@burdenoff/fe-libs 2026.1022.2 → 2026.1023.1

package/dist/chrome/LanguageSwitcher.d.ts

@@ -12,6 +12,16 @@ export interface LanguageSwitcherProps {
     /** Show as icon only (for small screens) */
     compact?: boolean;
 }
+/**
+ * Accessible name of the switcher's trigger button.
+ *
+ * WCAG 2.5.3 (Label in Name; axe `label-content-name-mismatch`): when the
+ * trigger shows the current language code, its accessible name must contain
+ * that visible text, so a speech-input user who says "click EN" hits it. The
+ * name therefore leads with the code ("EN, Change language"). The compact
+ * trigger shows only a globe icon, so its name stays the plain action label.
+ */
+export declare function languageTriggerLabel(currentCode: string | undefined, changeLabel: string, compact: boolean): string;
 /**
  * LanguageSwitcher Component
  *

package/dist/chrome/LanguageSwitcher.js

@@ -3,46 +3,50 @@ import { useAssistantControl as t } from "../shared/assistant/appControls/useAss
 import { useEffect as n, useMemo as r, useRef as i, useState as a } from "react";
 import { Fragment as o, jsx as s, jsxs as c } from "react/jsx-runtime";
 //#region src/chrome/LanguageSwitcher.tsx
-var l = ({ languages: l, currentLanguage: u, onLanguageChange: d, compact: f = !1 }) => {
-	let p = e(), [m, h] = a(!1), g = i(null), _ = l.find((e) => e.code === u) || l[0], v = i({
-		languages: l,
-		currentLanguage: u,
-		onLanguageChange: d
+function l(e, t, n) {
+	let r = e?.trim().toUpperCase();
+	return n || !r ? t : `${r}, ${t}`;
+}
+var u = ({ languages: u, currentLanguage: d, onLanguageChange: f, compact: p = !1 }) => {
+	let m = e(), [h, g] = a(!1), _ = i(null), v = u.find((e) => e.code === d) || u[0], y = i({
+		languages: u,
+		currentLanguage: d,
+		onLanguageChange: f
 	});
-	v.current = {
-		languages: l,
-		currentLanguage: u,
-		onLanguageChange: d
+	y.current = {
+		languages: u,
+		currentLanguage: d,
+		onLanguageChange: f
 	};
-	let y = d !== void 0;
-	t("language", r(() => y ? {
-		languages: () => v.current.languages.map((e) => ({
+	let b = f !== void 0;
+	t("language", r(() => b ? {
+		languages: () => y.current.languages.map((e) => ({
 			code: e.code,
 			label: e.nativeName || e.name
 		})),
-		current: () => v.current.currentLanguage,
+		current: () => y.current.currentLanguage,
 		set: (e) => {
-			let { languages: t, currentLanguage: n, onLanguageChange: r } = v.current, i = t.find((t) => t.code.toLowerCase() === e.toLowerCase());
+			let { languages: t, currentLanguage: n, onLanguageChange: r } = y.current, i = t.find((t) => t.code.toLowerCase() === e.toLowerCase());
 			return !i || !r ? { status: "failed" } : i.code === n ? { status: "already" } : (r(i), { status: "done" });
 		}
-	} : null, [y])), n(() => {
+	} : null, [b])), n(() => {
 		let e = (e) => {
-			g.current && !g.current.contains(e.target) && h(!1);
+			_.current && !_.current.contains(e.target) && g(!1);
 		};
-		if (m) return document.addEventListener("mousedown", e), () => document.removeEventListener("mousedown", e);
-	}, [m]);
-	let b = (e) => {
-		d && d(e), h(!1);
+		if (h) return document.addEventListener("mousedown", e), () => document.removeEventListener("mousedown", e);
+	}, [h]);
+	let x = (e) => {
+		f && f(e), g(!1);
 	};
 	return /* @__PURE__ */ c("div", {
 		className: "relative",
-		ref: g,
+		ref: _,
 		children: [/* @__PURE__ */ s("button", {
-			onClick: () => h(!m),
-			className: `flex items-center gap-2 px-3 py-2 rounded-button hover:bg-bg-sunken transition-colors ${m ? "bg-bg-sunken" : ""}`,
-			"aria-label": p("languageSwitcher.change", "Change language"),
-			"aria-expanded": m,
-			children: f ? /* @__PURE__ */ s("svg", {
+			onClick: () => g(!h),
+			className: `flex items-center gap-2 px-3 py-2 rounded-button hover:bg-bg-sunken transition-colors ${h ? "bg-bg-sunken" : ""}`,
+			"aria-label": l(v?.code, m("languageSwitcher.change", "Change language"), p),
+			"aria-expanded": h,
+			children: p ? /* @__PURE__ */ s("svg", {
 				className: "size-5 text-text-primary",
 				fill: "none",
 				stroke: "currentColor",
@@ -55,9 +59,9 @@ var l = ({ languages: l, currentLanguage: u, onLanguageChange: d, compact: f = !
 				})
 			}) : /* @__PURE__ */ c(o, { children: [/* @__PURE__ */ s("span", {
 				className: "text-body-sm font-medium text-text-primary uppercase",
-				children: _?.code
+				children: v?.code.toUpperCase()
 			}), /* @__PURE__ */ s("svg", {
-				className: `w-4 h-4 text-text-secondary transition-transform ${m ? "rotate-180" : ""}`,
+				className: `w-4 h-4 text-text-secondary transition-transform ${h ? "rotate-180" : ""}`,
 				fill: "none",
 				stroke: "currentColor",
 				viewBox: "0 0 24 24",
@@ -68,19 +72,19 @@ var l = ({ languages: l, currentLanguage: u, onLanguageChange: d, compact: f = !
 					d: "M19 9l-7 7-7-7"
 				})
 			})] })
-		}), m && /* @__PURE__ */ c("div", {
+		}), h && /* @__PURE__ */ c("div", {
 			className: "absolute right-0 mt-2 w-[calc(100vw-1.5rem)] sm:w-64 max-w-64 bg-bg-elevated border border-border-subtle rounded-card shadow-[var(--shadow-elevation-4)] z-50 py-2 overflow-hidden animate-in fade-in-0 zoom-in-95 slide-in-from-top-2 duration-200",
 			children: [/* @__PURE__ */ s("div", {
 				className: "px-4 py-2 border-b border-border-subtle",
 				children: /* @__PURE__ */ s("p", {
 					className: "text-[11px] font-medium text-text-muted uppercase tracking-wider",
-					children: p("languageSwitcher.title", "Select Language")
+					children: m("languageSwitcher.title", "Select Language")
 				})
 			}), /* @__PURE__ */ s("div", {
 				className: "py-1 max-h-96 overflow-y-auto",
-				children: l.map((e) => /* @__PURE__ */ c("button", {
-					onClick: () => b(e),
-					className: `w-full flex items-center gap-3 px-4 py-2.5 text-body-sm transition-colors ${e.code === u ? "bg-[var(--color-accent-soft)] text-text-primary font-medium" : "text-text-primary hover:bg-bg-sunken"}`,
+				children: u.map((e) => /* @__PURE__ */ c("button", {
+					onClick: () => x(e),
+					className: `w-full flex items-center gap-3 px-4 py-2.5 text-body-sm transition-colors ${e.code === d ? "bg-[var(--color-accent-soft)] text-text-primary font-medium" : "text-text-primary hover:bg-bg-sunken"}`,
 					children: [
 						e.flag && /* @__PURE__ */ s("span", {
 							className: "text-xl flex-shrink-0",
@@ -96,7 +100,7 @@ var l = ({ languages: l, currentLanguage: u, onLanguageChange: d, compact: f = !
 								children: e.name
 							})]
 						}),
-						e.code === u && /* @__PURE__ */ s("svg", {
+						e.code === d && /* @__PURE__ */ s("svg", {
 							className: "size-5 text-action-primary-bg flex-shrink-0",
 							fill: "currentColor",
 							viewBox: "0 0 20 20",
@@ -113,4 +117,4 @@ var l = ({ languages: l, currentLanguage: u, onLanguageChange: d, compact: f = !
 	});
 };
 //#endregion
-export { l as LanguageSwitcher };
+export { u as LanguageSwitcher };

