Merge pull request 'chore(ci): gate deploys on new advisories, restore lint and typecheck' (#32) from chore/audit-gate-and-lint-gates into main

Reviewed-on: #32

.gitea/workflows/publish.yml

@@ -4,6 +4,14 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+
+# One deploy at a time: `surfer deploy` swaps the site atomically, so two runs
+# racing each other is not corruption, but it is a wasted build and the last
+# swap wins.
+concurrency:
+  group: surfer-datacontroller-io
+  cancel-in-progress: false
 
 jobs:
   Build-and-publish:
@@ -18,8 +26,44 @@ jobs:
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
 
+      # Blocking gate. `npm audit --audit-level=<x>` is all-or-nothing and this
+      # tree cannot pass a flat gate at any level: the Gatsby 5 build toolchain
+      # carries ~100 advisories with no non-breaking fix, so gating on the tree
+      # as a whole stops publishing permanently. scripts/audit-gate.mjs instead
+      # accepts the known set (scripts/audit-baseline.json, with an owner and a
+      # reason) and FAILS on any new critical/high advisory.
+      - name: Audit for new critical/high advisories
+        run: node scripts/audit-gate.mjs
+
+      # The prettier and type checks used to live in a GitHub workflow that
+      # never ran on this forge; keep them ahead of the build so a type or
+      # formatting error blocks the deploy rather than shipping.
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Check prettier offences
+        run: npm run lint
+
       - name: Build
         run: npm run build
 
+      # Deploy tooling pinned to an exact version: the workflow publishes
+      # whatever is committed, and an unpinned `latest` would let a breaking or
+      # compromised upstream release ship straight to the live site.
+      #
+      # `deploy` (v7) replaces the site atomically - it extracts to a staging
+      # folder and swaps it in, so a failed upload leaves the current site
+      # serving.  The v6 `put` this replaces was token authenticated and is
+      # gone; v7 takes the Cloudron username plus an app password for this app.
       - name: Publish
-        run: npx surfer put --token ${{ secrets.SURFER_TOKEN }} --server datacontroller.io public/* /
+        env:
+          SURFER_PASSWORD: ${{ secrets.SURFER_PASSWORD }}
+          REF_NAME: ${{ gitea.ref_name }}
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          set -euo pipefail
+          npx --yes @cloudron/surfer@7.2.0 deploy public \
+            --server datacontroller.io \
+            --username allan \
+            --password "$SURFER_PASSWORD" \
+            --message "Build from ${REF_NAME} @ ${COMMIT_SHA:0:8}"

.github/workflows/publish.yml

@@ -1,30 +0,0 @@
-name: Gatsby Publish
-
-on:
-  push:
-    branches: main
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Use Node.js from .nvmrc
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
-
-      - name: Check prettier offences
-        run: npm run lint
-
-      - uses: enriikke/gatsby-gh-pages-action@v2
-        with:
-          access-token: ${{ secrets.DCSITE }}
-          deploy-branch: gh-pages
-          gatsby-args: --prefix-paths

.pre-commit-config.yaml

@@ -0,0 +1,12 @@
+# Secret scanning for staged content, so a credential is caught before it is
+# committed rather than after it has been pushed and published.
+#
+# gitleaks is pinned to an exact tag: a floating rev would pull whatever the
+# hook's upstream does next into every contributor's commit path.
+#
+# Install once per clone: `pre-commit install`.
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks

content/blog/derived-variables/index.md

@@ -0,0 +1,140 @@
+---
+title: 'Derived Variables: computed columns in the EDIT screen'
+description: Data Controller can now compute columns that do not exist in the table - and, crucially, filter on them. Configured per table in MPE_DERIVED, computed on every read, never stored.
+date: '2026-10-21 12:00:00'
+author: 'Allan Bowe'
+authorLink: https://www.linkedin.com/in/allanbowe/
+previewImg: './derived-grid.png'
+tags:
+  - Data Controller
+  - Features
+---
+
+# Derived variables: computed columns you can filter on
+
+Every reporting team has a version of this request, and it always sounds like a five minute job: a column in the EDIT screen that is not in the table. A region worked out from a state code. A line value that is quantity times price. Not stored, not loaded, just *there* - and, as the requester usually adds, filterable.
+
+The "not stored" part is easy. The "filterable" part is where the design lives, and it is worth writing down, because it explains every other decision in the feature.
+
+## Why a computed column is not automatically filterable
+
+You would write it in a DATA step:
+
+```sas
+data out;
+  set mylib.mytable;
+  REGION = ifc(STATE in ('CA','OR','WA'),'West','East');
+  where REGION = 'West';
+run;
+```
+
+That fails. A `WHERE` statement applies to the data set named on the `SET` statement - the *input* - and on that input `REGION` does not exist. SAS cannot see a variable that the same step creates later. You can put the assignment and the filter in separate steps, but then the filter runs after the step has read every row, which is precisely the work the filter exists to avoid - and for a large table that is the difference between a fast screen and a coffee break.
+
+So the calculation has to happen somewhere the filter can see it. In Data Controller it happens in a **DATA step view**:
+
+```sas
+data work.vw_derived / view=work.vw_derived;
+  set mylib.mytable;
+  attrib REGION length=$8 label='REGION=ifc(...)' format=$8.;
+  REGION = ifc(STATE in ('CA','OR','WA'),'West','East');
+run;
+
+data out;
+  set work.vw_derived;
+  where %inc filtref;;
+run;
+```
+
+The view is not executed when it is defined. When the second step reads it, the assignment runs as part of the view's step, so by the time the `WHERE` is evaluated `REGION` is a column of the input. The filter is unchanged, the row-level security clause is unchanged, and nothing extra is read.
+
+## What it looks like
+
+The demo table below has four rows. `LINE_VALUE` is `QTY * PRICE`, `REGION` is derived from `STATE`, and `REGION_LABEL` is built on `REGION`. None of the three is a column of the table, and all three are read-only in the grid - and marked so, with a tinted header carrying an `fx` badge, italic tinted cells, and an edge where the computed block begins, so that "computed" never has to be confused with "locked by a rule":
+
+![](./derived-grid.png)
+
+Because they are on the input to the filter, they filter like any other column. Here is `REGION = 'West'`, with the filter bar naming the derived variable:
+
+![](./derived-filter-region.png)
+
+and a numeric one, `LINE_VALUE > 50`:
+
+![](./derived-filter-value.png)
+
+The value list in the filter dialog is built the same way, from the table under the rest of the filter - so a derived column gets a dropdown of its distinct values, not a blank box.
+
+## Configuration
+
+`MPE_DERIVED` is itself a Data Controller table, so it is maintained through the EDIT screen with the usual submit / review / approve workflow. One row per variable - these are the three rows behind the screenshots above:
+
+![](./derived-config.png)
+
+
+```
+VAR_NM      REGION
+VAR_DEPS    STATE
+VAR_TYPE    C
+VAR_LEN     8
+VAR_FMT     (blank)
+VAR_LABEL   (blank)
+VAR_LOGIC   ifc(STATE in ('CA','OR','WA'),'West','East')
+ACTIVE      1
+```
+
+and the chained one:
+
+```
+VAR_NM      REGION_LABEL
+VAR_DEPS    REGION STATE
+VAR_TYPE    C
+VAR_LEN     14
+VAR_FMT     (blank)
+VAR_LABEL   Region and state
+VAR_LOGIC   cats(REGION,'-',STATE)
+ACTIVE      1
+```
+
+Which produces, at read time:
+
+```sas
+attrib REGION length=$8 label='REGION=ifc(STATE in (''CA'',''OR'',''WA''),''West'',''East'')' format=$8.;
+REGION = ifc(STATE in ('CA','OR','WA'),'West','East');
+attrib REGION_LABEL length=$14 label='Region and state' format=$14.;
+REGION_LABEL = cats(REGION,'-',STATE);
+```
+
+Type and length are declared rather than guessed, so a value is truncated exactly as specified. The format is optional; when it is left blank a character variable gets `$<length>.` and a numeric one `<length>.`, and a date, time or datetime format makes the column render - and filter - as a date, the same way a stored column does. The label is `VAR_LABEL` when you supply one, otherwise the name, an equals sign and the expression, so a user who switches labels on can see where the value came from.
+
+## Dependencies, without a sequence number
+
+`REGION_LABEL` needs `REGION` to exist first. Rather than maintain a sort order, each row declares its inputs in `VAR_DEPS`, and the statements are emitted in dependency order. Adding a variable in the middle of a chain means editing one row's `VAR_DEPS`, not renumbering the table.
+
+`VAR_DEPS` lists *every* input - physical columns and derived variables alike - and the declaration is checked against the expression in both directions: a derived variable the expression references must be declared, and a declared name the expression does not reference is an error. A declared name must be a column of the table or a derived variable of the same table, and a cycle is rejected with the path that forms it:
+
+```
+VAR_DEPS contains a cycle: A -> B -> C -> A
+```
+
+## What it will not do
+
+**Expressions only.** `VAR_LOGIC` must be a single SAS expression. Semicolons, macro triggers (`%`, `&`) and comments are rejected, so one row can never be more than an expression - which is the point: a config table is not a place to write programs. Conditional logic is available through functions such as `ifc()`, `choosec()`, `cats()`, `catx()`, `put()`, `input()` and `intnx()`.
+
+**No shadowing, no self-reference.** A derived variable may not reuse the name of a column in the target table. Nor may it reference itself: `SUMMER = SUMMER + 1` implies a retained value, which depends on the order rows happen to arrive in.
+
+**Never stored.** Derived values are computed on every read. Nothing derived is submitted, reviewed or written back - the approval package contains physical columns only, and a crafted submission that includes a derived column is discarded before the security check runs.
+
+**EDIT screen only, for now.** The VIEW screen and the download services do not show derived columns. A saved filter that references one still applies there and is evaluated the same way.
+
+**Not for row level security.** A rule in `MPE_ROW_LEVEL_SECURITY` cannot reference a derived column: the rule is evaluated against the submitted data, where the column does not exist. Saving a rule that names one is rejected with an explanation rather than left to fail at submit time.
+
+## One warning
+
+An expression can reference a column that is hidden from a user by [Column Level Security](https://docs.datacontroller.io/column-level-security/) - and the derived column will show the result. Configure derived variables with the same care as any other data exposure.
+
+## Availability
+
+Derived variables are available on SAS 9, Viya and SASjs Server. The configuration table, the settings and the post-edit validation are created by the usual upgrade - there is nothing to install beyond the release itself.
+
+The full reference, including every column of `MPE_DERIVED` and the validation rules applied at submit time, is in the [docs](https://docs.datacontroller.io/derived-variables/).
+
+If a table of yours has been waiting for "just one more column", we would love to [hear from you](/contact).

