From 8e42a95b316608e6e6990d3d4807a1cdc9236ed7 Mon Sep 17 00:00:00 2001 From: Paul Clark Date: Fri, 9 Oct 2026 09:25:58 -0400 Subject: [PATCH] Patch source-map-js event-loop denial of service --- .github/workflows/deploy.yml | 2 ++ README.md | 2 ++ e2e/a11y.spec.ts | 1 + index.html | 2 +- package-lock.json | 6 +++--- tests/browser-smoke.mjs | 11 ++++++++--- 6 files changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 1728728..95c58f8 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -45,6 +45,8 @@ jobs: - run: npm run build - name: Install Playwright browser run: npx playwright install --with-deps chromium + - name: Browser smoke and teaching scenario checks + run: npm run test:browser - name: Accessibility gate (axe-core, WCAG A/AA) run: npm run test:a11y - uses: actions/upload-pages-artifact@v5 diff --git a/README.md b/README.md index 191ee4e..5d15bf8 100644 --- a/README.md +++ b/README.md @@ -44,6 +44,8 @@ npm run dev No environment variables, no API keys, no servers — everything runs client-side. The build bundles `@noble/secp256k1` and `@noble/hashes` into a single static JS file deployed straight to GitHub Pages, with no remote services and no telemetry. Additional scripts: `npm run build` (tsc + production build to `dist/`), `npm run preview` (serve the built `dist/` locally), and `npm test` (Vitest: engine known-answers, a jsdom run that drives the real stepper, and an axe-core WCAG 2 A/AA gate). +For browser verification, run `npx playwright install chromium`, then `npm run test:browser` and `npm run test:a11y`. The smoke suite uses installed Windows Edge when available and the installed Playwright Chromium on other systems. `CRYPTO_LAB_BROWSER_PATH` can select an existing browser executable for verification; it is not required by the application. Both browser suites gate the Pages deployment. + ## Related Demos - [crypto-lab-bitcoin-wallet](https://systemslibrarian.github.io/crypto-lab-bitcoin-wallet/) — keys → P2PKH/P2WPKH addresses, BIP-39 mnemonics, and BIP-32 HD derivation: where the keys this script checks come from. diff --git a/e2e/a11y.spec.ts b/e2e/a11y.spec.ts index a690e5a..e7f8a19 100644 --- a/e2e/a11y.spec.ts +++ b/e2e/a11y.spec.ts @@ -185,6 +185,7 @@ async function expandAll(page: Page): Promise { async function open(page: Page, theme: 'dark' | 'light'): Promise { await page.emulateMedia({ reducedMotion: 'reduce' }); await page.goto('.'); + await expect(page.locator('.cl-brand')).toHaveAccessibleName(/CL CRYPTO LAB/); await assertReducedMotion(page); await expect(page.locator('html')).toHaveAttribute('data-theme', 'dark'); // #app ships empty; wait for the real first paint before believing anything. diff --git a/index.html b/index.html index fe6735b..1b013bd 100644 --- a/index.html +++ b/index.html @@ -100,7 +100,7 @@ Skip to content