@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.131

package/ds-canonical/fork/consumer/managed-files/c4aa767f11714467de0038a2149cf78074baddc17fc6a9e074b6aed7544c6f3c.blob

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// verify-consumer-css-entry.mjs — 機械保證 consumer CSS 入口完整,防 globals.css「掉東掉西」drift
+//
+// Why(2026-05-29,user「為何 globals.css 老讓 template 掉東西?怎麼永遠避免?」):
+//   consumer(apps + storybook)的 CSS 入口必須含 3 片段才能正確消費 DS,缺任一就 drift:
+//     1. `@import 'tailwindcss'`            — Tailwind v4 引擎(缺 → 完全沒 utility class)
+//     2. `@import '@qijenchen/design-system/styles/tokens'` — tokens + base 層(缺 → 字體/底色/間距退預設,即字體 drift bug)
+//        (base 層 2026-05-29 已併入 tokens aggregator,故單一 import 即拿 tokens+base)
+//     3. `@source '...design-system...src...'` — Tailwind scan DS 元件原始碼產對應 utility(缺 → DS 元件 unstyled「沒吃到元件」bug)
+//   過去這 3 個都各 drift 過(font / 沒吃到元件)。本 script = 那層缺失的機械保證。
+//
+// Scan:遞迴掃 apps/ + .storybook/ + template/ + src/ 全部 .css,抓所有 Tailwind 入口(`@import 'tailwindcss'`),
+//   排除 DS-internal dev 入口(用相對 workspace path import DS 的 repo-root globals.css),其餘視為 consumer 入口必檢。
+//   2026-05-29 加固:從固定候選路徑改遞迴掃描 → 非標準路徑/檔名的 consumer 入口也抓得到(codex Q4 boundary #1 閉合)。
+// 用法:node scripts/verify-consumer-css-entry.mjs(CI / 手動)。fork repo 同 script 自驗。
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+
+const TAILWIND_ENTRY = /@import\s+['"]tailwindcss['"]/
+// DS-internal dev 入口(repo-root src/globals.css)用相對 workspace path import DS,合法用個別 token import + 相對 base.css,
+// 非 consumer 路徑 → 排除,不要求 npm-path 的 tokens aggregator import。
+const DS_INTERNAL = /@import\s+['"]\.\.?\/[^'"]*packages\/(design-system|storybook-config)/
+
+// 2026-05-29 加固(user「做到完美」+ codex Q4 boundary #1):不再只掃固定候選路徑,
+// 改遞迴掃 consumer 領域全部 .css → 抓所有 Tailwind 入口(含非標準路徑檔名)→ 排除 DS-internal → 其餘必須完整。
+// 用手寫 walker 而非 fs.globSync:後者 `**` 不匹配 dot 目錄(.storybook)→ 會漏 storybook 入口。
+const SKIP_DIR = new Set(['node_modules', 'dist', 'storybook-static', '.git'])
+function walkCss(rel) {
+  const abs = join(ROOT, rel)
+  if (!existsSync(abs)) return []
+  const out = []
+  for (const e of readdirSync(abs, { withFileTypes: true })) {
+    if (SKIP_DIR.has(e.name)) continue
+    const child = rel ? `${rel}/${e.name}` : e.name
+    if (e.isDirectory()) out.push(...walkCss(child))
+    else if (e.name.endsWith('.css')) out.push(child)
+  }
+  return out
+}
+const SCAN_DIRS = ['apps', '.storybook', 'template', 'src']
+const allCss = SCAN_DIRS.flatMap(walkCss)
+
+// Consumer 入口 = Tailwind 入口 且 非 DS-internal dev 入口。
+const candidates = allCss.filter((p) => {
+  const css = readFileSync(join(ROOT, p), 'utf8')
+  return TAILWIND_ENTRY.test(css) && !DS_INTERNAL.test(css)
+})
+
+const REQUIRED = [
+  { name: "@import 'tailwindcss'", re: /@import\s+['"]tailwindcss['"]/ },
+  { name: "@import '@qijenchen/design-system/styles/tokens'", re: /@import\s+['"]@qijenchen\/design-system\/styles\/tokens['"]/ },
+  { name: "@source '...design-system...src...'", re: /@source\s+['"][^'"]*@qijenchen\/design-system\/src/ },
+]
+
+let failed = false
+for (const rel of candidates) {
+  const css = readFileSync(join(ROOT, rel), 'utf8')
+  const missing = REQUIRED.filter((r) => !r.re.test(css))
+  if (missing.length) {
+    failed = true
+    console.error(`❌ ${rel} 缺 consumer CSS 必要片段:`)
+    for (const m of missing) console.error(`   - ${m.name}`)
+  } else {
+    console.log(`✓ ${rel}(tailwind + tokens+base + @source 齊全)`)
+  }
+}
+
+if (candidates.length === 0) {
+  console.log('（無 consumer CSS 入口可檢 — 非 consumer repo 或無 apps/storybook）')
+  process.exit(0)
+}
+if (failed) {
+  console.error('\n消費端 CSS 入口不完整 → DS 元件會 drift(字體/底色/unstyled)。補齊上述片段。')
+  process.exit(1)
+}
+console.log('\n✅ 所有 consumer CSS 入口完整(tailwind + tokens+base + DS @source）— globals.css drift 防線通過')

