Sidekick website — front-end package

Open Home.dc.html through any static server (e.g. npx serve .) — not via file://.

Backend (built on site/backend-2026-10-15; close-out on site/closeout-2026-10-15)

• npm test (88 tests, no network) · npm run demo (whole pipeline on fakes) · npm run dev (real pages + API on fakes at http://localhost:8787; SITE_MODE=manual npm run dev for the email-only site) · node tools/browser-e2e.mjs [--mode manual] (headless Chrome).
• npm run build makes dist/ in the mode SITE_MODE names: manual (the default; email-only, no API, no Turnstile, no cookies, needs no secret) or automated (real API client, needs TURNSTILE_SITE_KEY). Mocks off and no Design review bar in both. Vercel runs it (see vercel.json); docs/MORNING.md has the steps to go live.
• Release facts live in data/releases.json only; node scripts/data-sync.mjs regenerates data/releases.js, and --from-dmg <path> fills the real size and SHA-256.
• npm run check: no-JS copies, release data and node tools/check-links.mjs (every internal link, fragment, email link form and mailto on the built site, both modes, offline).
• Design: docs/backend-design.md. Turning it on: docs/OWNER-SETUP.md (step 1 is node scripts/token-proof.mjs, before any account). Testing a deployment: docs/GO-LIVE-TEST.md.

Connecting your backend (original notes for the mock)

1. In data/site-config.js set mocksEnabled: false.
2. data/mock-api.js then calls the real endpoints instead of the mocks:
   • POST /api/get-sidekick (form page)
   • GET /api/download/:platform/:arch (download buttons — return a 302 to a signed URL, or JSON {url})
   • POST /api/roadmap-notify (closed: answers 410 and stores nothing; launch log Part 14)
   • POST /api/feedback (Suggest a feature)
3. Replace window.SK_RELEASES in data/site-config.js with the response of GET /api/releases.
4. The Download page checks the session via SK_API.session() — swap it for a call that checks your signed HttpOnly cookie.

Request/response schemas, env vars, tokens and launch blockers: see Handoff.md.

No-JavaScript copies

Home's FAQ and the Roadmap page include generated <noscript> copies. After editing the FAQ, data/roadmap-data.js or data/site-config.js, run node tools/noscript.mjs (and node tools/noscript.mjs --check before deploying).

Files

• *.dc.html — pages and shared components (need support.js next to them)
• data/ — config flags, release facts, roadmap data, API layer
• fonts/ — self-hosted fonts
• LOGOS/ — brand marks