frontend-go-live-check 1.4.1 → 1.6.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.5.0
+
+- **Your own tests in the same report**: unit tests (Vitest, Jest, Karma or `npm test`) with code coverage, and end-to-end tests (Playwright Test, Cypress) against the production build. A new area: *Tests, user flows and business rules*.
+- **User flows and business rules without code** in `go-live-check/flows.json`: open, fill, select, click, see, url and API checks (status and JSON values), on every screen size. A broken business rule is a blocker.
+- **Forms filled with valid data** and sent: they must save and tell the user (only on this computer or allowed hosts).
+- **Postman collection run in order** with its `pm.test` scripts and the variables carried between requests; `api.variables` for `{{variables}}`.
+- **Load profiles**: `light`, `standard` (50 users, 1 minute) and `stress` (finds the breaking point); `--load <profile>`.
+- **Security**: CORS (which websites may read the API) and the HTTPS certificate and TLS version.
+- **Code quality**: `lint` / `typecheck` scripts, unused and outdated libraries, very long files, copied code.
+- **One folder for everything**: `go-live-check/` holds the settings (`config.json`), the test passwords (`.env`), the API files (`api/`), the design baseline (`baseline/`), the report (`report/`) and a saved sign-in (`session.json`), with its own `.gitignore`. `init` creates it. Projects with the older root files keep working; the README shows how to move.
+- Every section of the HTML report opens and closes (accordion), with **Expand all** and **Collapse all**.
+- The date and time the report was created are at the top of the HTML report, on the PDF and Word cover, and in the page header.
+- Visual changes show the real pages: **Before** (the approved look), **Now** and **Changes** side by side; in each finding, Actual is the page now and Expected is the approved look.
+
 ## 1.4.1
 
 - Problems are grouped **by type** (Functionality, Design, Accessibility, Performance, Sign-in, APIs, Security, SEO, Code) in the HTML report, the PDF and the Word file, most serious first in each group.

package/README.md

@@ -18,6 +18,7 @@
 
 <p align="center">
   <a href="#quick-start">Quick start</a> ·
+  <a href="#files-everything-in-one-folder">Files</a> ·
   <a href="#sign-in-email-google-microsoft-uae-pass">Sign-in</a> ·
   <a href="#what-it-checks">What it checks</a> ·
   <a href="#how-it-works">How it works</a> ·
@@ -38,11 +39,11 @@ npx frontend-go-live-check init
 npm run go-live
 ```
 
-That's it. The result is `go-live-report/index.html`, plus a PDF and a Word file to share with your team.
+That's it. The result is `go-live-check/report/index.html`, plus a PDF and a Word file to share with your team.
 
 `init` adds the `go-live` scripts and a settings file, and downloads the test browser. It never overwrites anything.
 
-Have an API? Save your Postman collection as **`api/postman_collection.json`** (or your OpenAPI file as `api/openapi.json`) and the API tests run too.
+Have an API? Save your Postman collection as **`go-live-check/api/postman_collection.json`** (or your OpenAPI file as `go-live-check/api/openapi.json`) and the API tests run too.
 
 <p align="center">
   <img src="https://unpkg.com/frontend-go-live-check@1/docs/terminal.png" alt="Terminal output: NOT READY, 2 blocker, 7 major, 5 minor, with a score per area" width="760">
@@ -50,6 +51,54 @@ Have an API? Save your Postman collection as **`api/postman_collection.json`** (
 
 ---
 
+## Files: everything in one folder
+
+Everything the tool uses or makes is in **one `go-live-check/` folder** at the root of your project. `init` creates it.
