Compare commits
13
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 donghyeon-ka
|
9a120e6d45 | ||
|
donghyeon-ka
|
9200c80149 | ||
|
donghyeon-ka
|
f7e8ef6ee4 | ||
|
donghyeon-ka
|
e70b1a4ad9 | ||
|
donghyeon-ka
|
6b4b956d51 | ||
|
donghyeon-ka
|
7d4daea23a | ||
|
donghyeon-ka
|
c089e749d0 | ||
|
donghyeon-ka
|
2d199a5a23 | ||
|
donghyeon-ka
|
23c47a1eb9 | ||
|
donghyeon-ka
|
8a38805c01 | ||
|
donghyeon-ka
|
2725c35c28 | ||
|
donghyeon-ka
|
50dc803f19 | ||
|
donghyeon-ka
|
976f444692 |
@@ -1,15 +1,18 @@
|
||||
# APP_HOME accessibility review
|
||||
|
||||
Status: pending-manual-review
|
||||
|
||||
Route ID: APP_HOME
|
||||
Release ID:
|
||||
Reviewer:
|
||||
|
||||
Keyboard: automated tab-order fixture passed; human review pending.
|
||||
|
||||
Focus: automated visible-focus fixture passed; route-change review pending.
|
||||
|
||||
Screen reader: pending.
|
||||
|
||||
Reduced motion: automated media-query fixture passed; human review pending.
|
||||
|
||||
Color signal: pending.
|
||||
Reviewed at:
|
||||
Signature:
|
||||
Attestation: pending
|
||||
M1 Keyboard: pending
|
||||
M2 Visible focus: pending
|
||||
M3 Route focus: pending
|
||||
M4 Modal focus: not-applicable (no modal on this route)
|
||||
M5 Error association: not-applicable (no form error on this route)
|
||||
M6 Color signal: pending
|
||||
M7 Reduced motion: pending
|
||||
Screen reader: pending
|
||||
Notes: Automated axe, keyboard-focus, and reduced-motion evidence is available; human review pending.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
# NOT_FOUND accessibility review
|
||||
|
||||
Status: pending-manual-review
|
||||
Route ID: NOT_FOUND
|
||||
Release ID:
|
||||
Reviewer:
|
||||
Reviewed at:
|
||||
Signature:
|
||||
Attestation: pending
|
||||
M1 Keyboard: pending
|
||||
M2 Visible focus: pending
|
||||
M3 Route focus: pending
|
||||
M4 Modal focus: not-applicable (no modal on this route)
|
||||
M5 Error association: not-applicable (no form error on this route)
|
||||
M6 Color signal: pending
|
||||
M7 Reduced motion: pending
|
||||
Screen reader: pending
|
||||
Notes: Human review pending.
|
||||
@@ -0,0 +1,18 @@
|
||||
# SAMPLE_RESOURCE_LIST accessibility review
|
||||
|
||||
Status: pending-manual-review
|
||||
Route ID: SAMPLE_RESOURCE_LIST
|
||||
Release ID:
|
||||
Reviewer:
|
||||
Reviewed at:
|
||||
Signature:
|
||||
Attestation: pending
|
||||
M1 Keyboard: pending
|
||||
M2 Visible focus: pending
|
||||
M3 Route focus: pending
|
||||
M4 Modal focus: not-applicable (no modal on this route)
|
||||
M5 Error association: not-applicable (no form error on this route)
|
||||
M6 Color signal: pending
|
||||
M7 Reduced motion: pending
|
||||
Screen reader: pending
|
||||
Notes: Human review pending.
|
||||
@@ -124,7 +124,10 @@
|
||||
"logPath": "artifacts/quality/gates/FE-GATE-009.txt",
|
||||
"evidence": [
|
||||
"artifacts/tests/a11y.json",
|
||||
"artifacts/tests/a11y-manual/APP_HOME.md"
|
||||
"artifacts/tests/a11y-manual/APP_HOME.md",
|
||||
"artifacts/tests/a11y-manual/SAMPLE_RESOURCE_LIST.md",
|
||||
"artifacts/tests/a11y-manual/NOT_FOUND.md",
|
||||
"artifacts/tests/a11y-manual/report.json"
|
||||
],
|
||||
"retentionClass": "merge-cycle"
|
||||
},
|
||||
@@ -208,6 +211,10 @@
|
||||
},
|
||||
"FE-GATE-018": {
|
||||
"name": "field-web-vitals",
|
||||
"requiresEnvironment": [
|
||||
"FIELD_WEB_VITALS_INPUT",
|
||||
"MIN_ELIGIBLE_SAMPLES"
|
||||
],
|
||||
"steps": [
|
||||
{ "script": "collect:web-vitals-evidence", "expect": "pass" }
|
||||
],
|
||||
|
||||
@@ -1,5 +1,25 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"releaseId": "local-release",
|
||||
"environment": "replace-with-production",
|
||||
"source": {
|
||||
"system": "",
|
||||
"exportId": ""
|
||||
},
|
||||
"privacy": {
|
||||
"approved": false,
|
||||
"approvalRef": ""
|
||||
},
|
||||
"window": {
|
||||
"start": "2026-06-01T00:00:00Z",
|
||||
"end": "2026-06-29T00:00:00Z"
|
||||
},
|
||||
"thresholdDecision": {
|
||||
"status": "pending",
|
||||
"minimumEligibleSamples": null,
|
||||
"owner": "",
|
||||
"reviewedAt": "",
|
||||
"evidenceRef": ""
|
||||
},
|
||||
"samples": []
|
||||
}
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
"window",
|
||||
"context",
|
||||
"metrics",
|
||||
"thresholds",
|
||||
"eligibility",
|
||||
"status",
|
||||
"passed"
|
||||
@@ -18,12 +19,55 @@
|
||||
"window": { "type": "object", "required": ["days", "start", "end"] },
|
||||
"context": {
|
||||
"type": "object",
|
||||
"required": ["source", "network", "routeAggregation", "releaseId"]
|
||||
"required": [
|
||||
"source",
|
||||
"sourceSystem",
|
||||
"exportId",
|
||||
"network",
|
||||
"routeAggregation",
|
||||
"releaseId",
|
||||
"privacyApprovalRef",
|
||||
"thresholdDecisionRef",
|
||||
"validationFailures"
|
||||
],
|
||||
"properties": {
|
||||
"source": { "type": "string" },
|
||||
"sourceSystem": { "type": ["string", "null"] },
|
||||
"exportId": { "type": ["string", "null"] },
|
||||
"network": { "const": "production-real-user" },
|
||||
"routeAggregation": { "const": "route-id-only" },
|
||||
"releaseId": { "type": ["string", "null"] },
|
||||
"privacyApprovalRef": { "type": ["string", "null"] },
|
||||
"thresholdDecisionRef": { "type": ["string", "null"] },
|
||||
"validationFailures": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" }
|
||||
}
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"thresholds": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"p75LcpMs",
|
||||
"p75Cls",
|
||||
"p75InpMs",
|
||||
"minimumEligibleSamples"
|
||||
]
|
||||
},
|
||||
"metrics": {
|
||||
"type": "object",
|
||||
"required": ["p75LcpMs", "p75Cls", "p75InpMs"]
|
||||
},
|
||||
"metrics": { "type": "object" },
|
||||
"eligibility": {
|
||||
"type": "object",
|
||||
"required": ["consentRequired", "eligibleSamples", "minimumEligibleSamples"]
|
||||
"required": [
|
||||
"consentRequired",
|
||||
"totalSamples",
|
||||
"eligibleSamples",
|
||||
"minimumEligibleSamples",
|
||||
"routeSamples"
|
||||
]
|
||||
},
|
||||
"status": {
|
||||
"enum": ["PASS", "FAIL_THRESHOLD", "FAIL_UNVERIFIED"]
|
||||
|
||||
@@ -1,17 +1,47 @@
|
||||
# Manual accessibility review checklist
|
||||
|
||||
Automated axe checks do not establish WCAG conformance. A human reviewer must
|
||||
copy this checklist to `artifacts/tests/a11y-manual/<route-id>.md`, execute it
|
||||
on the release candidate, and sign it.
|
||||
review all three route records in `artifacts/tests/a11y-manual/` against one
|
||||
release candidate and sign them. Copy the template fields exactly; the gate
|
||||
rejects blank identity/timestamp/signature fields, pending verdicts, mismatched
|
||||
release IDs, or missing routes.
|
||||
|
||||
- Status: `pending` or `reviewed`
|
||||
- Reviewer and reviewed-at timestamp
|
||||
- Keyboard: all actions reachable in logical order
|
||||
- Focus: visible, route changes deterministic, modal restore verified
|
||||
- Screen reader: headings, live regions, errors, and actions announced once
|
||||
- Reduced motion: non-essential animation suppressed
|
||||
- Color signal: every state has text/icon/structure in addition to color
|
||||
- Notes and linked defect IDs
|
||||
Allowed item verdicts:
|
||||
|
||||
Passing the automated threshold means only that the tested pages had zero
|
||||
critical/serious axe findings under the recorded browser run.
|
||||
- `pass`
|
||||
- `not-applicable (<specific reason>)`
|
||||
|
||||
Required record:
|
||||
|
||||
```text
|
||||
Status: reviewed
|
||||
Route ID: APP_HOME
|
||||
Release ID: <immutable release ID>
|
||||
Reviewer: <human reviewer identity>
|
||||
Reviewed at: <RFC 3339 timestamp>
|
||||
Signature: <reviewer identity or approved signature reference>
|
||||
Attestation: accepted
|
||||
M1 Keyboard: pass
|
||||
M2 Visible focus: pass
|
||||
M3 Route focus: pass
|
||||
M4 Modal focus: not-applicable (no modal on this route)
|
||||
M5 Error association: not-applicable (no form error on this route)
|
||||
M6 Color signal: pass
|
||||
M7 Reduced motion: pass
|
||||
Screen reader: pass
|
||||
Notes: <observations and linked defect IDs>
|
||||
```
|
||||
|
||||
The reviewer must verify:
|
||||
|
||||
- M1: every action works without a pointing device
|
||||
- M2: every focused element has a visible indicator
|
||||
- M3: route transitions move focus to a deterministic target
|
||||
- M4: modal focus is trapped and restored, when a modal exists
|
||||
- M5: errors are programmatically associated with their controls, when present
|
||||
- M6: state never relies on color alone
|
||||
- M7: non-essential motion is suppressed with reduced-motion preference
|
||||
- Screen reader: headings, live regions, errors, and actions are announced once
|
||||
|
||||
Passing automated evidence means only that tested pages had no critical or
|
||||
serious axe findings under the recorded browser run.