package/ds-canonical/fork/consumer/managed-files/c893e9b734b162f4c631fef871128c16a9ab565f796a0e76d7f320f821f220f5.blob

@@ -0,0 +1,41 @@
+import { execFileSync } from 'node:child_process'
+import { lstatSync, realpathSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+function invariant(condition, message) {
+  if (!condition) throw new Error(`GOV-WORKSPACE-SETUP-001:${message}`)
+}
+
+function regularScript(root, path) {
+  const absolute = join(root, path)
+  const info = lstatSync(absolute)
+  invariant(info.isFile() && !info.isSymbolicLink() && info.nlink === 1 && realpathSync(absolute) === absolute, `workspace setup script is unsafe:${path}`)
+  return path
+}
+
+export function runWorkspacePostCreate({
+  root: requestedRoot,
+  runner = execFileSync,
+  environment = process.env,
+} = {}) {
+  const root = realpathSync(resolve(requestedRoot))
+  const workspaceSetup = regularScript(root, 'scripts/setup-workspace.mjs')
+  const banner = regularScript(root, '.devcontainer/onboard-banner.sh')
+  const steps = [
+    ['jq prerequisite', 'jq', ['--version']],
+    ['complete provider-neutral workspace setup', process.execPath, [workspaceSetup]],
+    ['onboarding banner', 'bash', [banner]],
+  ]
+  for (const [label, command, args] of steps) {
+    console.log(`\n[post-create] ${label}`)
+    runner(command, args, {
+      cwd: root,
+      env: environment,
+      shell: false,
+      stdio: 'inherit',
+      timeout: 6 * 60 * 60 * 1_000,
+      windowsHide: true,
+    })
+  }
+  return { root, steps: steps.map(([label]) => label) }
+}

package/ds-canonical/fork/consumer/managed-files/cd9c61f8ff24fb9bcc3663e346e2cfa419cfb84e02aae18d3dc66dd192681696.blob

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/github-cli:1.1.0": {
+      "version": "1.1.0",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
+      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
+    }
+  }
+}

package/ds-canonical/fork/consumer/managed-files/da2ad2737315d25a5300905ddefd62f1695056a8a1af155c5b34170ad9923bce.blob

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Codespaces onboarding; versions and governance snapshot were installed/verified by postCreateCommand.
+
+cat <<'BANNER'
+
+╭─────────────────────────────────────────────────────────────╮
+│  Codespace ready                                             │
+│  Node >=22.12.0 + Claude Code + Codex                      │
+│  Exact npm snapshot + hooks-off governance check passed      │
+╰─────────────────────────────────────────────────────────────╯
+
+Choose either provider (both read the same governance SSOT):
+
+  $ claude
+  $ codex
+
+No plugin or session-time install is required. Native hooks are fast
+feedback; `npm run governance:check -- --hooks-off` + CI are authoritative.
+Post-create ran the one provider-neutral setup entrypoint. Revalidate with:
+
+  $ npm run setup:all
+
+Product setup:
+
+  $ npm run create-app <kebab-name>
+  $ npm run storybook
+  $ npm run setup:netlify
+
+Netlify setup is Dashboard-only while the reviewed CLI candidate is blocked.
+The command prints the manual steps and intentionally exits 2; no CLI is installed or invoked.
+
+Netlify password (free edge-function path): add
+STORYBOOK_BASIC_AUTH=user:password in Site configuration → Environment variables.
+Credentials stay in Netlify and never enter Git.
+
+See README.md and docs/01-first-time-setup.md.
+
+BANNER

