@sdods/contracts 0.7.2 → 0.9.0

package/dist/schemas/env.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
-import { EvidencePatchSchema, HealConfigSchema, PerfBudgetsSchema, ScreenshotConfigSchema, TimeoutsSchema, } from './project.js';
+import { A11yPatchSchema, EvidencePatchSchema, HealConfigSchema, PerfBudgetsSchema, ScreenshotConfigSchema, TimeoutsSchema, } from './project.js';
+import { EnvLoadSchema } from './load.js';
 export const ApiAuthSchema = z.discriminatedUnion('type', [
     z.object({ type: z.literal('none') }),
     z.object({ type: z.literal('bearer'), token: z.string() }),
@@ -24,6 +25,21 @@ export const EnvUseSchema = z.object({
     extraHTTPHeaders: z.record(z.string(), z.string()).optional(),
     httpCredentials: z.object({ username: z.string(), password: z.string() }).optional(),
 });
+/**
+ * The mail catcher the email steps read. Only Mailpit today: MailHog's API hands back raw MIME
+ * (quoted-printable, nested multiparts) and is unmaintained, so an enum value for it would be a
+ * half-working promise. `auth.password` trips the secret-literal check, so it must be `${VAR}`.
+ */
+export const MailConfigSchema = z.object({
+    provider: z.enum(['mailpit']).default('mailpit'),
+    url: z.string().url(),
+    auth: z
+        .object({ type: z.literal('basic'), username: z.string(), password: z.string() })
+        .optional(),
+    pollIntervalMs: z.number().int().positive().default(1000),
+    clockSkewMs: z.number().int().nonnegative().default(2000),
+    timeoutSeconds: z.number().int().positive().default(15),
+});
 export const EnvConfigSchema = z.object({
     name: z.string().min(1),
     description: z.string().optional(),
@@ -36,6 +52,7 @@ export const EnvConfigSchema = z.object({
     }),
     aliases: z.array(z.string().url()).default([]),
     db: z.object({ driver: z.enum(['sqlite', 'postgres']), url: z.string() }).optional(),
+    mail: MailConfigSchema.optional(),
     users: z.object({ poolSize: z.number().int().positive().optional() }).default({}),
     vars: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).default({}),
     use: EnvUseSchema.default({}),
@@ -44,6 +61,9 @@ export const EnvConfigSchema = z.object({
     heal: HealConfigSchema.partial().optional(),
     timeouts: TimeoutsSchema.partial().optional(),
     perf: z.object({ budgets: PerfBudgetsSchema.partial() }).optional(),
+    a11y: A11yPatchSchema.optional(),
     ci: z.boolean().optional(),
+    /** Opt-in for `sdods load`; absent means load tests are refused. */
+    load: EnvLoadSchema.optional(),
 });
 //# sourceMappingURL=env.js.map

package/dist/schemas/index.d.ts

@@ -1,3 +1,5 @@
 export * from './project.js';
 export * from './env.js';
+export * from './load.js';
+export * from './matrix.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.js

@@ -1,3 +1,5 @@
 export * from './project.js';
 export * from './env.js';
+export * from './load.js';
+export * from './matrix.js';
 //# sourceMappingURL=index.js.map

package/dist/schemas/load.d.ts

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+/**
+ * Load testing is opt-in per environment. Load against a shared or production environment is
+ * destructive, and load against an environment that caps writes measures the cap rather than the
+ * system, so `sdods load` refuses to run unless the environment says `load.allowed: true`.