|
||||
|
||||
@@ -1,5 +1,9 @@
|
||||
# Architecture overview
|
||||
|
||||
This Mermaid view is a repository-local implementation projection. The
|
||||
`PASS_SCOPED` reviewer evidence applies to the canonical draw.io diagram named
|
||||
in `review-ledger.json`, not automatically to edits in this file.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
Bootstrap[bootstrap / composition root] --> Presentation[presentation]
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
# Imported scoped diagram review evidence
|
||||
|
||||
This ledger entry consumes the canonical evidence already recorded by the
|
||||
`ca-skeleton-frontend-operational-contract` project note. It does not claim
|
||||
review of the repository-local Mermaid projections or of the complete
|
||||
production deployment topology.
|
||||
|
||||
- Reviewer: `wiki-diagram-reviewer`
|
||||
- Standard: `rules/diagram-standards.md` v2
|
||||
- Canonical report:
|
||||
`docs/superpowers/specs/2026-07-18-ca-skeleton-frontend-operational-contract-review/diagram-review.md`
|
||||
- Canonical report SHA-256:
|
||||
`b4d2a35e4f07e176717786408f98dab5cee1047f77f6ff61f5faeddfccd78a29`
|
||||
|
||||
| Canonical diagram | SHA-256 | Score | Verdict | Reviewed scope |
|
||||
| --- | --- | ---: | --- | --- |
|
||||
| `raw/diagrams/ca-skeleton-frontend/architecture-overview-2026-07-18.drawio` | `c0ae56c9c964c5c6e698ab7dcc91736b9b811b2b834381817905db81c4230ba0` | 100 | PASS | Clean Architecture compile-time dependency ownership |
|
||||
| `raw/diagrams/ca-skeleton-frontend/architecture-deployment-2026-07-18.drawio` | `9a654326fb840ddf24b832221ff7eec4b8fadd9f87ad84174fccfa3bfcd1a25b` | 100 | PASS | immutable static assets and mutable `/config.json` delivery |
|
||||
|
||||
The canonical report explicitly limits this `PASS_SCOPED`: it does not verify
|
||||
the complete release/rollback topology, the implementation topology, or live
|
||||
hosting state.
|
||||
@@ -1,17 +1,29 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"status": "pending-review",
|
||||
"reviewerThreshold": null,
|
||||
"status": "PASS_SCOPED",
|
||||
"reviewer": "wiki-diagram-reviewer",
|
||||
"standard": "rules/diagram-standards.md v2",
|
||||
"evidenceReport": {
|
||||
"repoPath": "docs/architecture/review-evidence.md",
|
||||
"canonicalPath": "docs/superpowers/specs/2026-07-18-ca-skeleton-frontend-operational-contract-review/diagram-review.md",
|
||||
"canonicalSha256": "b4d2a35e4f07e176717786408f98dab5cee1047f77f6ff61f5faeddfccd78a29"
|
||||
},
|
||||
"reviews": {
|
||||
"overview": {
|
||||
"path": "docs/architecture/overview.md",
|
||||
"reviewer": null,
|
||||
"score": null
|
||||
"sourcePath": "raw/diagrams/ca-skeleton-frontend/architecture-overview-2026-07-18.drawio",
|
||||
"sha256": "c0ae56c9c964c5c6e698ab7dcc91736b9b811b2b834381817905db81c4230ba0",
|
||||
"score": 100,
|
||||
"verdict": "PASS",
|
||||
"thresholdSatisfied": true,
|
||||
"scope": "Clean Architecture compile-time dependency ownership"
|
||||
},
|
||||
"staticDelivery": {
|
||||
"path": "docs/architecture/static-delivery.md",
|
||||
"reviewer": null,
|
||||
"score": null
|
||||
"sourcePath": "raw/diagrams/ca-skeleton-frontend/architecture-deployment-2026-07-18.drawio",
|
||||
"sha256": "9a654326fb840ddf24b832221ff7eec4b8fadd9f87ad84174fccfa3bfcd1a25b",
|
||||
"score": 100,
|
||||
"verdict": "PASS",
|
||||
"thresholdSatisfied": true,
|
||||
"scope": "immutable static assets and mutable /config.json delivery"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,5 +1,9 @@
|
||||
# Static asset and runtime-config delivery
|
||||
|
||||
This Mermaid view is a repository-local implementation projection. The
|
||||
`PASS_SCOPED` reviewer evidence applies only to the canonical static-delivery
|
||||
draw.io scope recorded in `review-ledger.json`.
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
participant CI
|
||||
|
||||
@@ -18,9 +18,10 @@ DOCUMENTATION_READY (off-chain)
|
||||
Pull requests and `develop` pushes evaluate merge readiness. Version tags
|
||||
evaluate merge then release readiness. Production and field evaluation require
|
||||
an explicit workflow dispatch. The field tier cannot pass until the 28-day
|
||||
sample threshold decision is recorded. Documentation readiness cannot pass
|
||||
until both scoped diagrams have a recorded reviewer threshold and signed
|
||||
scores.
|
||||
sample threshold decision is recorded. Documentation readiness consumes the
|
||||
canonical project-note evidence in which both scoped diagrams already received
|
||||
100/100 `PASS_SCOPED`; the repo ledger preserves the evidence scope and
|
||||
canonical digests.
|
||||
|
||||
All jobs upload the shared `artifacts/` tree even after failure. Numeric
|
||||
retention remains an organization/provider decision; the workflow intentionally
|
||||
|
||||
@@ -13,5 +13,10 @@ Performance evidence is deliberately split by measurement context:
|
||||
The field minimum eligible-sample threshold is intentionally unresolved until
|
||||
a privacy-approved telemetry baseline exists. Therefore the field command
|
||||
fails closed with `FAIL_UNVERIFIED` when run against the example input. Provide
|
||||
`FIELD_WEB_VITALS_INPUT` and a reviewed `MIN_ELIGIBLE_SAMPLES` only after that
|
||||
decision is recorded.
|
||||
`FIELD_WEB_VITALS_INPUT` and `MIN_ELIGIBLE_SAMPLES` only after that decision is
|
||||
recorded. The external input must identify a production release and an exact
|
||||
28-day export window, name the source/export, carry privacy-approval and
|
||||
threshold-decision references, and contain only non-negative route-ID samples.
|
||||
The environment threshold must be a positive integer equal to the approved
|
||||
decision embedded in the input. Invalid metadata fails as `FAIL_UNVERIFIED`;
|
||||
the example can never serve as production evidence.
|
||||
|
||||
@@ -26,4 +26,7 @@ to the declared allowlist; a cache-correct response with a mismatched
|
||||
|
||||
`corepack pnpm verify:hosting-headers` uses a deterministic fixture locally.
|
||||
Set `HOSTING_BASE_URL` to probe deployed responses; production promotion
|
||||
requires the artifact to report `mode: "live"`.
|
||||
requires the artifact to report `mode: "live"`. The live target must be its
|
||||
canonical, non-loopback HTTPS root URL. Each required surface must return HTTP
|
||||
200 without leaving that origin before its cache, content-type, and security
|
||||
headers can count as deployment evidence.
