@dwp/govuk-casa 9.7.0 → 10.1.0

package/dist/routes/journey.js

@@ -1,32 +1,26 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateGovukErrors = void 0;
-exports.default = journeyRouter;
-const MutableRouter_js_1 = __importDefault(require("../lib/MutableRouter.js"));
-const skip_waypoint_js_1 = __importDefault(require("../middleware/skip-waypoint.js"));
-const steer_journey_js_1 = __importDefault(require("../middleware/steer-journey.js"));
-const sanitise_fields_js_1 = __importDefault(require("../middleware/sanitise-fields.js"));
-const gather_fields_js_1 = __importDefault(require("../middleware/gather-fields.js"));
-const validate_fields_js_1 = __importDefault(require("../middleware/validate-fields.js"));
-const progress_journey_js_1 = __importDefault(require("../middleware/progress-journey.js"));
-const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
-const logger_js_1 = __importDefault(require("../lib/logger.js"));
-const utils_js_1 = require("../lib/utils.js");
-const constants_js_1 = require("../lib/constants.js");
-const log = (0, logger_js_1.default)("routes:journey");
+import MutableRouter from "../lib/MutableRouter.js";
+import NullObject from "../lib/NullObject.js";
+import skipWaypointMiddlewareFactory from "../middleware/skip-waypoint.js";
+import steerJourneyMiddlewareFactory from "../middleware/steer-journey.js";
+import sanitiseFieldsMiddlewareFactory from "../middleware/sanitise-fields.js";
+import gatherFieldsMiddlewareFactory from "../middleware/gather-fields.js";
+import validateFieldsMiddlewareFactory from "../middleware/validate-fields.js";
+import progressJourneyMiddlewareFactory from "../middleware/progress-journey.js";
+import waypointUrl from "../lib/waypoint-url.js";
+import logger from "../lib/logger.js";
+import { resolveMiddlewareHooks } from "../lib/utils.js";
+import { CONFIG_ERROR_VISIBILITY_ALWAYS } from "../lib/constants.js";
+const log = logger("routes:journey");
 /**
- * @param {import("../casa.js").GlobalHook} GlobalHook
+ * @typedef {import("../casa.js").GlobalHook} GlobalHook
  * @access private
  */
 /**
- * @param {import("../casa.js").Page} Page
+ * @typedef {import("../casa.js").Page} Page
  * @access private
  */
 /**
- * @param {import("../casa.js").Plan} Plan
+ * @typedef {import("../casa.js").Plan} Plan
  * @access private
  */
 /** @typedef {import("../casa.js").ValidationError} ValidationError */
@@ -40,7 +34,8 @@ const log = (0, logger_js_1.default)("routes:journey");
  * @property {GlobalHook[]} globalHooks Global hooks
  * @property {Page[]} pages Page definitions
  * @property {Plan} plan Plan
- * @property {Function[]} csrfMiddleware Middleware for providing CSRF controls
+ * @property {import("express").RequestHandler[]} csrfMiddleware Middleware for
+ *   providing CSRF controls
  */
 const renderMiddlewareFactory = (view, contextFactory) => [
     (req, res, next) => {
@@ -69,11 +64,17 @@ const renderMiddlewareFactory = (view, contextFactory) => [
  * @param {import("express").Request} req Casa request object
  * @returns {GovUkErrorObject[]} Array of error objects
  */
-const generateGovukErrors = (errors, req) => Object.values(errors || {}).map(([error]) => ({
+export const generateGovukErrors = (errors, req) => Object.values(errors || {}).map(([error]) => ({
     text: req.t(error.summary, error.variables),
     href: error.fieldHref,
 }));
-exports.generateGovukErrors = generateGovukErrors;
+/**
+ * Generate edit cancel URL
+ *
+ * @param {string} editOrigin Edit mode origin waypoint
+ * @param {string} waypoint Current waypoint
+ * @returns {string} Edit cancel URL
+ */
 const generateEditCancelUrl = (editOrigin, waypoint) => {
     const url = new URL(editOrigin, "https://placeholder.test/");
     url.searchParams.set("editcancel", waypoint);
@@ -82,14 +83,15 @@ const generateEditCancelUrl = (editOrigin, waypoint) => {
 /**
  * Handle errorVisibility flag and function and return boolean
  *
- * @param {object} req Casa request object
- * @param {symbol | Function} errorVisibility ErrorVisibility config option
+ * @param {import("express").Request} req Casa request object
+ * @param {Page["errorVisibility"]} errorVisibility ErrorVisibility config
+ *   option
  * @returns {boolean} True if errorVisibility is "always" or function condition
  *   true
  */
