Add the §2 eval gate, on green, and prove it can fail

[MichalAFerber]

DS §2 says built output MUST be free of runtime code generation, and that scripts/no-eval.sh MUST run in CI against it. This repo shipped neither the script nor the step.

Estate context: 11 Node repos ship a build script and 7 already run this scan. This is the last of the 4 that did not. Tracked in MichalAFerber/tgwab-standards#173.

Measured, not inherited

The two repos already gated under #173 are LAN Astro sites. Nothing about their result carries here — inheriting a scan result across repos is precisely the failure that issue was filed against. Built from origin/main (c7f4561):

step	result
npm ci (prepare runs the build) → lint → test	all exit 0
dist	1 file — markdownwizard-tools.iife.js, 46,037 bytes
./scripts/no-eval.sh dist	eval-free: OK (dist) — exit 0

Proved able to fail

::error::runtime code-generation found in dist (CSP has no 'unsafe-eval')
dist/__ctl__/x.js:1:const f = new Function("a","return a"); eval("1");
exit 1

Removing the planted file returns the run to green. The gate goes on green because nothing eval-shaped reaches the bundle, not because the scan is lenient.

Scope — and this one is specific to a published package

Worth reading before treating a green check here as full coverage:

• The files list ships both src and dist.
• The default export is "." : "./src/index.js".

So a consumer writing import … from 'markdownwizard-tools' gets the source; only the ./iife subpath resolves to what this scan covers. no-eval.sh dist does not cover the path most consumers use.

Nothing is hiding there — src/ scans clean today, all 8 files, exit 0. But whether §2's target should widen for a package whose default export is source is a standards question, and this repo should not answer it by quietly editing its own step. Raised in MichalAFerber/tgwab-standards#173. If the ruling is to widen, dist src is a one-word change and is green today.

Placement

No subtlety: prepare is the build, so npm ci produces dist and the scan has the bundle to read from that point on. It sits after test to keep the §15 gates contiguous.

Refs MichalAFerber/tgwab-standards#173

🤖 Generated with Claude Code

https://claude.ai/code/session_016beCydw4C9VrgL9eHzGUG2