@designcrowd/fe-shared-lib 1.8.4-edge-fallback-0 → 1.8.4-edge-fallback-2

package/CLAUDE.md

@@ -123,7 +123,15 @@ npm link @designcrowd/fe-shared-lib                # in consumer project
 
 ## Publishing (UAT)
 
-To test experimental versions without publishing to production:
-1. Update `package.json` version to `[current]-[description]`
-2. Run `docker build . --build-arg NPM_TOKEN=$NPM_TOKEN`
-3. Update consumer package reference to the new version
+Use `scripts/publish-uat.sh <suffix>` to publish a UAT build for testing in a consumer (e.g. BrandCrowd.Net). The script handles the version bump, bundle-translation, secret scanning of the tarball, and the commit. Examples:
+
+```bash
+./scripts/publish-uat.sh edge-fallback-0
+./scripts/publish-uat.sh edge-fallback-1   # next iteration
+```
+
+It refuses to run on `master`/`main`, refuses if the version is already published, aborts on dangerous filenames or token-shaped strings inside the tarball, and only commits the bump after the registry confirms upload.
+
+The npm publish token is read from `~/.config/designcrowd/npm-publish-token` (mode 600). Override with `NPM_PUBLISH_TOKEN_FILE` if it lives elsewhere. The token file is **not** stored anywhere in the repo.
+
+The legacy `docker build . --build-arg NPM_TOKEN=...` flow still works but is brittle — prefer the script.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@designcrowd/fe-shared-lib",
-  "version": "1.8.4-edge-fallback-0",
+  "version": "1.8.4-edge-fallback-2",
   "scripts": {
     "start": "run-p storybook watch:translation",
     "build": "npm run build:css --production",