 const resolveErrorVisibility = (req, errorVisibility) => typeof errorVisibility === "function"
     ? errorVisibility({ req })
-    : errorVisibility === constants_js_1.CONFIG_ERROR_VISIBILITY_ALWAYS;
+    : errorVisibility === CONFIG_ERROR_VISIBILITY_ALWAYS;
 /**
  * Create an instance of the router for all waypoints visited during a Journey
  * through the Plan.
@@ -98,9 +100,9 @@ const resolveErrorVisibility = (req, errorVisibility) => typeof errorVisibility
  * @returns {MutableRouter} Router
  * @access private
  */
-function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVisibility, }) {
+export default function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVisibility, }) {
     // Router
-    const router = new MutableRouter_js_1.default({ mergeParams: true });
+    const router = new MutableRouter({ mergeParams: true });
     // Special "_" route which handles redirecting the user between sub-apps
     // /app1/_/?refmount=app2&route=prev
     router.all("/_", (req, res) => {
@@ -109,7 +111,7 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
         const route = req.query?.route;
         log.trace(`App root ${mountUrl}: refmount = ${refmount}, route = ${route}`);
         let redirectTo;
-        const fallback = (0, waypoint_url_js_1.default)({
+        const fallback = waypointUrl({
             mountUrl,
             waypoint: plan.traverse(req.casa.journeyContext, {
                 stopCondition: () => true, // we only need one; stop at the first
@@ -127,7 +129,7 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
                 startWaypoint: refmount,
             });
             redirectTo = routes.length
-                ? (0, waypoint_url_js_1.default)({
+                ? waypointUrl({
                     mountUrl,
                     waypoint: routes[0].target,
                     journeyContext: req.casa.journeyContext,
@@ -140,7 +142,7 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
             });
             if (routes[0].target !== null) {
                 redirectTo = routes.length
-                    ? (0, waypoint_url_js_1.default)({
+                    ? waypointUrl({
                         mountUrl,
                         waypoint: routes[0].target,
                         journeyContext: req.casa.journeyContext,
@@ -178,16 +180,16 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
             log.info(`Configuring "${waypoint}" as a skippable waypoint`);
             commonWaypointMiddleware = [
                 ...commonWaypointMiddleware,
-                ...(0, skip_waypoint_js_1.default)({ waypoint }),
+                ...skipWaypointMiddlewareFactory({ waypoint }),
             ];
         }
-        router.get(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)("journey.presteer", waypointPath, [
+        router.get(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...resolveMiddlewareHooks("journey.presteer", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, steer_journey_js_1.default)({ waypoint, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.poststeer", waypointPath, [
+        ]), ...steerJourneyMiddlewareFactory({ waypoint, plan }), ...resolveMiddlewareHooks("journey.poststeer", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.prerender", waypointPath, [
+        ]), ...resolveMiddlewareHooks("journey.prerender", waypointPath, [
             ...globalHooks,
             ...pageHooks,
         ]), renderMiddlewareFactory(view, (req) => {
@@ -195,10 +197,10 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
                 resolveErrorVisibility(req, errorVisibility);
             const errors = displayErrors &&
                 (req.casa.journeyContext.getValidationErrorsForPageByField(waypoint) ??
-                    Object.create(null));
-            const govukErrors = displayErrors && (0, exports.generateGovukErrors)(errors, req);
+                    new NullObject());
+            const govukErrors = displayErrors && generateGovukErrors(errors, req);
             return {
-                formUrl: (0, waypoint_url_js_1.default)({
+                formUrl: waypointUrl({
                     mountUrl: `${req.baseUrl}/`,
                     waypoint,
                     journeyContext: req.casa.journeyContext,
