# Project conventions

## What this is

A Next.js site with a client-side markdown viewer. Everything renders in the
browser: there is no API route and no server-side processing of user content.

## Commands

```bash
npm run dev     # development server on port 3040
npm run build   # production build
npm test        # vitest
npm run lint    # eslint
```

## Rules that are not obvious from the code

- Nothing a visitor supplies may be sent anywhere. If a change needs a server
  round trip for user content, it is the wrong change.
- The site sets no cookies. The privacy page says so, so it has to stay true.
- `lib/markdown.ts` sanitizes untrusted input. `renderTrustedMarkdown` skips the
  sanitizer and is only for content committed to this repository.
- Copy is written in British English, and never uses em dashes.

## Before you finish

1. `npm run lint` and `npm test` both clean.
2. New user-facing strings exist in all five locales.
3. If you changed the palette, update `brand/README.md` in the same commit.

npm run dev     # development server on port 3040
npm run build   # production build
npm test        # vitest
npm run lint    # eslint