package/ds-canonical/fork/consumer/managed-files/e26057408661597aac4a57cdf7e30e2f9d0afb1b9a2dbbb692c3805cd9028ca5.blob

@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+// Dependency-free, committed workflow data validator.
+//
+// Workflows may pass data to this CLI, but they must never pass JavaScript source
+// through node -e/-p/--eval/--print or stdin. Keep every accepted operation and
+// package field closed here so untrusted paths/values remain data, not code.
+
+import { lstatSync, readFileSync, realpathSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const MAX_MANIFEST_BYTES = 1024 * 1024
+const ALLOWED_DEPENDENCIES = new Set([
+  '@qijenchen/design-system',
+  '@qijenchen/storybook-config',
+])
+
+function invariant(condition, message) {
+  if (!condition) throw new Error(`WF-STATIC-VALIDATION-001:${message}`)
+}
+
+function compareAscii(left, right) {
+  return left === right ? 0 : left < right ? -1 : 1
+}
+
+function compareNumericIdentifier(left, right) {
+  return left.length - right.length || compareAscii(left, right)
+}
+
+function isNonCanonicalNumericIdentifier(identifier) {
+  return identifier.length > 1 && identifier.startsWith('0')
+}
+
+export function parseExactSemver(value, {
+  allowBuild = true,
+  allowLegacyPrefix = false,
+} = {}) {
+  invariant(typeof value === 'string' && value.length > 0, 'semantic version must be a non-empty string')
+  let candidate = value
+  if (allowLegacyPrefix && /^[~^]/.test(candidate)) candidate = candidate.slice(1)
+  const match = candidate.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+([0-9A-Za-z.-]+))?$/)
+  invariant(match, `exact semantic version required; received ${JSON.stringify(value)}`)
+  const core = match.slice(1, 4)
+  const prerelease = match[4]?.split('.') ?? null
+  const build = match[5]?.split('.') ?? null
+  invariant(!core.some(isNonCanonicalNumericIdentifier), `non-canonical numeric core in ${JSON.stringify(value)}`)
+  invariant(
+    !prerelease?.some(identifier => (
+      identifier.length === 0
+      || (/^\d+$/.test(identifier) && isNonCanonicalNumericIdentifier(identifier))
+    )),
+    `non-canonical prerelease in ${JSON.stringify(value)}`,
+  )
+  invariant(!build?.some(identifier => identifier.length === 0), `non-canonical build metadata in ${JSON.stringify(value)}`)
+  invariant(allowBuild || build === null, `build metadata is forbidden in ${JSON.stringify(value)}`)
+  return Object.freeze({
+    build: build === null ? null : Object.freeze(build),
+    core: Object.freeze(core),
+    normalized: `${core.join('.')}${prerelease === null ? '' : `-${prerelease.join('.')}`}${build === null ? '' : `+${build.join('.')}`}`,
+    prerelease: prerelease === null ? null : Object.freeze(prerelease),
+  })
+}
+
+export function compareExactSemver(leftValue, rightValue, {
+  rightAllowsLegacyPrefix = false,
+} = {}) {
+  const left = parseExactSemver(leftValue, { allowBuild: false })
+  const right = parseExactSemver(rightValue, {
+    allowBuild: false,
+    allowLegacyPrefix: rightAllowsLegacyPrefix,
+  })
+  for (let index = 0; index < 3; index += 1) {
+    if (left.core[index] !== right.core[index]) {
+      return compareNumericIdentifier(left.core[index], right.core[index])
+    }
+  }
+  const x = left.prerelease
+  const y = right.prerelease
+  if (x === null || y === null) return x === y ? 0 : x === null ? 1 : -1
+  for (let index = 0; index < Math.max(x.length, y.length); index += 1) {