@@ -208,28 +210,28 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
                 formErrorsGovukArray: govukErrors.length && displayErrors ? govukErrors : null,
             };
         }));
-        router.post(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...(0, utils_js_1.resolveMiddlewareHooks)("journey.presteer", waypointPath, [
+        router.post(waypointPath, ...commonMiddleware, ...commonWaypointMiddleware, ...resolveMiddlewareHooks("journey.presteer", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, steer_journey_js_1.default)({ waypoint, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.poststeer", waypointPath, [
+        ]), ...steerJourneyMiddlewareFactory({ waypoint, plan }), ...resolveMiddlewareHooks("journey.poststeer", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.presanitise", waypointPath, [
+        ]), ...resolveMiddlewareHooks("journey.presanitise", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, sanitise_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.postsanitise", waypointPath, [
+        ]), ...sanitiseFieldsMiddlewareFactory({ waypoint, fields }), ...resolveMiddlewareHooks("journey.postsanitise", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.pregather", waypointPath, [
+        ]), ...resolveMiddlewareHooks("journey.pregather", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, gather_fields_js_1.default)({ waypoint, fields }), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.postgather", waypointPath, [
+        ]), ...gatherFieldsMiddlewareFactory({ waypoint, fields }), ...resolveMiddlewareHooks("journey.postgather", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.prevalidate", waypointPath, [
+        ]), ...resolveMiddlewareHooks("journey.prevalidate", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, validate_fields_js_1.default)({ waypoint, fields, plan }), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.postvalidate", waypointPath, [
+        ]), ...validateFieldsMiddlewareFactory({ waypoint, fields, plan }), ...resolveMiddlewareHooks("journey.postvalidate", waypointPath, [
             ...globalHooks,
             ...pageHooks,
         ]), 
@@ -237,16 +239,16 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
         // next, where the errors will be rendered
         (req, res, next) => req.casa.journeyContext.hasValidationErrorsForPage(waypoint)
             ? next("route")
-            : next(), ...(0, utils_js_1.resolveMiddlewareHooks)("journey.preredirect", waypointPath, [
+            : next(), ...resolveMiddlewareHooks("journey.preredirect", waypointPath, [
             ...globalHooks,
             ...pageHooks,
-        ]), ...(0, progress_journey_js_1.default)({ waypoint, plan }));
-        router.post(waypointPath, ...(0, utils_js_1.resolveMiddlewareHooks)("journey.prerender", waypointPath, [
+        ]), ...progressJourneyMiddlewareFactory({ waypoint, plan }));
+        router.post(waypointPath, ...resolveMiddlewareHooks("journey.prerender", waypointPath, [
             ...globalHooks,
             ...pageHooks,
         ]), renderMiddlewareFactory(view, (req) => {
             const errors = req.casa.journeyContext.getValidationErrorsForPageByField(waypoint) ??
-                Object.create(null);
+                new NullObject();
             // This is a convenience for the template. The `govukErrorSummary` macro
             // requires the errors be in a particular format, so here we provide our
             // errors in that format.
@@ -254,9 +256,9 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
             // first one is shown.
             // Disabling security/detect-object-injection rule because both `errors`
             // and the `k` property are known entities
-            const govukErrors = (0, exports.generateGovukErrors)(errors, req);
+            const govukErrors = generateGovukErrors(errors, req);
             return {
-                formUrl: (0, waypoint_url_js_1.default)({
+                formUrl: waypointUrl({
                     mountUrl: `${req.baseUrl}/`,
                     waypoint,
                     journeyContext: req.casa.journeyContext,
@@ -269,4 +271,3 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, globalErrorVi
     }
     return router;
 }
-//# sourceMappingURL=journey.js.map