content/blog/two-rule-sets-one-table/index.md

@@ -1,128 +0,0 @@
----
-title: 'One Table, Two Rule Sets'
-description: 'A single physical table can carry only one set of Data Controller validation rules. Two librefs over the same data - or a pair of hook scripts - give you as many rule sets as you need.'
-date: '2026-09-24 15:30:00'
-author: 'Data Controller'
-authorLink: https://www.linkedin.com/showcase/data-controller-for-sas
-tags:
-  - Data Quality
-  - Configuration
-previewImg: './rule-set-1.png'
----
-
-# One Table, Two Rule Sets
-
-Most Data Controller sites settle into an obvious mapping: one table, one edit screen, one set of validation rules. But that is not always what the business wants. A table of orders might be edited from a finance report that only tolerates small adjustments, and from an operations report where much larger ones are routine. Same table, same columns, same approvers - different rules.
-
-Data Controller's validation rules are configured per table, so this takes a little thought. There are two ways to do it: the one we recommend, and the one to reach for when the first is not available.
-
-## Why one table is one rule set
-
-Two configuration tables decide this.
-
-`MPE_TABLES` is the list of editable tables, and its primary key is `(tx_from, libref, dsn)`. One physical table is one editable table.
-
-`MPE_VALIDATIONS` holds the rules, and its primary key is `(tx_from, base_lib, base_ds, base_col, rule_type)`. Rules hang off a physical `libref.dataset`. There is no per-menu or per-report scoping anywhere in the schema, and the editor is handed exactly the rules whose `base_lib` and `base_ds` match the table being opened.
-
-So two rule sets on one table need two distinct `libref.dataset` identities. The question is how to get them without copying the data.
-
-## Option 1 (recommended): two librefs over the same data
-
-A libref is just a name pointing at a location. Nothing stops you assigning two of them to the same place, and Data Controller will treat the two as separate tables:
-
-```sas
-libname ORDERS_EU '/data/orders';
-libname ORDERS_US '/data/orders';
-```
-
-`ORDERS_EU.ORDERS` and `ORDERS_US.ORDERS` are now the same physical file, but they are different rows in `MPE_TABLES` and can therefore carry different rows in `MPE_VALIDATIONS`. Register both, give each its own rules, and point each report at its own editor URL - `#/editor/ORDERS_EU.ORDERS` and `#/editor/ORDERS_US.ORDERS`.
-
-![The first report rejects an amount of 5000](rule-set-1.png)
-
-![The second report accepts the same value](rule-set-2.png)
-
-Everything else works exactly as it always did. Filtering, search, the row cap, the approval diff and the audit trail all operate on the table as normal, because as far as Data Controller is concerned these are ordinary tables. The only difference is that the two names resolve to the same file, so an approval in either report updates the same data - and that one difference has a consequence for concurrency, which is covered below.
-
-There is no copy to keep in sync, no hook to write and nothing to maintain. That is why it is the option we recommend.
-
-### Things worth knowing
-
-- Where the librefs are defined depends on your platform. On Viya, in the compute context's `autoexec.sas` (or `[DC Drive Path]/services/settings.sas`); on SAS 9, as metadata libraries or in the Data Controller Settings stored process; on SASjs Server, in `services/public/settings.sas`. The one requirement is that each library has a unique libref.
-- `mp_lockanytable` keys on `libref.dataset`, so the two menus do not serialise against each other. That has consequences beyond a collision - see *The concurrency caveat* below.
-- The audit trail and approval queue record which libref a change came through, so `ORDERS_EU.ORDERS` and `ORDERS_US.ORDERS` stay distinguishable in history. For most people that is a feature - you can see which report a change originated from.
-
-### The concurrency caveat
-
-Data Controller serialises its writes with `mp_lockanytable`, and the control table it uses, `MPE_LOCKANYTABLE`, has a primary key of `(lock_lib, lock_ds)`. That is the *registration*, not the physical file. At approve time, `postdata` takes the lock on the base table named in the submit record, and the same service runs its "has this table been updated since the diff screen was shown" check against `MPE_DATALOADS`, keyed on that same `libref` and `dsn`.
-
-Two librefs over one location are two different `(libref, dsn)` pairs, so:
-
-- two approvals arriving through different reports take two different locks, and neither one blocks the other;
-- a load through one report writes its `MPE_DATALOADS` entry against its own name, so the other report's staleness check does not see it either.
-
-So two people editing the same rows through different reports can both be approved, and the second write wins, silently. The lock is advisory to begin with - `mp_lockanytable` is, in its own words, "only useful if every update uses the macro" - so this is not a new class of risk, but registering one file twice is a new way to fall into it.
-
-The hook route does not have this problem. Both mirrors route their submit to the same base table, so every approval locks, loads and logs against one identity.
-
-If you do use two librefs, and concurrency matters to you, the cleanest fix is to keep the two registrations for the edit screen and give each one a `POST_EDIT_HOOK` that re-points the changeset at a single canonical registration - then every approval is keyed on the same table regardless of which report raised it. Register that canonical name as well. The alternative, an explicit shared lock taken in `PRE_APPROVE_HOOK` and released in `POST_APPROVE_HOOK`, works too, but a failed run leaves the sentinel locked and `MPE_LOCKANYTABLE` is then a table you have to unpick by hand.
-
-## Option 2: an empty mirror and a pair of hook scripts
-
-Sometimes two librefs over one location are not available: a database library where the platform will not let you define the same object twice, or a site where adding a library definition is a change nobody wants to make. Then you can reach the same result with a mirror table and two hook scripts.
-
-The idea is that the thing Data Controller edits is not the real table at all, but an empty table of the same shape, with hooks moving data in and out of it:
-
-- a `PRE_EDIT_HOOK` fills the editor with the live rows of the real table, so the mirror never has to hold a copy
-- a `POST_EDIT_HOOK` re-points the submitted changeset at the real table, so the approval is raised against the real table and the load writes there
-
-The mirror exists purely to carry the rule set, and never stores any data.
-
-### The pre-edit hook
-
-`PRE_EDIT_HOOK` runs inside the `getdata` service, after the user's filter has been applied and the rows sorted, with the data in `work.OUT`. It may replace that dataset, which is all this needs:
-
-```sas
-data work.out;
-  set ORDERS.ORDERS;
-run;
-```
-
-The registered table is `ORDERS.MIRROR`, which is empty - so without the hook the editor would show nothing at all. With it, the grid shows the live rows:
-
-![An empty mirror displaying the live rows of the real table](mirror-live.png)
-
-Note the title bar: the mirror really is empty. Everything on screen came from the hook, and the grid is validated against the mirror's own rules rather than the real table's.
-
-### The post-edit hook
-
-This is the part that surprises people. `POST_EDIT_HOOK` runs inside the `mpe_loader` macro at submit time, on the staged rows, before the submit record is written. It cannot choose the target table directly - but at that point `LIBREF` and `DS` are still ordinary macro variables, and the submit record is built from them. Reassigning them re-points the whole changeset:
-
-```sas
-data _null_;
-  call symputx('libref','ORDERS');
-  call symputx('ds','ORDERS');
-run;
-```
-
-From that moment the changeset is an approval against `ORDERS.ORDERS`. The approver sees a diff against the real table, the load writes to the real table, and the mirror is never touched.
-
-![A change submitted against the mirror, raised against the real table](approval-routed.png)
-
-### The detail that will bite you
-
-Use `call symputx`, not `%let`. `LIBREF` and `DS` are not declared `%local` in `mpe_loader`, and the hook is included into that scope - so `call symputx` finds the existing variable and updates it, while a `%let` creates a new variable in the hook's own scope and is silently discarded. The hook runs, the log looks clean, and the changeset goes to the mirror anyway.
-
-### Other things to watch
-
-- Concurrency behaves correctly here. Both mirrors route their submit to the same base table, so every approval locks, loads and logs against one identity - unlike the two-libref route above.
-- The filter has already been applied to the empty mirror by the time the pre-edit hook runs, so a hook that reads the real table ignores the user's filter unless it re-applies it (`where %inc filtref`). On a small table you will not notice; on a large one the `DC_MAXOBS_WEBEDIT` cap will stop the edit screen with "Table is too big".
-- The hook's output must have the same columns the editor expects - the real table, minus any transaction or processing columns that Data Controller drops on load.
-- The real table must itself be registered in `MPE_TABLES`. The approval screen resolves the table's audit settings from that row, so a changeset routed to a table with no registration cannot be reviewed - the submit is refused up front, naming the table.
-- The mirror's `MPE_TABLES` row is read for the edit screen and the real table's for the load, so keep their `buskey`, `loadtype` and temporal column settings identical.
-- At approval time the access checks run against the real table, so editors need `EDIT` on the mirror while approvers need `EDIT` and `APPROVE` on the real table.
-
-## Which should you use?
-
-If you can define two librefs over the same data, do that. It is configuration only, it leaves every other behaviour of the editor untouched, and there is nothing to maintain.
-
-Reach for the hook scripts when the platform will not let you duplicate the library definition, or when you specifically want the rule set to be a property of the application rather than of the data.