package/scripts/publish-uat.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+#
+# publish-uat.sh — publish a UAT-suffixed version of @designcrowd/fe-shared-lib
+#
+# Usage:   ./scripts/publish-uat.sh <suffix>
+# Example: ./scripts/publish-uat.sh edge-fallback-2
+#
+# Reads the npm publish token from $NPM_PUBLISH_TOKEN_FILE
+# (default ~/.config/designcrowd/npm-publish-token, mode 600).
+# The token is never written into the repo.
+#
+# Workflow:
+#   1. Validate branch (refuse master) and suffix.
+#   2. Compute new version = <base>-<suffix>, refuse if already published.
+#   3. Bump package.json, run bundle-translation.
+#   4. npm pack — produces a tarball.
+#   5. Secret scan: dangerous filenames + token-shaped strings + the
+#      literal token bytes from the token file (if it leaked into the
+#      tree somehow, this catches it).
+#   6. npm publish <tarball> via a temp .npmrc in /tmp (mode 600,
+#      removed on exit).
+#   7. git add + commit the version bump.
+#
+# Anything in steps 4-6 that fails leaves the working tree dirty so you
+# can investigate. The commit only lands after the registry confirms
+# the upload.
+
+set -euo pipefail
+
+PKG="@designcrowd/fe-shared-lib"
+TOKEN_FILE="${NPM_PUBLISH_TOKEN_FILE:-$HOME/.config/designcrowd/npm-publish-token}"
+
+abort() { echo "ABORT: $*" >&2; exit 1; }
+
+# --- args ---
+SUFFIX="${1:-}"
+[[ -z "$SUFFIX" ]] && abort "usage: $0 <suffix>  e.g. $0 edge-fallback-2"
+[[ "$SUFFIX" =~ ^[A-Za-z0-9._-]+$ ]] || abort "suffix must be [A-Za-z0-9._-]+"
+
+# --- repo state ---
+cd "$(git rev-parse --show-toplevel)"
+BRANCH=$(git symbolic-ref --short HEAD)
+[[ "$BRANCH" == "master" || "$BRANCH" == "main" ]] && abort "refusing to publish from $BRANCH"
+
+# --- token ---
+[[ -f "$TOKEN_FILE" ]] || abort "no token at $TOKEN_FILE (set NPM_PUBLISH_TOKEN_FILE to override)"
+TOKEN=$(tr -d '[:space:]' < "$TOKEN_FILE")
+[[ -n "$TOKEN" ]] || abort "token file is empty: $TOKEN_FILE"
+
+# --- compute version ---
+BASE=$(node -p "require('./package.json').version.replace(/-.*/, '')")
+NEW="$BASE-$SUFFIX"
+
+if npm view "$PKG@$NEW" version >/dev/null 2>&1; then
+  abort "$PKG@$NEW already published — pick a new suffix"
+fi
+
+echo "==> publishing $PKG@$NEW from branch $BRANCH"
+
+# --- bump + bundle ---
+node -e "const fs=require('fs');const p=require('./package.json');p.version='$NEW';fs.writeFileSync('./package.json', JSON.stringify(p, null, 2)+'\n');"
+echo "==> running bundle-translation"
+npm run --silent bundle-translation >/dev/null
+
+# --- pack ---
+echo "==> packing"
+TARBALL=$(npm pack --silent)
+[[ -f "$TARBALL" ]] || abort "npm pack did not produce a tarball"
+
+# Always clean up temp artifacts on exit
+SCAN_DIR=$(mktemp -d)
+TMP_NPMRC=$(mktemp /tmp/fe-shared-lib-publish.XXXXXX.npmrc)
+chmod 600 "$TMP_NPMRC"
+cleanup() { rm -rf "$SCAN_DIR"; rm -f "$TMP_NPMRC" "$TARBALL"; }
+trap cleanup EXIT
+
+# --- secret scan: filenames ---
+echo "==> scanning $TARBALL"
+DANGEROUS_PATHS='(^|/)(\.env(\..+)?|\.npmrc|\.npm-publish-token|id_rsa.*|id_ed25519.*|.*\.pem|.*\.key|.*token.*|.*secret.*|.*credential.*)$|(^|/)\.(aws|ssh|gnupg)/'
+if BAD=$(tar tzf "$TARBALL" | grep -E -i "$DANGEROUS_PATHS" || true); [[ -n "$BAD" ]]; then
+  echo "$BAD" >&2
+  abort "dangerous filenames in tarball"
+fi
+
+# --- secret scan: contents ---
+tar xzf "$TARBALL" -C "$SCAN_DIR"
+
+# Token-shaped patterns. Tightened so the literal '${NPM_TOKEN}' template
+# in the tracked npmrc file doesn't trip the check.
+SECRET_PATTERNS='(npm_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk_live_[A-Za-z0-9]{20,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)'
+if HITS=$(grep -REn -I -E "$SECRET_PATTERNS" "$SCAN_DIR" 2>/dev/null || true); [[ -n "$HITS" ]]; then
+  echo "$HITS" >&2
+  abort "secret-shaped string in tarball"
+fi
+
+# Belt-and-braces: the token's own bytes. If our publish token ever
+# lands in a tracked file by accident, this catches it regardless of
+# pattern-matching.
+if grep -RFq "$TOKEN" "$SCAN_DIR" 2>/dev/null; then
+  abort "publish token bytes appear in tarball — DO NOT publish"
+fi
+
+FILES=$(tar tzf "$TARBALL" | wc -l | tr -d ' ')
+SIZE=$(du -h "$TARBALL" | cut -f1)
+echo "==> scan clean. $FILES files, $SIZE"
+
+# --- publish ---
+printf '//registry.npmjs.org/:_authToken=%s\n' "$TOKEN" > "$TMP_NPMRC"
+echo "==> publishing"
+npm publish "$TARBALL" --userconfig "$TMP_NPMRC"
+
+# --- commit bump ---
+git add -- package.json
+git add -- src/bundles 2>/dev/null || true
+git commit -m "bump version to $NEW" >/dev/null
+echo
+echo "Published $PKG@$NEW (commit $(git rev-parse --short HEAD))"
+echo
+echo "Install in BrandCrowd.Net:"
+echo "  npm i $PKG@$NEW"

package/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"33dfc84f-253d-421e-b0c6-adbf8fc2c94d","pid":84069,"procStart":"339429","acquiredAt":1777334296981}

