🌾 feat: rebuild the landing page, and stop it from rotting again

The old page had been quietly broken for some time. It loaded
@babel/standalone from an **unpinned** CDN URL, which rolled over to Babel
8 and dropped the `proposal-class-properties` plugin the page asked for, so
Babel.transform threw before it ever reached the decorators — and the
decorator config it passed was `{ legacy: true }`, which 0.2.0 had already
made wrong. Nothing on the page said so. The copy was still selling the
0.1.0 pitch ("Spring-like"), listed about half the decorators, showed
`npm install cereale` for a package the registry returns 404 for, and
claimed "Zero overhead" against a README that publishes the real
microsecond costs.

The rebuild is one self-contained page: hand-written CSS, no Tailwind CDN,
no CodeMirror, and a vendored compiler pinned by package.json. It loads
nothing from the network. The playground runs the real bundled library
across six examples, all verified in a headless browser. The reference
covers all 68 decorators and the full API, counted from the bundle at
runtime so it cannot drift.

The hero's compiler error is not typed into the HTML. scripts/build-docs.mjs
compiles the snippets with the real tsc and writes the verbatim diagnostics
into docs/diagnostics.js, failing the build if a snippet the page calls a
compile error ever compiles — and two snippets that must compile guard
against the harness passing vacuously.

Three guards keep it honest, all wired into CI:
- check:docs fails on any remote subresource
- build:docs + git diff fails if docs/ is stale against src/
- check:types compiles a consumer against dist/ with no DOM lib, no
  @types/node and no skipLibCheck

That last one found a real packaging defect: `fromRequest` was declared as
taking the global `Request`, so cereale's own published .d.ts raised
"Cannot find name 'Request'" in any project whose lib and types did not
happen to supply it — inside a dependency, in code they may never call, and
unfixable from the outside. It now takes a structural JsonBody, which a
Request still satisfies. The library's own type tests had been hiding it by
enabling both DOM and skipLibCheck.

An adversarial review of the finished page caught four more: the lede
claimed *every* rule is type-checked (@IsDefined and @IsNotIn deliberately
are not), the guarantee section was wrong about the mechanism (a legacy
decorator does get design:type under emitDecoratorMetadata — the real claim
is about its type signature), one sample called a Movie method on a Media[]
and did not compile, and "nested objects come back as real classes" omitted
that you have to declare them. WCAG contrast was measured rather than
eyeballed: seven real failures fixed in the two themes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SAcqrz3FcadkYr3xG32CjK

scripts/check-docs.mjs

@@ -0,0 +1,78 @@
+/**
+ * Guards the two properties the landing page silently lost before.
+ *
+ * 1. It must load nothing from the network. The previous page pulled Tailwind, CodeMirror and
+ *    Babel from three CDNs, and its playground died without a sound the day the unpinned
+ *    `@babel/standalone` URL started serving Babel 8, whose plugin list no longer had the
+ *    plugin the page asked for. Nobody noticed, because nothing on the page said so.
+ * 2. The bundle the playground runs must match the library source. It is built from `src/`,
+ *    so a change there leaves the page demonstrating a version that no longer exists.
+ *
+ * Ordinary <a href> links out are fine — a link is not a subresource.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const docs = path.join(root, 'docs');
+
+const failures = [];
+
+/** Subresource references — the things a browser fetches without being clicked. */
+const SUBRESOURCES = [
+  [/<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/gi, 'script src'],
+  [/<link\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi, 'link href'],
+  [/<(?:img|iframe|video|audio|source|embed)\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/gi, 'media src'],
+  [/@import\s+(?:url\()?["']([^"']+)["']/gi, 'css @import'],
+  [/url\(\s*["']?(https?:\/\/[^)"']+)/gi, 'css url()'],
+];
+
+const isRemote = (url) => /^(?:https?:)?\/\//i.test(url);
+
+const html = (await readdir(docs)).filter((name) => name.endsWith('.html'));
+if (html.length === 0) failures.push('docs/ contains no HTML page');
+
+for (const name of html) {
+  const source = await readFile(path.join(docs, name), 'utf8');
+  for (const [pattern, kind] of SUBRESOURCES) {
+    for (const match of source.matchAll(pattern)) {
+      if (isRemote(match[1])) failures.push(`docs/${name}: remote ${kind} — ${match[1]}`);
+    }
+  }
+  // A fetch to a CDN would not be caught by the markup scan.
+  for (const match of source.matchAll(/\b(?:fetch|importScripts)\(\s*["'`](https?:\/\/[^"'`]+)/gi)) {
+    failures.push(`docs/${name}: remote fetch — ${match[1]}`);
+  }
+}
+
+for (const name of (await readdir(docs)).filter((f) => f.endsWith('.js'))) {
+  const source = await readFile(path.join(docs, name), 'utf8');
+  for (const match of source.matchAll(/\.src\s*=\s*["'`](https?:\/\/[^"'`]+)/gi)) {
+    failures.push(`docs/${name}: loads a remote script — ${match[1]}`);
+  }
+  for (const match of source.matchAll(/\bfetch\(\s*["'`](https?:\/\/[^"'`]+)/gi)) {
+    failures.push(`docs/${name}: remote fetch — ${match[1]}`);
+  }
+}
+
+// The playground compiles against whatever is in the bundle, so a stale bundle means the
+// page demonstrates a library that no longer exists.
+const bundle = await readFile(path.join(docs, 'cereale.js'), 'utf8').catch(() => null);
+if (bundle === null) {
+  failures.push('docs/cereale.js is missing — run `npm run build:docs`');
+} else {
+  // Spot-check that the exports the page relies on actually made it into the bundle.
+  for (const name of ['toInstanceSync', 'toPlainSync', 'flattenErrors', 'JsonMappingError', 'IsString']) {
+    if (!bundle.includes(name)) failures.push(`docs/cereale.js does not export ${name} — rebuild it`);
+  }
+}
+
+const babel = path.join(docs, 'vendor/babel.min.js');
+await readFile(babel).catch(() => failures.push('docs/vendor/babel.min.js is missing — run `npm run build:docs`'));
+
+if (failures.length > 0) {
+  console.error('docs check failed:\n' + failures.map((f) => `  - ${f}`).join('\n'));
+  process.exit(1);
+}
+console.log(`docs check passed — ${html.length} page(s), no network dependencies.`);