package/dist/routes/static.d.ts

@@ -29,3 +29,4 @@ export type StaticOptions = {
     cacheControl?: string | undefined;
 };
 import MutableRouter from "../lib/MutableRouter.js";
+//# sourceMappingURL=static.d.ts.map

package/dist/routes/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/routes/static.js"],"names":[],"mappings":"AAWA;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,iEAJW,aAAa,GACX,aAAa,CA2FzB;;;;;;;;;;;;;;;;0BA5GyB,yBAAyB"}

package/dist/routes/static.js

@@ -1,18 +1,11 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = staticRouter;
-const express_1 = __importDefault(require("express"));
-const node_fs_1 = require("node:fs");
-const node_url_1 = require("node:url");
-const node_path_1 = require("node:path");
-const node_module_1 = require("node:module");
-const dirname_cjs_1 = __importDefault(require("./dirname.cjs"));
-const MutableRouter_js_1 = __importDefault(require("../lib/MutableRouter.js"));
-const utils_js_1 = require("../lib/utils.js");
-const { static: ExpressStatic } = express_1.default; // CommonJS
+import ExpressJS from "express";
+import { readFileSync } from "node:fs";
+import { URL } from "node:url";
+import { resolve } from "node:path";
+import { createRequire } from "node:module";
+import MutableRouter from "../lib/MutableRouter.js";
+import { validateUrlPath } from "../lib/utils.js";
+const { static: ExpressStatic } = ExpressJS; // CommonJS
 /**
  * @typedef {object} StaticOptions Options to configure static router
  * @property {number} [maxAge=3600000] Cache TTL for all assets. Default is
@@ -27,8 +20,8 @@ const { static: ExpressStatic } = express_1.default; // CommonJS
  * @returns {MutableRouter} ExpressJS Router instance
  * @access private
  */
-function staticRouter({ maxAge = 3600000, cacheControl = "no-cache, private", } = {}) {
-    const router = new MutableRouter_js_1.default();
+export default function staticRouter({ maxAge = 3600000, cacheControl = "no-cache, private", } = {}) {
+    const router = new MutableRouter();
     const notFoundHandler = (req, res, next) => {
         // Fall through to a general purpose error handler
         next(new Error("404"));
@@ -36,7 +29,7 @@ function staticRouter({ maxAge = 3600000, cacheControl = "no-cache, private", }
     const setHeaders = (req, res, next) => {
         res.set("cache-control", cacheControl);
         res.set("expires", new Date(Date.now() + maxAge).toUTCString());
-        const { pathname } = new node_url_1.URL(req?.originalUrl ?? "", "https://placeholder.test/");
+        const { pathname } = new URL(req?.originalUrl ?? "", "https://placeholder.test/");
         if (pathname.substr(-4) === ".css") {
             // Just needed for our in-memory CSS assets
             res.set("content-type", "text/css");
@@ -55,18 +48,17 @@ function staticRouter({ maxAge = 3600000, cacheControl = "no-cache, private", }
     // must be replaced with the dynamic `mountUrl` to ensure govuk-frontend
     // assets are served from the correct location.
     /* eslint-disable security/detect-non-literal-fs-filename */
-    const casaCss = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(dirname_cjs_1.default, "../../dist/assets/css/casa.css"), { encoding: "utf8" });
+    const casaCss = readFileSync(resolve(import.meta.dirname, "../../dist/assets/css/casa.css"), { encoding: "utf8" });
     /* eslint-enable security/detect-non-literal-fs-filename */
     // The static middleware will only server GET/HEAD requests, so we can mount
     // the middleware using `use()` rather than resorting to `get()`
-    const govukFrontendDirectory = (0, node_path_1.resolve)((0, node_module_1.createRequire)(dirname_cjs_1.default).resolve("govuk-frontend"), "../../");
+    const govukFrontendDirectory = resolve(createRequire(import.meta.dirname).resolve("govuk-frontend"), "../../");
     router.use("/govuk/govuk-frontend.min.js", ExpressStatic(`${govukFrontendDirectory}/govuk/govuk-frontend.min.js`, staticConfig));
     router.use("/govuk/govuk-frontend.min.js.map", ExpressStatic(`${govukFrontendDirectory}/govuk/govuk-frontend.min.js.map`, staticConfig));
     router.use("/govuk/assets", ExpressStatic(`${govukFrontendDirectory}/govuk/assets`, staticConfig));
     router.use("/govuk/assets", notFoundHandler);
-    router.get("/casa/assets/css/casa.css", setHeaders, (req, res) => res.send(casaCss.replace(/~~~CASA_MOUNT_URL~~~/g, (0, utils_js_1.validateUrlPath)(`${req.baseUrl}/`))));
-    router.use("/casa/assets/css/casa.css.map", ExpressStatic((0, node_path_1.resolve)(dirname_cjs_1.default, "../../dist/assets/css/casa.css.map")));
+    router.get("/casa/assets/css/casa.css", setHeaders, (req, res) => res.send(casaCss.replace(/~~~CASA_MOUNT_URL~~~/g, validateUrlPath(`${req.baseUrl}/`))));
+    router.use("/casa/assets/css/casa.css.map", ExpressStatic(resolve(import.meta.dirname, "../../dist/assets/css/casa.css.map")));
     router.use("/casa/assets", notFoundHandler);
     return router;
 }
-//# sourceMappingURL=static.js.map