+ */
+export declare const EnvLoadSchema: z.ZodObject<{
+    allowed: z.ZodDefault<z.ZodBoolean>;
+    maxVus: z.ZodOptional<z.ZodNumber>;
+    allowWrites: z.ZodDefault<z.ZodBoolean>;
+    allowBaseUrlOverride: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+/** k6 duration: `30s`, `1m30s`, `500ms`, `2h`. */
+export declare const K6DurationSchema: z.ZodString;
+export declare const LOAD_READ_METHODS: readonly ["GET", "HEAD", "OPTIONS"];
+export declare const LOAD_METHODS: readonly ["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"];
+export declare const LoadRequestSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    method: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodEnum<{
+        GET: "GET";
+        HEAD: "HEAD";
+        OPTIONS: "OPTIONS";
+        POST: "POST";
+        PUT: "PUT";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+    }>>>;
+    path: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    body: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodArray<z.ZodUnknown>]>>;
+    expect: z.ZodDefault<z.ZodObject<{
+        status: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodNumber, z.ZodArray<z.ZodNumber>]>>, z.ZodTransform<number[], number | number[]>>;
+        bodyContains: z.ZodOptional<z.ZodString>;
+        maxDurationMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const LoadStageSchema: z.ZodObject<{
+    duration: z.ZodString;
+    target: z.ZodNumber;
+}, z.core.$strip>;
+/** `projects/<slug>/load/<name>.yaml` */
+export declare const LoadProfileSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    auth: z.ZodDefault<z.ZodEnum<{
+        env: "env";
+        none: "none";
+    }>>;
+    thinkTimeSeconds: z.ZodDefault<z.ZodNumber>;
+    vus: z.ZodOptional<z.ZodNumber>;
+    duration: z.ZodOptional<z.ZodString>;
+    iterations: z.ZodOptional<z.ZodNumber>;
+    stages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        duration: z.ZodString;
+        target: z.ZodNumber;
+    }, z.core.$strip>>>;
+    thresholds: z.ZodPipe<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>, z.ZodTransform<{
+        [k: string]: string[];
+    }, Record<string, string | string[]>>>;
+    requests: z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        method: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodEnum<{
+            GET: "GET";
+            HEAD: "HEAD";
+            OPTIONS: "OPTIONS";
+            POST: "POST";
+            PUT: "PUT";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+        }>>>;
+        path: z.ZodString;
+        headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        body: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodArray<z.ZodUnknown>]>>;
+        expect: z.ZodDefault<z.ZodObject<{
+            status: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodNumber, z.ZodArray<z.ZodNumber>]>>, z.ZodTransform<number[], number | number[]>>;
+            bodyContains: z.ZodOptional<z.ZodString>;
+            maxDurationMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type EnvLoadConfig = z.infer<typeof EnvLoadSchema>;
+export type LoadRequest = z.infer<typeof LoadRequestSchema>;
+export type LoadProfile = z.infer<typeof LoadProfileSchema>;
+export type LoadProfileInput = z.input<typeof LoadProfileSchema>;
+//# sourceMappingURL=load.d.ts.map

package/dist/schemas/load.js

@@ -0,0 +1,92 @@
+import { z } from 'zod';
+/**
+ * Load testing is opt-in per environment. Load against a shared or production environment is
+ * destructive, and load against an environment that caps writes measures the cap rather than the
+ * system, so `sdods load` refuses to run unless the environment says `load.allowed: true`.
+ */
+export const EnvLoadSchema = z.object({
+    /** The environment is sized for load and owned by the team running it. */
+    allowed: z.boolean().default(false),
+    /** Refuse profiles whose peak virtual users exceed this. */
+    maxVus: z.number().int().positive().optional(),
+    /** Allow POST, PUT, PATCH and DELETE requests; read-only profiles need nothing. */
+    allowWrites: z.boolean().default(false),
+    /**
+     * Let `SDODS_API_BASE_URL` send the load somewhere other than this file's `api.baseUrl`. Off by
+     * default: the opt-in is for this environment, and a stray override would load another host.