package/dist/chrome/Tabs.js

@@ -14,7 +14,7 @@ var i = ({ items: i, activeTabId: a, onTabChange: o, variant: s = "default", siz
 			md: "px-4 py-2 text-body-md",
 			lg: "px-6 py-3 text-body-lg"
 		}[c], l && "flex-1 justify-center");
-		return e.disabled ? t(r, "text-text-disabled cursor-not-allowed opacity-50") : s === "underline" ? t("flex shrink-0 items-center gap-1.5 whitespace-nowrap transition-colors", "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-action-primary-border rounded-t", c === "sm" && "px-3 py-2 text-xs sm:gap-2 sm:px-4 sm:text-sm", c === "md" && "px-3 py-2.5 text-xs sm:gap-2 sm:px-4 sm:text-sm", c === "lg" && "px-4 py-3 text-sm sm:gap-2 sm:px-5 sm:text-body-md", "font-medium border-b-2", l && "flex-1 justify-center", e.disabled && "text-text-disabled cursor-not-allowed opacity-50", !e.disabled && (n ? "border-action-primary-bg text-action-primary-bg" : "border-transparent text-text-secondary hover:text-text-primary hover:border-border-default")) : s === "pills" ? t(r, "rounded-button", n ? "bg-action-primary-bg text-action-primary-text font-medium" : "text-text-secondary hover:text-text-primary hover:bg-action-ghost-bg-hover") : t(r, "border border-border-default", n ? "bg-bg-elevated text-text-primary font-medium border-border-strong" : "bg-bg-surface text-text-secondary hover:text-text-primary hover:bg-bg-elevated");
+		return e.disabled ? t(r, "text-text-disabled cursor-not-allowed opacity-50") : s === "underline" ? t("flex shrink-0 items-center gap-1.5 whitespace-nowrap transition-colors", "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-action-primary-border rounded-t", c === "sm" && "px-3 py-2 text-xs sm:gap-2 sm:px-4 sm:text-sm", c === "md" && "px-3 py-2.5 text-xs sm:gap-2 sm:px-4 sm:text-sm", c === "lg" && "px-4 py-3 text-sm sm:gap-2 sm:px-5 sm:text-body-md", "font-medium border-b-2", l && "flex-1 justify-center", e.disabled && "text-text-disabled cursor-not-allowed opacity-50", !e.disabled && (n ? "border-action-primary-bg text-text-primary" : "border-transparent text-text-secondary hover:text-text-primary hover:border-border-default")) : s === "pills" ? t(r, "rounded-button", n ? "bg-action-primary-bg text-action-primary-text font-medium" : "text-text-secondary hover:text-text-primary hover:bg-action-ghost-bg-hover") : t(r, "border border-border-default", n ? "bg-bg-elevated text-text-primary font-medium border-border-strong" : "bg-bg-surface text-text-secondary hover:text-text-primary hover:bg-bg-elevated");
 	};
 	return /* @__PURE__ */ n("div", {
 		role: "tablist",