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
"REQUEST_TIMEOUT_MS": 10000,
|
||||
"MAX_RETRY_ATTEMPTS": 2,
|
||||
"TELEMETRY_ENABLED": false,
|
||||
"AUTH_MODE": "external",
|
||||
"AUTH_MODE": "demo",
|
||||
"CONFIG_SCHEMA_VERSION": "1",
|
||||
"API_CONTRACT_VERSION": "1",
|
||||
"RELEASE_MANIFEST_URL": "/release-manifest.json",
|
||||
|
||||
@@ -4,23 +4,19 @@ import {
|
||||
evaluateFieldBudget,
|
||||
percentile75,
|
||||
} from "../src/application/policies/performance-budgets.js";
|
||||
import { validateFieldEvidenceInput } from "./lib/field-vitals-evidence.mjs";
|
||||
|
||||
const inputPath =
|
||||
process.env.FIELD_WEB_VITALS_INPUT ||
|
||||
"config/performance/field-input.example.json";
|
||||
const input =
|
||||
/** @type {{
|
||||
* releaseId: string,
|
||||
* samples: Array<{
|
||||
* timestamp: string,
|
||||
* consent: boolean,
|
||||
* releaseId: string,
|
||||
* routeId: string,
|
||||
* lcpMs: number,
|
||||
* cls: number,
|
||||
* inpMs: number
|
||||
* }>
|
||||
* }} */ (JSON.parse(await readFile(inputPath, "utf8")));
|
||||
const rawInput = JSON.parse(await readFile(inputPath, "utf8"));
|
||||
const now = new Date();
|
||||
const validation = validateFieldEvidenceInput(
|
||||
rawInput,
|
||||
process.env.MIN_ELIGIBLE_SAMPLES,
|
||||
now,
|
||||
);
|
||||
const input = validation.data;
|
||||
const configured =
|
||||
/** @type {{
|
||||
* p75LcpMs: number,
|
||||
@@ -30,17 +26,17 @@ const configured =
|
||||
* }} */ (
|
||||
JSON.parse(await readFile("config/performance/budgets.json", "utf8")).field
|
||||
);
|
||||
const minimumEligibleSamples = process.env.MIN_ELIGIBLE_SAMPLES
|
||||
? Number(process.env.MIN_ELIGIBLE_SAMPLES)
|
||||
: configured.minimumEligibleSamples;
|
||||
const end = new Date();
|
||||
const start = new Date(end);
|
||||
start.setUTCDate(start.getUTCDate() - 28);
|
||||
const eligible = input.samples.filter((sample) => {
|
||||
const minimumEligibleSamples = validation.minimumEligibleSamples;
|
||||
const fallbackEnd = now;
|
||||
const fallbackStart = new Date(fallbackEnd);
|
||||
fallbackStart.setUTCDate(fallbackStart.getUTCDate() - 28);
|
||||
const start = input ? new Date(input.window.start) : fallbackStart;
|
||||
const end = input ? new Date(input.window.end) : fallbackEnd;
|
||||
const eligible = (input?.samples ?? []).filter((sample) => {
|
||||
const timestamp = new Date(sample.timestamp);
|
||||
return (
|
||||
sample.consent === true &&
|
||||
sample.releaseId === input.releaseId &&
|
||||
sample.releaseId === input?.releaseId &&
|
||||
timestamp >= start &&
|
||||
timestamp <= end
|
||||
);
|
||||
@@ -55,6 +51,8 @@ const result = evaluateFieldBudget(
|
||||
{ metrics, eligibleSamples: eligible.length },
|
||||
thresholds,
|
||||
);
|
||||
const passed = validation.passed && result.passed;
|
||||
const status = validation.passed ? result.status : "FAIL_UNVERIFIED";
|
||||
const routeSamples = Object.fromEntries(
|
||||
Object.entries(
|
||||
eligible.reduce(
|
||||
@@ -68,24 +66,30 @@ const routeSamples = Object.fromEntries(
|
||||
);
|
||||
const report = {
|
||||
schemaVersion: 1,
|
||||
generatedAt: end.toISOString(),
|
||||
generatedAt: now.toISOString(),
|
||||
window: { days: 28, start: start.toISOString(), end: end.toISOString() },
|
||||
context: {
|
||||
source: inputPath,
|
||||
sourceSystem: input?.source.system ?? null,
|
||||
exportId: input?.source.exportId ?? null,
|
||||
network: "production-real-user",
|
||||
routeAggregation: "route-id-only",
|
||||
releaseId: input.releaseId,
|
||||
releaseId: input?.releaseId ?? null,
|
||||
privacyApprovalRef: input?.privacy.approvalRef ?? null,
|
||||
thresholdDecisionRef: input?.thresholdDecision.evidenceRef ?? null,
|
||||
validationFailures: validation.failures,
|
||||
},
|
||||
metrics,
|
||||
thresholds,
|
||||
eligibility: {
|
||||
consentRequired: true,
|
||||
totalSamples: input?.samples.length ?? 0,
|
||||
eligibleSamples: eligible.length,
|
||||
minimumEligibleSamples,
|
||||
routeSamples,
|
||||
},
|
||||
status: result.status,
|
||||
passed: result.passed,
|
||||
status,
|
||||
passed,
|
||||
};
|
||||
|
||||
await mkdir("artifacts/performance", { recursive: true });
|
||||
@@ -93,9 +97,9 @@ await writeFile(
|
||||
"artifacts/performance/field-web-vitals.json",
|
||||
`${JSON.stringify(report, null, 2)}\n`,
|
||||
);
|
||||
if (!result.passed) {
|
||||
if (!passed) {
|
||||
process.stderr.write(
|
||||
`Field Web Vitals: ${result.status} (minimum eligible sample threshold and 28-day production data are required)\n`,
|
||||
`Field Web Vitals: ${status} (approved threshold decision and valid 28-day production evidence are required)\n`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,122 @@
|
||||
import { z } from "zod";
|
||||
|
||||
const WINDOW_MILLISECONDS = 28 * 24 * 60 * 60 * 1000;
|
||||
const nonEmptyString = z.string().trim().min(1);
|
||||
const timestamp = nonEmptyString.refine(
|
||||
(value) => Number.isFinite(Date.parse(value)),
|
||||
"must be an RFC 3339 timestamp",
|
||||
);
|
||||
const sampleSchema = z
|
||||
.object({
|
||||
timestamp,
|
||||
consent: z.boolean(),
|
||||
releaseId: nonEmptyString,
|
||||
routeId: nonEmptyString.regex(/^[A-Z][A-Z0-9_]*$/),
|
||||
lcpMs: z.number().finite().nonnegative(),
|
||||
cls: z.number().finite().nonnegative(),
|
||||
inpMs: z.number().finite().nonnegative(),
|
||||
})
|
||||
.strict();
|
||||
|
||||
const fieldEvidenceInputSchema = z
|
||||
.object({
|
||||
schemaVersion: z.literal(1),
|
||||
environment: z.literal("production"),
|
||||
releaseId: nonEmptyString.refine(
|
||||
(value) => value !== "local-release",
|
||||
"must identify an immutable production release",
|
||||
),
|
||||
source: z
|
||||
.object({
|
||||
system: nonEmptyString,
|
||||
exportId: nonEmptyString,
|
||||
})
|
||||
.strict(),
|
||||
privacy: z
|
||||
.object({
|
||||
approved: z.literal(true),
|
||||
approvalRef: nonEmptyString,
|
||||
})
|
||||
.strict(),
|
||||
window: z
|
||||
.object({
|
||||
start: timestamp,
|
||||
end: timestamp,
|
||||
})
|
||||
.strict(),
|
||||
thresholdDecision: z
|
||||
.object({
|
||||
status: z.literal("approved"),
|
||||
minimumEligibleSamples: z.number().int().positive(),
|
||||
owner: nonEmptyString,
|
||||
reviewedAt: timestamp,
|
||||
evidenceRef: nonEmptyString,
|
||||
})
|
||||
.strict(),
|
||||
samples: z.array(sampleSchema),
|
||||
})
|
||||
.strict()
|
||||
.superRefine((input, context) => {
|
||||
const start = Date.parse(input.window.start);
|
||||
const end = Date.parse(input.window.end);
|
||||
if (end - start !== WINDOW_MILLISECONDS) {
|
||||
context.addIssue({
|
||||
code: "custom",
|
||||
path: ["window"],
|
||||
message: "must cover exactly 28 days",
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @param {unknown} input
|
||||
* @param {string | undefined} configuredMinimum
|
||||
* @param {Date} [now]
|
||||
*/
|
||||
export function validateFieldEvidenceInput(
|
||||
input,
|
||||
configuredMinimum,
|
||||
now = new Date(),
|
||||
) {
|
||||
const parsed = fieldEvidenceInputSchema.safeParse(input);
|
||||
const failures = parsed.success
|
||||
? []
|
||||
: parsed.error.issues.map(
|
||||
(issue) => `${issue.path.join(".") || "input"}: ${issue.message}`,
|
||||
);
|
||||
const minimumEligibleSamples = Number(configuredMinimum);
|
||||
if (
|
||||
configuredMinimum === undefined ||
|
||||
!Number.isInteger(minimumEligibleSamples) ||
|
||||
minimumEligibleSamples <= 0
|
||||
) {
|
||||
failures.push("MIN_ELIGIBLE_SAMPLES: must be a positive integer");
|
||||
}
|
||||
|
||||
if (parsed.success) {
|
||||
if (
|
||||
parsed.data.thresholdDecision.minimumEligibleSamples !==
|
||||
minimumEligibleSamples
|
||||
) {
|
||||
failures.push(
|
||||
"MIN_ELIGIBLE_SAMPLES: does not match the approved threshold decision",
|
||||
);
|
||||
}
|
||||
if (Date.parse(parsed.data.window.end) > now.getTime()) {
|
||||
failures.push("window.end: must not be in the future");
|
||||
}
|
||||
if (Date.parse(parsed.data.thresholdDecision.reviewedAt) > now.getTime()) {
|
||||
failures.push("thresholdDecision.reviewedAt: must not be in the future");
|
||||
}
|
||||
}
|
||||
|
||||
return Object.freeze({
|
||||
data: parsed.success ? parsed.data : null,
|
||||
failures: Object.freeze(failures),
|
||||
minimumEligibleSamples:
|
||||
Number.isInteger(minimumEligibleSamples) && minimumEligibleSamples > 0
|
||||
? minimumEligibleSamples
|
||||
: null,
|
||||
passed: parsed.success && failures.length === 0,
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
const LOOPBACK_IPV4 = /^127(?:\.\d{1,3}){3}$/;
|
||||
|
||||
/**
|
||||
* A release gate must not promote a local preview server as live hosting
|
||||
* evidence.