+
+```text
+my-project/
+├── go-live-check/
+│   ├── config.json            ← the settings (all optional)
+│   ├── .env                   ← test passwords (Git ignores it)
+│   ├── .env.example           ← the names to fill in (committed)
+│   ├── api/
+│   │   ├── postman_collection.json   ← your Postman collection
+│   │   ├── postman_environment.json  ← optional: its environment
+│   │   └── openapi.json              ← or/and your OpenAPI file
+│   ├── flows.json             ← your user journeys and business rules (optional)
+│   ├── baseline/              ← the approved look of every page (commit it)
+│   ├── report/                ← the results: HTML, PDF, Word, zip (Git ignores it)
+│   ├── session.json           ← a saved sign-in, after `login` (Git ignores it)
+│   └── .gitignore             ← keeps .env, report/ and session.json out of Git
+├── src/
+└── package.json
+```
+
+| Commit | Never commit (already ignored) |
+| --- | --- |
+| `config.json`, `.env.example`, `api/`, `flows.json`, `baseline/` | `.env`, `report/`, `session.json` |
+
+<details>
+<summary><b>Set up with an older version?</b></summary>
+
+Projects with `go-live-check.config.json`, `go-live-check.env`, `api/`, `go-live-baseline/` and `go-live-report/` at the root keep working. To move to the folder:
+
+```bash
+mkdir -p go-live-check
+git mv go-live-check.config.json go-live-check/config.json
+git mv go-live-check.env.example go-live-check/.env.example
+git mv api go-live-check/api
+git mv go-live-baseline go-live-check/baseline
+mv go-live-check.env go-live-check/.env
+printf '.env\nreport/\nsession.json\n' > go-live-check/.gitignore
+```
+
+In `go-live-check/config.json`, change `$schema` to `../node_modules/frontend-go-live-check/schema.json`. Remove the old `go-live-report/` folder and its `.gitignore` lines.
+
+</details>
+
+---
+
 ## Why
 
 | Without it | With it |
@@ -99,7 +148,7 @@ npx frontend-go-live-check login
 What happens:
 
 - A normal browser window opens on your app. Sign in the way your users do (approve UAE PASS on your phone), wait for a signed-in page, then press Enter in the terminal.
-- The session (cookies and browser storage) is saved in **`go-live-check.session.json`**. Treat it like a password: Git ignores it, never share it.
+- The session (cookies and browser storage) is saved in **`go-live-check/session.json`**. Treat it like a password: Git ignores it, never share it.
 - When it expires, the report says ***"The saved sign-in session has expired"*** (also when the app's API starts answering 401), and `doctor` tells you before you run. Run `login` again.
 
 **Pipelines (`ciLogin`)**: a pipeline has no one to approve a sign-in, so it uses `ciLogin` instead of `login`. Pick one of these:
@@ -144,19 +193,22 @@ The report lists every sign-in method found (*email and password · Google · UA
 
 | | Area | What is checked |
 | :-: | --- | --- |
+| ✅ | **Unit and end-to-end tests** | Runs **your own tests**: Vitest, Jest, Karma or `npm test` with code coverage (low coverage is reported), and your Playwright or Cypress tests against the production build |
+| 🧭 | **User flows and business rules** | Your main journeys and business rules, written **without code** in `go-live-check/flows.json` (open, fill, click, see, check the API answer), on every screen size; a broken business rule blocks going live |
+| 📝 | **Forms with valid data** | Every form is filled with valid test data and sent: it must save and tell the user (only on this computer or allowed test hosts) |
 | 🧭 | **Functionality** | JavaScript errors, console errors, failed requests, broken links, images and anchors, blank pages, buttons covered by something else, unfinished text (`undefined`, `NaN`, `[object Object]`, translation keys, lorem ipsum, TODO), loading spinners that never stop, the production build, the "page not found" page |
 | 🛟 | **Resilience** | Each page opened again with its API calls failing: does it crash, go blank, or tell the user? |
 | 📱 | **Design and responsive layout** | Every page at every screen size: sideways scrolling, text that spills out of its box (a button too small for its label), text on top of other text, content cut off at the screen edge, text cut off inside its box, overlapping buttons, stretched or squashed images, tiny text on phones, right-to-left layout (Arabic, Hebrew…), fonts that fail to load, too many fonts and sizes |
