@devopsplaybook.io/common-web 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to this project are documented here.
 This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-10-24
+
+### Added
+
+- Package metadata: `repository`, `homepage`, `bugs` and a conservative
+  `sideEffects` whitelist (CSS and `.vue` files are never tree-shaken;
+  the `.ts` modules are side-effect-free at import time). No `types` entry is
+  added because the package intentionally ships raw sources with no build step;
+  this is now documented in the README.
+- axe-core accessibility gate: `tests/accessibility.spec.ts` mounts every
+  shipped component in a real DOM tree and fails on axe violations
+  (`color-contrast` is covered by the packed-tokens contrast test instead,
+  because jsdom cannot compute rendered contrast).
+- Coverage thresholds in `vitest.config.ts` (statements 95%, branches 88%,
+  functions 99%, lines 97%) so coverage regressions fail `npm test`.
+
+### Changed
+
+- `scripts/build-package.mjs` now derives `requiredFiles` from the public
+  source directories plus the fixed root assets, so every public file is
+  required and packaging regressions fail `npm run build` instead of shipping
+  silently.
+- Removed the dead `base-package` and `bootstrap-checks` jobs from `PR Check`;
+  `main` has had a package manifest since 0.4.0, so the bootstrap path could
+  never run. `version-check` now always runs.
+- README: removed the stale bootstrap-workflow note and added "SSR and
+  client-only usage" plus "Packaging, types and side effects" documenting the
+  delivered behavior. CONTRIBUTING: documented the coverage and accessibility
+  gates.
+- `.gitignore` now excludes environment files (`.env`, `.env.*` with an
+  `!.env.example` exception) and key material (`*.pem`, `*.key`). No secret is
+  committed today; this is cheap hardening. No consumer-facing API change.
+
 ## [0.7.0] - 2026-10-24
 
 ### Added

package/CONTRIBUTING.md

@@ -15,6 +15,18 @@ npm audit --omit=dev --audit-level=high
 The tests consume the generated npm tarball, not only the working tree.
 `npm run build` checks the publish file list and builds the Nuxt playground.
 
+Two quality gates run with `npm test`:
+
+- **Coverage thresholds** are enforced in `vitest.config.ts` (statements 95%,
+  branches 88%, functions 99%, lines 97%) over the composables, services and
+  stores shipped in the tarball. Raise the bar when coverage improves; lower it
+  only with an explanation in the PR.
+- **Accessibility**: `tests/accessibility.spec.ts` runs axe-core against every
+  shipped component mounted in a real DOM tree and fails on violations. The
+  `color-contrast` rule is disabled there because jsdom cannot compute rendered
+  contrast; WCAG AA color pairs are already gated by `tests/contrast.spec.ts`
+  against the packed tokens.
+
 ## Scope and compatibility
 
 Keep the layer limited to UI and browser behavior that is shared by multiple

package/README.md

@@ -174,6 +174,28 @@ missing or malformed; `set()` normalises valid non-negative integer strings
 (for example `"05000"` becomes `"5000"`) and throws `TypeError` otherwise.
 `"0"` is valid and keeps polling disabled.
 
+## SSR and client-only usage
+
+The layer is SSR-compatible: the components render on the server, and the
+composables guard their browser-only access.
+
+- `useTheme()` guards `document` and `localStorage` (`applyTheme()` returns
+  early when `document` is missing; storage writes are skipped), and reads the
+  stored preference and media query in `onMounted`, which never runs during SSR.
+- `useOfflineStatus()` defaults `isOnline` to `true` when `navigator` is
+  missing, and registers its listeners in `onMounted`.
+- `useAppHeight()` touches `window` only inside `onMounted`.
+- `AuthService` guards every `localStorage` access: during SSR `getToken()`
+  resolves `null` and `saveToken()` / `removeToken()` are no-ops.
+
+Token storage, session renewal, `AUTH_UPDATED` propagation, cross-tab
+synchronisation and the opt-in Axios integration are browser-only: register the
+Axios helper from a `.client.ts` plugin as shown above, and expect the
+authentication state to become meaningful only after hydration.
+`PreferencesService` and `RefreshIntervalService` access `localStorage`
+unguarded and must only be called in the browser (a client plugin or a
+composable hook, never during SSR).
+
 ## Tokens and app-shell styles
 
 The layer loads `assets/css/tokens.css` and `assets/css/app-shell.css`.
@@ -231,8 +253,18 @@ workflows so the audit gate can cover production dependencies only;
 development-toolchain advisories are reported but do not fail the build. See
 [CONTRIBUTING.md](CONTRIBUTING.md#dependency-audit-policy) for the policy and
 the accepted development-only advisories. The local jobs are a stop-gap until
-the shared `common-utils` npm workflows adopt the same gate; the `PR Check`
-bootstrap job is retained for the case where `main` has no package manifest.
+the shared `common-utils` npm workflows adopt the same gate.
+
+### Packaging, types and side effects
+
+The package ships raw Vue and TypeScript sources with no build step, so there is
+deliberately no `types` or `exports.types` entry: type information comes from
+the `.ts`/`.vue` sources themselves and deep imports resolve through the
+`exports` map under Nuxt module resolution. `sideEffects` whitelists CSS and
+`.vue` files so component styles and the token stylesheets are never
+tree-shaken, while the side-effect-free `.ts` modules can be. `npm run build`
+fails when any public file is missing from the packed tarball, and the packed
+archive is what `npm test` runs against.
 
 ## Development
 

package/package.json

@@ -1,8 +1,18 @@
 {
   "name": "@devopsplaybook.io/common-web",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Shared Nuxt layer for DevOpsPlaybook web applications",
   "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/devopsplaybook-io/common-web.git"
+  },
+  "homepage": "https://github.com/devopsplaybook-io/common-web#readme",
+  "bugs": "https://github.com/devopsplaybook-io/common-web/issues",
+  "sideEffects": [
+    "**/*.css",
+    "**/*.vue"
+  ],
   "engines": {
     "node": ">=22"
   },
@@ -46,6 +56,7 @@
     "@vitejs/plugin-vue": "^6.0.9",
     "@vitest/coverage-v8": "^5.0.5",
     "@vue/test-utils": "^2.5.1",
+    "axe-core": "^4.14.0",
     "jsdom": "^30.1.1",
     "nuxt": "^4.6.2",
     "oxlint": "^1.85.0",