package/package.json

@@ -1,18 +1,14 @@
 {
   "name": "@dwp/govuk-casa",
-  "version": "9.7.0",
+  "version": "10.1.0",
   "description": "A framework for building GOVUK Collect-And-Submit-Applications",
   "repository": {
     "type": "git",
     "url": "git@github.com:dwp/govuk-casa.git"
   },
+  "type": "module",
   "main": "dist/casa.js",
-  "module": "dist/mjs/casa.js",
-  "exports": {
-    "types": "./dist/casa.d.ts",
-    "import": "./dist/mjs/esm-wrapper.js",
-    "require": "./dist/casa.js"
-  },
+  "types": "dist/casa.d.ts",
   "files": [
     "dist/**/*",
     "locales/**/*",
@@ -22,14 +18,15 @@
     "!src/core-plugins/**/tests/"
   ],
   "engines": {
-    "node": ">=18 <=24",
-    "npm": ">=8 <=11"
+    "node": ">=22",
+    "npm": ">=10"
   },
   "scripts": {
     "pipeline": "npm run coverage && npm run lint",
     "coverage": "c8 npm test",
-    "test": "npm run test:unit && npm run test:e2e && npm run core-plugin:edit-snapshot:test:e2e",
-    "test:unit": "mocha './tests/**/*.test.js'",
+    "test": "npm run test:mkdir && npm run test:unit && npm run test:e2e && npm run core-plugin:edit-snapshot:test:e2e",
+    "test:mkdir": "node -e 'require(`node:fs/promises`).mkdir(`./.junit`).catch((err) => err.code !== `EEXIST` && console.error(err))'",
+    "test:unit": "node --test --test-reporter=junit --test-reporter-destination=.junit/unit.xml --test-reporter=spec --test-reporter-destination=stdout",
     "test:e2e": "spiderplan --worker-init ./tests/e2e/worker-init.js --language en ./tests/e2e/personas/**/*.yaml",
     "test:dast": "spiderplan --worker-init ./tests/e2e/worker-init.js --language en ./tests/e2e/personas/**/traversal.yaml --workers 1 --zap --zap-proxy 'http://localhost:8080/' --zap-target-hostname 'host.docker.internal'",
     "test:dast:report": "curl -s --header 'X-ZAP-Api-Key: secret' http://localhost:8080/OTHER/core/other/htmlreport > gl-dast-report.html",
@@ -39,7 +36,7 @@
     "lint": "eslint .",
     "build": "npm run build:prepare && npm run build:sources && npm run build:css-assets",
     "build:prepare": "rm -rf dist/* && mkdir -p dist/assets/js/ && mkdir -p dist/assets/css/",
-    "build:sources": "tsc -p tsconfig-cjs.json && ./scripts/fixup.sh && node scripts/esm-wrapper",
+    "build:sources": "tsc -p tsconfig.json && sed 1d ./src/globals.d.ts >> dist/casa.d.ts",
     "build:css-assets": "node scripts/compile-sass.js",
     "build:api-docs": "npx jsdoc -c ./jsdoc.json -d ./docs/api/ --debug -P '' -r -R ./README.md --verbose -t ./node_modules/docdash ./src",