+     */
+    allowBaseUrlOverride: z.boolean().default(false),
+});
+/** k6 duration: `30s`, `1m30s`, `500ms`, `2h`. */
+export const K6DurationSchema = z
+    .string()
+    .regex(/^(\d+(\.\d+)?(ms|s|m|h))+$/, 'expected a k6 duration such as 30s, 1m30s or 500ms');
+export const LOAD_READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+export const LOAD_METHODS = [...LOAD_READ_METHODS, 'POST', 'PUT', 'PATCH', 'DELETE'];
+export const LoadRequestSchema = z.object({
+    /** Shown in k6 output and used as the request's `name` tag. Defaults to `METHOD path`. */
+    name: z.string().min(1).optional(),
+    method: z
+        .string()
+        .transform((m) => m.toUpperCase())
+        .pipe(z.enum(LOAD_METHODS))
+        .default('GET'),
+    /** Relative to the environment's `api.baseUrl`; absolute URLs are refused. */
+    path: z
+        .string()
+        .min(1)
+        .refine((p) => p.startsWith('/'), 'path must start with "/" (it is relative to api.baseUrl)'),
+    headers: z.record(z.string(), z.string()).default({}),
+    /** A string is sent as-is; an object or array is sent as JSON. `${VAR}` reads `__ENV`. */
+    body: z.union([z.string(), z.record(z.string(), z.unknown()), z.array(z.unknown())]).optional(),
+    expect: z
+        .object({
+        status: z
+            .union([z.number().int(), z.array(z.number().int()).min(1)])
+            .default(200)
+            .transform((s) => (Array.isArray(s) ? s : [s])),
+        bodyContains: z.string().optional(),
+        maxDurationMs: z.number().positive().optional(),
+    })
+        .default({ status: [200] }),
+});
+export const LoadStageSchema = z.object({
+    duration: K6DurationSchema,
+    target: z.number().int().nonnegative(),
+});
+/** `projects/<slug>/load/<name>.yaml` */
+export const LoadProfileSchema = z
+    .object({
+    description: z.string().optional(),
+    /** `env` sends the environment's `api.auth` and `api.headers`; `none` sends neither. */
+    auth: z.enum(['env', 'none']).default('env'),
+    /** Pause between iterations of one virtual user, in seconds. */
+    thinkTimeSeconds: z.number().nonnegative().default(1),
+    vus: z.number().int().positive().optional(),
+    duration: K6DurationSchema.optional(),
+    iterations: z.number().int().positive().optional(),
+    stages: z.array(LoadStageSchema).min(1).optional(),
+    /** k6 thresholds, e.g. `http_req_duration: ['p(95)<500']`. A single string is accepted. */
+    thresholds: z
+        .record(z.string(), z.union([z.string(), z.array(z.string()).min(1)]))
+        .default({})
+        .transform((t) => Object.fromEntries(Object.entries(t).map(([k, v]) => [k, Array.isArray(v) ? v : [v]]))),
+    requests: z.array(LoadRequestSchema).min(1),
+})
+    .superRefine((p, ctx) => {
+    if (p.stages && (p.duration || p.iterations || p.vus)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['stages'],
+            message: 'use either stages, or vus with duration or iterations — not both',
+        });
+    }
+    if (!p.stages && !(p.vus && (p.duration || p.iterations))) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['vus'],
+            message: 'set stages, or vus with duration or iterations',
+        });
+    }
+});
+//# sourceMappingURL=load.js.map

package/dist/schemas/matrix.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+/**
+ * `projects/<slug>/roles.matrix.yaml` — the expected outcome of each role on each surface.
+ *
+ * `sdods matrix expand` turns every `@matrix:<name>` Scenario Outline into one `Examples:` block per
+ * role, tagged `@user:<role>`, so an actor × surface grid is data rather than hundreds of
+ * hand-written scenarios. Only the shape lives here; cross-field rules (every row has the same
+ * columns, every role resolves to an outcome, `expect` keys are declared roles) are checked by
+ * `loadRolesMatrices` in @sdods/core so they can be reported as lint findings.
+ */
+export declare const ROLES_MATRIX_FILE = "roles.matrix.yaml";
+/** A matrix name as it appears in `@matrix:<name>`. Checked by the loader for a readable message. */
+export declare const MATRIX_NAME_RE: RegExp;
+export declare const RolesMatrixRowSchema: z.ZodObject<{
+    expect: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+    default: z.ZodOptional<z.ZodString>;
+}, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+export declare const RolesMatrixSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    roles: z.ZodArray<z.ZodString>;
+    default: z.ZodOptional<z.ZodString>;
+    outcomes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    title: z.ZodOptional<z.ZodString>;
+    rows: z.ZodArray<z.ZodObject<{
+        expect: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+        default: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>>;
+}, z.core.$strict>;
+export declare const RolesMatrixFileSchema: z.ZodObject<{
+    matrices: z.ZodRecord<z.ZodString, z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        roles: z.ZodArray<z.ZodString>;
+        default: z.ZodOptional<z.ZodString>;
+        outcomes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        title: z.ZodOptional<z.ZodString>;
+        rows: z.ZodArray<z.ZodObject<{
+            expect: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            default: z.ZodOptional<z.ZodString>;
+        }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type RolesMatrixRowInput = z.infer<typeof RolesMatrixRowSchema>;
+export type RolesMatrixInput = z.infer<typeof RolesMatrixSchema>;
+export type RolesMatrixFile = z.infer<typeof RolesMatrixFileSchema>;
+//# sourceMappingURL=matrix.d.ts.map

package/dist/schemas/matrix.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+/**
+ * `projects/<slug>/roles.matrix.yaml` — the expected outcome of each role on each surface.