-| 🖼️ | **Visual changes** | A pixel comparison of every page with the saved baseline, with the changed areas in red |
+| 🖼️ | **Visual changes** | Every page compared with its approved look (the baseline): **Before**, **Now** and the changed areas side by side |
 | ♿ | **Accessibility** | axe-core against WCAG 2.0 / 2.1 / 2.2 A and AA; keyboard-only use: visible focus, no traps, nothing that only a mouse can click; form field types |
 | ⚡ | **Performance** | Size, JavaScript, requests, load time, LCP, layout shift and frozen-page time for every page, against budgets; Lighthouse as a phone and as a desktop |
 | 🔌 | **API calls made by the pages** | Slow, very large, repeated, too many, uncompressed or uncached calls |
-| 📈 | **Load** | 10 users at the same time on the main pages and the app's own read requests |
+| 📈 | **Load** | Profiles: `light` (10 users, every run), `standard` (50 users for a minute, added gradually) and `stress` (adds users until the app slows down or fails: the **breaking point**) |
 | 🔐 | **Sign-in and access** | Every sign-in method found (email, Google, Microsoft, Apple, UAE PASS, OpenID Connect) and its buttons; wrong password, unknown user, empty sign-in; a cancelled sign-in; signed-in pages and APIs opened without signing in; tokens in web storage; every form submitted empty |
-| 🧪 | **API tests** | From your **Postman collection or OpenAPI/Swagger file**: every endpoint with valid and invalid data, without a token, with the wrong role, and with another user's records |
-| 🛡️ | **Security** | Security headers, cookies, private files (`.env`, `.git`), source maps, secrets in the JavaScript or the source, passwords in addresses, outside scripts without integrity, `npm audit` |
+| 🧪 | **API tests** | From your **Postman collection or OpenAPI/Swagger file**: every endpoint with valid and invalid data, without a token, with the wrong role, and with another user's records. Plus the **collection run in order with its own `pm.test` scripts**, the variables carried between requests (sign in → create → read → delete) |
+| 🛡️ | **Security** | Security headers, cookies, CORS (which sites may read the API), the HTTPS certificate and TLS version, private files (`.env`, `.git`), source maps, secrets in the JavaScript or the source, passwords in addresses, outside scripts without integrity, `npm audit` |
 | 🔎 | **SEO and sharing** | Titles, descriptions, headings, language, duplicate titles, favicon, link previews, robots.txt and sitemap.xml |
-| 🧹 | **Code** | TypeScript errors, your own ESLint rules, leftover `console.log` |
+| 🧹 | **Code** | TypeScript errors, your ESLint rules (or your `lint` / `typecheck` scripts), leftover `console.log`, libraries installed but never used, libraries a major version behind, very long files, copied code |
 
 The report's **What was checked** table says exactly what ran on your project, and why anything was skipped.
 
@@ -170,7 +222,7 @@ The report's **What was checked** table says exactly what ran on your project, a
 
 | Step | What happens |
 | :-: | --- |
-| **1. Detect** | Reads `package.json`: the framework, the package manager, the sign-in libraries, and your API file in `api/` |
+| **1. Detect** | Reads `package.json`: the framework, the package manager, the sign-in libraries, and your files in `go-live-check/` |
 | **2. Build & start** | Builds the app and starts it **the way it runs in production**, plus any services you listed (a backend or a mock API) |
 | **3. Sign in** | With the test account, the saved session (`login`) or a test token, so the signed-in pages are tested too |
 | **4. Find pages** | Follows every link, reads your routes in the source code and your `sitemap.xml` |
@@ -180,6 +232,44 @@ The report's **What was checked** table says exactly what ran on your project, a
 
 ---
 
+## User flows and business rules (no code)
+
+The tool opens every page by itself, but only your team knows the journeys and the rules. Write them once in **`go-live-check/flows.json`**; every run checks them on desktop and phone, with a picture where a step fails.