content/feed/columns-that-are-not-in-the-table/index.md

@@ -0,0 +1,39 @@
+---
+title: 'The column that is not in the table'
+description: 'Derived variables give the EDIT screen columns that do not exist in the table - computed on every read, never stored, and filterable like any other column. The full story is in the article.'
+date: '2026-10-27 09:00:00'
+author: 'Data Controller'
+authorLink: https://www.linkedin.com/showcase/data-controller-for-sas
+tags:
+  - Announcements
+  - Features
+previewImg: './derived-fx.png'
+---
+
+# The column that is not in the table
+
+Every reporting team has a version of this request, and it always sounds like a five minute job: "can we have a region column? It is just the state, mapped. And a line value - quantity times price. We do not need it stored, we just need it on the screen."
+
+It is never a five minute job - so Data Controller now does the obvious thing instead. You write the expression, and the EDIT screen shows the column: computed on every read, never stored, marked `fx` and read-only, so nobody has to wonder whether it is locked or simply has nothing to edit.
+
+The part that took the thinking is that they filter like any other column. That needed a DATA step view rather than a data step, and the reasoning is worth reading: [Derived variables: computed columns you can filter on](/derived-variables/).
+
+Reference: [Derived Variables](https://docs.datacontroller.io/derived-variables/).
+
+If a table of yours has been waiting for "just one more column", we would love to [hear from you](/contact).
+
+<!--
+Feed teaser for the article at /derived-variables/. The article carries the
+engineering - why a computed column is not automatically filterable, the DATA
+step view, the configuration table, the limits - so this post links to it
+rather than repeating it.
+
+Image prompt (cover): a clean, modern illustration on a white background: a
+spreadsheet grid rendered in soft slate and light blue, with the leftmost four
+columns showing plain data and three further columns floating slightly to the
+right, detached from the table, tinted light blue and italicised, each marked
+with a small "fx" badge. A thin left border separates the floating block from
+the stored columns. No text other than the fx badges. Flat vector style, brand
+palette: slate #314351, light blue #d3e5f2, accent green #79a843 used sparingly
+as a single dot.
+-->