+    if (x[index] === undefined || y[index] === undefined) return x[index] === undefined ? -1 : 1
+    if (x[index] === y[index]) continue
+    const leftNumeric = /^\d+$/.test(x[index])
+    const rightNumeric = /^\d+$/.test(y[index])
+    if (leftNumeric && rightNumeric) return compareNumericIdentifier(x[index], y[index])
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1
+    return compareAscii(x[index], y[index])
+  }
+  return 0
+}
+
+function regularManifest(pathValue) {
+  invariant(typeof pathValue === 'string' && pathValue.length > 0, 'manifest path must be non-empty')
+  const path = resolve(pathValue)
+  const info = lstatSync(path)
+  invariant(
+    info.isFile() && !info.isSymbolicLink() && info.nlink === 1 && realpathSync(path) === path,
+    `manifest must be a single-link regular file with no symlink ancestry:${path}`,
+  )
+  invariant(info.size > 0 && info.size <= MAX_MANIFEST_BYTES, `manifest byte size is outside the closed limit:${path}`)
+  let manifest
+  try {
+    manifest = JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(`WF-STATIC-VALIDATION-001:manifest is invalid JSON:${path}:${error.message}`)
+  }
+  invariant(manifest && typeof manifest === 'object' && !Array.isArray(manifest), `manifest root must be an object:${path}`)
+  return Object.freeze({ manifest, path })
+}
+
+function packageVersion(pathValue) {
+  const { manifest, path } = regularManifest(pathValue)
+  parseExactSemver(manifest.version, { allowBuild: false })
+  return Object.freeze({ path, value: manifest.version })
+}
+
+function exactNpmVersion(pathValue) {
+  const { manifest, path } = regularManifest(pathValue)
+  const value = manifest.devDependencies?.npm
+  parseExactSemver(value, { allowBuild: false })
+  return Object.freeze({ path, value })
+}
+
+function dependencySpec(pathValue, packageName) {
+  invariant(ALLOWED_DEPENDENCIES.has(packageName), `dependency is outside the closed workflow set:${String(packageName)}`)
+  const { manifest, path } = regularManifest(pathValue)
+  const value = manifest.dependencies?.[packageName]
+  invariant(typeof value === 'string' && value.length > 0, `manifest has no exact ${packageName} dependency:${path}`)
+  return Object.freeze({ path, value })
+}
+
+export function assertPackageVersion({ manifestPath, expected }) {
+  parseExactSemver(expected, { allowBuild: false })
+  const observed = packageVersion(manifestPath)
+  invariant(observed.value === expected, `${observed.path} version ${JSON.stringify(observed.value)} differs from ${JSON.stringify(expected)}`)
+  return observed
+}
+
+export function assertPackageDependency({ manifestPath, packageName, expected }) {
+  parseExactSemver(expected, { allowBuild: false })
+  const observed = dependencySpec(manifestPath, packageName)
+  invariant(observed.value === expected, `${observed.path} ${packageName} ${JSON.stringify(observed.value)} differs from ${JSON.stringify(expected)}`)
+  return observed
+}
+
+export function assertMirrorVersionFloor({
+  rootManifestPath,
+  appManifestPath,
+  builtVersion,
+}) {
+  parseExactSemver(builtVersion, { allowBuild: false })
+  const observed = [
+    ['root design-system', dependencySpec(rootManifestPath, '@qijenchen/design-system').value],
+    ['root storybook-config', dependencySpec(rootManifestPath, '@qijenchen/storybook-config').value],
+    ['app design-system', dependencySpec(appManifestPath, '@qijenchen/design-system').value],
+  ]
+  const normalized = observed.map(([label, spec]) => [
+    label,