+
+```json
+{
+  "flows": [
+    {
+      "name": "A citizen sends a new application",
+      "rule": true,
+      "steps": [
+        { "open": "/applications/new" },
+        { "select": { "Service": "Permit" } },
+        { "fill": { "Description": "Permit for a small shop {unique}" } },
+        { "click": "Submit application" },
+        { "api": { "method": "POST", "path": "/api/applications", "status": 201, "body": { "status": "Submitted" } } },
+        { "url": "/applications" },
+        { "see": "Permit" }
+      ]
+    }
+  ]
+}
+```
+
+| Step | What it does |
+| --- | --- |
+| `open` | Opens an address of the app |
+| `fill`, `select`, `check` | Fills fields found by their label, placeholder or name (`css=…` works too). `"$NAME"` comes from `.env`; `{unique}` is unique to the run |
+| `click`, `press` | Clicks a button or link by its text; presses a key |
+| `see`, `notSee` | A text must (or must not) be on the page |
+| `url` | The address must start with this |
+| `api` | The page called this API, it answered this status, and its JSON answer has these values |
+| `wait` | Waits a moment (ms) |
+
+A flow is signed in with the test user unless `"signedIn": false`. **`"rule": true`** marks a business rule ("a new application is Submitted", "a citizen sees only their own applications"): if it fails, it is a blocker.
+
+---
+
 ## Works with
 
 **Next.js** · **React** (Vite, Create React App) · **Vue** · **Nuxt** · **Angular** · **Svelte / SvelteKit** · **Astro** · **Remix / React Router** · **Gatsby** · **Solid** · **Preact** · **Qwik** · **plain HTML**. Anything else, in any language, works with a start command or `--url`.
@@ -214,7 +304,8 @@ The framework and the package manager (npm, pnpm, yarn, bun) are detected. The a
 
 The report has:
 
-- the **verdict** and a **score per area** (click an area to filter);
+- when it was created, the **verdict** and a **score per area** (click an area to jump to it);
+- every section opens and closes, with **Expand all** and **Collapse all**;
 - **problems by type**: Functionality, Design, Accessibility, Performance, Sign-in, APIs, Security, SEO, Code, each with its score, worst problems first;
 - the API results, the speed of every page, and the load test;
 - screenshots of every page at every size, for the design review.
@@ -316,7 +407,7 @@ The short name `go-live-check` works too. After `init`, use `npm run go-live`, `
 
 | Option | What it does |
 | --- | --- |
-| `--only pages,security` | Only these areas: `pages`, `lighthouse`, `auth`, `security`, `resilience`, `load`, `api`, `code` |
+| `--only pages,security` | Only these areas: `pages`, `lighthouse`, `auth`, `flows`, `security`, `resilience`, `load`, `api`, `code`, `tests` |
 | `--skip lighthouse,load` | Everything except these |
 | `--api-only` | Only the API tests (backend projects) |
 | `--api <file or URL>` | The Postman collection or OpenAPI/Swagger file (found automatically in the project) |
@@ -327,6 +418,7 @@ The short name `go-live-check` works too. After `init`, use `npm run go-live`, `
 | `--no-lighthouse` · `--no-build` · `--no-export` | Skip Lighthouse · use the existing build · no PDF/Word |
 | `--format pdf` | Only one of the documents |
 | `--update-baseline` | Save the current look of every page as the new design baseline |
+| `--load stress` | `light` (default) · `standard` (50 users for a minute) · `stress` (finds the breaking point) |
 | `--fail-on major` | What fails the command: `blocker` (default) · `major` · `minor` · `never` |
 | `--open` · `--out <folder>` · `--config <file>` · `--quiet` · `--ci` | Open the report · report folder · settings file · less output · pipeline mode |
 
@@ -336,18 +428,18 @@ The short name `go-live-check` works too. After `init`, use `npm run go-live`, `
 
 ## Settings
 
-Everything is optional. `init` writes `go-live-check.config.json`, and your editor autocompletes it through `$schema`.
