[gitluis]

On hold — draft on purpose. Part of the v2.0 — Public launch milestone. This is the PR that makes FinLens live on the web, so keep it open until the app is more mature, renamed and the custom domain is bought. Mark it "Ready for review" when you want to merge it.

Summary

Adds .github/workflows/pages.yml. On every push to master (that is, after a merge), or when you run it by hand from the Actions tab, it publishes the app as static files to GitHub Pages. Pull requests never deploy, so opening this PR doesn't publish anything. The app itself doesn't change.

• Only the app is published: index.html, js/ and samples/ (about 500 KB). docs/, CLAUDE.md, tests and CI files stay in the repo but aren't served.
• Safety check: the build fails, and publishes nothing, if a finlens-state*.json, finlens-export-* or data/ file somehow ends up in the site folder.
• Your data doesn't move. Pages serves only the code. Transactions, settings and the API key stay in each visitor's own browser and folder.
• CLAUDE.md §23 Hosting (new; §23 because the stack adds §22 Migrations): what's served, the one-site-per-origin rule, custom-domain setup, and the Pages limits.

Version: v2.0.3 (renumbered from v2.0.2: the rename PR #58 takes v2.0.2 so it merges first).

Before merging (one-time setup)

1. Settings → Pages → Build and deployment → Source: "GitHub Actions". Without this, the first deploy fails at the Deploy step.
2. Custom domain (once renamed and bought): Settings → Pages → Custom domain. Set it on this repo, not on a gitluis.github.io user-site repo. Then tick Enforce HTTPS and verify the domain under your account's Settings → Pages. With an Actions deploy, no CNAME file is needed.
3. Until there's a custom domain, don't publish any other repo on Pages from this account. Every Pages site of an account shares the origin https://gitluis.github.io, so another site there could read FinLens's browser data.
4. Rename first. The workflow has no name in it, but the URL is gitluis.github.io/<repo name>/, and a rename after people use it moves them to a new origin with empty browser data.

How it was tested

• Ran the same assemble step locally and served the result from a /finlens/ subpath, the way Pages serves a project site. The app booted with all 24 views registered, no page errors, no 404s, and samples/ loaded by relative path (as the AI Eval view does).
• The data-file guard passes on a clean checkout.
• Not tested: an actual Pages deploy. That needs Pages turned on and a push to master, and the workflow only runs after merge. pull_request doesn't trigger it, so there's no Actions run on this PR.

Manual testing (step by step, after merging)

1. Open the Actions tab → Deploy to GitHub Pages. The run should show two green jobs, Build site and Deploy.
2. Open Build site → Assemble site. The list of published files should show only index.html, .nojekyll, js/… and samples/….
3. Click the URL on the Deploy job (or Settings → Pages). FinLens should open with the version v2.0.3 in the footer.
4. Click Choose folder and pick a folder with your CSVs. Edge or Chrome should ask for access, as it does locally. This is the first test of the real permission prompt on HTTPS.
5. Reload the page. Your data should still be there, since the browser data lives on the new origin.
6. (If something's wrong) Settings → Pages → Unpublish site takes it offline straight away.

Please check before merging

• Renamed, and the custom domain is ready (or you've decided to launch on gitluis.github.io first)
• Pages Source set to GitHub Actions
• No other Pages site on this account
• Version v2.0.3 isn't taken by anything merged before this (renumber if so)
• v2.0.2: generic storage names (app_db, app-state.json…) + rename script #58 (rename) merged first, and ideally v2.0.0: CI checks on pull requests (JavaScript syntax, CDN SRI) #54 and v2.0.1: browser smoke tests in CI (Chromium + Edge) #55, and set as required checks on master, so only passing code gets deployed

https://claude.ai/code/session_013Z8iBUNj6C627mxmm1CurV

---

Generated by Claude Code