+    spec,
+    parseExactSemver(spec, { allowBuild: false, allowLegacyPrefix: true }).normalized,
+  ])
+  const versions = new Set(normalized.map(([, , version]) => version))
+  invariant(
+    versions.size === 1,
+    `target package versions are not one canonical release:${normalized.map(([label, spec]) => `${label}=${spec}`).join(',')}`,
+  )
+  const currentVersion = normalized[0][2]
+  invariant(
+    compareExactSemver(builtVersion, currentVersion) >= 0,
+    `refusing mirror downgrade ${builtVersion} < ${currentVersion}`,
+  )
+  return Object.freeze({ builtVersion, currentVersion })
+}
+
+function parseClosedFlags(args, allowed) {
+  invariant(args.length % 2 === 0, 'every option must have exactly one value')
+  const values = new Map()
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index]
+    const value = args[index + 1]
+    invariant(allowed.has(flag), `unknown option:${String(flag)}`)
+    invariant(!values.has(flag), `duplicate option:${flag}`)
+    invariant(typeof value === 'string' && value.length > 0 && !value.startsWith('--'), `missing value:${flag}`)
+    values.set(flag, value)
+  }
+  invariant(values.size === allowed.size, `required options are ${[...allowed].join(',')}`)
+  return values
+}
+
+export function runWorkflowStaticValidationCli(args, { stdout = process.stdout } = {}) {
+  invariant(Array.isArray(args) && args.length >= 1, 'one closed command is required')
+  const [command, ...options] = args
+  if (command === 'assert-exact-semver') {
+    const values = parseClosedFlags(options, new Set(['--value']))
+    parseExactSemver(values.get('--value'))
+    return
+  }
+  if (command === 'print-package-version') {
+    const values = parseClosedFlags(options, new Set(['--manifest']))
+    stdout.write(`${packageVersion(values.get('--manifest')).value}\n`)
+    return
+  }
+  if (command === 'print-exact-npm-version') {
+    const values = parseClosedFlags(options, new Set(['--manifest']))
+    stdout.write(`${exactNpmVersion(values.get('--manifest')).value}\n`)
+    return
+  }
+  if (command === 'assert-package-version') {
+    const values = parseClosedFlags(options, new Set(['--manifest', '--expected']))
+    assertPackageVersion({
+      manifestPath: values.get('--manifest'),
+      expected: values.get('--expected'),
+    })
+    return
+  }
+  if (command === 'assert-package-dependency') {
+    const values = parseClosedFlags(options, new Set(['--manifest', '--package', '--expected']))
+    assertPackageDependency({
+      manifestPath: values.get('--manifest'),
+      packageName: values.get('--package'),
+      expected: values.get('--expected'),
+    })
+    return
+  }
+  if (command === 'assert-mirror-version-floor') {
+    const values = parseClosedFlags(options, new Set([
+      '--root-manifest',
+      '--app-manifest',
+      '--built-version',
+    ]))
+    assertMirrorVersionFloor({
+      rootManifestPath: values.get('--root-manifest'),
+      appManifestPath: values.get('--app-manifest'),
+      builtVersion: values.get('--built-version'),
+    })
+    return
+  }
+  invariant(false, `unknown command:${String(command)}`)
+}
+
+const isMain = process.argv[1]
+  && realpathSync(resolve(process.argv[1])) === realpathSync(fileURLToPath(import.meta.url))
+if (isMain) {
+  try {
+    runWorkflowStaticValidationCli(process.argv.slice(2))
+  } catch (error) {
+    console.error(`❌ workflow static validation failed:${error.message}`)
+    process.exit(1)
+  }
+}