package/.claude/settings.local.json

@@ -1,54 +0,0 @@
-{
-  "env": {},
-  "permissions": {
-    "allow": [
-      "Bash(npm outdated:*)",
-      "Bash(npm install:*)",
-      "Bash(npx npm-check-updates)",
-      "Bash(npm audit:*)",
-      "Skill(superpowers:writing-plans)",
-      "Bash(cat:*)",
-      "Bash(mkdir:*)",
-      "Skill(superpowers:subagent-driven-development)",
-      "Bash(echo:*)",
-      "Bash(ping:*)",
-      "Bash(docker system:*)",
-      "Bash(docker buildx du:*)",
-      "Bash(npm view:*)",
-      "Bash(~/.npmrc)",
-      "Bash(npm run bundle-translation:*)",
-      "mcp__plugin_context7_context7__resolve-library-id",
-      "Bash(node:*)",
-      "Bash(npm:*)",
-      "Bash(find:*)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib log --oneline --all)",
-      "Bash(wc:*)",
-      "mcp__plugin_context7_context7__query-docs",
-      "Skill(superpowers:test-driven-development)",
-      "Bash(git rev-parse:*)",
-      "Bash(npx tsc:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Skill(superpowers:using-superpowers)",
-      "WebSearch",
-      "Bash(git checkout:*)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib status)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib diff package.json)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib log --oneline -5)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib diff vite.config.ts)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib add package.json package-lock.json vite.config.ts)",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib commit -m \"$\\(cat <<''EOF''\nchore: upgrade vite 6→7, vue 3.5.15→3.5.26, storybook 9→10\n\n- Update vite to ^7.3.1\n- Update @vitejs/plugin-vue to ^6.0.3 \\(required for Vite 7\\)\n- Update vite-plugin-vue-devtools to ^7.7.2\n- Update vue to ^3.5.26\n- Remove vite-plugin-eslint \\(unmaintained, incompatible with Vite 7\\)\n- Update storybook to 10.2.1 \\(required for Vite 7 compatibility\\)\n- Update @storybook/vue3, @storybook/vue3-vite to 10.2.1\n- Update @storybook/addon-a11y, @storybook/addon-links, @storybook/addon-themes to 10.2.1\n- Update eslint-plugin-storybook to 10.2.1 \\(required for Storybook 10\\)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
-      "Bash(git -C /home/zknowles/repos/fe-shared-lib log --oneline -3)",
-      "Bash(git show:*)",
-      "Bash(git stash:*)",
-      "Bash(chmod:*)",
-      "Bash(~/.claude/statusline.sh)",
-      "Bash(ls:*)",
-      "Bash(for v in 1.5.20-dts-upgrades 1.5.20-dts-upgrades-2 1.5.21 1.5.20-ast-icons 1.5.20-ast-icons-1 1.5.21-BestLogoIcons-3 1.5.22)",
-      "Bash(do)",
-      "Bash(done)",
-      "Bash(cp \"/home/zknowles/.claude/plugins/cache/designcrowd-plugins/experimental/0.19.0/docs/growth-it-runs-on-local-team-2026-04-09-thread.md\" \"/home/zknowles/repos/fe-shared-lib/docs/voice-to-text-discussion.md\")",
-      "Bash(cp -r \"/home/zknowles/.claude/plugins/cache/designcrowd-plugins/experimental/0.19.0/docs/growth-it-runs-on-local-team-2026-04-09-thread-attachments\" \"/home/zknowles/repos/fe-shared-lib/docs/voice-to-text-discussion-attachments\")"
-    ]
-  }
-}