content/feed/customer-story/index.md

@@ -0,0 +1,55 @@
+---
+title: 'Data Controller for SAS® - a Customer Story'
+description: Data Controller for SAS® lets business users self serve their data updates - restricted access to the data values, with the data model protected.
+date: '2026-10-11 09:00:00'
+author: 'Data Controller'
+authorLink: https://www.linkedin.com/showcase/data-controller-for-sas
+tags:
+  - Announcements
+previewImg: './customer-story.jpeg'
+---
+
+# Data Controller for SAS® - a Customer Story
+
+Data Controller for SAS® empowers business users to self serve their data updates, by providing restricted access to the data *values* whilst protecting the data *model*. This short customer story shows what that looks like for Data and Analytics teams in regulated industries.
+
+The distinction is the whole point. An editor can add, correct and delete rows in the tables they are responsible for, but they cannot change the structure underneath - no new columns, no altered formats, no dropped keys. The shape of the table is fixed, and only its contents move. Every change is staged, validated at the point of entry, reviewed as a diff and approved by a data owner before it is loaded, with a full audit trail of who changed what, when and why.
+
+See it in action:
+
+<iframe title="Data Controller for SAS - a Customer Story" width="560" height="315" src="https://vid.4gl.io/videos/embed/kpSGoNE26FSif8X9A6pUfe" style="border: 0px;" allow="fullscreen" sandbox="allow-same-origin allow-scripts allow-popups allow-forms"></iframe>
+
+Would you like to see how this would work against your own tables? [Get in touch](/contact) to arrange a walkthrough.
+
+<!--
+Source LinkedIn post:
+
+Business users need to keep their data current. They do not need to change the tables underneath.
+
+Most tools blur the two. Hand someone a spreadsheet and they reshape the file. Grant write access to a production table and they can reshape the table. Neither is what you want.
+
+Data Controller for SAS® draws the line at the data VALUES. Business users self serve their updates - adding, correcting and deleting rows in the tables they own - with restricted access to what is inside the table, whilst the data MODEL stays protected. No new columns, no altered formats, no dropped keys.
+
+→ Every change is staged and validated at the point of entry
+→ Reviewed as a diff and approved by a data owner before it loads
+→ With a full audit trail of who changed what, when and why
+
+A short customer story, for Data and Analytics teams in regulated industries:
+
+✅ Watch the story, then book a Discovery Call - link in the comments.
+
+#sas #sasviya #datagovernance #datacapture #dataquality
+-->
+
+<!-- Image prompt:
+
+Generate a 16:9 landscape illustration for a B2B data-governance blog cover, 1200x627.
+
+Style: flat vector illustration, dark slate background (#314351) with a faint evenly spaced dot grid, brand green accent (#90c445), lighter slate panels (#2e4252), soft diffused shadows, subtle depth.
+
+Scene: a single data table drawn as two separated layers. The top layer is the table's structure - a header band of column blocks in muted slate, held behind a closed green padlock on the left. The bottom layer is the table's values - four rows of rounded cells in lighter slate, with two cells filled solid brand green and a small green pencil resting beside the lower right of the grid, as if those values are the ones being edited. A thin vertical gap separates the two layers, so the padlock reads as protecting the structure above while the open cells below are the editable values.
+
+Minimal text, no letters, no numbers, no logos, no watermark. Keep the subject inside the central square so a 1:1 crop is safe; the outer left and right thirds may be croppable background only.
+
+Output: save as ./customer-story.jpeg at 1200x627 (matching the other feed covers, and doubling as the LinkedIn share card). Do not also embed the image in the markdown body.
+-->

content/feed/support-diagnostics/index.md

@@ -0,0 +1,158 @@
+---
+title: 'Support Diagnostics: browser_info and browser_url_vars'
+description: Data Controller sends two input tables with the startup service and with every service that runs customer code - the browser context and the page URL parameters. A support ticket can be answered from the job log, and a hook can read them.
+date: '2026-09-27 09:00:00'
+author: 'Data Controller'
+authorLink: https://www.linkedin.com/showcase/data-controller-for-sas
+tags:
+  - Announcements
+previewImg: './support-diagnostics.jpeg'
+---
+
+# Support Diagnostics: browser_info and browser_url_vars
+
+A support ticket usually starts with a round of questions. Which browser? Which timezone? Which build? What was in the URL? Data Controller now answers them itself. The frontend sends two input tables - `browser_info` and `browser_url_vars` - with the startup service and with every service that runs customer-provided code, so the context of a session is in the job log before anyone asks for it, and a hook script can read it.
+
+This ships with the next Data Controller release.
+
+## The two tables
+
+Both are ordinary input tables on the request: the adapter turns each array in the payload into a table in the service's WORK library, so they arrive as `work.browser_info` and `work.browser_url_vars`.
+
+### browser_info
+
+A single row, describing the client that made the request:
+
+| Column | What it holds |
+|---|---|
+| `url` | The URL of the Data Controller page itself (the iframe), not the document embedding it - so an embedded editor is distinguishable from a standalone one. |
+| `referrer` | The embedding document, from `document.referrer`. For an embedded report this is the report URL. |
+| `timezone` | The browser's IANA timezone, e.g. `Europe/Berlin`. |
+| `tz_offset` | The browser's UTC offset in minutes, as `Date.getTimezoneOffset()` returns it - positive west of UTC, so `Europe/Berlin` in summer is `-120`. |
+| `locale` | The browser locale, e.g. `en-GB`. |
+| `dc_version` | The Data Controller build, as `appinfo()` reports it. |
+| `adapter_version` | The `@sasjs/adapter` version the client was built with. |
+| `browser` | The browser family, parsed from the user agent. |
+| `browser_version` | The browser version. |
+| `platform` | The operating system. |
+| `user_agent` | The raw `navigator.userAgent` string. |
+
+### browser_url_vars
+
+One row per URL parameter:
+
+| Column | What it holds |
+|---|---|
+| `name` | The parameter name. |
+| `value` | The parameter value. |
+
+Parameters are read from both the search string and the hash query string, because Angular routes carry them after the `#`. Where the same name appears in both, the search string wins. The table is sent only when the page URL has at least one parameter.
+
+## Which services receive them
+
+| Service | When |
+|---|---|
+| `public/startupservice` | Once per session, so every job log carries the session context |
+| `editors/getdata` | The PRE_EDIT_HOOK |
+| `editors/stagedata` | The POST_EDIT_HOOK, through the loader |
+| `editors/restore` | The POST_EDIT_HOOK, through the loader |
+| `editors/getdynamiccolvals` | The dynamic cell dropdown programs |
+| `auditors/postdata` | The PRE_APPROVE_HOOK and POST_APPROVE_HOOK |
+| `editors/loadfile` | The POST_EDIT_HOOK - see the caveat below |
+
+Those are the services that run customer code. The viewer's `viewlibs`, `viewtables` and `viewdata`, the metadata services and `usernav` receive neither table, so the high-frequency calls stay lean.
+
+## Reading them in a hook
+
+A hook script is `%include`d into the running service, so it shares the service's WORK library and can read the tables directly. Take an embedded editor opened at:
+
+```
+https://datacontroller.io/#/editor/SASHELP.CLASS?labels=true&embed=va
+```
+
+`browser_url_vars` then holds a row per parameter - `labels=true` and `embed=va` - and a hook can read either by name:
+
+```sas
+%let labels=N;
+%let embed=N;
+
+%if %sysfunc(exist(work.browser_url_vars)) %then %do;
+  proc sql noprint;
+    select value into :labels
+    from work.browser_url_vars
+    where name = 'labels';
+    select value into :embed
+    from work.browser_url_vars
+    where name = 'embed';
+  quit;
+%end;
+```
+
+Or branch on what the user's browser reports:
+
+```sas
+data _null_;
+  set work.browser_info;
+  call symputx('dc_timezone', timezone);
+  call symputx('dc_locale', locale);
+run;
+```
+
+Note the `exist()` guard. A service called directly, or by a frontend older than this feature, has no `work.browser_info` at all, so an unguarded `set` or `select` would fail the job. Guard first, then read.
+
+## In the job log
+
+Turn debug on and the session initialisation writes both tables to the log, so a ticket can be diagnosed without a second round of questions:
+
+```
+NOTE: MPEINIT: work.browser_url_vars:
+name=embed value=va
+NOTE: MPEINIT: work.browser_info:
+url=... referrer=... timezone=Europe/Berlin tz_offset=-120 locale=en-GB
+dc_version=... adapter_version=... browser=Chrome browser_version=...
+platform=Linux user_agent=...
+```
+
+The debug value depends on the path - `&_debug=131` on the Compute API and SAS 9, `&_debug=128` on the Viya web (JES) path with `runAsTask` enabled, which is what the frontend sends there. Either way, switching debug on in the app is enough.
+
+## Worth knowing
+
+- The values are supplied by the client. Treat them as diagnostics hints, never as a security boundary.
+- `editors/loadfile` is reached through the adapter's multipart file upload, which carries no input tables, so in normal use that service - and the hook it runs - does not receive them. It is on the list for completeness.
+- Nothing else pays for the tables: they travel only with the services above.
+
+Full detail, including the column definitions and the log output, is in the [troubleshooting documentation](https://docs.datacontroller.io/dci-troubleshooting/).
+
+<!--
+Source LinkedIn post:
+
+A support ticket starts with questions. Which browser? Which timezone? Which build? What was in the URL?
+
+Data Controller now answers them itself.
+
+Two tables travel with the startup service, and with every service that runs your own code:
+
+→ browser_info - one row: browser and version, platform, timezone and UTC offset, locale, the DC and adapter builds, the page URL and the referrer
+
+→ browser_url_vars - one row per URL parameter, name and value, read straight into a macro variable
+
+Both land in the job log when debug is on, so a ticket can be diagnosed from the log instead of a round trip. Both are readable from a hook script - %include shares the service's WORK library, so a hook can branch on the user's timezone, or pick up a parameter from the URL.
+
+They are client supplied values: diagnostics hints, not a security boundary. Guard with %sysfunc(exist()) - a service called directly, or an older frontend, sends nothing.
+
+✅ Full detail in the Data Controller documentation - link in the comments.
+
+#sas #sasviya #datagovernance #datacapture #sasjs
+-->
+
+<!-- Image prompt:
+Generate a 16:9 landscape illustration for a B2B data-governance blog cover, 1200x627.
+
+Style: flat vector illustration, dark slate background (#314351) with a faint evenly spaced dot grid, brand green accent (#90c445), lighter slate panels (#2e4252), soft diffused shadows, subtle depth.
+
+Scene: two rounded panels side by side, each with a header bar in brand green and four rows of rounded cells. The left panel carries short uniform value blocks (the browser context); the right panel carries name-and-value pairs, drawn as a narrow block beside a wider one (the URL parameters), with a single row in the left panel highlighted in green. Between and below the panels a thin vertical connector line runs down to a wide, flat log strip of alternating short green rules on a lighter slate panel, suggesting the tables being written to a job log.
+
+Minimal text, no letters, no numbers, no logos, no watermark. Keep the subject inside the central square so a 1:1 crop is safe; the outer left and right thirds may be croppable background only.
+
+Output: save as ./support-diagnostics.jpeg at 1200x627 (matching the other feed covers, and doubling as the LinkedIn share card). Do not also embed the image in the markdown body.
+-->