+Everything is optional. `init` writes `go-live-check/config.json`, and your editor autocompletes it through `$schema`.
 
 ```json
 {
-  "$schema": "./node_modules/frontend-go-live-check/schema.json",
+  "$schema": "../node_modules/frontend-go-live-check/schema.json",
   "login": { "page": "/login", "username": "test.user", "password": "$GO_LIVE_PASSWORD" },
   "services": [{ "command": "npm run api", "url": "http://localhost:4000/health" }],
   "failOn": "blocker"
 }
 ```
 
-API tests need no settings when your files are in `api/` (see *API tests from Postman or OpenAPI* below). Passwords are written as `"$NAME"`. Put their values in `go-live-check.env` (Git ignores it) or in your pipeline's secrets. They are replaced with `‹secret›` in every report.
+API tests need no settings when your files are in `go-live-check/api/` (see *API tests from Postman or OpenAPI* below). Passwords are written as `"$NAME"`. Put their values in `go-live-check/.env` (Git ignores it) or in your pipeline's secrets. They are replaced with `‹secret›` in every report.
 
 <details>
 <summary><b>🔐 Sign-in forms that need help</b></summary>
@@ -376,19 +468,16 @@ An external single sign-on page usually can't be automated. Point `login` at a t
 <details>
 <summary><b>🧪 API tests from Postman or OpenAPI</b></summary>
 
-Put your API description in an **`api/`** folder at the root of your project, with **exactly these names**:
+Put your API description in **`go-live-check/api/`**, with **exactly these names**:
 
 ```text
-my-project/
-├── api/
-│   ├── postman_collection.json     ← the Postman collection (v2.1)
-│   ├── postman_environment.json    ← optional: its environment ({{baseUrl}} and other variables)
-│   └── openapi.json                ← or/and the OpenAPI / Swagger file (openapi.yaml works too)
-├── go-live-check.config.json
-└── package.json
+go-live-check/api/
+├── postman_collection.json     ← the Postman collection (v2.1)
+├── postman_environment.json    ← optional: its environment ({{baseUrl}} and other variables)
+└── openapi.json                ← or/and the OpenAPI / Swagger file (openapi.yaml works too)
 ```
 
-That's all: no settings are needed. Postman export names (`My API.postman_collection.json`) need renaming to `postman_collection.json`. If both a Postman collection and an OpenAPI file are there, they are combined: OpenAPI gives the rules, Postman the examples. `init` creates `api/README.md` with these instructions. `frontend-go-live-check doctor` shows what it found.
+That's all: no settings are needed. Postman export names (`My API.postman_collection.json`) need renaming to `postman_collection.json`. If both a Postman collection and an OpenAPI file are there, they are combined: OpenAPI gives the rules, Postman the examples. `init` creates `go-live-check/api/README.md` with these instructions. `frontend-go-live-check doctor` shows what it found.
 
 Never put real passwords or tokens in these files: use `$NAMES` (see below).
 
@@ -416,7 +505,7 @@ To test roles and ownership, add test users. Include a **second user of the same
 <details>
 <summary><b>🖼️ Visual changes</b></summary>
 
-The first run saves a picture of every page at every size in `go-live-baseline/`. Commit that folder. Later runs report pages that look different, with the changed areas in red.
+The first run saves a picture of every page at every size in `go-live-check/baseline/`. Commit that folder. Later runs report pages that look different, with the changed areas in red.