package/.claude/skills/playwright-cli/SKILL.md

@@ -1,278 +0,0 @@
----
-name: playwright-cli
-description: Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
-allowed-tools: Bash(playwright-cli:*)
----
-
-# Browser Automation with playwright-cli
-
-## Quick start
-
-```bash
-# open new browser
-playwright-cli open
-# navigate to a page
-playwright-cli goto https://playwright.dev
-# interact with the page using refs from the snapshot
-playwright-cli click e15
-playwright-cli type "page.click"
-playwright-cli press Enter
-# take a screenshot (rarely used, as snapshot is more common)
-playwright-cli screenshot
-# close the browser
-playwright-cli close
-```
-
-## Commands
-
-### Core
-
-```bash
-playwright-cli open
-# open and navigate right away
-playwright-cli open https://example.com/
-playwright-cli goto https://playwright.dev
-playwright-cli type "search query"
-playwright-cli click e3
-playwright-cli dblclick e7
-playwright-cli fill e5 "user@example.com"
-playwright-cli drag e2 e8
-playwright-cli hover e4
-playwright-cli select e9 "option-value"
-playwright-cli upload ./document.pdf
-playwright-cli check e12
-playwright-cli uncheck e12
-playwright-cli snapshot
-playwright-cli snapshot --filename=after-click.yaml
-playwright-cli eval "document.title"
-playwright-cli eval "el => el.textContent" e5
-playwright-cli dialog-accept
-playwright-cli dialog-accept "confirmation text"
-playwright-cli dialog-dismiss
-playwright-cli resize 1920 1080
-playwright-cli close
-```
-
-### Navigation
-
-```bash
-playwright-cli go-back
-playwright-cli go-forward
-playwright-cli reload
-```
-
-### Keyboard
-
-```bash
-playwright-cli press Enter
-playwright-cli press ArrowDown
-playwright-cli keydown Shift
-playwright-cli keyup Shift
-```
-
-### Mouse
-
-```bash
-playwright-cli mousemove 150 300
-playwright-cli mousedown
-playwright-cli mousedown right
-playwright-cli mouseup
-playwright-cli mouseup right
-playwright-cli mousewheel 0 100
-```
-
-### Save as
-
-```bash
-playwright-cli screenshot
-playwright-cli screenshot e5
-playwright-cli screenshot --filename=page.png
-playwright-cli pdf --filename=page.pdf
-```
-
-### Tabs
-
-```bash
-playwright-cli tab-list
-playwright-cli tab-new
-playwright-cli tab-new https://example.com/page
-playwright-cli tab-close
-playwright-cli tab-close 2
-playwright-cli tab-select 0
-```
-
-### Storage
-
-```bash
-playwright-cli state-save
-playwright-cli state-save auth.json
-playwright-cli state-load auth.json
-
-# Cookies
-playwright-cli cookie-list
-playwright-cli cookie-list --domain=example.com
-playwright-cli cookie-get session_id
-playwright-cli cookie-set session_id abc123
-playwright-cli cookie-set session_id abc123 --domain=example.com --httpOnly --secure
-playwright-cli cookie-delete session_id
-playwright-cli cookie-clear
-
-# LocalStorage
-playwright-cli localstorage-list
-playwright-cli localstorage-get theme
-playwright-cli localstorage-set theme dark
-playwright-cli localstorage-delete theme
-playwright-cli localstorage-clear
-
-# SessionStorage
-playwright-cli sessionstorage-list
-playwright-cli sessionstorage-get step
-playwright-cli sessionstorage-set step 3
-playwright-cli sessionstorage-delete step
-playwright-cli sessionstorage-clear
-```
-
-### Network
-
-```bash
-playwright-cli route "**/*.jpg" --status=404
-playwright-cli route "https://api.example.com/**" --body='{"mock": true}'
-playwright-cli route-list
-playwright-cli unroute "**/*.jpg"
-playwright-cli unroute
-```
-
-### DevTools
-
-```bash
-playwright-cli console
-playwright-cli console warning
-playwright-cli network
-playwright-cli run-code "async page => await page.context().grantPermissions(['geolocation'])"
-playwright-cli tracing-start
-playwright-cli tracing-stop
-playwright-cli video-start
-playwright-cli video-stop video.webm
-```
-
-## Open parameters
-```bash
-# Use specific browser when creating session
-playwright-cli open --browser=chrome
-playwright-cli open --browser=firefox
-playwright-cli open --browser=webkit
-playwright-cli open --browser=msedge
-# Connect to browser via extension
-playwright-cli open --extension
-
-# Use persistent profile (by default profile is in-memory)
-playwright-cli open --persistent
-# Use persistent profile with custom directory
-playwright-cli open --profile=/path/to/profile
-
-# Start with config file
-playwright-cli open --config=my-config.json
-
-# Close the browser
-playwright-cli close
-# Delete user data for the default session
-playwright-cli delete-data
-```
-
-## Snapshots
-
-After each command, playwright-cli provides a snapshot of the current browser state.
-
-```bash
-> playwright-cli goto https://example.com
-### Page
-- Page URL: https://example.com/
-- Page Title: Example Domain
-### Snapshot
-[Snapshot](.playwright-cli/page-2026-02-14T19-22-42-679Z.yml)
-```
-
-You can also take a snapshot on demand using `playwright-cli snapshot` command.
-
-If `--filename` is not provided, a new snapshot file is created with a timestamp. Default to automatic file naming, use `--filename=` when artifact is a part of the workflow result.
-
-## Browser Sessions
-
-```bash
-# create new browser session named "mysession" with persistent profile
-playwright-cli -s=mysession open example.com --persistent
-# same with manually specified profile directory (use when requested explicitly)
-playwright-cli -s=mysession open example.com --profile=/path/to/profile
-playwright-cli -s=mysession click e6
-playwright-cli -s=mysession close  # stop a named browser
-playwright-cli -s=mysession delete-data  # delete user data for persistent session
-
-playwright-cli list
-# Close all browsers
-playwright-cli close-all
-# Forcefully kill all browser processes
-playwright-cli kill-all
-```
-
-## Local installation
-
-In some cases user might want to install playwright-cli locally. If running globally available `playwright-cli` binary fails, use `npx playwright-cli` to run the commands. For example:
-
-```bash
-npx playwright-cli open https://example.com
-npx playwright-cli click e1
-```
-
-## Example: Form submission
-
-```bash
-playwright-cli open https://example.com/form
-playwright-cli snapshot
-
-playwright-cli fill e1 "user@example.com"
-playwright-cli fill e2 "password123"
-playwright-cli click e3
-playwright-cli snapshot
-playwright-cli close
-```
-
-## Example: Multi-tab workflow
-
-```bash
-playwright-cli open https://example.com
-playwright-cli tab-new https://example.com/other
-playwright-cli tab-list
-playwright-cli tab-select 0
-playwright-cli snapshot
-playwright-cli close
-```
-
-## Example: Debugging with DevTools
-
-```bash
-playwright-cli open https://example.com
-playwright-cli click e4
-playwright-cli fill e7 "test"
-playwright-cli console
-playwright-cli network
-playwright-cli close
-```
-
-```bash
-playwright-cli open https://example.com
-playwright-cli tracing-start
-playwright-cli click e4
-playwright-cli fill e7 "test"
-playwright-cli tracing-stop
-playwright-cli close
-```
-
-## Specific tasks
-
-* **Request mocking** [references/request-mocking.md](references/request-mocking.md)
-* **Running Playwright code** [references/running-code.md](references/running-code.md)
-* **Browser session management** [references/session-management.md](references/session-management.md)
-* **Storage state (cookies, localStorage)** [references/storage-state.md](references/storage-state.md)
-* **Test generation** [references/test-generation.md](references/test-generation.md)
-* **Tracing** [references/tracing.md](references/tracing.md)
-* **Video recording** [references/video-recording.md](references/video-recording.md)