+ *
+ * `sdods matrix expand` turns every `@matrix:<name>` Scenario Outline into one `Examples:` block per
+ * role, tagged `@user:<role>`, so an actor × surface grid is data rather than hundreds of
+ * hand-written scenarios. Only the shape lives here; cross-field rules (every row has the same
+ * columns, every role resolves to an outcome, `expect` keys are declared roles) are checked by
+ * `loadRolesMatrices` in @sdods/core so they can be reported as lint findings.
+ */
+export const ROLES_MATRIX_FILE = 'roles.matrix.yaml';
+/** A matrix name as it appears in `@matrix:<name>`. Checked by the loader for a readable message. */
+export const MATRIX_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+const MatrixCellSchema = z.union([z.string(), z.number(), z.boolean()]);
+export const RolesMatrixRowSchema = z
+    .object({
+    /** One outcome for every role, or a per-role map; roles left out fall back to `default`. */
+    expect: z.union([z.string().min(1), z.record(z.string(), z.string().min(1))]).optional(),
+    /** Outcome for the roles this row's `expect` map does not name. Overrides the matrix default. */
+    default: z.string().min(1).optional(),
+})
+    // Every other key is an Examples column (`surface: /settings/billing` → `<surface>`).
+    .catchall(MatrixCellSchema);
+export const RolesMatrixSchema = z
+    .object({
+    description: z.string().optional(),
+    /** The actors, in the order their Examples blocks are written. Each must be a declared role. */
+    roles: z.array(z.string().regex(/^[^\s@|]+$/, 'a role cannot contain spaces, @ or |')).min(1),
+    /** Outcome for any role a row does not name. */
+    default: z.string().min(1).optional(),
+    /** When set, every outcome must be one of these (catches `alowed`). */
+    outcomes: z.array(z.string().min(1)).min(1).optional(),
+    /** Example title, written as the `# title-format:` of each generated block. Must use `<role>` and every row column, so titles are unique. */
+    title: z.string().min(1).optional(),
+    rows: z.array(RolesMatrixRowSchema).min(1),
+})
+    .strict();
+export const RolesMatrixFileSchema = z
+    .object({
+    /** Keys are matrix names (`MATRIX_NAME_RE`), referenced as `@matrix:<name>`. */
+    matrices: z.record(z.string(), RolesMatrixSchema),
+})
+    .strict();
+//# sourceMappingURL=matrix.js.map

package/dist/schemas/project.d.ts

@@ -48,15 +48,19 @@ export declare const UserPoolSchema: z.ZodObject<{
     roleColumn: z.ZodDefault<z.ZodString>;
     leaseStore: z.ZodDefault<z.ZodEnum<{
         file: "file";
-        db: "db";
     }>>;
     leaseTtlMs: z.ZodDefault<z.ZodNumber>;
     mode: z.ZodDefault<z.ZodEnum<{
         exclusive: "exclusive";
         shared: "shared";
     }>>;
-    waitMs: z.ZodDefault<z.ZodNumber>;
+    waitMs: z.ZodOptional<z.ZodNumber>;
+    leaseScope: z.ZodDefault<z.ZodEnum<{
+        scenario: "scenario";
+        worker: "worker";
+    }>>;
 }, z.core.$strip>;
+export type UserPoolConfig = z.infer<typeof UserPoolSchema>;
 export declare const AuthStrategySchema: z.ZodEnum<{
     custom: "custom";
     none: "none";
@@ -106,6 +110,14 @@ export declare const ProjectAuthSchema: z.ZodObject<{
         prefix: z.ZodDefault<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * Settings for one named visual baseline (`the page should match the visual baseline "<name>"`).
+ * `mask` is added to the project/env `screenshots.mask`, never a replacement for it.