package/dist/shared/providers/shell/ThemeProvider.js

@@ -83,7 +83,7 @@ function g({ children: n, defaultMode: r = "system", defaultBrand: l = "default"
 		let n = document.documentElement;
 		if (n.setAttribute("data-theme", P), n.setAttribute("data-brand", t(x)), n.setAttribute("data-density", L), n.setAttribute("data-typography", R), n.setAttribute("data-glass", z), n.toggleAttribute("data-reduce-motion", B), I === "dark" ? n.classList.add("dark") : n.classList.remove("dark"), N) {
 			let e = N.accent;
-			n.style.setProperty("--color-action-primary-bg", e), n.style.setProperty("--color-action-primary-bgHover", `color-mix(in oklab, ${e} 84%, black)`), n.style.setProperty("--color-action-primary-bgActive", `color-mix(in oklab, ${e} 70%, black)`), p(e) ? n.style.setProperty("--color-action-primary-text", "#0a0a0a") : n.style.removeProperty("--color-action-primary-text");
+			n.style.setProperty("--color-action-primary-bg", e), n.style.setProperty("--color-action-primary-bgHover", `color-mix(in oklab, ${e} 84%, black)`), n.style.setProperty("--color-action-primary-bgActive", `color-mix(in oklab, ${e} 70%, black)`), n.style.setProperty("--color-action-primary-text", p(e) ? "#0a0a0a" : "#ffffff");
 		} else n.style.removeProperty("--color-action-primary-bg"), n.style.removeProperty("--color-action-primary-bgHover"), n.style.removeProperty("--color-action-primary-bgActive"), n.style.removeProperty("--color-action-primary-text");
 		let r = () => {
 			let t = getComputedStyle(n).getPropertyValue("--color-bg-canvas").trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.1022.2",
+  "version": "2026.1023.1",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "bin": {
@@ -330,7 +330,7 @@
     "test:package-livekit-optional": "node scripts/validate-livekit-optional.mjs",
     "verify:package": "node scripts/verify-package-contents.mjs",
     "test:handsfree-browser": "node scripts/handsfree-browser-run.mjs",
-    "test": "bun test scripts/graphql-schema-drift/__tests__ scripts/a11y-audit/__tests__ scripts/i18n/__tests__ src/credentials src/connections src/storage src/shared/assistant src/shared/feature-flags src/platform-pages src/admin-overview src/shared/components src/shared/graphql/links/sse-link.test.ts src/shared/graphql/fetch.test.ts src/shared/graphql/prepareWorkspaceRequest.test.ts src/shared/graphql/client.test.ts src/shared/utils/apollo.test.ts src/shared/utils/canvasTokens.test.ts src/shared/graphql/tourWorkspaceAuth.test.ts src/shared/config/gatewayUrls.test.ts src/shared/config/authBridgeUrls.test.ts src/shared/config/shellRoutes.test.ts src/shared/config/gatewayFallback.test.ts scripts/__tests__ src/shared/config/products.test.ts src/shared/config/docsUrls.test.ts src/shared/config/productSlug.test.ts src/shared/hooks/shell/useProducts.test.ts src/shared/hooks/shell/useGlobalSearch.test.ts src/shared/providers/shell/brandAttribute.test.ts src/chrome/ProductSwitcher.test.ts src/shared/utils/backendErrors.test.ts src/shared/utils/gatewayFetchRewrite.test.ts src/shared/utils/authCookie.test.ts src/shared/utils/redirectAllowlist.test.ts src/shared/providers/shell/ProfileStorageManager.test.ts src/shared/providers/AppShellProvider.test.ts src/shared/providers/shell/interpolate.test.ts src/shared/providers/shell/resolveTranslation.test.ts src/shared/providers/shell/I18nProvider.render.test.tsx src/shared/providers/shell/I18nProvider.client.test.tsx src/shared/providers/shell/translationStore.test.ts src/shared/providers/shell/translationLayers.test.ts src/shared/providers/shell/directionMode.test.ts src/shared/providers/shell/authProvider/ssoRelay.test.ts src/shared/providers/shell/authProvider/useAuthActions.signOut.test.tsx src/shared/providers/shell/personaSurfaceRemote.test.ts src/shared/providers/shell/workspaceSwitch.client.test.tsx src/shared/events/sinks/RybbitSink.test.ts src/shared/events/sinks/RybbitSink.client.test.tsx src/shell-native src/shared/native src/shared/navigation src/shared/tours src/chrome/__tests__ src/ui/__tests__",
+    "test": "bun test scripts/graphql-schema-drift/__tests__ scripts/a11y-audit/__tests__ scripts/i18n/__tests__ src/credentials src/connections src/storage src/shared/assistant src/shared/feature-flags src/platform-pages src/admin-overview src/shared/components src/shared/graphql/links/sse-link.test.ts src/shared/graphql/fetch.test.ts src/shared/graphql/prepareWorkspaceRequest.test.ts src/shared/graphql/client.test.ts src/shared/utils/apollo.test.ts src/shared/utils/canvasTokens.test.ts src/shared/utils/brandContrast.test.ts src/shared/graphql/tourWorkspaceAuth.test.ts src/shared/config/gatewayUrls.test.ts src/shared/config/authBridgeUrls.test.ts src/shared/config/shellRoutes.test.ts src/shared/config/gatewayFallback.test.ts scripts/__tests__ src/shared/config/products.test.ts src/shared/config/docsUrls.test.ts src/shared/config/productSlug.test.ts src/shared/hooks/shell/useProducts.test.ts src/shared/hooks/shell/useGlobalSearch.test.ts src/shared/providers/shell/brandAttribute.test.ts src/chrome/ProductSwitcher.test.ts src/shared/utils/backendErrors.test.ts src/shared/utils/gatewayFetchRewrite.test.ts src/shared/utils/authCookie.test.ts src/shared/utils/redirectAllowlist.test.ts src/shared/providers/shell/ProfileStorageManager.test.ts src/shared/providers/AppShellProvider.test.ts src/shared/providers/shell/interpolate.test.ts src/shared/providers/shell/resolveTranslation.test.ts src/shared/providers/shell/I18nProvider.render.test.tsx src/shared/providers/shell/I18nProvider.client.test.tsx src/shared/providers/shell/translationStore.test.ts src/shared/providers/shell/translationLayers.test.ts src/shared/providers/shell/directionMode.test.ts src/shared/providers/shell/authProvider/ssoRelay.test.ts src/shared/providers/shell/authProvider/useAuthActions.signOut.test.tsx src/shared/providers/shell/personaSurfaceRemote.test.ts src/shared/providers/shell/workspaceSwitch.client.test.tsx src/shared/events/sinks/RybbitSink.test.ts src/shared/events/sinks/RybbitSink.client.test.tsx src/shell-native src/shared/native src/shared/navigation src/shared/tours src/chrome/__tests__ src/ui/__tests__",
     "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run lint:sanity && bun run format && bun run type:check && bun run test && bun run build && bun run verify:package'",
     "switch:status": "bun scripts/deps-mode.ts status",
     "switch:remote": "bun scripts/deps-mode.ts remote",

package/scripts/a11y-audit/README.md

@@ -110,6 +110,69 @@ how you point the same config at alpha or prod.
 
 Per route you can also set `waitForSelector` and a route-specific `settleMs`.
 
+### Signed-in routes: `fixtures`
+
+External requests are blocked, so a signed-in page cannot reach its gateway and
+the shell bounces to `/auth/login`. A **fixture** gives a route a deterministic
+session instead of a live one:
+
+```jsonc
+// a11y-audit.config.json
+"routes": [
+  { "path": "/vibecontrols", "name": "signed-in-overview", "fixture": "signed-in",
+    "waitForSelector": "main#main-content h1", "minTextLength": 1500 }
+],
+"fixtures": { "signed-in": "a11y/fixtures/signed-in.json" }   // or the object inline
+```
+
+```jsonc
+// a11y/fixtures/signed-in.json
+{
+  "localStorage": {
+    "bf-p-<profile>-tokens": {
+      "accessToken": { "$jwt": { "sub": "<user>", "exp": { "$fromNow": 3600 } } },
+      "expiresAt": { "$fromNowMs": 3600000 }
+    }
+  },
+  "cookies": { "bf-sso": { "id": "<profile>", "origin": null } },
+  "graphql": {
+    "endpoints": ["/global/graphql", "/workspaces/graphql"],
+    "operations": { "ValidateAuthToken": { "data": { "validateTokens": { "valid": true } } } }
+  }
+}
+```
+
+| Field | Meaning |
+| --- | --- |
+| `localStorage` | Seeded before any page script runs (same-origin documents only). Strings are stored as-is, anything else as JSON. |
+| `cookies` | Set on the app origin before the page opens. Strings as-is, anything else as URL-encoded JSON. |
+| `graphql.endpoints` | Path suffixes that identify a GraphQL endpoint on **any** origin. Matching requests never leave the browser. |
+| `graphql.operations` | Response body per operation name. Batched requests get a batched answer in order. |
+
+Markers, resolved when each page opens:
+
+- `{ "$jwt": { ...claims } }` becomes an **unsigned** (`alg: none`) token. Never
+  put a real or real-looking credential in a fixture.
+- `{ "$fromNow": seconds }` becomes unix seconds from now (JWT `exp`/`iat`);
+  `{ "$fromNowMs": ms }` becomes epoch milliseconds from now (`expiresAt`). Do
+  not use a fixed far-future expiry: shells schedule refresh timers off it, and
+  a delay past setTimeout's 2^31-1 ms ceiling fires immediately.
+
+Guarantees:
+
+- Every route runs in its own browser context, so a fixture's session never
+  leaks into the signed-out routes (or the other way round).
+- A fixture route that ends anywhere other than its `path` (the query string is
+  ignored) is a failed attempt: landing on `/auth/login` means the fixture did
+  not sign in, and auditing the login page again would be a false pass. Set
+  `allowRedirect` on the route only if the redirect is the page.
+- An operation the fixture has no answer for gets a GraphQL error response
+  (code `A11Y_FIXTURE_UNMOCKED`), never a live call, and is listed under the
+  route in the console and step-summary report. Keep that list empty: an
+  unmocked query usually means part of the page rendered its error state.
+- Fixture data is synthetic. Use obviously fake ids and names, never an export
+  of a real account.
+
 ### `failOn`
 