package/ds-canonical/fork/consumer/managed-files/e68ae1915965d8e17d4b2441c00c2b97fe062ea308ae8535c9eebb2fc16fa245.blob

@@ -0,0 +1,20 @@
+{
+  "$schema": "./schemas/visual-baseline-review-policy.schema.json",
+  "schemaVersion": 1,
+  "kind": "visual-baseline-review-trust-policy",
+  "status": "not-activated",
+  "issuerRegistryPath": "trust/issuers.json",
+  "issuerRegistrySha256": "b4da935a9d39239f99fdb15f9ee0a05b538ac0c427b32b77fce8010560fdef2b",
+  "human": {
+    "status": "not-activated",
+    "allowedKeyIds": []
+  },
+  "managedBroker": {
+    "status": "not-activated",
+    "allowedKeyIds": [],
+    "activationEvidencePath": null,
+    "activationEvidenceSha256": null,
+    "modelAuthorityPolicyDigest": null,
+    "brokerPolicyDigest": null
+  }
+}

package/ds-canonical/fork/consumer/managed-files/e71c65f45c6af7ce12b6b3c0d8028f185da5b719e2050c9b2a6b243d41ae4878.blob

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+// audit-consumer-a11y.mjs — Phase 5 consumer-side a11y check on built apps
+//
+// 在 consumer repo CI 跑(audit.yml 後 build step):
+//   1. apps/*/dist 已 build
+//   2. serve each app from an owned ephemeral 127.0.0.1 capability
+//   3. Playwright + @axe-core 跑 WCAG 2 A+AA
+//   4. fail = block PR
+//
+// 對齊 DS repo `npm run a11y:check`(scripts/audit-a11y.mjs)的 consumer-side equivalent。
+
+import { existsSync, lstatSync, readdirSync, realpathSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { chromium } from 'playwright'
+import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
+import { resolveA11yStaticFile, startA11yStaticServer } from './lib/a11y-static-server.mjs'
+
+const require = createRequire(import.meta.url)
+const axeBundle = require.resolve('axe-core/axe.min.js')
+const SCRIPT_PATH = fileURLToPath(import.meta.url)
+
+const APPS_DIR = 'apps'
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function nonEmptySingleLine(value, label) {
+  if (typeof value !== 'string' || !value || /[\0\r\n]/.test(value)) throw new Error(`${label} must be a non-empty single-line string`)
+  return value
+}
+
+/** Refuse malformed transport output instead of treating missing `length` as zero violations. */
+export function validateAxeViolations(violations) {
+  if (!Array.isArray(violations)) throw new Error('axe result violations must be an array')
+  for (const [violationIndex, violation] of violations.entries()) {
+    if (!isRecord(violation)) throw new Error(`axe violation ${violationIndex} must be an object`)
+    nonEmptySingleLine(violation.id, `axe violation ${violationIndex} id`)
+    nonEmptySingleLine(violation.description, `axe violation ${violationIndex} description`)
+    if (!Array.isArray(violation.nodes) || violation.nodes.length === 0) {
+      throw new Error(`axe violation ${violation.id} nodes must be a non-empty array`)
+    }
+    for (const [nodeIndex, node] of violation.nodes.entries()) {
+      if (!isRecord(node)) throw new Error(`axe violation ${violation.id} node ${nodeIndex} must be an object`)
+      if (typeof node.html !== 'string' || !node.html) throw new Error(`axe violation ${violation.id} node ${nodeIndex} html must be non-empty`)
+      if (!Array.isArray(node.target) || node.target.length === 0) {
+        throw new Error(`axe violation ${violation.id} node ${nodeIndex} target must be a non-empty array`)
+      }
+      for (const target of node.target) {
+        const validTarget = typeof target === 'string'
+          ? target.length > 0
+          : Array.isArray(target) && target.length > 0 && target.every(part => typeof part === 'string' && part.length > 0)
+        if (!validTarget) throw new Error(`axe violation ${violation.id} node ${nodeIndex} target is malformed`)
+      }
+    }
+  }
+  return violations
+}
+
+export function discoverBuiltApps(appsDir = APPS_DIR) {
+  if (!existsSync(appsDir)) return []
+  const appsInfo = lstatSync(appsDir)
+  if (!appsInfo.isDirectory() || appsInfo.isSymbolicLink()) throw new Error('apps root must be a regular non-symlink directory')
+  const apps = []
+  for (const name of readdirSync(appsDir).sort()) {
+    const appPath = join(appsDir, name)
+    const info = lstatSync(appPath)