 
 After an intended design change, save the new look:
 
@@ -439,7 +528,11 @@ Hide parts that change on their own (clocks, live data) with `"visualMask": [".c
 | `services` | Commands started first (a backend, a mock API), each ready when its `url` answers |
 | `build`, `start`, `url` | `false` or your own build command · your own start command (`{port}` / `$PORT`) · check a running site |
 | `budgets` | `pageKB` 3000 · `jsKB` 1000 · `requests` 120 · `loadMs` 4000 · `apiMs` 1000 · `apiCalls` 30 |
-| `load` | `{ "users": 10, "seconds": 10, "maxTargets": 8, "hosts": [] }`, or `false` (GET only; this computer or listed hosts) |
+| `load` | `{ "profile": "light" | "standard" | "stress" }` or your own `users`, `seconds`, `rampSeconds`, `hosts`; or `false` (GET only; this computer or listed hosts) |
+| `tests` | `{ "coverage": 60, "unitCommand": "…", "e2eCommand": "…" }`, or `false` to skip your own tests |
+| `flows` | User journeys and business rules (or in `go-live-check/flows.json`) |
+| `formFill` | `{ "hosts": ["test.example.com"] }` to also fill and send forms on a test host, or `false` |
+| `api.variables` | Values for `{{variables}}` in the Postman collection, e.g. `{ "password": "$GO_LIVE_PASSWORD" }` |
 | `keyboard`, `resilience`, `visual`, `evidence`, `formChecks`, `lighthouse`, `discoverRoutes` | All on by default; `false` turns one off |
 | `visualThreshold`, `visualMask`, `baselineDir` | How much may change (0.1%); parts to hide; where the baseline lives |
 | `report` | `organisation`, `classification` (default *Internal*), `preparedFor`, `approvers`: shown in the PDF and Word |
@@ -455,7 +548,7 @@ Hide parts that change on their own (clocks, live data) with `"visualMask": [".c
 ## Safety and privacy
 
 - **Everything runs on your machine** or your own pipeline. Nothing is sent anywhere except to the app being tested.
-- **Test passwords** come from `go-live-check.env` or pipeline secrets, and never appear in a report or log.
+- **Test passwords** come from `go-live-check/.env` or pipeline secrets, and never appear in a report or log.
 - **Use test accounts on a test environment.** Browser checks only read pages and submit forms empty.
 - **API writes and the load test** run only against this computer or the hosts you list. Every record the tests create is deleted afterwards.
 - **Closed networks.** Point `PLAYWRIGHT_DOWNLOAD_HOST` at your mirror, or `GO_LIVE_CHROMIUM` at an existing Chromium.
@@ -500,7 +593,7 @@ No other services: nothing is uploaded, and no account is needed.
 <details>
 <summary><b>Does it replace unit and end-to-end tests?</b></summary>
 
-No. It checks what every web app needs before going live, without any test code. Your own tests still cover your business rules.
+It runs them. Your own unit tests (with coverage) and your Playwright or Cypress tests are part of every run, and their results are in the same report and the same verdict. Your journeys and business rules can also be written as flows, without code. Writing the unit tests themselves is still your team's job: only you know what each function must do.
 
 </details>
 
@@ -521,10 +614,10 @@ Security headers, compression and caching usually come from your web server or C
 <details>
 <summary><b>What still needs a person?</b></summary>
 
-- whether the design matches what was intended (the screenshots make this quick);
-- business rules;
-- a full load test before a big launch;
-- a penetration test.
+- whether the design matches what was intended (the screenshots and the visual comparison make this quick);
+- writing the flows and unit tests for your business rules (the tool runs them every time);
+- a load test from proper servers for a very large launch (the `stress` profile finds the breaking point on one machine);
+- a penetration test by a security specialist before a big launch.
