From df5d0a116057b1daafceabdbedcdf7d59194951a Mon Sep 17 00:00:00 2001 From: jamiegibbs-del Date: Fri, 28 Aug 2026 10:37:40 -0400 Subject: [PATCH 1/2] docs: point the Legion API link at the new docs mount The Legion API reference moved from the ReadMe site to docs.picogrid.com/legion, built from the legion-docs repo. The guide header's Legion API link still resolved to /reference/start, and the resolver's root allowlist had no `legion` entry, so it also refused a LEGION_DOCS_URL override pointing at the new mount. The link fails closed either way. - defaultPath becomes /legion/ - documentationRoots gains `legion` `reference` is retained: the ReadMe site it names is still served on this host, so a build can still be pointed back at it while that remains true. Test fixtures follow the new default. Both affected suites pass: docs:legion:test 18/18, docs:check:deploy:test 46/46. --- docs/site/check-deploy-contract.test.mjs | 8 ++++---- docs/site/legion-documentation.mjs | 8 ++++++-- docs/site/legion-documentation.test.mjs | 8 ++++---- 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/docs/site/check-deploy-contract.test.mjs b/docs/site/check-deploy-contract.test.mjs index 3b6e244..f581c97 100644 --- a/docs/site/check-deploy-contract.test.mjs +++ b/docs/site/check-deploy-contract.test.mjs @@ -133,16 +133,16 @@ test('rejects a Worker documentation mount that differs from site-config', async test('admits the reviewed Legion reference, and nothing else off the mount', async () => { const admitted = await runFixture({ - html: 'Legion API', + html: 'Legion API', }); assert.equal(admitted.ok, true, admitted.output); // Its neighbour on the same host is not the reviewed target. const neighbour = await runFixture({ - html: 'Legion API', + html: 'Legion API', }); assert.equal(neighbour.ok, false); - assert.match(neighbour.output, /resolves outside \/ecn-sdk\/: .*\/reference\/other/); + assert.match(neighbour.output, /resolves outside \/ecn-sdk\/: .*\/legion\/other/); // A page of the guide that escapes the mount still fails. const escaped = await runFixture({ html: 'Concepts' }); @@ -151,7 +151,7 @@ test('admits the reviewed Legion reference, and nothing else off the mount', asy }); test('rejects variants of the reviewed Legion reference', async () => { - const reviewed = 'https://docs.picogrid.com/reference/start'; + const reviewed = 'https://docs.picogrid.com/legion/'; // The credential is applied through the URL API rather than written inline. A // credential-bearing URL literal on an approved host is a publication-input // violation in its own right, and the release scan refuses the file carrying diff --git a/docs/site/legion-documentation.mjs b/docs/site/legion-documentation.mjs index d70dbe9..8c74583 100644 --- a/docs/site/legion-documentation.mjs +++ b/docs/site/legion-documentation.mjs @@ -25,13 +25,17 @@ */ const approvedOrigin = 'https://docs.picogrid.com'; -const defaultPath = '/reference/start'; +const defaultPath = '/legion/'; const label = 'Legion API'; const segmentPattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/; // Reference material lives under one of these roots. An allowlist rather than a // list of authentication routes to refuse: a blacklist admits every endpoint // nobody thought of, and the decision requires this to fail closed. -const documentationRoots = new Set(['docs', 'guides', 'reference']); +// +// `legion` is the current mount, built from the legion-docs repo. `reference` is +// retained because the ReadMe site it names is still served on this host, so a +// build can still be pointed back at it while that remains true. +const documentationRoots = new Set(['legion', 'docs', 'guides', 'reference']); const versionPattern = /^[A-Za-z0-9][A-Za-z0-9. _-]{0,31}$/; // A dot segment, single or double, literal or percent-encoded. `URL` normalizes // these away, so the raw target has to be refused before it is parsed or the diff --git a/docs/site/legion-documentation.test.mjs b/docs/site/legion-documentation.test.mjs index 03ac671..b4fc890 100644 --- a/docs/site/legion-documentation.test.mjs +++ b/docs/site/legion-documentation.test.mjs @@ -11,7 +11,7 @@ function resolve(environment) { } const defaultTarget = { - href: 'https://docs.picogrid.com/reference/start', + href: 'https://docs.picogrid.com/legion/', label: 'Legion API', origin: 'https://docs.picogrid.com', title: 'Legion API documentation', @@ -28,7 +28,7 @@ test('uses the default target when LEGION_DOCS_URL is empty or whitespace', () = }); test('accepts explicit targets under each documentation root', () => { - for (const root of ['docs', 'guides', 'reference']) { + for (const root of ['legion', 'docs', 'guides', 'reference']) { const href = `https://docs.picogrid.com/${root}/start`; assert.equal(resolve({ LEGION_DOCS_URL: href }).href, href); } @@ -122,14 +122,14 @@ test('rejects bare query and fragment delimiters', () => { test('rejects a path outside the documentation roots', () => { assert.throws( () => resolve({ LEGION_DOCS_URL: 'https://docs.picogrid.com/api/start' }), - /the Legion documentation target must address a published documentation path \(docs, guides, reference\)/, + /the Legion documentation target must address a published documentation path \(legion, docs, guides, reference\)/, ); }); test('rejects an empty path segment', () => { assert.throws( () => resolve({ LEGION_DOCS_URL: 'https://docs.picogrid.com/reference//start' }), - /the Legion documentation target must address a published documentation path \(docs, guides, reference\)/, + /the Legion documentation target must address a published documentation path \(legion, docs, guides, reference\)/, ); }); From 69cc1ad38dc29ac772d738b0564dea6557b38368 Mon Sep 17 00:00:00 2001 From: jamiegibbs-del Date: Fri, 28 Aug 2026 12:44:47 -0400 Subject: [PATCH 2/2] build(docs): bump nanoid to 3.3.18 to clear the release audit gate `Exact release artifact` is a required check and it runs `npm audit --audit-level=high`, which now fails on a high-severity nanoid advisory: custom generators can loop indefinitely when size is zero, affecting < 3.3.18. nanoid is transitive here, astro -> vite -> postcss -> nanoid, so the lockfile is the only place to pin it. Fails on untouched main too, so this is not fallout from the docs change in this branch; it is bundled because the gate blocks the merge either way. npm update nanoid --package-lock-only. Six lines. After it, npm audit --audit-level=high reports zero vulnerabilities at any severity, and both docs suites still pass: docs:legion:test 18/18, docs:check:deploy:test 46/46. --- docs/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/package-lock.json b/docs/package-lock.json index 6b0f6ab..5d81fbe 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -7834,9 +7834,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.17", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", - "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ {