Docs: narrow the README dependency claim

README.md

@@ -33,7 +33,7 @@ Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a c
 - **A glance should tell you more than a number would.** Widgets are small visuals, not readouts.
 - **Anything can be a badge.** Point Stackyard at any API and show what it reports as a [live activity badge](https://stackyard.sandobserver.com/docs/badges/). One poll can carry several labelled values, each with its own colour and threshold. No custom widget, no code.
 - **Configured by clicking, not by editing files.** Everything is set up in the web UI, with config import and export.
-- **No dependencies.** Review it once and stop worrying about the supply chain.
+- **No runtime npm dependencies.** The image adds only nginx and supervisor, from Alpine, to the official Node base.
 - **Six languages, right-to-left included.** Contrast and screen-reader labels are covered by tests.
 - **Installs like an app.** A mobile layout that opens in its own window from a home screen. No offline mode: every tile is live.
 

test/repo/readme-dependencies.test.js

@@ -0,0 +1,28 @@
+/* The README names what the image adds to its base. A dependency added to the
+   API or a package added to the image makes that sentence false. */
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.join(__dirname, '..', '..');
+const read = f => fs.readFileSync(path.join(root, f), 'utf8');
+
+test('the README says what the image adds to its base', () => {
+  assert.match(
+    read('README.md'),
+    /No runtime npm dependencies\.\*\* The image adds only nginx and supervisor, from Alpine, to the official Node base\./,
+  );
+});
+
+test('the API declares no npm dependencies', () => {
+  const pkg = JSON.parse(read('api/package.json'));
+  assert.deepEqual(pkg.dependencies || {}, {});
+});
+
+test('the image installs nginx and supervisor and no other package', () => {
+  const adds = [...read('Dockerfile').matchAll(/apk add\s+((?:--\S+\s+)*)([^&\\\n]+)/g)].map(m => m[2].trim());
+  assert.deepEqual(adds, ['nginx supervisor']);
+  assert.match(read('Dockerfile'), /^FROM node:\d+-alpine@sha256:[0-9a-f]{64}$/m);
+});