 
 </details>
 
@@ -534,7 +627,7 @@ Security headers, compression and caching usually come from your web server or C
 | You see | Fix |
 | --- | --- |
 | `Executable doesn't exist` | `npx playwright install chromium` |
-| `Not set: GO_LIVE_PASSWORD` | Copy `go-live-check.env.example` to `go-live-check.env` and fill it in |
+| `Not set: GO_LIVE_PASSWORD` | Copy `go-live-check/.env.example` to `go-live-check/.env` and fill it in |
 | `login-failed` | Check `login`; name the fields (`usernameField`, `passwordField`, `submit`) if the form is unusual |
 | *Signed-in pages were not tested* | Set `login`, or run `npx frontend-go-live-check login` (Google, UAE PASS…) |
 | *The saved sign-in session has expired* | Run `npx frontend-go-live-check login` again |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontend-go-live-check",
-  "version": "1.4.1",
+  "version": "1.6.0",
   "description": "Is your frontend ready to go live? One command tests any web frontend (React, Next.js, Vue, Angular, Svelte, plain HTML…): pages, responsive design, accessibility, keyboard, performance and load, API calls, security, SEO, sign-in and APIs from Postman/OpenAPI. Report with evidence, PDF and Word, and a pipeline gate that approves or rejects the merge.",
   "homepage": "https://www.npmjs.com/package/frontend-go-live-check",
   "repository": {

package/schema.json

@@ -154,7 +154,7 @@
         },
         "password": {
           "type": "string",
-          "description": "Use \"$NAME\" and put NAME in go-live-check.env."
+          "description": "Use \"$NAME\" and put NAME in go-live-check/.env."
         },
         "usernameField": {
           "type": "string",
@@ -169,7 +169,7 @@
         },
         "fields": {
           "type": "object",
-          "description": "Other fields to fill: label \u2192 value."
+          "description": "Other fields to fill: label → value."
         },
         "expect": {
           "type": "string",
@@ -181,7 +181,7 @@
             "session",
             "token"
           ],
-          "description": "form = fill the email/password form \u00b7 session = reuse the session saved by 'frontend-go-live-check login' \u00b7 token = a test token. Default: form when username/password are set, token when token is set, otherwise session."
+          "description": "form = fill the email/password form · session = reuse the session saved by 'frontend-go-live-check login' · token = a test token. Default: form when username/password are set, token when token is set, otherwise session."
         },
         "token": {
           "type": "object",
@@ -193,24 +193,24 @@
             },
             "cookies": {
               "type": "object",
-              "description": "Cookie name \u2192 value."
+              "description": "Cookie name → value."
             },
             "localStorage": {
               "type": "object",
-              "description": "Key \u2192 value, set before the app loads."
+              "description": "Key → value, set before the app loads."
             },
             "sessionStorage": {
               "type": "object",
-              "description": "Key \u2192 value, set before the app loads."
+              "description": "Key → value, set before the app loads."
             }
           }
         },
         "sessionFile": {
           "type": "string",
-          "description": "Where the saved session is kept. Default go-live-check.session.json (never commit it)."
+          "description": "Where the saved session is kept. Default go-live-check/session.json (never commit it)."
         }
       },
-      "description": "How the tool signs in. Email/password: page + username + password. Google, Microsoft, Apple, UAE PASS\u2026: \"method\": \"session\" and run frontend-go-live-check login once. Pipelines: see ciLogin."
+      "description": "How the tool signs in. Email/password: page + username + password. Google, Microsoft, Apple, UAE PASS…: \"method\": \"session\" and run frontend-go-live-check login once. Pipelines: see ciLogin."
     },
     "lighthouse": {
       "type": "boolean"
@@ -358,6 +358,13 @@
             },
             "seed": {
               "type": "integer"
+            },
+            "variables": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Values for {{variables}} in the Postman collection, e.g. { \"password\": \"$GO_LIVE_PASSWORD\" }."
             }
           }
         }
@@ -422,6 +429,227 @@
     "ciLogin": {
       "$ref": "#/properties/login",
       "description": "Used instead of \"login\" in pipelines (no one there to approve a Google or UAE PASS sign-in): a test email/password on the test environment, or a test token from the pipeline's secrets."
+    },
+    "load": {
+      "description": "The load test: false, or a profile and/or your own numbers. GET requests only, on this computer or the hosts listed.",
+      "oneOf": [
+        {
+          "const": false
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "profile": {
+              "enum": [
+                "light",
+                "standard",
+                "stress"
+              ],
+              "description": "light: 10 users for 10 s (default) · standard: 50 users for 60 s, added over 15 s · stress: adds 10 users every 10 s until the app gets slow or fails (the breaking point)"
+            },
+            "users": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "seconds": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "rampSeconds": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "step": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "stress: users added per step"
+            },
+            "maxTargets": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "hosts": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Other hosts the load test may call (test environments only)."