|
||||
*
|
||||
* @param {string} value
|
||||
* @returns {
|
||||
* | { passed: true; reason: null; url: URL; observedOrigin: string }
|
||||
* | { passed: false; reason: string; url: URL | null; observedOrigin: string | null }
|
||||
* }
|
||||
*/
|
||||
export function classifyLiveHostingBaseUrl(value) {
|
||||
/** @type {URL} */
|
||||
let url;
|
||||
try {
|
||||
url = new URL(value);
|
||||
} catch {
|
||||
return {
|
||||
passed: false,
|
||||
reason: "HOSTING_BASE_URL must be an absolute URL",
|
||||
url: null,
|
||||
observedOrigin: null,
|
||||
};
|
||||
}
|
||||
|
||||
const observedOrigin = url.origin;
|
||||
const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
|
||||
if (url.protocol !== "https:") {
|
||||
return {
|
||||
passed: false,
|
||||
reason: "live hosting evidence requires HTTPS",
|
||||
url,
|
||||
observedOrigin,
|
||||
};
|
||||
}
|
||||
if (url.username || url.password) {
|
||||
return {
|
||||
passed: false,
|
||||
reason: "HOSTING_BASE_URL must not contain credentials",
|
||||
url,
|
||||
observedOrigin,
|
||||
};
|
||||
}
|
||||
if (
|
||||
hostname === "localhost" ||
|
||||
hostname.endsWith(".localhost") ||
|
||||
hostname === "::1" ||
|
||||
hostname === "0.0.0.0" ||
|
||||
LOOPBACK_IPV4.test(hostname)
|
||||
) {
|
||||
return {
|
||||
passed: false,
|
||||
reason: "local or loopback hosts are not live deployment evidence",
|
||||
url,
|
||||
observedOrigin,
|
||||
};
|
||||
}
|
||||
if (url.pathname !== "/" || url.search || url.hash) {
|
||||
return {
|
||||
passed: false,
|
||||
reason: "HOSTING_BASE_URL must be the canonical root URL",
|
||||
url,
|
||||
observedOrigin,
|
||||
};
|
||||
}
|
||||
return { passed: true, reason: null, url, observedOrigin };
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
export const MANUAL_A11Y_ROUTE_IDS = Object.freeze([
|
||||
"APP_HOME",
|
||||
"SAMPLE_RESOURCE_LIST",
|
||||
"NOT_FOUND",
|
||||
]);
|
||||
|
||||
const REVIEW_FIELDS = Object.freeze([
|
||||
"M1 Keyboard",
|
||||
"M2 Visible focus",
|
||||
"M3 Route focus",
|
||||
"M4 Modal focus",
|
||||
"M5 Error association",
|
||||
"M6 Color signal",
|
||||
"M7 Reduced motion",
|
||||
"Screen reader",
|
||||
]);
|
||||
|
||||
/** @param {string} content */
|
||||
export function validateManualA11yEvidence(content) {
|
||||
const fields = Object.fromEntries(
|
||||
content
|
||||
.split(/\r?\n/)
|
||||
.map((line) => /^([^:]+):\s*(.*)$/.exec(line))
|
||||
.filter(Boolean)
|
||||
.map((match) => [
|
||||
/** @type {RegExpExecArray} */ (match)[1].trim(),
|
||||
/** @type {RegExpExecArray} */ (match)[2].trim(),
|
||||
]),
|
||||
);
|
||||
const failures = [];
|
||||
if (fields.Status !== "reviewed") failures.push("Status");
|
||||
if (!fields["Route ID"]) failures.push("Route ID");
|
||||
if (!fields["Release ID"]) failures.push("Release ID");
|
||||
if (!fields.Reviewer) failures.push("Reviewer");
|
||||
if (!fields.Signature) failures.push("Signature");
|
||||
if (fields.Attestation !== "accepted") failures.push("Attestation");
|
||||
if (
|
||||
!fields["Reviewed at"] ||
|
||||
!Number.isFinite(Date.parse(fields["Reviewed at"]))
|
||||
) {
|
||||
failures.push("Reviewed at");
|
||||
}
|
||||
|
||||
for (const field of REVIEW_FIELDS) {
|
||||
const result = fields[field];
|
||||
if (
|
||||
result !== "pass" &&
|
||||
!/^not-applicable \(.+\)$/.test(result ?? "")
|
||||
) {
|
||||
failures.push(field);
|
||||
}
|
||||
}
|
||||
return Object.freeze({
|
||||
fields: Object.freeze(fields),
|
||||
failures: Object.freeze(failures),
|
||||
passed: failures.length === 0,
|
||||
});
|
||||
}
|
||||
@@ -1,25 +1,71 @@
|
||||
import { readFile } from "node:fs/promises";
|
||||
import { mkdir, readFile, writeFile } from "node:fs/promises";
|
||||
|
||||
const evidence = await readFile(
|
||||
"artifacts/tests/a11y-manual/APP_HOME.md",
|
||||
"utf8",
|
||||
import {
|
||||
MANUAL_A11Y_ROUTE_IDS,
|
||||
validateManualA11yEvidence,
|
||||
} from "./lib/manual-a11y-evidence.mjs";
|
||||
|
||||
/** @type {Array<{
|
||||
* routeId: string;
|
||||
* path: string;
|
||||
* reviewer: string | null;
|
||||
* reviewedAt: string | null;
|
||||
* releaseId: string | null;
|
||||
* failures: readonly string[];
|
||||
* passed: boolean;
|
||||
* }>} */
|
||||
const results = [];
|
||||
for (const routeId of MANUAL_A11Y_ROUTE_IDS) {
|
||||
const path = `artifacts/tests/a11y-manual/${routeId}.md`;
|
||||
const evidence = await readFile(path, "utf8");
|
||||
const validation = validateManualA11yEvidence(evidence);
|
||||
const failures =
|
||||
validation.fields["Route ID"] === routeId
|
||||
? validation.failures
|
||||
: Object.freeze([...validation.failures, "Route ID mismatch"]);
|
||||
results.push({
|
||||
routeId,
|
||||
path,
|
||||
reviewer: validation.fields.Reviewer ?? null,
|
||||
reviewedAt: validation.fields["Reviewed at"] ?? null,
|
||||
releaseId: validation.fields["Release ID"] ?? null,
|
||||
failures,
|
||||
passed: validation.passed && failures.length === 0,
|
||||
});
|
||||
}
|
||||
const releaseIds = new Set(results.map((result) => result.releaseId));
|
||||
const passed =
|
||||
results.every((result) => result.passed) &&
|
||||
releaseIds.size === 1 &&
|
||||
results.every((result) => Boolean(result.releaseId));
|
||||
|
||||
await mkdir("artifacts/tests/a11y-manual", { recursive: true });
|
||||
await writeFile(
|
||||
"artifacts/tests/a11y-manual/report.json",
|
||||
`${JSON.stringify(
|
||||
{
|
||||
schemaVersion: 1,
|
||||
generatedAt: new Date().toISOString(),
|
||||
scope: MANUAL_A11Y_ROUTE_IDS,
|
||||
results,
|
||||
coherentRelease: releaseIds.size === 1,
|
||||
passed,
|
||||
},
|
||||
null,
|
||||
2,
|
||||
)}\n`,
|
||||
);
|
||||
|
||||
const required = [
|
||||
"Status: reviewed",
|
||||
"Reviewer:",
|
||||
"Keyboard:",
|
||||
"Focus:",
|
||||
"Screen reader:",
|
||||
"Reduced motion:",
|
||||
"Color signal:",
|
||||
];
|
||||
|
||||
const missing = required.filter((marker) => !evidence.includes(marker));
|
||||
if (missing.length > 0) {
|
||||
if (!passed) {
|
||||
const failures = results
|
||||
.filter((result) => !result.passed)
|
||||
.map((result) => `${result.routeId}: ${result.failures.join(", ")}`);
|
||||
if (releaseIds.size !== 1) failures.push("release IDs do not match");
|
||||
process.stderr.write(
|
||||
`Manual accessibility evidence is incomplete: ${missing.join(", ")}\n`,
|
||||
`Manual accessibility evidence is incomplete:\n${failures.join("\n")}\n`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
process.stdout.write("Manual accessibility evidence: PASS\n");
|
||||
process.stdout.write(
|
||||
`Manual accessibility evidence: PASS (${results.length} routes)\n`,
|
||||
);
|
||||
|
||||
@@ -3,29 +3,43 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
|
||||
const ledger = JSON.parse(
|
||||
await readFile("docs/architecture/review-ledger.json", "utf8"),
|
||||
);
|
||||
const evidence = await readFile(ledger.evidenceReport.repoPath, "utf8");
|
||||
const results = [];
|
||||
for (const [diagram, review] of Object.entries(ledger.reviews)) {
|
||||
const content = await readFile(review.path, "utf8");
|
||||
const hasDiagram = /```mermaid[\s\S]+```/.test(content);
|
||||
const sourceReferenced = evidence.includes(review.sourcePath);
|
||||
const digestReferenced =
|
||||
/^[0-9a-f]{64}$/.test(review.sha256) &&
|
||||
evidence.includes(review.sha256);
|
||||
const scorePass =
|
||||
typeof ledger.reviewerThreshold === "number" &&
|
||||
review.thresholdSatisfied === true &&
|
||||
review.verdict === "PASS" &&
|
||||
typeof review.score === "number" &&
|
||||
review.score >= ledger.reviewerThreshold;
|
||||
evidence.includes(`| ${review.score} | PASS |`);
|
||||
results.push({
|
||||
diagram,
|
||||
path: review.path,
|
||||
hasDiagram,
|
||||
reviewer: review.reviewer,
|
||||
sourcePath: review.sourcePath,
|
||||
sha256: review.sha256,
|
||||
sourceReferenced,
|
||||
digestReferenced,
|
||||
reviewer: ledger.reviewer,
|
||||
score: review.score,
|
||||
scorePass,
|
||||
passed:
|
||||
hasDiagram &&
|
||||
Boolean(review.reviewer) &&
|
||||
sourceReferenced &&
|
||||
digestReferenced &&
|
||||
ledger.reviewer === "wiki-diagram-reviewer" &&
|
||||
ledger.standard === "rules/diagram-standards.md v2" &&
|
||||
scorePass &&
|
||||
ledger.status === "PASS_SCOPED",
|
||||
});
|
||||
}
|
||||
const passed = results.every((result) => result.passed);
|
||||
const reportDigestValid =
|
||||
/^[0-9a-f]{64}$/.test(ledger.evidenceReport.canonicalSha256) &&
|
||||
evidence.includes(ledger.evidenceReport.canonicalSha256);
|
||||
const passed =
|
||||
reportDigestValid &&
|
||||
results.length === 2 &&
|
||||
results.every((result) => result.passed);
