commit`)
// 1. CLEAN
const dirty = run('git', ['status', '--porcelain', '--', 'public', 'plugin-designs', 'library', 'internal', 'vite.config.js', 'vite.doxa-maps-build-config.json', 'package.json'])