+ */
+export declare const BaselineConfigSchema: z.ZodObject<{
+    mask: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    maxDiffPixelRatio: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 export declare const ScreenshotConfigSchema: z.ZodObject<{
     policy: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
         visual: "visual";
@@ -116,6 +128,11 @@ export declare const ScreenshotConfigSchema: z.ZodObject<{
     }>>>;
     fullPage: z.ZodDefault<z.ZodBoolean>;
     mask: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    maxDiffPixelRatio: z.ZodDefault<z.ZodNumber>;
+    baselines: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        mask: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        maxDiffPixelRatio: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
     viewport: z.ZodDefault<z.ZodObject<{
         width: z.ZodNumber;
         height: z.ZodNumber;
@@ -229,6 +246,43 @@ export declare const EVIDENCE_DEFAULTS: {
     readonly trace: "on-first-retry";
     readonly redactTraces: true;
 };
+/**
+ * Selectors the canvas steps (`canvas.steps.ts`) use to find nodes, handles, edges, node fields and
+ * badges on a graph editor. The defaults are the DOM React Flow (v11 and v12) renders; a project on
+ * another editor, or with its own markers, overrides only the keys that differ.
+ *
+ * Values are CSS selector templates. `{id}`, `{handle}`, `{source}`, `{target}`, `{field}` and
+ * `{badge}` are replaced by the step argument, escaped for a quoted CSS string, so write them inside
+ * quotes: `[data-id="{id}"]`. `{testIdAttribute}` is replaced by the project's attribute name.
+ */
+export declare const CANVAS_DEFAULTS: {
+    /** The editor surface; every other lookup is scoped inside it. */
+    readonly root: ".react-flow";
+    /** Every node, for counting. */
+    readonly nodes: ".react-flow__node";
+    /** One node by id. */
+    readonly node: ".react-flow__node[data-id=\"{id}\"]";
+    /** A handle, searched inside its node. */
+    readonly handle: ".react-flow__handle[data-handleid=\"{handle}\"]";
+    /** An edge by source and target node id. React Flow's default edge aria-label. */
+    readonly edge: ".react-flow__edge[aria-label=\"Edge from {source} to {target}\"]";
+    /** A field, searched inside its node. A wrapper is fine: the editable control inside it is filled. */
+    readonly field: "[name=\"{field}\"], [aria-label=\"{field}\"], [{testIdAttribute}=\"{field}\"]";
+    /** A badge, searched inside its node. */
+    readonly badge: "[{testIdAttribute}=\"{badge}\"]";
+    /** What a node matches once selected; `I select the node` waits for it. Empty skips the check. */
+    readonly selected: ".selected";
+};
+export declare const CanvasConfigSchema: z.ZodDefault<z.ZodObject<{
+    root: z.ZodDefault<z.ZodString>;
+    nodes: z.ZodDefault<z.ZodString>;
+    node: z.ZodDefault<z.ZodString>;
+    handle: z.ZodDefault<z.ZodString>;
+    edge: z.ZodDefault<z.ZodString>;
+    field: z.ZodDefault<z.ZodString>;
+    badge: z.ZodDefault<z.ZodString>;
+    selected: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>>;
 /**
  * Scenarios that must pass before anything else in the run starts: probes, login, seeding.
  *
@@ -252,6 +306,45 @@ export declare const PerfBudgetsSchema: z.ZodObject<{
     ttfbMs: z.ZodOptional<z.ZodNumber>;
     apiP95Ms: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
+/** axe impact levels, weakest first. Mirrored by `IMPACT_ORDER` in core's a11y audit. */
+export declare const A11yImpactSchema: z.ZodEnum<{
+    minor: "minor";
+    moderate: "moderate";
+    serious: "serious";
+    critical: "critical";
+}>;
+/**
+ * The audit every `@a11y` UI or hybrid scenario gets at its end.
+ *
+ * `failOn` is the weakest impact that fails the scenario: `serious` fails on serious and critical
+ * violations and reports the rest. `include` narrows the audit to these selectors, `exclude` leaves
+ * these selectors out (a third-party widget the team does not own, for instance). Both are passed
+ * to axe as they are, so a selector that matches nothing in `include` fails the audit rather than
+ * scanning an empty page.