|
||||
await mkdir("artifacts/quality", { recursive: true });
|
||||
await writeFile(
|
||||
"artifacts/quality/documentation-review.json",
|
||||
@@ -34,7 +48,10 @@ await writeFile(
|
||||
schemaVersion: 1,
|
||||
generatedAt: new Date().toISOString(),
|
||||
status: ledger.status,
|
||||
reviewerThreshold: ledger.reviewerThreshold,
|
||||
reviewer: ledger.reviewer,
|
||||
standard: ledger.standard,
|
||||
evidenceReport: ledger.evidenceReport,
|
||||
reportDigestValid,
|
||||
results,
|
||||
passed,
|
||||
},
|
||||
@@ -44,7 +61,7 @@ await writeFile(
|
||||
);
|
||||
if (!passed) {
|
||||
process.stderr.write(
|
||||
"Documentation readiness: FAIL_UNVERIFIED (reviewer threshold and signed reviews required)\n",
|
||||
"Documentation readiness: FAIL_UNVERIFIED (canonical scoped-review evidence is incomplete)\n",
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
|
||||
|
||||
import { classifyLiveHostingBaseUrl } from "./lib/hosting-probe.mjs";
|
||||
|
||||
const cachePolicy = JSON.parse(
|
||||
await readFile("config/hosting/cache-policy.json", "utf8"),
|
||||
);
|
||||
@@ -7,6 +9,7 @@ const securityPolicy = JSON.parse(
|
||||
await readFile("config/hosting/security-headers.json", "utf8"),
|
||||
);
|
||||
const baseUrl = process.env.HOSTING_BASE_URL;
|
||||
const liveTarget = baseUrl ? classifyLiveHostingBaseUrl(baseUrl) : null;
|
||||
const distFiles = (await readdir("dist", { recursive: true })).map(String);
|
||||
const publicSourceMaps = distFiles.filter((file) => file.endsWith(".map"));
|
||||
const publicServiceWorkers = distFiles.filter((file) =>
|
||||
@@ -14,10 +17,19 @@ const publicServiceWorkers = distFiles.filter((file) =>
|
||||
);
|
||||
|
||||
/** @type {Record<string, Record<string, string>>} */
|
||||
let responses;
|
||||
let responses = {};
|
||||
let mode;
|
||||
/** @type {Array<{
|
||||
* surface: string;
|
||||
* header: string;
|
||||
* expected: unknown;
|
||||
* observed: unknown;
|
||||
* reason?: string;
|
||||
* passed: boolean;
|
||||
* }>} */
|
||||
const probeResults = [];
|
||||
|
||||
if (baseUrl) {
|
||||
if (liveTarget?.passed) {
|
||||
mode = "live";
|
||||
const assets = await readdir("dist/assets");
|
||||
const hashedJavaScript = assets.find((file) => file.endsWith(".js"));
|
||||
@@ -30,14 +42,52 @@ if (baseUrl) {
|
||||
};
|
||||
responses = {};
|
||||
for (const [surface, pathname] of Object.entries(paths)) {
|
||||
const response = await fetch(new URL(pathname, baseUrl));
|
||||
responses[surface] = Object.fromEntries(
|
||||
[...response.headers.entries()].map(([name, value]) => [
|
||||
name.toLowerCase(),
|
||||
value,
|
||||
]),
|
||||
);
|
||||
const requestedUrl = new URL(pathname, liveTarget.url);
|
||||
try {
|
||||
const response = await fetch(requestedUrl, { redirect: "follow" });
|
||||
const finalUrl = new URL(response.url);
|
||||
probeResults.push(
|
||||
{
|
||||
surface,
|
||||
header: "http-status",
|
||||
expected: 200,
|
||||
observed: response.status,
|
||||
passed: response.status === 200,
|
||||
},
|
||||
{
|
||||
surface,
|
||||
header: "final-origin",
|
||||
expected: liveTarget.url.origin,
|
||||
observed: finalUrl.origin,
|
||||
passed: finalUrl.origin === liveTarget.url.origin,
|
||||
},
|
||||
);
|
||||
responses[surface] = Object.fromEntries(
|
||||
[...response.headers.entries()].map(([name, value]) => [
|
||||
name.toLowerCase(),
|
||||
value,
|
||||
]),
|
||||
);
|
||||
} catch (error) {
|
||||
probeResults.push({
|
||||
surface,
|
||||
header: "transport",
|
||||
expected: "reachable",
|
||||
observed: error instanceof Error ? error.name : "UnknownError",
|
||||
passed: false,
|
||||
});
|
||||
}
|
||||
}
|
||||
} else if (liveTarget) {
|
||||
mode = "invalid-live";
|
||||
probeResults.push({
|
||||
surface: "deployment",
|
||||
header: "base-url",
|
||||
expected: "canonical non-loopback HTTPS root URL",
|
||||
observed: liveTarget.observedOrigin,
|
||||
reason: liveTarget.reason,
|
||||
passed: false,
|
||||
});
|
||||
} else {
|
||||
mode = "fixture";
|
||||
responses = JSON.parse(
|
||||
@@ -45,7 +95,7 @@ if (baseUrl) {
|
||||
).responses;
|
||||
}
|
||||
|
||||
const results = [];
|
||||
const results = [...probeResults];
|
||||
for (const [surface, policy] of Object.entries(cachePolicy.surfaces)) {
|
||||
if (!("cacheControl" in policy)) continue;
|
||||
const observed = responses[surface]?.["cache-control"];
|
||||
@@ -110,7 +160,7 @@ await writeFile(
|
||||
schemaVersion: 1,
|
||||
generatedAt: new Date().toISOString(),
|
||||
mode,
|
||||
baseUrl: baseUrl ?? null,
|
||||
baseUrl: liveTarget?.observedOrigin ?? null,
|
||||
providerVerificationRequired: mode !== "live",
|
||||
results,
|
||||
passed,
|
||||
|
||||
@@ -10,7 +10,7 @@ await writeFile(
|
||||
scope: ["APP_HOME", "SAMPLE_RESOURCE_LIST", "NOT_FOUND"],
|
||||
threshold: { critical: 0, serious: 0 },
|
||||
automatedStatus: "passed",
|
||||
manualReview: "see artifacts/tests/a11y-manual/APP_HOME.md",
|
||||
manualReview: "see artifacts/tests/a11y-manual/report.json",
|
||||
},
|
||||
null,
|
||||
2,
|
||||
|
||||
@@ -4,6 +4,9 @@
|
||||
*
|
||||
* @param {{
|
||||
* readState(): import("../../application/ports/auth-session-port.js").SessionState,
|
||||
* subscribe(listener: () => void): () => void,
|
||||
* beginSignIn(returnTo?: string): Promise<void>,
|
||||
* signOut(): Promise<void>,
|
||||
* attachCredential(request: Request): Promise<Request>,
|
||||
* recoverSession(): Promise<"restored" | "no-session">,
|
||||
* notifyUnauthenticated(): void
|
||||
@@ -15,6 +18,16 @@ export function createExternalAuthSessionAdapter(owner) {
|
||||
getState() {
|
||||
return owner.readState();
|
||||
},
|
||||
subscribe(listener) {
|
||||
return owner.subscribe(listener);
|
||||
},
|
||||
async beginSignIn(returnTo) {
|
||||
await owner.beginSignIn(returnTo);
|
||||
},
|
||||
async signOut() {
|
||||
await owner.signOut();
|
||||
},
|
||||
/** @param {Request} request */
|
||||
async attach(request) {
|
||||
const attached = await owner.attachCredential(request);
|
||||
if (!(attached instanceof Request)) {
|
||||
@@ -38,8 +51,74 @@ export function createExternalAuthSessionAdapter(owner) {
|
||||
export function createAnonymousSessionAdapter() {
|
||||
return createExternalAuthSessionAdapter({
|
||||
readState: () => "unauthenticated",
|
||||
subscribe: () => () => {},
|
||||
beginSignIn: async () => {},
|
||||
signOut: async () => {},
|
||||
attachCredential: async (request) => request,
|
||||
recoverSession: async () => "no-session",
|
||||
notifyUnauthenticated: () => {},
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Local/test-only session seam. It never creates or stores credentials.
|
||||
*
|
||||
* @param {import("../../application/ports/auth-session-port.js").SessionState} [initialState]
|
||||
*/
|
||||
export function createDemoSessionAdapter(initialState = "unauthenticated") {
|
||||
let state = initialState;
|
||||
const listeners = new Set();
|
||||
|
||||
function notify() {
|
||||
for (const listener of listeners) listener();
|
||||
}
|
||||
|
||||
/** @param {import("../../application/ports/auth-session-port.js").SessionState} next */
|
||||
function setState(next) {
|
||||
state = next;
|
||||
notify();
|
||||
}
|
||||
|
||||
return Object.freeze({
|
||||
getState: () => state,
|
||||
/** @param {() => void} listener */
|
||||
subscribe(listener) {
|
||||
listeners.add(listener);
|
||||
return () => listeners.delete(listener);
|
||||
},
|
||||
async beginSignIn() {
|
||||
setState("authenticated");
|
||||
},
|
||||
async signOut() {
|
||||
setState("unauthenticated");
|
||||
},
|
||||
/** @param {Request} request */
|
||||
async attach(request) {
|
||||
return request;
|
||||
},
|
||||
async recover() {
|
||||
if (state === "recovery-pending") {
|
||||
setState("authenticated");
|
||||
return /** @type {const} */ ("restored");
|
||||
}
|
||||
return /** @type {const} */ ("no-session");
|
||||
},
|
||||
onUnauthenticated() {
|
||||
setState("unauthenticated");
|
||||
},
|
||||
setState,
|
||||
});
|
||||
}
|
||||
|
||||
export function createUnavailableSessionAdapter() {
|
||||
return Object.freeze({
|
||||
getState: () => /** @type {const} */ ("integration-failed"),
|
||||
subscribe: () => () => {},
|
||||
beginSignIn: async () => {},
|
||||
signOut: async () => {},
|
||||
/** @param {Request} request */
|
||||
attach: async (request) => request,
|
||||
recover: async () => /** @type {const} */ ("no-session"),
|
||||
onUnauthenticated: () => {},
|
||||
});
|
||||
}
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* Application facade factory. Concrete dependencies are supplied by bootstrap.