package.json

@@ -55,7 +55,6 @@
     "@types/react": "^18.3.31",
     "@types/react-dom": "^18.3.7",
     "bootstrap": "^5.0.0-beta3",
-    "cloudron-surfer": "^6.4.1",
     "jquery": "^3.6.0",
     "typescript": "^7.0.2"
   },

scripts/audit-baseline.json

@@ -0,0 +1,940 @@
+{
+  "$comment": "Advisories at critical/high accepted for this tree. scripts/audit-gate.mjs fails the build on anything not listed here, so removing an entry re-arms the gate for that advisory. Regenerate with: node scripts/audit-gate.mjs --write-baseline",
+  "owner": "Site maintainers (allan@4gl.io)",
+  "reason": "Gatsby 5 build toolchain: no non-breaking fix available upstream, and these are build-time dependencies of a statically generated site. Re-check on each Gatsby major bump.",
+  "accepted": [
+    {
+      "pkg": "@ardatan/relay-compiler",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@babel/plugin-transform-modules-systemjs",
+      "severity": "high",
+      "advisory": "GHSA-fv7c-fp4j-7gwp",
+      "title": "@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
+      "range": ">=7.12.0 <=7.29.3"
+    },
+    {
+      "pkg": "@graphql-codegen/add",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-codegen/core",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-codegen/plugin-helpers",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-codegen/schema-ast",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-codegen/typescript-operations",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-codegen/typescript",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-codegen/visitor-plugin-common",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/code-file-loader",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/graphql-tag-pluck",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/load",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/merge",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/relay-operation-optimizer",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/schema",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "@graphql-tools/utils",
+      "severity": "high",
+      "advisory": "GHSA-7mx3-vvmw-hjmv",
+      "title": "GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`",
+      "range": "<=12.0.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-35jp-ww65-95wh",
+      "title": "axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`",
+      "range": ">=1.0.0 <1.16.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-3g43-6gmg-66jw",
+      "title": "axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge",
+      "range": ">=1.0.0 <1.15.2"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-3p68-rc4w-qgx5",
+      "title": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
+      "range": ">=1.0.0 <1.15.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-3pq3-5fj3-cg6v",
+      "title": "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls",
+      "range": ">=1.13.0 <1.20.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-3w6x-2g7m-8v23",
+      "title": "Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`",
+      "range": ">=1.0.0 <1.15.2"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-42h9-826w-cgv3",
+      "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service",
+      "range": ">=1.0.0 <1.18.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-43fc-jf86-j433",
+      "title": "Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig",
+      "range": ">=1.0.0 <=1.13.4"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-445q-vr5w-6q77",
+      "title": "Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-4hqw-qxg8-jxx2",
+      "title": "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders",
+      "range": ">=1.12.0 <1.20.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-542g-h47m-68v8",
+      "title": "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization",
+      "range": ">=1.13.0 <1.20.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-5c9x-8gcm-mpgx",
+      "title": "Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-62hf-57xw-28j9",
+      "title": "Axios: unbounded recursion in toFormData causes DoS via deeply nested request data",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-6chq-wfr3-2hj9",
+      "title": "Axios: Header Injection via Prototype Pollution",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-777c-7fjr-54vf",
+      "title": "Allocation of Resources Without Limits or Throttling in Axios",
+      "range": ">=1.7.0 <1.16.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-7q8q-rj6j-mhjq",
+      "title": "Axios: Nested axios option objects can consume polluted prototype values",
+      "range": ">=1.0.0 <1.18.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-898c-q2cr-xwhg",
+      "title": "axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions",
+      "range": ">=1.0.0 <1.16.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-9fr6-4gfg-395g",
+      "title": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",
+      "range": ">=1.0.0 <1.20.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-fvcv-3m26-pcqx",
+      "title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain",
+      "range": ">=1.0.0 <1.15.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-hfxv-24rg-xrqf",
+      "title": "Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection",
+      "range": ">=1.0.0 <1.16.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-j5f8-grm9-p9fc",
+      "title": "Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection",
+      "range": ">=1.0.0 <1.16.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-j8rh-479h-cp32",
+      "title": "Axios: Header Injection via Inherited headers After Minimal Interceptor",
+      "range": ">=1.0.0 <1.20.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-jqh4-m9w3-8hp9",
+      "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",
+      "range": ">=1.7.0 <1.18.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-m7pr-hjqh-92cm",
+      "title": "Axios: no_proxy bypass via IP alias allows SSRF",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-mmx7-hfxf-jppx",
+      "title": "Axios: Prototype pollution gadgets can alter axios request construction",
+      "range": ">=1.0.0 <1.18.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-mwf2-3pr3-8698",
+      "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",
+      "range": ">=1.13.0 <1.18.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-p92q-9vqr-4j8v",
+      "title": "Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter",
+      "range": ">=1.0.0 <1.16.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-pf86-5x62-jrwf",
+      "title": "Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-pmv8-rq9r-6j72",
+      "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",
+      "range": ">=1.0.0 <1.18.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-pmwg-cvhr-8vh7",
+      "title": "Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-q8qp-cvcw-x6jj",
+      "title": "Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking",
+      "range": ">=1.0.0 <1.15.2"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-vf2m-468p-8v99",
+      "title": "Axios: HTTP adapter streamed responses bypass maxContentLength",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-vh66-26gq-q6x8",
+      "title": "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",
+      "range": ">=1.7.0 <1.20.0"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-w9j2-pvgh-6h63",
+      "title": "Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-xhjh-pmcv-23jw",
+      "title": "Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "axios",
+      "severity": "high",
+      "advisory": "GHSA-xx6v-rp6x-q39c",
+      "title": "Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion",
+      "range": ">=1.0.0 <1.15.1"
+    },
+    {
+      "pkg": "body-parser",
+      "severity": "high",
+      "advisory": "GHSA-27r3-jxmh-p828",
+      "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
+      "range": "<1.20.9"
+    },
+    {
+      "pkg": "body-parser",
+      "severity": "high",
+      "advisory": "GHSA-qwcr-r2fm-qrc7",
+      "title": "body-parser vulnerable to denial of service when url encoding is enabled",
+      "range": "<1.20.3"
+    },
+    {