     "prepare": "npm run build",
@@ -50,22 +47,22 @@
   "keywords": [],
   "author": "DWP Digital",
   "license": "ISC",
-  "type": "module",
   "dependencies": {
-    "@dagrejs/graphlib": "2.2.4",
+    "@dagrejs/graphlib": "4.0.1",
+    "@fastify/deepmerge": "3.2.1",
     "bytes": "3.1.2",
     "cookie-parser": "1.4.7",
     "csrf-sync": "4.2.1",
     "debug": "4.4.3",
-    "deepmerge": "4.3.1",
-    "express": "4.22.1",
+    "express": "5.2.1",
     "express-session": "1.19.0",
-    "govuk-frontend": "5.14.0",
-    "helmet": "8.1.0",
-    "i18next": "25.10.10",
-    "i18next-http-middleware": "3.9.6",
+    "fast-equals": "6.0.0",
+    "govuk-frontend": "6.1.0",
+    "helmet": "8.2.0",
+    "i18next": "26.3.0",
+    "i18next-http-middleware": "3.9.7",
+    "is-plain-obj": "4.1.0",
     "js-yaml": "4.1.1",
-    "lodash": "4.18.1",
     "luxon": "3.7.2",
     "nunjucks": "3.2.4",
     "path-to-regexp": "8.4.2",
@@ -73,35 +70,32 @@
     "validator": "13.15.35"
   },
   "devDependencies": {
-    "@dwp/casa-spiderplan": "4.6.2",
-    "@dwp/casa-spiderplan-a11y-plugin": "1.1.0",
-    "@dwp/casa-spiderplan-zap-plugin": "1.1.0",
+    "@dwp/casa-spiderplan": "5.0.0",
+    "@dwp/casa-spiderplan-a11y-plugin": "2.0.0",
+    "@dwp/casa-spiderplan-zap-plugin": "2.0.0",
     "@dwp/commitlint-config-base": "5.0.0",
     "@dwp/eslint-config-base": "9.0.2",
     "@types/express": "5.0.6",
     "@types/luxon": "3.7.1",
-    "@types/node": "25.6.0",
+    "@types/node": "25.9.1",
     "@types/nunjucks": "3.2.6",
     "c8": "11.0.0",
-    "chai": "6.2.2",
-    "cheerio": "1.0.0",
-    "commitlint": "20.5.3",
+    "cheerio": "1.2.0",
+    "commitlint": "21.0.1",
     "docdash": "2.0.2",
     "eslint": "9.39.4",
     "eslint-plugin-import": "2.32.0",
-    "eslint-plugin-jsdoc": "62.9.0",
-    "eslint-plugin-security": "3.0.1",
-    "eslint-plugin-sonarjs": "3.0.7",
-    "fast-check": "4.7.0",
+    "eslint-plugin-jsdoc": "63.0.0",
+    "eslint-plugin-security": "4.0.0",
+    "eslint-plugin-sonarjs": "4.0.3",
+    "fast-check": "4.8.0",
     "jsdoc": "4.0.5",
     "jsdoc-tsimport-plugin": "1.0.5",
-    "mocha": "11.7.5",
     "prettier": "3.8.3",
     "prettier-plugin-jsdoc": "1.8.0",
-    "sass": "1.99.0",
-    "sinon": "22.0.0",
+    "sass": "1.100.0",
     "supertest": "7.2.2",
     "ts-api-utils": "2.5.0",
-    "typescript": "5.9.3"
+    "typescript": "6.0.3"
   }
 }

package/src/casa.js

@@ -48,6 +48,9 @@ export {
 // These exist here so that consumer can import CASA's internal types
 