|
||||
*
|
||||
* @param {{
|
||||
* resources: {
|
||||
* resources?: {
|
||||
* query: import("./ports/resource-ports.js").ResourceQueryPort<unknown, unknown>,
|
||||
* command: import("./ports/resource-ports.js").ResourceCommandPort<unknown, unknown>
|
||||
* },
|
||||
@@ -17,7 +17,9 @@ export function createApplication(ports) {
|
||||
* @param {import("./ports/resource-ports.js").RequestContext} [context]
|
||||
*/
|
||||
function queryResources(query, context) {
|
||||
return ports.resources.query.execute(query, context);
|
||||
return /** @type {NonNullable<typeof ports.resources>} */ (
|
||||
ports.resources
|
||||
).query.execute(query, context);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -25,14 +27,18 @@ export function createApplication(ports) {
|
||||
* @param {import("./ports/resource-ports.js").RequestContext} [context]
|
||||
*/
|
||||
function commandResources(command, context) {
|
||||
return ports.resources.command.execute(command, context);
|
||||
return /** @type {NonNullable<typeof ports.resources>} */ (
|
||||
ports.resources
|
||||
).command.execute(command, context);
|
||||
}
|
||||
|
||||
return Object.freeze({
|
||||
resources: Object.freeze({
|
||||
query: queryResources,
|
||||
command: commandResources,
|
||||
}),
|
||||
resources: ports.resources
|
||||
? Object.freeze({
|
||||
query: queryResources,
|
||||
command: commandResources,
|
||||
})
|
||||
: null,
|
||||
cache: ports.cache,
|
||||
storage: ports.storage,
|
||||
telemetry: ports.telemetry,
|
||||
|
||||
@@ -7,6 +7,9 @@
|
||||
*
|
||||
* @typedef {{
|
||||
* getState(): SessionState,
|
||||
* subscribe(listener: () => void): () => void,
|
||||
* beginSignIn(returnTo?: string): Promise<void>,
|
||||
* signOut(): Promise<void>,
|
||||
* attach(request: Request): Promise<Request>,
|
||||
* recover(): Promise<"restored" | "no-session">,
|
||||
* onUnauthenticated(): void
|
||||
|
||||
@@ -4,14 +4,23 @@ import { createApplication } from "../application/create-application.js";
|
||||
* This is the only module allowed to join concrete adapters to application
|
||||
* ports. Boot phases are explicit so failures can stop before product mount.
|
||||
*
|
||||
* @template Config
|
||||
* @template Release
|
||||
* @template {Parameters<typeof createApplication>[0]} Ports
|
||||
* @param {{
|
||||
* loadConfig(): Promise<Record<string, unknown>>,
|
||||
* loadRelease(config: Record<string, unknown>): Promise<Record<string, unknown>>,
|
||||
* loadConfig(): Promise<Config>,
|
||||
* loadRelease(config: Config): Promise<Release>,
|
||||
* createAdapters(context: {
|
||||
* config: Record<string, unknown>,
|
||||
* release: Record<string, unknown>
|
||||
* }): Promise<Parameters<typeof createApplication>[0]>
|
||||
* config: Config,
|
||||
* release: Release
|
||||
* }): Promise<Ports>
|
||||
* }} factories
|
||||
* @returns {Promise<Readonly<{
|
||||
* config: Config,
|
||||
* release: Release,
|
||||
* ports: Ports,
|
||||
* application: ReturnType<typeof createApplication>
|
||||
* }>>}
|
||||
*/
|
||||
export async function createCompositionRoot(factories) {
|
||||
const config = await factories.loadConfig();
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
import { createCompositionRoot } from "./composition-root.js";
|
||||
import { loadReleaseManifest } from "./load-release-manifest.js";
|
||||
import { loadRuntimeConfig } from "./load-runtime-config.js";
|
||||
import { createRuntimeAdapters } from "./runtime-adapters.js";
|
||||
|
||||
/**
|
||||
* @param {{
|
||||
* fetcher?: typeof fetch,
|
||||
* host?: Record<string, unknown>
|
||||
* }} [dependencies]
|
||||
*/
|
||||
export function createRuntimeComposition(dependencies = {}) {
|
||||
return createCompositionRoot({
|
||||
loadConfig: () => loadRuntimeConfig({ fetcher: dependencies.fetcher }),
|
||||
loadRelease: (runtime) =>
|
||||
loadReleaseManifest(
|
||||
/** @type {Awaited<ReturnType<typeof loadRuntimeConfig>>} */ (runtime),
|
||||
{ fetcher: dependencies.fetcher },
|
||||
),
|
||||
createAdapters: ({ config: runtime, release }) =>
|
||||
createRuntimeAdapters({
|
||||
runtime:
|
||||
/** @type {Awaited<ReturnType<typeof loadRuntimeConfig>>} */ (runtime),
|
||||
release:
|
||||
/** @type {Awaited<ReturnType<typeof loadReleaseManifest>>} */ (
|
||||
release
|
||||
),
|
||||
fetcher: dependencies.fetcher,
|
||||
host: dependencies.host,
|
||||
}),
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,107 @@
|
||||
import { z } from "zod";
|
||||
|
||||
const version = z.string().regex(/^\d+(?:\.\d+){0,2}$/);
|
||||
const releaseManifestSchema = z
|
||||
.object({
|
||||
schemaVersion: z.literal(1),
|
||||
appVersion: z.string().min(1),
|
||||
buildId: z.string().min(1),
|
||||
commitSha: z.string().min(1),
|
||||
configSchemaVersion: version,
|
||||
apiContractVersion: version,
|
||||
assetManifestHash: z.string().min(1),
|
||||
releaseId: z.string().min(1),
|
||||
builtAt: z.string().min(1),
|
||||
})
|
||||
.strict();
|
||||
|
||||
export class ReleaseManifestError extends Error {
|
||||
/** @param {string} code @param {{buildId: string, releaseId?: string}} safe */
|
||||
constructor(code, safe) {
|
||||
super("Release manifest could not be loaded");
|
||||
this.name = "ReleaseManifestError";
|
||||
this.kind = "RELEASE_MANIFEST_FAILURE";
|
||||
this.code = code;
|
||||
this.safe = Object.freeze({
|
||||
kind: this.kind,
|
||||
code,
|
||||
buildId: safe.buildId,
|
||||
releaseId: safe.releaseId,
|
||||
supportReference: `${safe.buildId}:${code}`,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Awaited<ReturnType<typeof import("./load-runtime-config.js").loadRuntimeConfig>>} runtime
|
||||
* @param {{fetcher?: typeof fetch}} [options]
|
||||
*/
|
||||
export async function loadReleaseManifest(runtime, options = {}) {
|
||||
const fetcher = options.fetcher ?? fetch;
|
||||
let response;
|
||||
try {
|
||||
response = await fetcher(runtime.config.RELEASE_MANIFEST_URL, {
|
||||
cache: "no-store",
|
||||
headers: { Accept: "application/json" },
|
||||
});
|
||||
} catch {
|
||||
throw new ReleaseManifestError("MANIFEST_FETCH_FAILED", {
|
||||
buildId: runtime.build.buildId,
|
||||
releaseId: runtime.config.RELEASE_ID,
|
||||
});
|
||||
}
|
||||
if (!response.ok) {
|
||||
throw new ReleaseManifestError("MANIFEST_HTTP_FAILED", {
|
||||
buildId: runtime.build.buildId,
|
||||
releaseId: runtime.config.RELEASE_ID,
|
||||
});
|
||||
}
|
||||
|
||||
let raw;
|
||||
try {
|
||||
raw = await response.json();
|
||||
} catch {
|
||||
throw new ReleaseManifestError("MANIFEST_JSON_INVALID", {
|
||||
buildId: runtime.build.buildId,
|
||||
releaseId: runtime.config.RELEASE_ID,
|
||||
});
|
||||
}
|
||||
const parsed = releaseManifestSchema.safeParse(raw);
|
||||
if (!parsed.success) {
|
||||
throw new ReleaseManifestError("MANIFEST_SCHEMA_INVALID", {
|
||||
buildId: runtime.build.buildId,
|
||||
releaseId: runtime.config.RELEASE_ID,
|
||||
});
|
||||
}
|
||||
|
||||
const manifest = parsed.data;
|
||||
const mismatches = [];
|
||||
if (manifest.buildId !== runtime.build.buildId) mismatches.push("buildId");
|
||||
if (
|
||||
runtime.config.BUILD_ID &&
|
||||
manifest.buildId !== runtime.config.BUILD_ID
|
||||
) {
|
||||
mismatches.push("runtimeBuildId");
|
||||
}
|
||||
if (
|
||||
manifest.configSchemaVersion !== runtime.config.CONFIG_SCHEMA_VERSION
|
||||
) {
|
||||
mismatches.push("configSchemaVersion");
|
||||
}
|
||||
if (manifest.apiContractVersion !== runtime.config.API_CONTRACT_VERSION) {
|
||||
mismatches.push("apiContractVersion");
|
||||
}
|
||||
if (
|
||||
runtime.config.RELEASE_ID &&
|
||||
manifest.releaseId !== runtime.config.RELEASE_ID
|
||||
) {
|
||||
mismatches.push("releaseId");
|
||||
}
|
||||
if (mismatches.length > 0) {
|
||||
throw new ReleaseManifestError("MANIFEST_RUNTIME_MISMATCH", {
|
||||
buildId: runtime.build.buildId,
|
||||
releaseId: runtime.config.RELEASE_ID,
|
||||
});
|
||||
}
|
||||
return Object.freeze(structuredClone(manifest));
|
||||
}
|
||||
@@ -1,10 +1,11 @@
|
||||
import { StrictMode } from "react";
|
||||
import { createRoot } from "react-dom/client";
|
||||
|
||||
import { createAnonymousSessionAdapter } from "../adapters/auth/external-session-adapter.js";
|
||||
import { BootErrorShell } from "../presentation/boundaries/boot-error-shell.jsx";
|
||||
import { AppRouter } from "../presentation/routes/app-router.jsx";
|
||||
import { BootConfigError, loadRuntimeConfig } from "./load-runtime-config.js";
|
||||
import { createRuntimeComposition } from "./create-runtime-composition.js";
|
||||
import { BootConfigError } from "./load-runtime-config.js";
|
||||
import { ReleaseManifestError } from "./load-release-manifest.js";
|
||||
import "../presentation/styles/theme.css";
|
||||
|
||||
const rootElement = document.getElementById("root");
|
||||