+      "pkg": "body-parser",
+      "severity": "high",
+      "advisory": "GHSA-v422-hmwv-36x6",
+      "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
+      "range": "<1.20.6"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-3jxr-9vmj-r5cp",
+      "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
+      "range": "<1.1.16"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-6j4f-fj2g-mc7p",
+      "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
+      "range": "<1.1.19"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-f886-m6hf-6m8v",
+      "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
+      "range": "<1.1.13"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-mh99-v99m-4gvg",
+      "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
+      "range": "<1.1.17"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-q2hr-2g5m-vwhr",
+      "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
+      "range": "<1.1.21"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-qhr7-859c-m2p7",
+      "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
+      "range": "<1.1.20"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-rgw5-rvv9-x895",
+      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
+      "range": "<1.1.18"
+    },
+    {
+      "pkg": "brace-expansion",
+      "severity": "high",
+      "advisory": "GHSA-v6h2-p8h4-qcjw",
+      "title": "brace-expansion Regular Expression Denial of Service vulnerability",
+      "range": ">=1.0.0 <=1.1.11"
+    },
+    {
+      "pkg": "browserslist",
+      "severity": "high",
+      "advisory": "GHSA-73wf-gq98-2v4g",
+      "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)",
+      "range": "<=4.28.6"
+    },
+    {
+      "pkg": "browserslist",
+      "severity": "high",
+      "advisory": "GHSA-c83g-rgw3-j3cx",
+      "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
+      "range": "<=4.28.6"
+    },
+    {
+      "pkg": "compression",
+      "severity": "high",
+      "advisory": "GHSA-vc2v-76pw-4v95",
+      "title": "compression vulnerable to Denial of Service via memory leak on premature response close",
+      "range": "<1.8.2"
+    },
+    {
+      "pkg": "cross-spawn",
+      "severity": "high",
+      "advisory": "GHSA-3xgq-45jj-v275",
+      "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
+      "range": ">=7.0.0 <7.0.5"
+    },
+    {
+      "pkg": "engine.io",
+      "severity": "high",
+      "advisory": "GHSA-2gc4-cqfq-p2gv",
+      "title": "Socket.IO: Engine.IO Protocol Revision Mismatch DoS",
+      "range": ">=6.6.0 <6.6.10"
+    },
+    {
+      "pkg": "engine.io",
+      "severity": "high",
+      "advisory": "GHSA-gr94-w7qr-f4j3",
+      "title": "Socket.IO: Engine.IO WebTransport SID DoS",
+      "range": ">=6.5.0 <6.6.7"
+    },
+    {
+      "pkg": "engine.io",
+      "severity": "high",
+      "advisory": "GHSA-r635-g3xr-vw7x",
+      "title": "Socket.IO: Engine.IO Polling Transport Connection Exhaustion",
+      "range": ">=4.1.0 <6.6.7"
+    },
+    {
+      "pkg": "express",
+      "severity": "high",
+      "advisory": "GHSA-qw6h-vgh9-j6wx",
+      "title": "express vulnerable to XSS via response.redirect()",
+      "range": "<4.20.0"
+    },
+    {
+      "pkg": "flatted",
+      "severity": "high",
+      "advisory": "GHSA-25h7-pfq9-p65f",
+      "title": "flatted vulnerable to unbounded recursion DoS in parse() revive phase",
+      "range": "<3.4.0"
+    },
+    {
+      "pkg": "flatted",
+      "severity": "high",
+      "advisory": "GHSA-rf6f-7fwh-wjgh",
+      "title": "Prototype Pollution via parse() in NodeJS flatted",
+      "range": "<=3.4.1"
+    },
+    {
+      "pkg": "form-data",
+      "severity": "high",
+      "advisory": "GHSA-hmw2-7cc7-3qxx",
+      "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
+      "range": ">=4.0.0 <4.0.6"
+    },
+    {
+      "pkg": "gatsby-plugin-manifest",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "gatsby-plugin-sharp",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "gatsby-plugin-utils",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "gatsby-sharp",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "gatsby-transformer-sharp",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "gatsby",
+      "severity": "high",
+      "advisory": "transitive"
+    },
+    {
+      "pkg": "http-cache-semantics",
+      "severity": "high",
+      "advisory": "GHSA-ch52-4w7c-c8xp",
+      "title": "http-cache-semantics max-stale handling can disclose cross-user cached responses",
+      "range": "<=4.2.0"
+    },
+    {
+      "pkg": "immutable",
+      "severity": "high",
+      "advisory": "GHSA-v56q-mh7h-f735",
+      "title": "Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",
+      "range": "<3.8.4"
+    },
+    {
+      "pkg": "immutable",
+      "severity": "high",
+      "advisory": "GHSA-wf6x-7x77-mvgw",
+      "title": "Immutable is vulnerable to Prototype Pollution",
+      "range": "<3.8.3"
+    },
+    {
+      "pkg": "immutable",
+      "severity": "high",
+      "advisory": "GHSA-xvcm-6775-5m9r",
+      "title": "Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",
+      "range": "<3.8.4"
+    },
+    {
+      "pkg": "joi",
+      "severity": "high",
+      "advisory": "GHSA-6h2x-m376-mqjq",
+      "title": "joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`",
+      "range": ">=17.2.0 <17.13.7"
+    },
+    {
+      "pkg": "joi",
+      "severity": "high",
+      "advisory": "GHSA-6w3j-5fw6-r9vr",
+      "title": "joi: Prototype pollution via a `__proto__` language key in custom messages",
+      "range": ">=17.2.0 <17.13.6"
+    },
+    {
+      "pkg": "joi",
+      "severity": "high",
+      "advisory": "GHSA-gg4h-3hg2-grpc",
+      "title": "joi: object().rename() with a template target can set the validated object's prototype",
+      "range": ">=16.0.0 <17.13.5"
+    },
+    {
+      "pkg": "joi",
+      "severity": "high",
+      "advisory": "GHSA-wr44-6hxh-3jwq",
+      "title": "joi messages compilation allows prototype replacement through __proto__ error codes",
+      "range": "<17.13.8"
+    },
+    {
+      "pkg": "js-yaml",
+      "severity": "high",
+      "advisory": "GHSA-2883-xcg3-v3hh",
+      "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
+      "range": ">=3.0.0 <3.15.2"
+    },
+    {
+      "pkg": "js-yaml",
+      "severity": "high",
+      "advisory": "GHSA-52cp-r559-cp3m",
+      "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
+      "range": ">=3.0.0 <3.15.0"
+    },
+    {
+      "pkg": "js-yaml",
+      "severity": "high",
+      "advisory": "GHSA-5p4m-2wfm-xmqj",
+      "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
+      "range": ">=3.0.0 <3.15.1"
+    },
+    {
+      "pkg": "js-yaml",
+      "severity": "high",
+      "advisory": "GHSA-h67p-54hq-rp68",
+      "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
+      "range": "<3.15.0"
+    },
+    {
+      "pkg": "js-yaml",
+      "severity": "high",
+      "advisory": "GHSA-mh29-5h37-fv8m",
+      "title": "js-yaml has prototype pollution in merge (<<)",
+      "range": "<3.14.2"
+    },
+    {
+      "pkg": "lodash",
+      "severity": "high",
+      "advisory": "GHSA-f23m-r3pf-42rh",
+      "title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
+      "range": "<=4.17.23"
+    },
+    {
+      "pkg": "lodash",
+      "severity": "high",
+      "advisory": "GHSA-r5fr-rjxr-66jc",
+      "title": "lodash vulnerable to Code Injection via `_.template` imports key names",
+      "range": ">=4.0.0 <=4.17.23"
+    },
+    {
+      "pkg": "lodash",
+      "severity": "high",
+      "advisory": "GHSA-xxjr-mmjv-4gpg",
+      "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
+      "range": ">=4.0.0 <=4.17.22"
+    },
+    {
+      "pkg": "minimatch",
+      "severity": "high",
+      "advisory": "GHSA-23c5-xmqv-rm74",
+      "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
+      "range": "<3.1.4"
+    },
+    {
+      "pkg": "minimatch",
+      "severity": "high",
+      "advisory": "GHSA-3ppc-4f35-3m26",
+      "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
+      "range": "<3.1.3"
+    },
+    {
+      "pkg": "minimatch",
+      "severity": "high",
+      "advisory": "GHSA-7r86-cg39-jmmj",
+      "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