 /** @typedef {import("./lib/field").PageField} PageField */
+/** @typedef {import("express").Request} ExpressRequest */
+/** @typedef {import("express").RequestHandler} RequestHandler */
+/** @typedef {import("helmet").HelmetOptions} HelmetOptions */
 
 /**
  * @typedef {object} ContextEventHandlerOptions
@@ -76,11 +79,19 @@ export {
  * @property {ContextEventHandler} handler Handler to invoke when change happens
  */
 
+/**
+ * @callback ErrorVisibiltyFunction
+ * @param {object} opts Options
+ * @param {ExpressRequest} opts.req Request
+ */
+
 /**
  * @typedef {object} Page Page configuration. A Page is the interactive
  *   representation of a waypoint
  * @property {string} waypoint The waypoint with which this page is associated
  * @property {string} view Template path
+ * @property {ErrorVisibiltyFunction | symbol} [errorVisibility] Should page
+ *   validation errors be visible on GET requests
  * @property {PageHook[]} [hooks=[]] Page-specific hooks (optional, default []).
  *   Default is `[]`
  * @property {PageField[]} [fields=[]] Fields to be managed on this page
@@ -99,8 +110,8 @@ export {
 /**
  * @typedef {object} GlobalHook Hook configuration
  * @property {string} hook Hook name in format `<router>.<hook>`
- * @property {Function} middleware Middleware function to insert at the hook
- *   point
+ * @property {RequestHandler} middleware Middleware function to insert at the
+ *   hook point
  * @property {string | RegExp} [path=undefined] Only run if route path matches
  *   this string/regexp. Default is `undefined`
  */
@@ -108,8 +119,8 @@ export {
 /**
  * @typedef {object} PageHook (extends GlobalHook)
  * @property {string} hook Hook name (without a scope prefix)
- * @property {Function} middleware Middleware function to insert at the hook
- *   point
+ * @property {RequestHandler} middleware Middleware function to insert at the
+ *   hook point
  */
 
 /**
@@ -145,8 +156,16 @@ export {
 
 /**
  * @callback HelmetConfigurator
- * @param {object} config A default Helmet configuration provided by CASA
- * @returns {object} The modified configuration object
+ * @param {HelmetOptions} config A default Helmet configuration provided by CASA
+ * @returns {HelmetOptions} The modified configuration object
+ */
+
+/**
+ * @typedef {Omit<
+ *   import("nunjucks").Environment &
+ *     import("./lib/CasaTemplateLoader.js").default,
+ *   "getSource"
+ * >} CasaNunjucksEnvironment
  */
 
 /**
@@ -160,9 +179,12 @@ export {
  *
  * @callback Mounter
  * @param {import("express").Express} app Express application
- * @param {object} opts Mounting options
+ * @param {object} [opts] Mounting options
  * @param {string} [opts.route='/'] Optional route to attach all
  *   middleware/routers too. Default is `'/'`
+ * @param {boolean} [opts.serveFirstWaypoint=false] Automatically redirect
+ *   requests to the mount route to the first waypoint in the plan. Default is
+ *   `false`
  * @returns {import("express").Express} The prepared ExpressJS app instance
  */
 
@@ -188,32 +210,26 @@ export {
  *   to ingest. Default is `"50KB"`
  * @property {ContextIdGenerator} [contextIdGenerator] Custom context ID
  *   generator
- * @property {symbol | Function} [errorVisibility] Option to keep page errors
- *   active on GET request
- * @property {boolean} [govukRebrand=false] Sets whether you wish to use the
- *   govuk rebrand. Default is `false`
+ * @property {symbol | ErrorVisibiltyFunction} [errorVisibility] Option to keep
+ *   page errors active on GET request
  */
 