@@ -17,18 +18,18 @@ const root = createRoot(rootElement);
|
||||
|
||||
async function boot() {
|
||||
try {
|
||||
const runtime = await loadRuntimeConfig();
|
||||
const composition = await createRuntimeComposition();
|
||||
root.render(
|
||||
<StrictMode>
|
||||
<AppRouter
|
||||
authSession={createAnonymousSessionAdapter()}
|
||||
basename={runtime.build.routerBasePath}
|
||||
authSession={composition.ports.authSession}
|
||||
basename={composition.config.build.routerBasePath}
|
||||
/>
|
||||
</StrictMode>,
|
||||
);
|
||||
} catch (error) {
|
||||
const safe =
|
||||
error instanceof BootConfigError
|
||||
error instanceof BootConfigError || error instanceof ReleaseManifestError
|
||||
? error.safe
|
||||
: { supportReference: "boot:unknown" };
|
||||
|
||||
|
||||
@@ -0,0 +1,94 @@
|
||||
import {
|
||||
createDemoSessionAdapter,
|
||||
createExternalAuthSessionAdapter,
|
||||
createUnavailableSessionAdapter,
|
||||
} from "../adapters/auth/external-session-adapter.js";
|
||||
import { createHttpClient } from "../adapters/http/client.js";
|
||||
import {
|
||||
createQueryCacheAdapter,
|
||||
createQueryClient,
|
||||
} from "../adapters/query-cache/tanstack-query-cache.js";
|
||||
import { createBrowserStorageAdapter } from "../adapters/storage/browser-storage-adapter.js";
|
||||
import { createTelemetryAdapter } from "../adapters/telemetry/best-effort-telemetry.js";
|
||||
|
||||
/**
|
||||
* @param {Record<string, unknown>} host
|
||||
* @returns {Parameters<typeof createExternalAuthSessionAdapter>[0] | null}
|
||||
*/
|
||||
function externalOwnerFrom(host) {
|
||||
const candidate = host.__CA_FRONTEND_AUTH_OWNER__;
|
||||
if (!candidate || typeof candidate !== "object") return null;
|
||||
const owner = /** @type {Record<string, unknown>} */ (candidate);
|
||||
const required = [
|
||||
"readState",
|
||||
"subscribe",
|
||||
"beginSignIn",
|
||||
"signOut",
|
||||
"attachCredential",
|
||||
"recoverSession",
|
||||
"notifyUnauthenticated",
|
||||
];
|
||||
return required.every((name) => typeof owner[name] === "function")
|
||||
? /** @type {Parameters<typeof createExternalAuthSessionAdapter>[0]} */ (
|
||||
candidate
|
||||
)
|
||||
: null;
|
||||
}
|
||||
|
||||
/** @param {unknown} value */
|
||||
function storageOrUndefined(value) {
|
||||
return typeof Storage !== "undefined" && value instanceof Storage
|
||||
? value
|
||||
: undefined;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {{
|
||||
* runtime: Awaited<ReturnType<typeof import("./load-runtime-config.js").loadRuntimeConfig>>,
|
||||
* release: Awaited<ReturnType<typeof import("./load-release-manifest.js").loadReleaseManifest>>,
|
||||
* host?: Record<string, unknown>,
|
||||
* fetcher?: typeof fetch
|
||||
* }} context
|
||||
*/
|
||||
export async function createRuntimeAdapters(context) {
|
||||
const host = context.host ?? /** @type {Record<string, unknown>} */ (globalThis);
|
||||
const config = context.runtime.config;
|
||||
const externalOwner = externalOwnerFrom(host);
|
||||
const authSession =
|
||||
config.AUTH_MODE === "demo"
|
||||
? createDemoSessionAdapter()
|
||||
: externalOwner
|
||||
? createExternalAuthSessionAdapter(externalOwner)
|
||||
: createUnavailableSessionAdapter();
|
||||
const queryClient = createQueryClient();
|
||||
const cache = createQueryCacheAdapter(queryClient);
|
||||
const storage = createBrowserStorageAdapter({
|
||||
localStorage: storageOrUndefined(host.localStorage),
|
||||
sessionStorage: storageOrUndefined(host.sessionStorage),
|
||||
});
|
||||
const telemetry = createTelemetryAdapter({
|
||||
enabled: config.TELEMETRY_ENABLED,
|
||||
endpoint: config.TELEMETRY_ENDPOINT,
|
||||
fetcher: context.fetcher,
|
||||
});
|
||||
const http = createHttpClient({
|
||||
baseUrl: config.API_BASE_URL,
|
||||
authSession,
|
||||
fetcher: context.fetcher,
|
||||
});
|
||||
const releaseInfo = Object.freeze({
|
||||
async getCurrent() {
|
||||
return structuredClone(context.release);
|
||||
},
|
||||
});
|
||||
|
||||
return Object.freeze({
|
||||
authSession,
|
||||
cache,
|
||||
http,
|
||||
queryClient,
|
||||
releaseInfo,
|
||||
storage,
|
||||
telemetry,
|
||||
});
|
||||
}
|
||||
@@ -10,7 +10,7 @@ export const runtimeConfigSchema = z
|
||||
MAX_RETRY_ATTEMPTS: z.int().min(0).max(2).default(2),
|
||||
TELEMETRY_ENABLED: z.boolean(),
|
||||
TELEMETRY_ENDPOINT: z.url().optional(),
|
||||
AUTH_MODE: z.literal("external"),
|
||||
AUTH_MODE: z.enum(["external", "demo"]),
|
||||
CONFIG_SCHEMA_VERSION: version,
|
||||
API_CONTRACT_VERSION: version,
|
||||
RELEASE_MANIFEST_URL: z.string().min(1).default("/release-manifest.json"),
|
||||
@@ -28,6 +28,13 @@ export const runtimeConfigSchema = z
|
||||
}
|
||||
|
||||
const local = config.APP_ENV === "local" || config.APP_ENV === "development";
|
||||
if (!local && config.AUTH_MODE === "demo") {
|
||||
context.addIssue({
|
||||
code: "custom",
|
||||
path: ["AUTH_MODE"],
|
||||
message: "demo authentication is limited to local environments",
|
||||
});
|
||||
}
|
||||
const endpointEntries =
|
||||
/** @type {Array<[string, string | undefined]>} */ ([
|
||||
["API_BASE_URL", config.API_BASE_URL],
|
||||
|
||||
@@ -21,8 +21,9 @@ test("@a11y keyboard reaches the primary route action with visible focus", async
|
||||
page,
|
||||
}) => {
|
||||
await page.goto("/");
|
||||
await page.keyboard.press("Tab");
|
||||
const action = page.getByRole("link", { name: "샘플 리소스" });
|
||||
await expect(action).toBeVisible();
|
||||
await page.keyboard.press("Tab");
|
||||
await expect(action).toBeFocused();
|
||||
await expect(action).toHaveCSS("outline-style", "solid");
|
||||
});
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import {
|
||||
loadReleaseManifest,
|
||||
ReleaseManifestError,
|
||||
} from "../../src/bootstrap/load-release-manifest.js";
|
||||
|
||||
const runtime = {
|
||||
build: { buildId: "build-a" },
|
||||
config: {
|
||||
RELEASE_MANIFEST_URL: "/release-manifest.json",
|
||||
BUILD_ID: "build-a",
|
||||
RELEASE_ID: "release-a",
|
||||
CONFIG_SCHEMA_VERSION: "1",
|
||||
API_CONTRACT_VERSION: "1",
|
||||
},
|
||||
};
|
||||
const manifest = {
|
||||
schemaVersion: 1,
|
||||
appVersion: "0.1.0",
|
||||
buildId: "build-a",
|
||||
commitSha: "abc123",
|
||||
configSchemaVersion: "1",
|
||||
apiContractVersion: "1",
|
||||
assetManifestHash: "hash-a",
|
||||
releaseId: "release-a",
|
||||
builtAt: "2026-07-25T00:00:00Z",
|
||||
};
|
||||
|
||||
describe("release manifest boot boundary", () => {
|
||||
it("loads a coherent release tuple", async () => {
|
||||
await expect(
|
||||
loadReleaseManifest(
|
||||
/** @type {Parameters<typeof loadReleaseManifest>[0]} */ (runtime),
|
||||
{ fetcher: async () => new Response(JSON.stringify(manifest)) },
|
||||
),
|
||||
).resolves.toMatchObject({ releaseId: "release-a" });
|
||||
});
|
||||
|
||||
it("fails before mount when release and runtime differ", async () => {
|
||||
await expect(
|
||||
loadReleaseManifest(
|
||||
/** @type {Parameters<typeof loadReleaseManifest>[0]} */ (runtime),
|
||||
{
|
||||
fetcher: async () =>
|
||||
new Response(JSON.stringify({ ...manifest, buildId: "build-b" })),
|
||||
},
|
||||
),
|
||||
).rejects.toBeInstanceOf(ReleaseManifestError);
|
||||
});
|
||||
});
|
||||
@@ -35,6 +35,20 @@ describe("runtime configuration boundary", () => {
|
||||
);
|
||||
});
|
||||
|
||||
it("allows demo authentication only for local runtime configuration", () => {
|
||||
expect(
|
||||
validateRuntimeConfig({ ...validConfig, AUTH_MODE: "demo" }).success,
|
||||
).toBe(true);
|
||||
expect(
|
||||
validateRuntimeConfig({
|
||||
...validConfig,
|
||||
APP_ENV: "production",
|
||||
API_BASE_URL: "https://api.example.test",
|
||||
AUTH_MODE: "demo",
|
||||
}).success,
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("validates a fetched config under the 500ms budget excluding network", async () => {
|
||||
let current = 100;
|
||||
const result = await loadRuntimeConfig({
|
||||
|
||||
@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vitest";
|
||||
|
||||
import {
|
||||
createAnonymousSessionAdapter,
|
||||
createDemoSessionAdapter,
|
||||
createExternalAuthSessionAdapter,
|
||||
} from "../../src/adapters/auth/external-session-adapter.js";
|
||||
|
||||
@@ -9,6 +10,9 @@ describe("external AuthSessionPort adapter", () => {
|
||||
it("attaches opaque credentials without exposing a token-shaped session", async () => {
|
||||
const adapter = createExternalAuthSessionAdapter({
|
||||
readState: () => "authenticated",
|
||||
subscribe: () => () => {},
|
||||
beginSignIn: async () => {},
|
||||
signOut: async () => {},
|
||||
attachCredential: async (request) => {
|
||||
const headers = new Headers(request.headers);
|
||||
headers.set("X-Session-Attached", "true");
|
||||
@@ -28,6 +32,9 @@ describe("external AuthSessionPort adapter", () => {
|
||||