+    if (info.isSymbolicLink()) throw new Error(`${name}: app root may not be a symlink`)
+    if (info.isDirectory()) apps.push(name)
+  }
+  for (const app of apps) {
+    const distPath = join(appsDir, app, 'dist')
+    const indexPath = resolveA11yStaticFile(distPath, '/index.html')
+    if (!indexPath) throw new Error(`${app}: dist/index.html must be one physically contained single-link regular file`)
+  }
+  return apps
+}
+
+export async function startStaticServer({ distPath } = {}) {
+  return startA11yStaticServer({ rootDirectory: distPath, defaultFile: 'index.html' })
+}
+
+export async function auditUrlWithAxe({
+  url,
+  browserType = chromium,
+  axeBundlePath = axeBundle,
+  settleMs = 1000,
+} = {}) {
+  let browser
+  try {
+    browser = await browserType.launch()
+    const page = await (await browser.newContext()).newPage()
+    const response = await page.goto(url, { waitUntil: 'networkidle' })
+    if (!response || !response.ok()) throw new Error(`owned app server returned ${response?.status() ?? 'no response'}`)
+    if (settleMs > 0) await page.waitForTimeout(settleMs)
+
+    // Exact lockfile dependency: no mutable CDN code enters the protected audit.
+    await page.addScriptTag({ path: axeBundlePath })
+    return await page.evaluate(async () => {
+      const results = await window.axe.run({ runOnly: ['wcag2a', 'wcag2aa'] })
+      return results.violations
+    })
+  } finally {
+    await browser?.close()
+  }
+}
+
+export async function runConsumerA11yAudit({
+  appsDir = APPS_DIR,
+  logger = console,
+  startServer = startStaticServer,
+  auditUrl = auditUrlWithAxe,
+  auditOptions = {},
+} = {}) {
+  let apps
+  const errors = []
+
+  try {
+    apps = discoverBuiltApps(appsDir)
+  } catch (error) {
+    logger.error(`❌ invalid consumer build:${error.message}`)
+    return 1
+  }
+
+  if (apps.length === 0) {
+    logger.error('❌ No apps/*/dist found — run `npm run build` first')
+    return 1
+  }
+
+  logger.log(`Apps to audit: ${apps.join(', ')}`)
+
+  for (const app of apps) {
+    logger.log(`\n=== Auditing ${app} ===`)
+    const distPath = join(appsDir, app, 'dist')
+    let server
+    try {
+      server = await startServer({ app, distPath })
+      if (!server || !/^http:\/\/127\.0\.0\.1:\d+$/.test(server.origin || '') || typeof server.stop !== 'function') {
+        throw new Error('static server did not return an owned IPv4 loopback capability')
+      }
+      const violations = validateAxeViolations(await auditUrl({
+        ...auditOptions,
+        url: server.origin,
+      }))
+
+      if (violations.length > 0) {
+        logger.error(`  ❌ ${violations.length} WCAG violation(s):`)
+        for (const violation of violations.slice(0, 5)) {
+          logger.error(`     - ${violation.id}: ${violation.description}(${violation.nodes.length} node(s))`)
+        }
+        errors.push({ app, violations: violations.length })
+      } else {
+        logger.log('  ✅ 0 WCAG violations')
+      }
+    } catch (error) {
+      logger.error(`  ❌ a11y audit infrastructure error:${error.message}`)
+      errors.push({ app, auditError: error.message })
+    } finally {
+      await server?.stop()
+    }
+  }
+
+  logger.log('')
+  if (errors.length > 0) {
+    logger.error(`❌ ${errors.length} app(s) have a11y issues`)
+    return 1
+  }
+  logger.log('✅ All apps pass WCAG 2 A + AA')
+  return 0
+}
+
+const IS_MAIN = Boolean(process.argv[1]) && realpathSync(process.argv[1]) === realpathSync(SCRIPT_PATH)
+if (IS_MAIN) {
+  const args = process.argv.slice(2)
+  if (args.length !== 0 && !(args.length === 2 && args[0] === '--repo' && args[1])) {
+    console.error('usage: audit-consumer-a11y.mjs [--repo <candidate>]')
+    process.exit(2)
+  }
+  const repo = resolve(args.length === 0 ? process.cwd() : args[1])
+  process.exitCode = await runConsumerA11yAudit({ appsDir: join(repo, APPS_DIR) })
+}

package/ds-canonical/fork/consumer/managed-files/e813096d69c49812e40e00be9ac8fa14d77f0ec1f97ab4c45cb096b3bedd35de.blob

@@ -0,0 +1,3 @@
+# legacy-peer-deps=true to bypass storybook-config @storybook/react peer >=8.0.0 -> npm picks 10.x conflict with root storybook@^8.6.0
+legacy-peer-deps=true
+ignore-scripts=true