 Defaults to `["critical", "serious"]`. It may be **widened** (adding `moderate`),

package/scripts/a11y-audit/audit.ts

@@ -9,9 +9,16 @@
  */
 
 import { partitionNodes, flattenViolations } from './allowlist';
+import {
+  materializeCookies,
+  materializeLocalStorage,
+  matchesGraphqlEndpoint,
+  respondToGraphql,
+  seedLocalStorageScript,
+} from './fixtures';
 import type { AxeViolationLike } from './allowlist';
 import type { RunningApp } from './server';
-import type { AuditReport, ResolvedConfig, RouteResult } from './types';
+import type { AuditReport, FixtureSpec, ResolvedConfig, RouteResult } from './types';
 
 /* eslint-disable @typescript-eslint/no-explicit-any -- dynamically imported
    third-party modules have no static types available inside this script. */
@@ -124,14 +131,73 @@ export async function runAudit(
   const usedEntries = new Set<number>();
   const navigationErrors: string[] = [];
 
-  /** Fresh page with request routing applied — used for the first try and every retry. */
-  const openPage = async (context: AnyRecord): Promise<AnyRecord> => {
+  /**
+   * Fresh page with request routing applied — used for the first try and every
+   * retry. With a fixture, its session is seeded before any page script runs
+   * and its GraphQL endpoints are answered from the fixture (recording any
+   * operation it has no answer for in `unmocked`).
+   */
+  const openPage = async (
+    context: AnyRecord,
+    fixture: FixtureSpec | undefined,
+    unmocked: Set<string>
+  ): Promise<AnyRecord> => {
+    if (fixture?.cookies) {
+      await context.addCookies(
+        materializeCookies(fixture).map((cookie) => ({
+          ...cookie,
+          url: baseUrl,
+        }))
+      );
+    }
     const page = await context.newPage();
-    if (config.blockExternalRequests || resolveAsset) {
+    if (fixture?.localStorage) {
+      await page.addInitScript(seedLocalStorageScript, {
+        origin: new URL(baseUrl).origin,
+        entries: materializeLocalStorage(fixture),
+      });
+    }
+    if (config.blockExternalRequests || resolveAsset || fixture?.graphql) {
       await page.route('**/*', (route: AnyRecord) => {
-        const requestUrl: string = route.request().url();
+        const request = route.request();
+        const requestUrl: string = request.url();
         const isOwnOrigin = requestUrl.startsWith(baseUrl);
 
+        // Fixture GraphQL first: on any origin, a matching endpoint is answered
+        // from the fixture and never reaches a live gateway.
+        if (fixture?.graphql && matchesGraphqlEndpoint(requestUrl, fixture)) {
+          if (request.method() === 'OPTIONS') {
+            void route.fulfill({
+              status: 204,
+              headers: {
+                'access-control-allow-origin': new URL(baseUrl).origin,
+                'access-control-allow-credentials': 'true',
+                'access-control-allow-methods': 'GET, POST, OPTIONS',
+                'access-control-allow-headers': '*',
+              },
+              body: '',
+            });
+            return;
+          }
+          const answer = respondToGraphql(
+            fixture,
+            request.method() as string,
+            requestUrl,
+            (request.postData() as string | null) ?? null
+          );
+          answer.unmocked.forEach((name) => unmocked.add(name));
+          void route.fulfill({
+            status: answer.status,
+            contentType: 'application/json',
+            headers: {
+              'access-control-allow-origin': new URL(baseUrl).origin,
+              'access-control-allow-credentials': 'true',
+            },
+            body: answer.body,
+          });
+          return;
+        }
+
         // Serve the build's own files straight from disk. Chromium never opens
         // a socket for them, so a spurious network-change notification cannot
         // cancel a hundred in-flight chunk loads and leave the shell blank.
@@ -146,7 +212,11 @@ export async function runAudit(
             });
             return;
           }
-          void route.fulfill({ status: 404, contentType: 'text/plain', body: 'Not found' });
+          void route.fulfill({
+            status: 404,
+            contentType: 'text/plain',
+            body: 'Not found',
+          });
           return;
         }
 
@@ -162,27 +232,34 @@ export async function runAudit(
     return page;
   };
 
+  // Every route gets its own browser context, so a fixture's seeded session
+  // can never leak into the signed-out routes audited after it (or the other
+  // way round), and route order cannot change what axe sees.
+  const newContext = async (viewport: { width: number; height: number }): Promise<AnyRecord> =>
+    browser.newContext({
+      viewport: { width: viewport.width, height: viewport.height },
+      // Deterministic rendering: no OS locale/timezone drift between the dev
+      // machine and the CI runner changing what axe sees.
+      locale: 'en-US',
+      timezoneId: 'UTC',
+      reducedMotion: 'reduce',
+      // A service worker caching the shell across routes would make the audit
+      // depend on which route ran first.
+      serviceWorkers: 'block',
+    });
+
   try {
     for (const viewport of config.viewports) {
-      const context = await browser.newContext({
-        viewport: { width: viewport.width, height: viewport.height },
-        // Deterministic rendering: no OS locale/timezone drift between the dev
-        // machine and the CI runner changing what axe sees.
-        locale: 'en-US',
-        timezoneId: 'UTC',
-        reducedMotion: 'reduce',
-        // A service worker caching the shell across routes would make the audit
-        // depend on which route ran first.
-        serviceWorkers: 'block',
-      });
-
       for (const route of config.routes) {
         const url = `${baseUrl}${route.path}`;
         const attemptFailures: string[] = [];
         let result: RouteResult | null = null;
+        const fixture = route.fixture ? config.fixtures[route.fixture] : undefined;
 