it("fails invalid recovery states closed", async () => {
|
||||
const adapter = createExternalAuthSessionAdapter({
|
||||
readState: () => "authenticated",
|
||||
subscribe: () => () => {},
|
||||
beginSignIn: async () => {},
|
||||
signOut: async () => {},
|
||||
attachCredential: async (request) => request,
|
||||
recoverSession: async () => "unexpected",
|
||||
notifyUnauthenticated: vi.fn(),
|
||||
@@ -41,4 +48,20 @@ describe("external AuthSessionPort adapter", () => {
|
||||
expect(adapter.getState()).toBe("unauthenticated");
|
||||
await expect(adapter.recover()).resolves.toBe("no-session");
|
||||
});
|
||||
|
||||
it("provides a reactive credential-free demo seam", async () => {
|
||||
const adapter = createDemoSessionAdapter();
|
||||
let notifications = 0;
|
||||
const unsubscribe = adapter.subscribe(() => {
|
||||
notifications += 1;
|
||||
});
|
||||
|
||||
expect(adapter.getState()).toBe("unauthenticated");
|
||||
await adapter.beginSignIn("/");
|
||||
expect(adapter.getState()).toBe("authenticated");
|
||||
await adapter.signOut();
|
||||
expect(adapter.getState()).toBe("unauthenticated");
|
||||
expect(notifications).toBe(2);
|
||||
unsubscribe();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -0,0 +1,94 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { validateFieldEvidenceInput } from "../../scripts/lib/field-vitals-evidence.mjs";
|
||||
|
||||
const input = {
|
||||
schemaVersion: 1,
|
||||
environment: "production",
|
||||
releaseId: "release-2026-06-29",
|
||||
source: {
|
||||
system: "privacy-approved-rum-export",
|
||||
exportId: "export-2026-06-29",
|
||||
},
|
||||
privacy: {
|
||||
approved: true,
|
||||
approvalRef: "PRIVACY-42",
|
||||
},
|
||||
window: {
|
||||
start: "2026-06-01T00:00:00Z",
|
||||
end: "2026-06-29T00:00:00Z",
|
||||
},
|
||||
thresholdDecision: {
|
||||
status: "approved",
|
||||
minimumEligibleSamples: 25,
|
||||
owner: "performance-owner",
|
||||
reviewedAt: "2026-06-30T00:00:00Z",
|
||||
evidenceRef: "PERF-BASELINE-7",
|
||||
},
|
||||
samples: [
|
||||
{
|
||||
timestamp: "2026-06-20T00:00:00Z",
|
||||
consent: true,
|
||||
releaseId: "release-2026-06-29",
|
||||
routeId: "APP_HOME",
|
||||
lcpMs: 1200,
|
||||
cls: 0.01,
|
||||
inpMs: 80,
|
||||
},
|
||||
],
|
||||
};
|
||||
|
||||
describe("field Web Vitals evidence input", () => {
|
||||
it("accepts reviewed, coherent 28-day production metadata", () => {
|
||||
expect(
|
||||
validateFieldEvidenceInput(
|
||||
input,
|
||||
"25",
|
||||
new Date("2026-07-01T00:00:00Z"),
|
||||
),
|
||||
).toMatchObject({
|
||||
failures: [],
|
||||
minimumEligibleSamples: 25,
|
||||
passed: true,
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects a threshold that does not match the owner decision", () => {
|
||||
expect(
|
||||
validateFieldEvidenceInput(
|
||||
input,
|
||||
"10",
|
||||
new Date("2026-07-01T00:00:00Z"),
|
||||
),
|
||||
).toMatchObject({
|
||||
failures: [
|
||||
"MIN_ELIGIBLE_SAMPLES: does not match the approved threshold decision",
|
||||
],
|
||||
passed: false,
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects local, unapproved, malformed, or impossible measurements", () => {
|
||||
const invalid = {
|
||||
...input,
|
||||
environment: "local",
|
||||
releaseId: "local-release",
|
||||
privacy: { approved: false, approvalRef: "" },
|
||||
window: { ...input.window, end: "2026-06-28T00:00:00Z" },
|
||||
samples: [{ ...input.samples[0], lcpMs: -1 }],
|
||||
};
|
||||
const validation = validateFieldEvidenceInput(
|
||||
invalid,
|
||||
"-1",
|
||||
new Date("2026-07-01T00:00:00Z"),
|
||||
);
|
||||
expect(validation.passed).toBe(false);
|
||||
expect(validation.failures.join("\n")).toContain("environment");
|
||||
expect(validation.failures.join("\n")).toContain("releaseId");
|
||||
expect(validation.failures.join("\n")).toContain("privacy");
|
||||
expect(validation.failures.join("\n")).toContain("lcpMs");
|
||||
expect(validation.failures.join("\n")).toContain(
|
||||
"MIN_ELIGIBLE_SAMPLES: must be a positive integer",
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,27 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { classifyLiveHostingBaseUrl } from "../../scripts/lib/hosting-probe.mjs";
|
||||
|
||||
describe("live hosting evidence target", () => {
|
||||
it("accepts a canonical production HTTPS root", () => {
|
||||
expect(
|
||||
classifyLiveHostingBaseUrl("https://frontend.example.test/"),
|
||||
).toMatchObject({
|
||||
passed: true,
|
||||
observedOrigin: "https://frontend.example.test",
|
||||
});
|
||||
});
|
||||
|
||||
it.each([
|
||||
["http://frontend.example.test/", "requires HTTPS"],
|
||||
["https://localhost:4173/", "not live deployment evidence"],
|
||||
["https://127.0.0.1/", "not live deployment evidence"],
|
||||
["https://frontend.example.test/app/", "canonical root URL"],
|
||||
["https://user:secret@frontend.example.test/", "must not contain credentials"],
|
||||
])("rejects %s", (url, reason) => {
|
||||
expect(classifyLiveHostingBaseUrl(url)).toMatchObject({
|
||||
passed: false,
|
||||
reason: expect.stringContaining(reason),
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,57 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { validateManualA11yEvidence } from "../../scripts/lib/manual-a11y-evidence.mjs";
|
||||
|
||||
const reviewed = `Status: reviewed
|
||||
Route ID: APP_HOME
|
||||
Release ID: release-1
|
||||
Reviewer: reviewer@example.test
|
||||
Reviewed at: 2026-07-25T12:00:00Z
|
||||
Signature: review-record-1
|
||||
Attestation: accepted
|
||||
M1 Keyboard: pass
|
||||
M2 Visible focus: pass
|
||||
M3 Route focus: pass
|
||||
M4 Modal focus: not-applicable (no modal)
|
||||
M5 Error association: not-applicable (no form error)
|
||||
M6 Color signal: pass
|
||||
M7 Reduced motion: pass
|
||||
Screen reader: pass
|
||||
Notes: no defects`;
|
||||
|
||||
describe("manual accessibility evidence", () => {
|
||||
it("accepts a complete signed human review record", () => {
|
||||
expect(validateManualA11yEvidence(reviewed)).toMatchObject({
|
||||
failures: [],
|
||||
passed: true,
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects pending, unsigned, or incomplete evidence", () => {
|
||||
expect(
|
||||
validateManualA11yEvidence(
|
||||
reviewed
|
||||
.replace("Status: reviewed", "Status: pending-manual-review")
|
||||
.replace("Signature: review-record-1", "Signature:")
|
||||
.replace("Screen reader: pass", "Screen reader: pending"),
|
||||
),
|
||||
).toMatchObject({
|
||||
failures: ["Status", "Signature", "Screen reader"],
|
||||
passed: false,
|
||||
});
|
||||
});
|
||||
|
||||
it("does not treat an unexplained not-applicable verdict as evidence", () => {
|
||||
expect(
|
||||
validateManualA11yEvidence(
|
||||
reviewed.replace(
|
||||
"M4 Modal focus: not-applicable (no modal)",
|
||||
"M4 Modal focus: not-applicable",
|
||||
),
|
||||
),
|
||||
).toMatchObject({
|
||||
failures: ["M4 Modal focus"],
|
||||
passed: false,
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,57 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { createRuntimeAdapters } from "../../src/bootstrap/runtime-adapters.js";
|
||||
|
||||
const runtime = {
|
||||
config: {
|
||||
APP_ENV: "local",
|
||||
API_BASE_URL: "http://localhost:8080",
|
||||
TELEMETRY_ENABLED: false,
|
||||
AUTH_MODE: "demo",
|
||||
},
|
||||
};
|
||||
const release = {
|
||||
schemaVersion: 1,
|
||||
appVersion: "0.1.0",
|
||||
buildId: "build-a",
|
||||
commitSha: "abc123",
|
||||
configSchemaVersion: "1",
|
||||
apiContractVersion: "1",
|
||||
assetManifestHash: "hash-a",
|
||||
releaseId: "release-a",
|
||||
builtAt: "2026-07-25T00:00:00Z",
|
||||
};
|
||||
|
||||
describe("runtime adapter composition", () => {
|
||||
it("constructs the local demo seam and infrastructure adapters", async () => {
|
||||
const adapters = await createRuntimeAdapters({
|
||||
runtime:
|
||||
/** @type {Parameters<typeof createRuntimeAdapters>[0]["runtime"]} */ (
|
||||
runtime
|
||||
),
|
||||
release,
|
||||
host: {},
|
||||
});
|
||||
|
||||
expect(adapters.authSession.getState()).toBe("unauthenticated");
|
||||
expect(adapters.cache.read(["missing"])).toEqual({
|
||||
ok: true,
|
||||
value: undefined,
|
||||
});
|
||||
await expect(adapters.releaseInfo.getCurrent()).resolves.toMatchObject({
|
||||
releaseId: "release-a",
|
||||
});
|
||||
});
|
||||
|
||||
it("fails closed when an external auth owner was not installed", async () => {
|
||||
const adapters = await createRuntimeAdapters({
|
||||
runtime:
|
||||
/** @type {Parameters<typeof createRuntimeAdapters>[0]["runtime"]} */ ({
|
||||
config: { ...runtime.config, AUTH_MODE: "external" },
|
||||
}),
|
||||
release,
|
||||
host: {},
|
||||
});
|
||||
expect(adapters.authSession.getState()).toBe("integration-failed");
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user