doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
doxa-maps/library/components
History
Doxa Maps 4a12b009aa Every runtime CDN script and stylesheet is an exact version with an integrity hash 
maplibre-gl@5 and maplibre-gl-geocoder@1 were floating ranges, and no runtime loader set `integrity`,
so a CDN could serve any bytes to every partner's visitors unnoticed (CRITIC-5).

- library/constants/cdn.js is the one registry: mapbox-gl 3.24.0, maplibre-gl 5.24.0 (the release the
  @5 range already resolved to), both geocoders (1.9.4 / 5.0.0) and d3 7.9.0, each with its sha384.
  Every host answers Access-Control-Allow-Origin: *, so integrity + crossorigin work cross-origin.
- ensureEngineScript / ensureEngineCSS, the geocoder loaders (library and PPLR) and the generator's
  static MapLibre tags set integrity + crossorigin from it; the embed snippet's engine preload matches.
- check:cdn-pins (gates:post): no floating CDN url in shipped code, and every one is in the registry;
  --online re-fetches each and compares the hash (all 9 match today).

MapLibre stays on 5.x knowingly. GHSA-jrc7-96c5-q579 (DOM.sanitize, reached through a source's
attribution string) affects <= 6.4.0, and 6.x is ESM-only (no UMD global), so the upgrade is a loader
migration of its own. The attribution strings rendered today come from our configured basemap styles
and our own sources; the note in cdn.js says who is exposed until then.
2026-09-26 05:50:24 +00:00
..
charts Prepare repo to the vision: BLUF vision-cast README, library warning, SRI injection, term scrub 2026-09-15 22:58:19 +00:00
hints Phone: every shared control clears the 24px touch minimum 2026-09-25 07:30:14 +00:00
legends The legend's export menu speaks the reader's language 2026-09-26 04:38:59 +00:00
map-controls Every runtime CDN script and stylesheet is an exact version with an integrity hash 2026-09-26 05:50:24 +00:00
poster Poster wall: 'Show on map' says when it is on (aria-pressed), since a second press turns it off 2026-09-26 05:16:02 +00:00
qa Brand-neutral shared VerticalTabsLayout with lazy nested-element hosting; fix cap-5 prayer tab leaf path; neutralize library identifiers; add Forgejo CI build-gate workflow 2026-09-19 17:24:30 +00:00
search The last English in the shared header, panel and facet rail — and a 24px touch target 2026-09-25 09:15:30 +00:00
tables Put the tables in the house palette instead of Tabulator's stock theme 2026-09-24 03:51:06 +00:00
PeopleGroupDetail.vue Teach the synced-CSS gate what a selector is, and turn it on 2026-09-23 01:22:36 +00:00
README.md consolidate docs into documentation/ and deployment shells into deployment/ 2026-09-21 23:23:23 +00:00
ResearchMapFilterPanel.vue Merge main into bundler-2/work 2026-09-25 09:18:16 +00:00
ResearchMapSideMenu.vue Stop showing English where the catalogue already holds the translation 2026-09-25 12:16:59 +00:00
SideMenuDrawer.vue doxa-maps — portable bundler for embeddable JAMstack maps 2026-09-10 01:53:07 +00:00
ViewSelect.vue Move internal files out of the repo; fix five dead links; a fuller delegation diagram 2026-09-25 05:14:10 +00:00
WARNING.md Complete app-profiles->plugin-designs sweep across comments/docs; build green; layouts kept at root (load-bearing) 2026-09-17 18:18:19 +00:00

README.md

library/components/ — shared Vue components

The map UI, built from parameterized pieces every app-profile reuses. Fix one here and every map benefits — never edit a shared component to customize one map.

  library/components/
  ┌───────────────────────────────────────────┐
  │ legends/        map-controls/   poster/      │
  │ charts/         tables/                       │
  │ PeopleGroupDetail.vue   SideMenuDrawer.vue    │
  │ ResearchMapFilterPanel.vue  …SideMenu.vue     │
  └───────────────────────────────────────────┘
     reused by every app-profile via @map/components/…
  • legends/, map-controls/, poster/ each have their own README.
  • Every component uses <script setup>, calls useShadowStyles(), and reaches stores via inject('mapStore' | 'uiStore' | 'dataStore') — never a direct store import.

Full catalog + conventions: ../../documentation/architecture/components.md · per-file roles: ../../documentation/reference.md.