         for (let attempt = 1; attempt <= config.routeAttempts && result === null; attempt += 1) {
-          const page = await openPage(context);
+          const context = await newContext(viewport);
+          const unmocked = new Set<string>();
+          const page = await openPage(context, fixture, unmocked);
           try {
             const response = await page.goto(url, {
               waitUntil: 'load',
@@ -203,6 +280,18 @@ export async function runAudit(
               config.domQuietMs,
               config.navigationTimeoutMs
             );
+            if (fixture && !route.allowRedirect) {
+              const landed = new URL(page.url() as string).pathname.replace(/\/+$/, '') || '/';
+              const expected = new URL(url).pathname.replace(/\/+$/, '') || '/';
+              if (landed !== expected) {
+                throw new Error(
+                  `fixture "${route.fixture}" route ended on ${landed} instead of ${expected} — ` +
+                    'the fixture did not produce the page, so auditing where it landed would be ' +
+                    'a false pass' +
+                    (unmocked.size > 0 ? ` (unmocked operations: ${[...unmocked].join(', ')})` : '')
+                );
+              }
+            }
             const floor = route.minTextLength ?? config.minTextLength;
             if (stability.snapshot.textLength < floor) {
               throw new Error(
@@ -237,11 +326,18 @@ export async function runAudit(
               renderedTextLength: stability.snapshot.textLength,
               domSettled: stability.settled,
               attempts: attempt,
+              ...(route.fixture
+                ? {
+                    fixture: route.fixture,
+                    unmockedOperations: [...unmocked].sort(),
+                  }
+                : {}),
             };
           } catch (error) {
             attemptFailures.push(`attempt ${attempt}: ${(error as Error).message}`);
           } finally {
             await page.close();
+            await context.close();
           }
         }
 
@@ -259,8 +355,6 @@ export async function runAudit(
         }
         results.push(result);
       }
-
-      await context.close();
     }
   } finally {
     await browser.close();
@@ -279,7 +373,11 @@ export async function runAudit(
     .filter((entry) => !usedEntries.has(entry.index));
 
   const expiredAllowlistEntries = config.allowlist
-    .map((entry, index) => ({ index, rule: entry.rule, expires: entry.expires ?? '' }))
+    .map((entry, index) => ({
+      index,
+      rule: entry.rule,
+      expires: entry.expires ?? '',
+    }))
     .filter((entry) => {
       if (!entry.expires) return false;
       return now.getTime() > new Date(`${entry.expires}T23:59:59.999Z`).getTime();

package/scripts/a11y-audit/cli.ts

@@ -26,7 +26,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { runAudit } from './audit';
-import { ConfigError, resolveConfig } from './config';
+import { ConfigError, inlineFixtureFiles, resolveConfig } from './config';
 import { renderConsole, renderMarkdown } from './report';
 import { findUnreachableRouteScopes } from './allowlist';
 import { startApp } from './server';
@@ -40,7 +40,11 @@ interface CliArgs {
 }
 
 export function parseArgs(argv: string[]): CliArgs {
-  const args: CliArgs = { configPath: 'a11y-audit.config.json', routes: [], quiet: false };
+  const args: CliArgs = {
+    configPath: 'a11y-audit.config.json',
+    routes: [],
+    quiet: false,
+  };
   let positionalSeen = false;
   for (const arg of argv) {
     if (arg.startsWith('--base-url=')) args.baseUrl = arg.slice('--base-url='.length);
@@ -77,7 +81,10 @@ async function main(): Promise<number> {
 
   let config;
   try {
-    config = resolveConfig(JSON.parse(readFileSync(configPath, 'utf8')));
+    const raw: unknown = JSON.parse(readFileSync(configPath, 'utf8'));
+    config = resolveConfig(
+      inlineFixtureFiles(raw, dirname(configPath), (path) => readFileSync(path, 'utf8'))
+    );
   } catch (error) {
     if (error instanceof ConfigError) console.error(`[a11y-audit] ${error.message}`);
     else console.error(`[a11y-audit] Failed to read ${configPath}: ${(error as Error).message}`);

package/scripts/a11y-audit/config.ts

@@ -11,6 +11,7 @@ import { IMPACT_LEVELS } from './types';
 import type {
   A11yAuditConfig,
   AllowlistEntry,
+  FixtureSpec,
   ImpactLevel,
   ResolvedConfig,
   RouteSpec,
@@ -187,6 +188,73 @@ function validateRoute(route: unknown, index: number, issues: string[]): void {
   }
 }
 
+function validateFixture(name: string, fixture: unknown, issues: string[]): void {
+  const where = `fixtures.${name}`;
+  if (typeof fixture === 'string') {
+    issues.push(
+      `${where} is still a file reference ("${fixture}") — load the config with ` +
+        'inlineFixtureFiles() before resolving it'
+    );
+    return;
+  }
+  if (!isPlainObject(fixture)) {
+    issues.push(`${where} must be an object`);
+    return;
+  }
+  for (const key of Object.keys(fixture)) {
+    if (key !== 'localStorage' && key !== 'cookies' && key !== 'graphql') {
+      issues.push(
+        `${where}.${key} is not a fixture field (allowed: localStorage, cookies, graphql)`
+      );
+    }
+  }
+  if (
+    fixture.localStorage === undefined &&
+    fixture.cookies === undefined &&
+    fixture.graphql === undefined
+  ) {
+    issues.push(
+      `${where} must set localStorage, cookies and/or graphql — an empty fixture changes nothing`
+    );
+  }
+  for (const key of ['localStorage', 'cookies'] as const) {
+    if (fixture[key] !== undefined && !isPlainObject(fixture[key])) {
+      issues.push(`${where}.${key} must be an object of name → value`);
+    }
+  }
+  if (fixture.graphql !== undefined) {
+    const graphql = fixture.graphql;
+    if (!isPlainObject(graphql)) {
+      issues.push(`${where}.graphql must be { endpoints, operations }`);
+      return;
+    }
+    if (
+      !Array.isArray(graphql.endpoints) ||
+      graphql.endpoints.length === 0 ||
+      !graphql.endpoints.every(isNonEmptyString)
+    ) {
+      issues.push(`${where}.graphql.endpoints must be a non-empty array of path suffixes`);
+    } else {
+      graphql.endpoints.forEach((endpoint, i) => {
+        if (!endpoint.startsWith('/')) {
+          issues.push(`${where}.graphql.endpoints[${i}] "${endpoint}" must start with "/"`);
+        }
+      });
+    }
+    if (!isPlainObject(graphql.operations) || Object.keys(graphql.operations).length === 0) {
+      issues.push(`${where}.graphql.operations must be a non-empty object of operation → response`);
+    } else {
+      for (const [operation, result] of Object.entries(graphql.operations)) {
+        if (!isPlainObject(result) || (!('data' in result) && !('errors' in result))) {
+          issues.push(
+            `${where}.graphql.operations.${operation} must be a GraphQL response ({ data } or { errors })`
+          );
+        }
+      }
+    }
+  }
+}
+
 function validateServe(serve: unknown, issues: string[]): void {
   if (!isPlainObject(serve)) {
     issues.push('serve is required and must be an object');
@@ -286,6 +354,28 @@ export function resolveConfig(raw: unknown): ResolvedConfig {
     }
   }
 