+            }
+          }
+        }
+      ]
+    },
+    "tests": {
+      "description": "The project's own unit and end-to-end tests. false turns them off.",
+      "oneOf": [
+        {
+          "const": false
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "unit": {
+              "type": "boolean",
+              "default": true
+            },
+            "e2e": {
+              "type": "boolean",
+              "default": true
+            },
+            "coverage": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 100,
+              "default": 60,
+              "description": "Minimum share of code lines covered by the unit tests (%)."
+            },
+            "unitCommand": {
+              "type": "string",
+              "description": "Your own command for the unit tests (instead of Vitest/Jest/Karma)."
+            },
+            "e2eCommand": {
+              "type": "string",
+              "description": "Your own command for the end-to-end tests. BASE_URL points at the app."
+            }
+          }
+        }
+      ]
+    },
+    "flows": {
+      "description": "User journeys and business rules, written without code (they can also be in go-live-check/flows.json).",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "name",
+          "steps"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "rule": {
+            "type": "boolean",
+            "description": "A business rule: if it fails, it blocks going live."
+          },
+          "signedIn": {
+            "type": "boolean",
+            "default": true
+          },
+          "viewports": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "severity": {
+            "enum": [
+              "blocker",
+              "major",
+              "minor",
+              "info"
+            ]
+          },
+          "steps": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "minProperties": 1,
+              "maxProperties": 1,
+              "properties": {
+                "open": {
+                  "type": "string",
+                  "description": "Open this address, e.g. /applications"
+                },
+                "fill": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "description": "Field label, placeholder or name → value. \"$NAME\" comes from .env; {unique} is unique to the run."
+                },
+                "select": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "string"
+                  }
+                },
+                "check": {
+                  "type": "string"
+                },
+                "click": {
+                  "type": "string",
+                  "description": "Button or link text (or css=selector)."
+                },
+                "press": {
+                  "type": "string"
+                },
+                "see": {
+                  "type": "string"
+                },
+                "notSee": {
+                  "type": "string"
+                },
+                "url": {
+                  "type": "string",
+                  "description": "The address must start with this."
+                },
+                "api": {
+                  "type": "object",
+                  "required": [
+                    "path"
+                  ],
+                  "properties": {
+                    "method": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string",
+                      "description": "e.g. /api/applications or /api/applications/:id"
+                    },
+                    "status": {
+                      "type": "integer"
+                    },
+                    "body": {
+                      "type": "object",
+                      "description": "Values the JSON answer must have."
+                    }
+                  }
+                },
+                "wait": {
+                  "type": "integer"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "formFill": {
+      "description": "Fill every form with valid test data and send it. Writes data: only on this computer or the hosts listed. false turns it off.",
+      "oneOf": [
+        {
+          "const": false
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "hosts": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "max": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      ]
     }
   }
 }

package/src/api/model.mjs

@@ -242,6 +242,6 @@ export async function loadApiMap(api, dir) {
     }
   }
   const baseUrl = sources.find((s) => s.baseUrl)?.baseUrl;
-  if (!sources.length) notes.push('No API file given: set "api": { "file": "postman_collection.json" } (or "openapi") in go-live-check.config.json, or --api <file>.');
+  if (!sources.length) notes.push('No API file given: set "api": { "file": "postman_collection.json" } (or "openapi") in go-live-check/config.json, or put the file in go-live-check/api/, or --api <file>.');
   return { endpoints: [...map.values()], baseUrl, basePath: sources.find((s) => s.basePath)?.basePath, title: sources.find((s) => s.title)?.title, sources: sources.map((s) => s.kind), notes };
 }