+ */
+export declare const A11yConfigSchema: z.ZodObject<{
+    failOn: z.ZodDefault<z.ZodEnum<{
+        minor: "minor";
+        moderate: "moderate";
+        serious: "serious";
+        critical: "critical";
+    }>>;
+    include: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** The env-level patch: every key optional and default-free, for the reason `EvidencePatchSchema` gives. */
+export declare const A11yPatchSchema: z.ZodObject<{
+    failOn: z.ZodOptional<z.ZodEnum<{
+        minor: "minor";
+        moderate: "moderate";
+        serious: "serious";
+        critical: "critical";
+    }>>;
+    include: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** Branch names `integrations.github.evidence.branch` refuses: prune force-rewrites the branch. */
+export declare const EVIDENCE_PROTECTED_BRANCHES: string[];
 export declare const GitHubIntegrationSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     owner: z.ZodOptional<z.ZodString>;
@@ -267,6 +360,19 @@ export declare const GitHubIntegrationSchema: z.ZodObject<{
     labels: z.ZodDefault<z.ZodArray<z.ZodString>>;
     tokenEnv: z.ZodDefault<z.ZodString>;
     uploadToRelease: z.ZodOptional<z.ZodString>;
+    evidence: z.ZodOptional<z.ZodObject<{
+        host: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            branch: "branch";
+        }>>;
+        repo: z.ZodOptional<z.ZodString>;
+        branch: z.ZodDefault<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        maxFileBytes: z.ZodDefault<z.ZodNumber>;
+        maxRunBytes: z.ZodDefault<z.ZodNumber>;
+        retainDays: z.ZodDefault<z.ZodNumber>;
+        gifPreview: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const JiraIntegrationSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
@@ -305,6 +411,19 @@ export declare const IntegrationsSchema: z.ZodObject<{
         labels: z.ZodDefault<z.ZodArray<z.ZodString>>;
         tokenEnv: z.ZodDefault<z.ZodString>;
         uploadToRelease: z.ZodOptional<z.ZodString>;
+        evidence: z.ZodOptional<z.ZodObject<{
+            host: z.ZodDefault<z.ZodEnum<{
+                none: "none";
+                branch: "branch";
+            }>>;
+            repo: z.ZodOptional<z.ZodString>;
+            branch: z.ZodDefault<z.ZodString>;
+            tokenEnv: z.ZodOptional<z.ZodString>;
+            maxFileBytes: z.ZodDefault<z.ZodNumber>;
+            maxRunBytes: z.ZodDefault<z.ZodNumber>;
+            retainDays: z.ZodDefault<z.ZodNumber>;
+            gifPreview: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     jira: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -442,6 +561,17 @@ export declare const ScheduleSchema: z.ZodObject<{
     }>>>;
     retentionRuns: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
+/**
+ * Requirement traceability (`@req:<id>` tags → `sdods report traceability`).
+ *
+ * The id is opaque: SDODS does not decide whether it names a Jira story, a line in a requirements
+ * document or a clause of a regulation. That choice belongs to whoever signs the export.
+ */
+export declare const TraceabilitySchema: z.ZodObject<{
+    requirements: z.ZodOptional<z.ZodString>;
+    link: z.ZodOptional<z.ZodString>;
+    require: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
 /**
  * Hierarchy: organization → workspace → project → module.