+  const fixtureNames = new Set<string>();
+  if (raw.fixtures !== undefined) {
+    if (!isPlainObject(raw.fixtures)) {
+      issues.push('fixtures must be an object of name → fixture when present');
+    } else {
+      for (const [name, fixture] of Object.entries(raw.fixtures)) {
+        fixtureNames.add(name);
+        validateFixture(name, fixture, issues);
+      }
+    }
+  }
+  if (Array.isArray(raw.routes)) {
+    raw.routes.forEach((route, i) => {
+      if (!isPlainObject(route) || route.fixture === undefined) return;
+      if (!isNonEmptyString(route.fixture)) {
+        issues.push(`routes[${i}].fixture must be a non-empty fixture name when present`);
+      } else if (!fixtureNames.has(route.fixture)) {
+        issues.push(`routes[${i}].fixture "${route.fixture}" is not defined in fixtures`);
+      }
+    });
+  }
+
   if (issues.length > 0) throw new ConfigError(issues);
 
   const config = raw as unknown as A11yAuditConfig;
@@ -315,5 +405,38 @@ export function resolveConfig(raw: unknown): ResolvedConfig {
     domQuietMs: config.domQuietMs ?? 1500,
     minTextLength: config.minTextLength ?? 100,
     routeAttempts: config.routeAttempts ?? 3,
+    // Validated above: no string (file) entries survive to this point.
+    fixtures: (config.fixtures ?? {}) as Record<string, FixtureSpec>,
   };
 }
+
+/**
+ * Replace every fixture given as a file path with the parsed file. Paths
+ * resolve against `baseDir` (the config file's directory). `readFile` is
+ * injected so this stays pure and testable.
+ *
+ * @throws ConfigError when a referenced file is missing or is not JSON.
+ */
+export function inlineFixtureFiles(
+  raw: unknown,
+  baseDir: string,
+  readFile: (absolutePath: string) => string
+): unknown {
+  if (!isPlainObject(raw) || !isPlainObject(raw.fixtures)) return raw;
+  const issues: string[] = [];
+  const fixtures: Record<string, unknown> = {};
+  for (const [name, fixture] of Object.entries(raw.fixtures)) {
+    if (typeof fixture !== 'string') {
+      fixtures[name] = fixture;
+      continue;
+    }
+    const path = fixture.startsWith('/') ? fixture : `${baseDir.replace(/\/+$/, '')}/${fixture}`;
+    try {
+      fixtures[name] = JSON.parse(readFile(path));
+    } catch (error) {
+      issues.push(`fixtures.${name}: cannot load "${fixture}" (${(error as Error).message})`);
+    }
+  }
+  if (issues.length > 0) throw new ConfigError(issues);
+  return { ...raw, fixtures };
+}