+      "range": "<3.1.3"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-3p4h-7m6x-2hcm",
+      "title": "Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",
+      "range": ">=2.0.0-alpha.1 <2.2.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-535w-7cp7-47q4",
+      "title": "multer vulnerable to Denial of Service via oversized array index in field names",
+      "range": "<2.3.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-5528-5vmv-3xc2",
+      "title": "Multer Vulnerable to Denial of Service via Uncontrolled Recursion",
+      "range": "<2.1.1"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-72gw-mp4g-v24j",
+      "title": "Multer vulnerable to Denial of Service via deeply nested field names",
+      "range": ">=1.0.0 <2.2.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-q7qp-rjg7-q26m",
+      "title": "multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown",
+      "range": ">=2.0.0 <2.5.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-qvfw-j98x-7q72",
+      "title": "multer vulnerable to file size limit bypass via async fileFilter race condition",
+      "range": "<2.3.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-v52c-386h-88mc",
+      "title": "Multer vulnerable to Denial of Service via resource exhaustion",
+      "range": "<2.1.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-wc9g-mqfw-jrwm",
+      "title": "multer vulnerable to Denial of Service via crafted multipart field names",
+      "range": "<2.3.0"
+    },
+    {
+      "pkg": "multer",
+      "severity": "high",
+      "advisory": "GHSA-xf7r-hgr6-v32p",
+      "title": "Multer vulnerable to Denial of Service via incomplete cleanup",
+      "range": "<2.1.0"
+    },
+    {
+      "pkg": "nanoid",
+      "severity": "high",
+      "advisory": "GHSA-28wg-ghj8-5hjv",
+      "title": "nanoid: non-secure generators can loop indefinitely with negative size",
+      "range": "<3.3.16"
+    },
+    {
+      "pkg": "nanoid",
+      "severity": "high",
+      "advisory": "GHSA-2v37-7h3g-55p8",
+      "title": "nanoid: custom generators can loop indefinitely when size is zero",
+      "range": "<3.3.18"
+    },
+    {
+      "pkg": "nanoid",
+      "severity": "high",
+      "advisory": "GHSA-mwcw-c2x4-8c55",
+      "title": "Predictable results in nanoid generation when given non-integer values",
+      "range": "<3.3.8"
+    },
+    {
+      "pkg": "nanoid",
+      "severity": "high",
+      "advisory": "GHSA-xwg4-73v4-xw9w",
+      "title": "nanoid: Integer Overflow or Wraparound",
+      "range": "<3.3.12"
+    },
+    {
+      "pkg": "path-to-regexp",
+      "severity": "high",
+      "advisory": "GHSA-37ch-88jc-xwx2",
+      "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
+      "range": "<0.1.13"
+    },
+    {
+      "pkg": "path-to-regexp",
+      "severity": "high",
+      "advisory": "GHSA-9wv6-86v2-598j",
+      "title": "path-to-regexp outputs backtracking regular expressions",
+      "range": "<0.1.10"
+    },
+    {
+      "pkg": "path-to-regexp",
+      "severity": "high",
+      "advisory": "GHSA-rhx6-c78j-4q9w",
+      "title": "path-to-regexp contains a ReDoS",
+      "range": "<0.1.12"
+    },
+    {
+      "pkg": "picomatch",
+      "severity": "high",
+      "advisory": "GHSA-3v7f-55p6-f55p",
+      "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
+      "range": "<2.3.2"
+    },
+    {
+      "pkg": "picomatch",
+      "severity": "high",
+      "advisory": "GHSA-c2c7-rcm5-vvqj",
+      "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
+      "range": "<2.3.2"
+    },
+    {
+      "pkg": "postcss",
+      "severity": "high",
+      "advisory": "GHSA-6g55-p6wh-862q",
+      "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",
+      "range": "<=8.5.11"
+    },
+    {
+      "pkg": "postcss",
+      "severity": "high",
+      "advisory": "GHSA-fxqj-rqcc-2cmp",
+      "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
+      "range": "<=8.5.22"
+    },
+    {
+      "pkg": "postcss",
+      "severity": "high",
+      "advisory": "GHSA-qx2v-qp2m-jg93",
+      "title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
+      "range": "<8.5.10"
+    },
+    {
+      "pkg": "postcss",
+      "severity": "high",
+      "advisory": "GHSA-r28c-9q8g-f849",
+      "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
+      "range": "<=8.5.17"
+    },
+    {
+      "pkg": "probe-image-size",
+      "severity": "high",
+      "advisory": "GHSA-gjj5-9665-rwrc",
+      "title": "probe-image-size: Quadratic-time Denial of Service in the SVG Parser",
+      "range": "<=7.3.0"
+    },
+    {
+      "pkg": "serialize-javascript",
+      "severity": "high",
+      "advisory": "GHSA-5c6j-r48x-rmvq",
+      "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
+      "range": "<=7.0.2"
+    },
+    {
+      "pkg": "serialize-javascript",
+      "severity": "high",
+      "advisory": "GHSA-m5mm-p8h7-m29v",
+      "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
+      "range": "<7.1.3"
+    },
+    {
+      "pkg": "serialize-javascript",
+      "severity": "high",
+      "advisory": "GHSA-qj8w-gfj5-8c6v",
+      "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
+      "range": ">=5.0.0 <7.0.5"
+    },
+    {
+      "pkg": "sharp",
+      "severity": "high",
+      "advisory": "GHSA-f88m-g3jw-g9cj",
+      "title": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
+      "range": "<0.35.0"
+    },
+    {
+      "pkg": "sharp",
+      "severity": "high",
+      "advisory": "GHSA-rgj7-g3m4-5g8c",
+      "title": "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545",
+      "range": "<0.35.4"
+    },
+    {
+      "pkg": "sharp",
+      "severity": "high",
+      "advisory": "GHSA-wq5f-xc86-pv6w",
+      "title": "sharp : Vulnerability in librsvg dependency CVE-2026-96889",
+      "range": "<0.35.5"
+    },
+    {
+      "pkg": "socket.io-parser",
+      "severity": "high",
+      "advisory": "GHSA-2m8v-j782-fhvr",
+      "title": "Socket.IO: Zero-attachment Memory Exhaustion",
+      "range": ">=4.0.0 <4.2.7"
+    },
+    {
+      "pkg": "socket.io-parser",
+      "severity": "high",
+      "advisory": "GHSA-677m-j7p3-52f9",
+      "title": "socket.io allows an unbounded number of binary attachments",
+      "range": ">=4.0.0 <4.2.6"
+    },
+    {
+      "pkg": "source-map-js",
+      "severity": "high",
+      "advisory": "GHSA-68fv-2mgg-jv7q",
+      "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
+      "range": ">=1.0.0 <1.2.2"
+    },
+    {
+      "pkg": "svgo",
+      "severity": "high",
+      "advisory": "GHSA-2p49-hgcm-8545",
+      "title": "SVGO removeScripts plugin leaves some executable scripts intact",
+      "range": ">=1.0.0 <2.8.3"
+    },
+    {
+      "pkg": "svgo",
+      "severity": "high",
+      "advisory": "GHSA-4vpr-x523-8j87",
+      "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements",
+      "range": ">=1.0.0 <2.8.4"
+    },
+    {
+      "pkg": "svgo",
+      "severity": "high",
+      "advisory": "GHSA-w27v-7q3p-w38r",
+      "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses",
+      "range": ">=1.0.0 <2.8.4"
+    },
+    {
+      "pkg": "svgo",
+      "severity": "high",
+      "advisory": "GHSA-xpqw-6gx7-v673",
+      "title": "SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)",
+      "range": ">=2.1.0 <2.8.1"
+    },
+    {
+      "pkg": "tmp",
+      "severity": "high",
+      "advisory": "GHSA-52f5-9888-hmc6",
+      "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
+      "range": "<=0.2.3"
+    },
+    {
+      "pkg": "tmp",
+      "severity": "high",
+      "advisory": "GHSA-ph9p-34f9-6g65",
+      "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
+      "range": "<0.2.6"
+    },
+    {
+      "pkg": "webpack-dev-middleware",
+      "severity": "high",
+      "advisory": "GHSA-g84c-rxfj-3j2c",
+      "title": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",
+      "range": "<7.4.5"
+    },
+    {
+      "pkg": "ws",
+      "severity": "high",
+      "advisory": "GHSA-58qx-3vcg-4xpx",
+      "title": "ws: Uninitialized memory disclosure",
+      "range": ">=8.0.0 <8.20.1"
+    },
+    {
+      "pkg": "ws",
+      "severity": "high",
+      "advisory": "GHSA-96hv-2xvq-fx4p",
+      "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
+      "range": ">=8.0.0 <8.21.0"
+    }
+  ]
+}

