DongHyeonkaandClaude Opus 5
bdee07a93b
Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.
Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.
What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.
Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
94 lines
3.5 KiB
TypeScript
94 lines
3.5 KiB
TypeScript
import { readFile, writeFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import process from "node:process";
|
|
|
|
import {
|
|
DEPLOYMENT_TARGETS,
|
|
isDeploymentTarget,
|
|
type DeploymentTarget,
|
|
} from "../src/contracts/deployment-admission.ts";
|
|
import { runtimeConfigV2ArtifactSchema } from "../src/contracts/release-artifacts.ts";
|
|
|
|
/**
|
|
* §6.4. Materializes `dist/config.json` from the profile the build declares.
|
|
*
|
|
* `public/` is copied verbatim into `dist/`, so before this step the runtime
|
|
* document that shipped with every build was the local one — `APP_ENV: local`,
|
|
* `AUTH_MODE: demo`, a loopback API — regardless of what the build was for.
|
|
* The profile is the source of truth instead, and the only values a deployment
|
|
* may inject are the ones it actually owns: its endpoints and its identity.
|
|
*
|
|
* The result is validated against the same V2 schema the browser will apply, so
|
|
* an override cannot produce a document that only fails at boot.
|
|
*/
|
|
|
|
const PROFILE_DIRECTORY = "config/runtime";
|
|
const OUTPUT_PATH = "dist/config.json";
|
|
|
|
/**
|
|
* Deployment-supplied values. Everything else is fixed by the profile so a
|
|
* deployment cannot quietly widen what was reviewed.
|
|
*/
|
|
const OVERRIDES = Object.freeze({
|
|
API_BASE_URL: "RUNTIME_API_BASE_URL",
|
|
TELEMETRY_ENDPOINT: "RUNTIME_TELEMETRY_ENDPOINT",
|
|
} as const);
|
|
|
|
export async function generateRuntimeConfig(
|
|
target: DeploymentTarget,
|
|
environment: NodeJS.ProcessEnv = process.env,
|
|
): Promise<Record<string, unknown>> {
|
|
const profilePath = path.join(PROFILE_DIRECTORY, `${target}.json`);
|
|
const source: unknown = JSON.parse(await readFile(profilePath, "utf8"));
|
|
if (source === null || typeof source !== "object" || Array.isArray(source)) {
|
|
throw new TypeError(`${profilePath}: runtime profile must be an object`);
|
|
}
|
|
const draft: Record<string, unknown> = { ...(source as Record<string, unknown>) };
|
|
if (draft["APP_ENV"] !== target) {
|
|
throw new Error(
|
|
`${profilePath}: declares APP_ENV ${String(draft["APP_ENV"])}, expected ${target}`,
|
|
);
|
|
}
|
|
for (const [field, variable] of Object.entries(OVERRIDES)) {
|
|
const supplied = environment[variable];
|
|
if (supplied !== undefined && supplied !== "") draft[field] = supplied;
|
|
}
|
|
const buildId = environment["VITE_BUILD_ID"] ?? "local-build";
|
|
const releaseId = environment["RELEASE_ID"] ?? "local-release";
|
|
draft["BUILD_ID"] = buildId;
|
|
draft["RELEASE_ID"] = releaseId;
|
|
|
|
const parsed = runtimeConfigV2ArtifactSchema.safeParse(draft);
|
|
if (!parsed.success) {
|
|
const issues = parsed.error.issues
|
|
.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`)
|
|
.join("\n ");
|
|
throw new Error(`${profilePath}: runtime config is invalid\n ${issues}`);
|
|
}
|
|
return draft;
|
|
}
|
|
|
|
function resolveTarget(environment: NodeJS.ProcessEnv): DeploymentTarget {
|
|
const declared = environment["APP_PROFILE"] ?? "local";
|
|
if (!isDeploymentTarget(declared)) {
|
|
throw new Error(
|
|
`APP_PROFILE must be one of ${DEPLOYMENT_TARGETS.join(", ")}; received ${declared}`,
|
|
);
|
|
}
|
|
return declared;
|
|
}
|
|
|
|
async function main(): Promise<void> {
|
|
const target = resolveTarget(process.env);
|
|
const config = await generateRuntimeConfig(target);
|
|
await writeFile(OUTPUT_PATH, `${JSON.stringify(config, null, 2)}\n`, "utf8");
|
|
process.stdout.write(
|
|
`runtime config: ${target} profile written to ${OUTPUT_PATH} ` +
|
|
`(APP_ENV=${String(config["APP_ENV"])}, AUTH_MODE=${String(config["AUTH_MODE"])})\n`,
|
|
);
|
|
}
|
|
|
|
if (process.argv[1] && import.meta.url.endsWith(path.basename(process.argv[1]))) {
|
|
await main();
|
|
}
|