Patch source-map-js denial of service

.github/workflows/deploy.yml

@@ -45,6 +45,8 @@ jobs:
       - run: npm run build
       - name: Install Playwright browser
         run: npx playwright install --with-deps chromium
+      - name: Browser smoke and teaching scenario checks
+        run: npm run test:browser
       - name: Accessibility gate (axe-core, WCAG A/AA)
         run: npm run test:a11y
       - uses: actions/upload-pages-artifact@v5

README.md

@@ -44,6 +44,8 @@ npm run dev
 
 No environment variables, no API keys, no servers — everything runs client-side. The build bundles `@noble/secp256k1` and `@noble/hashes` into a single static JS file deployed straight to GitHub Pages, with no remote services and no telemetry. Additional scripts: `npm run build` (tsc + production build to `dist/`), `npm run preview` (serve the built `dist/` locally), and `npm test` (Vitest: engine known-answers, a jsdom run that drives the real stepper, and an axe-core WCAG 2 A/AA gate).
 
+For browser verification, run `npx playwright install chromium`, then `npm run test:browser` and `npm run test:a11y`. The smoke suite uses installed Windows Edge when available and the installed Playwright Chromium on other systems. `CRYPTO_LAB_BROWSER_PATH` can select an existing browser executable for verification; it is not required by the application. Both browser suites gate the Pages deployment.
+
 ## Related Demos
 
 - [crypto-lab-bitcoin-wallet](https://systemslibrarian.github.io/crypto-lab-bitcoin-wallet/) — keys → P2PKH/P2WPKH addresses, BIP-39 mnemonics, and BIP-32 HD derivation: where the keys this script checks come from.

e2e/a11y.spec.ts

@@ -185,6 +185,7 @@ async function expandAll(page: Page): Promise<void> {
 async function open(page: Page, theme: 'dark' | 'light'): Promise<void> {
   await page.emulateMedia({ reducedMotion: 'reduce' });
   await page.goto('.');
+  await expect(page.locator('.cl-brand')).toHaveAccessibleName(/CL CRYPTO LAB/);
   await assertReducedMotion(page);
   await expect(page.locator('html')).toHaveAttribute('data-theme', 'dark');
   // #app ships empty; wait for the real first paint before believing anything.

index.html

@@ -100,7 +100,7 @@
 </style>
 <a class="cl-skip-link" href="#app">Skip to content</a>
 <header class="cl-topbar" role="banner" aria-label="Crypto Lab">
-  <a class="cl-brand" href="https://crypto-lab.systemslibrarian.dev/" aria-label="Crypto Lab home">
+  <a class="cl-brand" href="https://crypto-lab.systemslibrarian.dev/">
     <span class="cl-badge">CL</span>
     <span class="cl-brand-text">
       <span class="cl-title">CRYPTO LAB</span>

tests/browser-smoke.mjs

@@ -1,5 +1,6 @@
-// tests/browser-smoke.mjs — real-browser verification using the system Edge
-// (no Chromium download). Run with: npm run test:browser  (it builds first).
+// tests/browser-smoke.mjs — real-browser verification using installed Windows
+// Edge when available, or the Playwright Chromium installed for the WCAG gate.
+// Run with: npm run test:browser (it builds first).
 //
 // Asserts, against the actual rendered page:
 //   * loads with no console/page errors
@@ -13,12 +14,16 @@
 
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
+import { existsSync } from 'node:fs';
+import { chromium } from '@playwright/test';
 import puppeteer from 'puppeteer-core';
 
 const require = createRequire(import.meta.url);
 const AXE_PATH = require.resolve('axe-core/axe.min.js');
 
 const EDGE = 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe';
+const BROWSER = process.env.CRYPTO_LAB_BROWSER_PATH ||
+  (process.platform === 'win32' && existsSync(EDGE) ? EDGE : chromium.executablePath());
 const PORT = 4401;
 const BASE = `http://localhost:${PORT}/crypto-lab-bitcoin-script/`;
 
@@ -51,7 +56,7 @@ async function main() {
   const preview = await startPreview();
   let browser;
   try {
-    browser = await puppeteer.launch({ executablePath: EDGE, headless: true, args: ['--no-sandbox', '--disable-gpu'] });
+    browser = await puppeteer.launch({ executablePath: BROWSER, headless: true, args: ['--no-sandbox', '--disable-gpu'] });
     const page = await browser.newPage();
     page.on('console', (m) => { if (m.type() === 'error') consoleErrors.push(m.text()); });
     page.on('pageerror', (e) => consoleErrors.push('pageerror: ' + e.message));