  * A module is a feature area of an application (auth, inventory, checkout …) that owns a
@@ -688,6 +818,16 @@ export declare const ProjectConfigSchema: z.ZodObject<{
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     routes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    canvas: z.ZodDefault<z.ZodObject<{
+        root: z.ZodDefault<z.ZodString>;
+        nodes: z.ZodDefault<z.ZodString>;
+        node: z.ZodDefault<z.ZodString>;
+        handle: z.ZodDefault<z.ZodString>;
+        edge: z.ZodDefault<z.ZodString>;
+        field: z.ZodDefault<z.ZodString>;
+        badge: z.ZodDefault<z.ZodString>;
+        selected: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
     tags: z.ZodDefault<z.ZodObject<{
         suites: z.ZodDefault<z.ZodArray<z.ZodString>>;
         extra: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -725,14 +865,17 @@ export declare const ProjectConfigSchema: z.ZodObject<{
             roleColumn: z.ZodDefault<z.ZodString>;
             leaseStore: z.ZodDefault<z.ZodEnum<{
                 file: "file";
-                db: "db";
             }>>;
             leaseTtlMs: z.ZodDefault<z.ZodNumber>;
             mode: z.ZodDefault<z.ZodEnum<{
                 exclusive: "exclusive";
                 shared: "shared";
             }>>;
-            waitMs: z.ZodDefault<z.ZodNumber>;
+            waitMs: z.ZodOptional<z.ZodNumber>;
+            leaseScope: z.ZodDefault<z.ZodEnum<{
+                scenario: "scenario";
+                worker: "worker";
+            }>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     auth: z.ZodDefault<z.ZodObject<{
@@ -778,6 +921,11 @@ export declare const ProjectConfigSchema: z.ZodObject<{
         }>>>;
         fullPage: z.ZodDefault<z.ZodBoolean>;
         mask: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        maxDiffPixelRatio: z.ZodDefault<z.ZodNumber>;
+        baselines: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            mask: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            maxDiffPixelRatio: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
         viewport: z.ZodDefault<z.ZodObject<{
             width: z.ZodNumber;
             height: z.ZodNumber;
@@ -850,6 +998,16 @@ export declare const ProjectConfigSchema: z.ZodObject<{
             apiP95Ms: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    a11y: z.ZodDefault<z.ZodObject<{
+        failOn: z.ZodDefault<z.ZodEnum<{
+            minor: "minor";
+            moderate: "moderate";
+            serious: "serious";
+            critical: "critical";
+        }>>;
+        include: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
     integrations: z.ZodDefault<z.ZodObject<{
         github: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -866,6 +1024,19 @@ export declare const ProjectConfigSchema: z.ZodObject<{
             labels: z.ZodDefault<z.ZodArray<z.ZodString>>;
             tokenEnv: z.ZodDefault<z.ZodString>;
             uploadToRelease: z.ZodOptional<z.ZodString>;
+            evidence: z.ZodOptional<z.ZodObject<{
+                host: z.ZodDefault<z.ZodEnum<{
+                    none: "none";
+                    branch: "branch";
+                }>>;
+                repo: z.ZodOptional<z.ZodString>;
+                branch: z.ZodDefault<z.ZodString>;
+                tokenEnv: z.ZodOptional<z.ZodString>;
+                maxFileBytes: z.ZodDefault<z.ZodNumber>;
+                maxRunBytes: z.ZodDefault<z.ZodNumber>;
+                retainDays: z.ZodDefault<z.ZodNumber>;
+                gifPreview: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
         jira: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -984,6 +1155,11 @@ export declare const ProjectConfigSchema: z.ZodObject<{
         allure: z.ZodDefault<z.ZodBoolean>;
         junit: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
+    traceability: z.ZodOptional<z.ZodObject<{
+        requirements: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        require: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
     ci: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         env: z.ZodOptional<z.ZodString>;
@@ -1090,9 +1266,15 @@ export type TestingType = z.infer<typeof TestingTypeSchema>;
 export type ProjectConfig = z.infer<typeof ProjectConfigSchema>;
 export type ProjectConfigInput = z.input<typeof ProjectConfigSchema>;
 export type ScreenshotConfig = z.infer<typeof ScreenshotConfigSchema>;
+export type BaselineConfig = z.infer<typeof BaselineConfigSchema>;
 export type EvidenceConfig = z.infer<typeof EvidenceSchema>;
+export type CanvasConfig = z.infer<typeof CanvasConfigSchema>;
 export type SetupConfig = z.infer<typeof SetupSchema>;
+export type TraceabilityConfig = z.infer<typeof TraceabilitySchema>;
 export type HealConfig = z.infer<typeof HealConfigSchema>;
+export type A11yConfig = z.infer<typeof A11yConfigSchema>;
+export type A11yImpact = z.infer<typeof A11yImpactSchema>;
+export type ProcessGates = ProcessConfig['gates'];
 export type TimeoutsConfig = z.infer<typeof TimeoutsSchema>;
 export type ProjectAuthConfig = z.infer<typeof ProjectAuthSchema>;
 export type McpServerConfig = z.infer<typeof McpServerSchema>;