package/scripts/a11y-audit/fixtures.ts

@@ -0,0 +1,277 @@
+/**
+ * Route fixtures: audit a signed-in page without a live backend.
+ *
+ * The gate blocks every request that leaves the app's own origin so the DOM it
+ * audits is reproducible. That is exactly why signed-in pages were never
+ * audited: with the gateway unreachable the shell bounces to /auth/login and
+ * the audit measures the login page a second time.
+ *
+ * A fixture fixes both halves deterministically:
+ *
+ *   - `localStorage` is seeded before any page script runs, so the shell boots
+ *     with a session. Values may embed `{ "$jwt": { ...claims } }`, which is
+ *     encoded here into an UNSIGNED token. Nothing in a repo ever holds a real
+ *     or real-looking credential, and the claims (exp, workspaceId, ...) stay
+ *     readable in the fixture file. Expiries use `{ "$fromNow": seconds }` so
+ *     a session is always valid for a realistic window when the page opens.
+ *   - `cookies` are set on the app origin, for shells that cross-check the
+ *     session against a cookie marker.
+ *   - `graphql.operations` answers GraphQL requests to the configured
+ *     endpoints by operation name, batched or not. An operation the fixture
+ *     does not cover gets a GraphQL error response (never a live call) and is
+ *     recorded in the report, so fixture drift is visible instead of silent.
+ *
+ * Everything in this file is pure, so it is unit-tested without a browser.
+ */
+
+import type { FixtureSpec, GraphqlResult } from './types';
+
+/** Marker key: `{ "$jwt": { ...claims } }` becomes an unsigned JWT string. */
+export const JWT_MARKER = '$jwt';
+
+/**
+ * Time markers, resolved when the page is opened:
+ * `{ "$fromNow": 3600 }` → unix SECONDS one hour from now (JWT `exp`/`iat`),
+ * `{ "$fromNowMs": 3600000 }` → epoch MILLISECONDS one hour from now
+ * (`expiresAt` fields). A fixed far-future expiry is not a safe substitute:
+ * shells schedule refresh timers off it, and a delay past setTimeout's 2^31-1
+ * ms ceiling fires immediately — the session "expires" on load.
+ */
+export const FROM_NOW_MARKER = '$fromNow';
+export const FROM_NOW_MS_MARKER = '$fromNowMs';
+
+/**
+ * Signature segment of every fixture token. It is not a signature; it says so,
+ * and it keeps the three-segment shape clients check for.
+ */
+export const UNSIGNED_SIGNATURE = 'a11y-fixture-unsigned';
+
+/** Error code carried by the response for an operation the fixture lacks. */
+export const UNMOCKED_CODE = 'A11Y_FIXTURE_UNMOCKED';
+
+function base64Url(value: string): string {
+  return Buffer.from(value, 'utf8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+/** Encode claims as an unsigned JWT (`alg: none`). For fixtures only. */
+export function encodeUnsignedJwt(claims: Record<string, unknown>): string {
+  const header = base64Url(JSON.stringify({ alg: 'none', typ: 'JWT' }));
+  const payload = base64Url(JSON.stringify(claims));
+  return `${header}.${payload}.${UNSIGNED_SIGNATURE}`;
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function soleKey(value: unknown): string | null {
+  if (!isPlainObject(value)) return null;
+  const keys = Object.keys(value);
+  return keys.length === 1 ? keys[0] : null;
+}
+
+/**
+ * Replace every marker in a JSON value: `{ "$jwt": {...} }` with its encoded
+ * token (claims are expanded first, so `exp` may itself be a `$fromNow`), and
+ * `{ "$fromNow": s }` / `{ "$fromNowMs": ms }` with a timestamp relative to
+ * `nowMs`.
+ */
+export function expandMarkers(value: unknown, nowMs: number = Date.now()): unknown {
+  const key = soleKey(value);
+  if (key !== null && isPlainObject(value)) {
+    const inner = value[key];
+    if (key === JWT_MARKER && isPlainObject(inner)) {
+      return encodeUnsignedJwt(expandMarkers(inner, nowMs) as Record<string, unknown>);
+    }
+    if (key === FROM_NOW_MARKER && typeof inner === 'number') {
+      return Math.floor(nowMs / 1000) + inner;
+    }
+    if (key === FROM_NOW_MS_MARKER && typeof inner === 'number') {
+      return nowMs + inner;
+    }
+  }
+  if (Array.isArray(value)) return value.map((item) => expandMarkers(item, nowMs));
+  if (isPlainObject(value)) {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, expandMarkers(v, nowMs)]));
+  }
+  return value;
+}
+
+/**
+ * The exact strings written to localStorage. A string value is stored as-is;
+ * anything else is stored as JSON, which is how persisted stores read it back.
+ */
+export function materializeLocalStorage(
+  spec: FixtureSpec,
+  nowMs: number = Date.now()
+): Record<string, string> {
+  const entries = Object.entries(spec.localStorage ?? {});
+  return Object.fromEntries(
+    entries.map(([key, value]) => {
+      const expanded = expandMarkers(value, nowMs);
+      return [key, typeof expanded === 'string' ? expanded : JSON.stringify(expanded)];
+    })
+  );
+}
+
+/**
+ * Cookies set on the app origin before the page opens. A string value is used
+ * as-is; anything else is stored as URL-encoded JSON, the encoding shells use
+ * for their own JSON cookies (e.g. the `bf-sso` session marker).
+ */
+export function materializeCookies(
+  spec: FixtureSpec,
+  nowMs: number = Date.now()
+): Array<{ name: string; value: string }> {
+  return Object.entries(spec.cookies ?? {}).map(([name, value]) => {
+    const expanded = expandMarkers(value, nowMs);
+    return {
+      name,
+      value: typeof expanded === 'string' ? expanded : encodeURIComponent(JSON.stringify(expanded)),
+    };
+  });
+}
+
+/** True when `url` is a request to one of the fixture's GraphQL endpoints. */
+export function matchesGraphqlEndpoint(url: string, spec: FixtureSpec): boolean {
+  const endpoints = spec.graphql?.endpoints ?? [];
+  if (endpoints.length === 0) return false;
+  let pathname: string;
+  try {
+    pathname = new URL(url).pathname.replace(/\/+$/, '');
+  } catch {
+    return false;
+  }
+  return endpoints.some((endpoint) => pathname.endsWith(endpoint.replace(/\/+$/, '')));
+}
+
+interface GraphqlRequestLike {
+  operationName?: unknown;
+  query?: unknown;
+}
+
+const OPERATION_NAME = /\b(?:query|mutation|subscription)\s+([A-Za-z_][A-Za-z0-9_]*)/;
+
+/** Operation name of one GraphQL request, from `operationName` or the document. */
+export function operationNameOf(request: GraphqlRequestLike): string {
+  if (typeof request.operationName === 'string' && request.operationName.length > 0) {
+    return request.operationName;
+  }
+  if (typeof request.query === 'string') {
+    const match = OPERATION_NAME.exec(request.query);
+    if (match) return match[1];
+  }
+  return '(anonymous)';
+}
+
+export interface FixtureResponse {
+  status: number;
+  body: string;
+  /** Operations in this request the fixture had no answer for. */
+  unmocked: string[];
+}
+
+function unmockedResult(name: string): GraphqlResult {
+  return {
+    data: null,
+    errors: [
+      {
+        message: `a11y fixture has no response for operation "${name}"`,
+        extensions: { code: UNMOCKED_CODE },
+      },
+    ],
+  };
+}
+
+/**
+ * Parse the request parameters of a GraphQL call: a POST body (single or
+ * batched), or a GET query string.
+ */
+export function parseGraphqlRequest(
+  method: string,
+  url: string,
+  body: string | null
+): GraphqlRequestLike | GraphqlRequestLike[] | null {
+  if (method.toUpperCase() === 'GET') {
+    try {
+      const params = new URL(url).searchParams;
+      return {
+        operationName: params.get('operationName') ?? undefined,
+        query: params.get('query'),
+      };
+    } catch {
+      return null;
+    }
+  }
+  if (!body) return null;
+  try {
+    const parsed: unknown = JSON.parse(body);
+    if (Array.isArray(parsed)) return parsed.filter(isPlainObject) as GraphqlRequestLike[];
+    return isPlainObject(parsed) ? (parsed as GraphqlRequestLike) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Answer a GraphQL request from the fixture. Batched requests get a batched
+ * response in the same order. A request that cannot be parsed is answered with
+ * a 400, never forwarded.
+ */
+export function respondToGraphql(
+  spec: FixtureSpec,
+  method: string,
+  url: string,
+  body: string | null,
+  nowMs: number = Date.now()
+): FixtureResponse {
+  const operations = spec.graphql?.operations ?? {};
+  const parsed = parseGraphqlRequest(method, url, body);
+  if (parsed === null) {
+    return {
+      status: 400,
+      body: JSON.stringify({
+        errors: [{ message: 'a11y fixture could not parse the request' }],
+      }),
+      unmocked: ['(unparseable request)'],
+    };
+  }
+
+  const unmocked: string[] = [];
+  const answer = (request: GraphqlRequestLike): GraphqlResult => {
+    const name = operationNameOf(request);
+    const result = Object.prototype.hasOwnProperty.call(operations, name)
+      ? operations[name]
+      : undefined;
+    if (result === undefined) {
+      unmocked.push(name);
+      return unmockedResult(name);
+    }
+    return expandMarkers(result, nowMs) as GraphqlResult;
+  };
+
+  const response = Array.isArray(parsed) ? parsed.map(answer) : answer(parsed);
+  return { status: 200, body: JSON.stringify(response), unmocked };
+}
+
+export interface SeedArgs {
+  /** Only documents on this origin are seeded (not about:blank or iframes). */
+  origin: string;
+  entries: Record<string, string>;
+}
+
+/**
+ * Script injected before every page script of a fixture route. Self-contained
+ * (no closure over module scope) so Playwright can serialize it into the page.
+ * It seeds once per document load, before the shell reads its session.
+ */
+export function seedLocalStorageScript(args: SeedArgs): void {
+  if (window.location.origin !== args.origin) return;
+  for (const [key, value] of Object.entries(args.entries)) {
+    window.localStorage.setItem(key, value);
+  }
+}

package/scripts/a11y-audit/index.ts

@@ -3,7 +3,23 @@
  * that needs to embed the audit rather than shell out to the CLI.
  */
 
-export { resolveConfig, ConfigError, DEFAULT_FAIL_ON, DEFAULT_STANDARD } from './config';
+export {
+  resolveConfig,
+  inlineFixtureFiles,
+  ConfigError,
+  DEFAULT_FAIL_ON,
+  DEFAULT_STANDARD,
+} from './config';
+export {
+  encodeUnsignedJwt,
+  expandMarkers,
+  materializeCookies,
+  materializeLocalStorage,
+  matchesGraphqlEndpoint,
+  operationNameOf,
+  parseGraphqlRequest,
+  respondToGraphql,
+} from './fixtures';
 export {
   entryCovers,
   findUnreachableRouteScopes,

package/scripts/a11y-audit/report.ts

@@ -5,12 +5,22 @@
 
 import type { AuditReport, FlatNode } from './types';
 