scripts/audit-gate.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+/**
+ * Audit gate: fail the build on any advisory that is not a tracked exception.
+ *
+ * `npm audit --audit-level=<x>` is all-or-nothing, and this tree cannot pass a
+ * flat gate: the Gatsby 5 build toolchain carries ~100 advisories at
+ * low/moderate/high with no non-breaking fix, because gatsby is a runtime
+ * dependency of the build. Blocking on any of those stops publishing
+ * permanently; ignoring the tree lets a genuinely new advisory through. So the
+ * known set is committed to audit-baseline.json with an owner and a reason,
+ * and this script fails only when something NEW appears at or above the
+ * threshold.
+ *
+ * Usage: node scripts/audit-gate.mjs [--write-baseline]
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const BASELINE = join(HERE, 'audit-baseline.json');
+const BLOCKING = new Set(['critical', 'high']);
+
+/** npm audit exits non-zero when it finds anything, so ignore the status. */
+function auditReport() {
+  let out;
+  try {
+    out = execFileSync('npm', ['audit', '--json', '--omit=optional'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 32 * 1024 * 1024
+    });
+  } catch (err) {
+    out = err.stdout;
+    if (!out) throw err;
+  }
+  return JSON.parse(out);
+}
+
+/** Flatten the report to one key per package/severity/advisory triple. */
+function currentFindings(report) {
+  const findings = new Map();
+  for (const [pkg, v] of Object.entries(report.vulnerabilities ?? {})) {
+    if (!BLOCKING.has(v.severity)) continue;
+    const advisories = (v.via ?? []).filter((x) => typeof x === 'object');
+    if (advisories.length === 0) {
+      // via is a chain of parent package names - attribute to the package.
+      findings.set(`${pkg}|${v.severity}|transitive`, { pkg, severity: v.severity, advisory: 'transitive' });
+      continue;
+    }
+    for (const a of advisories) {
+      const id = (a.url ?? '').split('/').pop() || a.title || 'unknown';
+      findings.set(`${pkg}|${v.severity}|${id}`, { pkg, severity: v.severity, advisory: id, title: a.title, range: a.range });
+    }
+  }
+  return findings;
+}
+
+const report = auditReport();
+const current = currentFindings(report);
+
+if (process.argv.includes('--write-baseline')) {
+  const accepted = [...current.values()].sort((a, b) => `${a.pkg}${a.advisory}`.localeCompare(`${b.pkg}${b.advisory}`));
+  writeFileSync(
+    BASELINE,
+    JSON.stringify(
+      {
+        $comment:
+          'Advisories at critical/high accepted for this tree. scripts/audit-gate.mjs fails the build on anything not listed here, so removing an entry re-arms the gate for that advisory. Regenerate with: node scripts/audit-gate.mjs --write-baseline',
+        owner: 'Site maintainers (allan@4gl.io)',
+        reason:
+          'Gatsby 5 build toolchain: no non-breaking fix available upstream, and these are build-time dependencies of a statically generated site. Re-check on each Gatsby major bump.',
+        accepted
+      },
+      null,
+      2
+    ) + '\n'
+  );
+  console.log(`wrote ${accepted.length} accepted advisories to ${BASELINE}`);
+  process.exit(0);
+}
+
+const baseline = JSON.parse(readFileSync(BASELINE, 'utf8'));
+const accepted = new Set((baseline.accepted ?? []).map((a) => `${a.pkg}|${a.severity}|${a.advisory}`));
+
+const fresh = [...current.entries()].filter(([key]) => !accepted.has(key));
+const resolved = [...accepted].filter((key) => !current.has(key));
+
+for (const [, f] of fresh) {
+  console.error(`NEW ${f.severity.toUpperCase()}: ${f.pkg} - ${f.title ?? f.advisory} (${f.advisory})`);
+}
+
+if (resolved.length > 0) {
+  // Not a failure: a bumped or removed dependency closes advisories, and the
+  // baseline should be trimmed in the same change that closes them.
+  console.log(`${resolved.length} baseline entries no longer present - consider re-running with --write-baseline:`);
+  for (const key of resolved) console.log(`  stale: ${key}`);
+}
+
+if (fresh.length > 0) {
+  console.error(`\n${fresh.length} untracked advisory/ies at critical or high.`);
+  console.error('Fix it, or add it to scripts/audit-baseline.json with a reason and an owner.');
+  process.exit(1);
+}
+
+console.log(`audit gate: no new critical/high advisories (${current.size} tracked in baseline)`);

static/two-rule-sets-one-table/index.html

@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>One Table, Two Rule Sets has moved</title>
+    <link rel="canonical" href="https://docs.datacontroller.io/developer-guide/two-rule-sets-one-table/" />
+    <meta http-equiv="refresh" content="0; url=https://docs.datacontroller.io/developer-guide/two-rule-sets-one-table/" />
+    <meta name="robots" content="noindex" />
+  </head>
+  <body>
+    <p>
+      This page has moved to
+      <a href="https://docs.datacontroller.io/developer-guide/two-rule-sets-one-table/">docs.datacontroller.io</a>.
+    </p>
+  </body>
+</html>