 /**
  * @typedef {object} ConfigureResult Result of a call to configure() function
- * @property {import("nunjucks").Environment} nunjucksEnv Nunjucks environment
+ * @property {CasaNunjucksEnvironment} nunjucksEnv Nunjucks environment
  * @property {MutableRouter} staticRouter Router handling all static assets
  * @property {MutableRouter} ancillaryRouter Router handling ancillary routes
  * @property {MutableRouter} journeyRouter Router handling all waypoint requests
- * @property {import("express").RequestHandler[]} preMiddleware Middleware
- *   mounted before everything
- * @property {import("express").RequestHandler[]} postMiddleware Middleware
- *   mounted after everything
- * @property {import("express").RequestHandler[]} csrfMiddleware CSRF get/set
- *   form middleware
- * @property {import("express").RequestHandler} sessionMiddleware Session
- *   middleware
- * @property {import("express").RequestHandler[]} cookieParserMiddleware
- *   Cookie-parsing middleware
- * @property {import("express").RequestHandler[]} i18nMiddleware I18n
- *   preparation middleware
- * @property {import("express").RequestHandler} bodyParserMiddleware Body
- *   parsing middleware
+ * @property {RequestHandler[]} preMiddleware Middleware mounted before
+ *   everything
+ * @property {RequestHandler[]} postMiddleware Middleware mounted after
+ *   everything
+ * @property {RequestHandler[]} csrfMiddleware CSRF get/set form middleware
+ * @property {RequestHandler} sessionMiddleware Session middleware
+ * @property {RequestHandler[]} cookieParserMiddleware Cookie-parsing middleware
+ * @property {RequestHandler[]} i18nMiddleware I18n preparation middleware
+ * @property {RequestHandler} bodyParserMiddleware Body parsing middleware
+ * @property {RequestHandler[]} dataMiddleware Data decoration middleware
  * @property {Mounter} mount Function used to mount all CASA artifacts onto an
  *   ExpressJS app
  * @property {ConfigurationOptions} config Ingested config supplied to
@@ -342,13 +358,19 @@ export {
  * @returns {boolean} Returns true is route should be followed
  */
 
+/**
+ * @callback StopCondition
+ * @param {PlanRoute} route Route metadata
+ * @returns {boolean} Returns true is traversal should be stopped
+ */
+
 /**
  * @typedef PlanTraverseOptions
  * @property {string} [startWaypoint] Waypoint from which to start (defaults to
  *   first in list)
  * @property {string} routeName Follow routes matching this name (next | prev)
  * @property {Map} history Used to detect loops in traversal (INTERNAL USE ONLY)
- * @property {Function} [stopCondition] If true, traversal will be stopped
+ * @property {StopCondition} [stopCondition] If true, traversal will be stopped
  *   (useful for performance)
  * @property {string | PlanArbiter} [arbiter] Multiple target routes found, this
  *   decides which to use
@@ -369,18 +391,26 @@ export {
  *   could eliminate
  */
 
+/**
+ * @typedef {object} JourneyContextIdentity Journey Context Identity Object
+ * @property {string} [id] The context ID
+ * @property {string} [name] Context name
+ * @property {string[]} [tags] JouneyContext tags
+ */
+
 /**
  * @typedef {object} JourneyContextObject Journey Context Object
  * @property {Record<string, any>} [data] Data
- * @property {any} [validation] Validation state
- * @property {any} [nav] Navigation meta
- * @property {any} [identity] Identity meta
+ * @property {Record<string, ValidationError[] | null>} [validation] Validation
+ *   state
+ * @property {object} [nav] Navigation meta
+ * @property {JourneyContextIdentity} [identity] Identity meta
  */
 
 /**
  * @typedef ContextIdGeneratorParams
  * @property {object} args Arguments
- * @property {import("express").Request} args.req Request
+ * @property {ExpressRequest} args.req Request
  * @property {[string]} args.reservedIds List of IDs already in use in session
  *   or request
  */
@@ -399,3 +429,5 @@ export {
  * @param {ContextIdGeneratorParams} params Parameters
  * @returns {string} A newly generated GUID
  */
+
+/** @typedef {import("../src/globals.d.ts")} */