package/.claude/skills/playwright-cli/references/request-mocking.md

@@ -1,87 +0,0 @@
-# Request Mocking
-
-Intercept, mock, modify, and block network requests.
-
-## CLI Route Commands
-
-```bash
-# Mock with custom status
-playwright-cli route "**/*.jpg" --status=404
-
-# Mock with JSON body
-playwright-cli route "**/api/users" --body='[{"id":1,"name":"Alice"}]' --content-type=application/json
-
-# Mock with custom headers
-playwright-cli route "**/api/data" --body='{"ok":true}' --header="X-Custom: value"
-
-# Remove headers from requests
-playwright-cli route "**/*" --remove-header=cookie,authorization
-
-# List active routes
-playwright-cli route-list
-
-# Remove a route or all routes
-playwright-cli unroute "**/*.jpg"
-playwright-cli unroute
-```
-
-## URL Patterns
-
-```
-**/api/users           - Exact path match
-**/api/*/details       - Wildcard in path
-**/*.{png,jpg,jpeg}    - Match file extensions
-**/search?q=*          - Match query parameters
-```
-
-## Advanced Mocking with run-code
-
-For conditional responses, request body inspection, response modification, or delays:
-
-### Conditional Response Based on Request
-
-```bash
-playwright-cli run-code "async page => {
-  await page.route('**/api/login', route => {
-    const body = route.request().postDataJSON();
-    if (body.username === 'admin') {
-      route.fulfill({ body: JSON.stringify({ token: 'mock-token' }) });
-    } else {
-      route.fulfill({ status: 401, body: JSON.stringify({ error: 'Invalid' }) });
-    }
-  });
-}"
-```
-
-### Modify Real Response
-
-```bash
-playwright-cli run-code "async page => {
-  await page.route('**/api/user', async route => {
-    const response = await route.fetch();
-    const json = await response.json();
-    json.isPremium = true;
-    await route.fulfill({ response, json });
-  });
-}"
-```
-
-### Simulate Network Failures
-
-```bash
-playwright-cli run-code "async page => {
-  await page.route('**/api/offline', route => route.abort('internetdisconnected'));
-}"
-# Options: connectionrefused, timedout, connectionreset, internetdisconnected
-```
-
-### Delayed Response
-
-```bash
-playwright-cli run-code "async page => {
-  await page.route('**/api/slow', async route => {
-    await new Promise(r => setTimeout(r, 3000));
-    route.fulfill({ body: JSON.stringify({ data: 'loaded' }) });
-  });
-}"
-```