-function ruleSummary(
-  nodes: FlatNode[]
-): Array<{ rule: string; impact: string; count: number; helpUrl: string; help: string }> {
+function ruleSummary(nodes: FlatNode[]): Array<{
+  rule: string;
+  impact: string;
+  count: number;
+  helpUrl: string;
+  help: string;
+}> {
   const byRule = new Map<
     string,
-    { rule: string; impact: string; count: number; helpUrl: string; help: string }
+    {
+      rule: string;
+      impact: string;
+      count: number;
+      helpUrl: string;
+      help: string;
+    }
   >();
   for (const node of nodes) {
     const existing = byRule.get(node.rule);
@@ -49,7 +59,12 @@ export function renderConsole(report: AuditReport): string {
         `\n         ${route.blocking.length} blocking · ${route.allowed.length} allowlisted · ` +
         `${route.advisory.length} advisory · ${route.passCount} checks passed · ` +
         `${route.incompleteCount} needs review · ${route.renderedTextLength} chars rendered` +
-        `${route.domSettled ? '' : ' (DOM never went quiet)'}`
+        `${route.domSettled ? '' : ' (DOM never went quiet)'}` +
+        (route.fixture ? `\n         fixture: ${route.fixture}` : '') +
+        (route.unmockedOperations && route.unmockedOperations.length > 0
+          ? ` · unmocked GraphQL operations (answered with an error): ` +
+            route.unmockedOperations.join(', ')
+          : '')
     );
     for (const entry of ruleSummary(route.blocking)) {
       lines.push(`           x ${entry.rule} (${entry.impact}) x${entry.count} — ${entry.help}`);
@@ -114,6 +129,22 @@ export function renderMarkdown(report: AuditReport): string {
     );
   }
 
+  const unmocked = report.routes.filter(
+    (r) => r.unmockedOperations && r.unmockedOperations.length > 0
+  );
+  if (unmocked.length > 0) {
+    lines.push('');
+    lines.push('### Fixture coverage');
+    lines.push('');
+    lines.push('Operations these fixture routes sent that the fixture has no answer for:');
+    for (const route of unmocked) {
+      lines.push(
+        `- \`${route.routeName}\` @ ${route.viewport} (fixture \`${route.fixture}\`): ` +
+          (route.unmockedOperations ?? []).map((name) => `\`${name}\``).join(', ')
+      );
+    }
+  }
+
   const allBlocking = report.routes.flatMap((r) => r.blocking);
   if (allBlocking.length > 0) {
     lines.push('');

package/scripts/a11y-audit/types.ts

@@ -66,6 +66,39 @@ export interface RouteSpec {
    * "clean" result on an unexpected error page cannot be mistaken for a pass.
    */
   allowRedirect?: boolean;
+  /**
+   * Name of an entry in the top-level `fixtures` map to load this route with —
+   * typically a signed-in session plus canned GraphQL answers. A fixture route
+   * that ends anywhere other than `path` fails the attempt (unless
+   * `allowRedirect` is set): landing on /auth/login means the fixture did not
+   * sign in, and auditing the login page again would be a false pass.
+   */
+  fixture?: string;
+}
+
+/** A GraphQL response body, as the gateway would send it. */
+export interface GraphqlResult {
+  data?: unknown;
+  errors?: Array<{ message: string; [key: string]: unknown }>;
+  extensions?: Record<string, unknown>;
+}
+
+/**
+ * Deterministic page state for a route. See fixtures.ts for the semantics.
+ * Never put a real credential in one: `{ "$jwt": { ...claims } }` is encoded
+ * into an unsigned token at run time.
+ */
+export interface FixtureSpec {
+  /** Seeded into localStorage before the first page script runs. */
+  localStorage?: Record<string, unknown>;
+  /** Cookies set on the app origin before the page opens. */
+  cookies?: Record<string, unknown>;
+  graphql?: {
+    /** Path suffixes that identify a GraphQL endpoint, on any origin. */
+    endpoints: string[];
+    /** Response body per operation name. */
+    operations: Record<string, GraphqlResult>;
+  };
 }
 
 export interface ViewportSpec {
@@ -152,6 +185,11 @@ export interface A11yAuditConfig {
    * still a hard failure — this retries a flake, it does not tolerate one.
    */
   routeAttempts?: number;
+  /**
+   * Named route fixtures. A value may be the fixture itself or a path, relative
+   * to the config file, of a JSON file holding it.
+   */
+  fixtures?: Record<string, FixtureSpec | string>;
 }
 
 /** Config with every default resolved. */
@@ -171,6 +209,7 @@ export interface ResolvedConfig {
   domQuietMs: number;
   minTextLength: number;
   routeAttempts: number;
+  fixtures: Record<string, FixtureSpec>;
 }
 
 /** A single failing DOM node, flattened out of an axe violation. */
@@ -212,6 +251,10 @@ export interface RouteResult {
   domSettled: boolean;
   /** Navigation attempts this route needed. >1 means the runner hit a flake. */
   attempts: number;
+  /** Fixture the route was loaded with, if any. */
+  fixture?: string;
+  /** GraphQL operations the page sent that the fixture had no answer for. */
+  unmockedOperations?: string[];
 }
 
 export interface AuditReport {
@@ -224,7 +267,11 @@ export interface AuditReport {
   blockExternalRequests: boolean;
   routes: RouteResult[];
   staleAllowlistEntries: Array<{ index: number; rule: string; reason: string }>;
-  expiredAllowlistEntries: Array<{ index: number; rule: string; expires: string }>;
+  expiredAllowlistEntries: Array<{
+    index: number;
+    rule: string;
+    expires: string;
+  }>;
   totals: {
     blocking: number;
     allowed: number;

package/src/shared/tokens/build/brands/fluidgrids.css

@@ -1,6 +1,25 @@
-/* FluidGrids brand overrides - Auto-generated */
+/* FluidGrids brand overrides
+ *
+ * WCAG 2.1 AA (1.4.3), parity G23. The accent is both the primary-button fill
+ * (white label) and, through --color-accent-primary, small accent text on the
+ * canvas, so one cyan cannot serve both themes:
+ *   - light: cyan-700 #0E7490 carries a white label at 5.36:1. The former
+ *     cyan-600 #0891B2 measured 3.68:1 and failed axe color-contrast on every
+ *     primary button of the landing page.
+ *   - dark: cyan-600 stays (5.2:1 as accent text on the #0A0E16 canvas), and
+ *     the button label turns dark (5.7:1); hover/active step LIGHTER so the
+ *     dark label keeps its contrast in every state.
+ */
 [data-brand="fluidgrids"] {
+  --color-action-primary-bg: #0E7490;
+  --color-action-primary-bgHover: #155E75;
+  --color-action-primary-bgActive: #164E63;
+}
+
+:root.dark[data-brand="fluidgrids"],
+[data-brand="fluidgrids"].dark {
   --color-action-primary-bg: #0891B2;
-  --color-action-primary-bgHover: #0E7490;
-  --color-action-primary-bgActive: #155E75;
+  --color-action-primary-bgHover: #06B6D4;
+  --color-action-primary-bgActive: #22D3EE;
+  --color-action-primary-text: #0A0E16;
 }