mandrel-platform 0.16.0 → 0.17.0

package/README.md

@@ -87,6 +87,13 @@ every consumer.
 A Biome base config with the recommended linter rule set, import organizer,
 and standard formatter defaults (2-space indent, 100-char line width).
 
+**Minimum Biome version: 2.0.** The base targets the **Biome v2 schema**
+(`$schema: https://biomejs.dev/schemas/2.5.0/schema.json`, `assist.actions.
+source.organizeImports`, `linter.rules.preset`). Biome v1 consumers cannot
+`extends` this base — the v2 config shape is a hard configuration error on
+Biome 1.x. There is no dual v1/v2 export; consumers on Biome 1.x must
+upgrade to 2.x before adopting this base (refs #153).
+
 **Consumer usage (`biome.json`):**
 
 ```jsonc
@@ -175,13 +182,28 @@ export default [
 ];
 ```
 
-#### `lighthouse.base.json`
-
-Lighthouse's `lighthouserc.json` has no whole-file `extends`, so the
-base ships the shared `ci` block — collect settings plus the four
-category assertions on the `lighthouse:recommended` preset. Deep-merge
-it and add your repo-specific `ci.collect.url` /
-`ci.collect.staticDistDir`:
+#### `lighthouse.base.json` / `lighthouse-thresholds.base.json`
+
+Lighthouse has **two runner mechanisms** in the fleet — `@lhci/cli`
+(`lighthouserc`) and a bespoke puppeteer + baseline-drift script (collect a
+Lighthouse result programmatically, diff category scores against a checked-in
+baseline JSON). Neither can consume the other's config shape natively, so the
+package ships **two bases**:
+
+- **`lighthouse-thresholds.base.json`** — the **mechanism-neutral** score
+  floors (`categories.performance` / `.accessibility` / `.best-practices` /
+  `.seo`, each a bare `0.0`–`1.0` number). This is the shared source of
+  truth both mechanisms read. Runner-agnostic on purpose: it has no LHCI
+  `ci.assert` wrapper and no puppeteer-script wiring, just the floors.
+- **`lighthouse.base.json`** — the **LHCI wrapper**. Ships the shared `ci`
+  block (collect settings + the four category assertions on the
+  `lighthouse:recommended` preset) for `@lhci/cli` consumers. Its
+  `categories:*` `minScore` values are sourced from
+  `lighthouse-thresholds.base.json` — keep the two in sync when a floor
+  changes.
+
+**LHCI consumers** (`@lhci/cli`) deep-merge `lighthouse.base.json` and add
+repo-specific `ci.collect.url` / `ci.collect.staticDistDir`:
 
 ```jsonc
 // lighthouserc.js — deep-merge the base, add repo-specific collect targets
@@ -198,6 +220,23 @@ export default {
 };
 ```
 
+**Puppeteer / baseline-drift consumers** (no `@lhci/cli`, no `lighthouserc`)
+extend `lighthouse-thresholds.base.json` directly — read the bare category
+floors and gate the collected result against them, independent of any LHCI
+config shape:
+
+```jsonc
+// scripts/lighthouse-baseline.mjs — read the shared floors, gate the collected result
+import thresholds from "mandrel-platform/lighthouse-thresholds.base.json" with { type: "json" };
+
+for (const [category, minScore] of Object.entries(thresholds.categories)) {
+  const score = lighthouseResult.categories[category].score;
+  if (score < minScore) {
+    throw new Error(`${category} score ${score} below floor ${minScore}`);
+  }
+}
+```
+
 > **Budgets stay consumer-tunable.** These bases standardize *which*
 > tools run and their shared defaults — not *what each tool gates on*
 > per consumer. Override any threshold, score floor, or budget locally;
@@ -465,6 +504,7 @@ pnpm run bootstrap
 | `mandrel-platform/dependency-cruiser.base.json` | `config/dependency-cruiser.base.json` |
 | `mandrel-platform/size-limit.base.json`         | `config/size-limit.base.json`         |
 | `mandrel-platform/lighthouse.base.json`         | `config/lighthouse.base.json`         |
+| `mandrel-platform/lighthouse-thresholds.base.json` | `config/lighthouse-thresholds.base.json` |
 | `mandrel-platform/pnpm-workspace.supply-chain.yaml` | `config/pnpm-workspace.supply-chain.yaml` |
 | `mandrel-platform/edge-security`                | `config/edge-security/index.mjs`      |
 | `mandrel-platform/edge-security/*`              | `config/edge-security/*`              |

package/config/biome.base.json

@@ -1,12 +1,11 @@
 {
-  "$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
-  "organizeImports": {
-    "enabled": true
-  },
+  "root": false,
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "assist": { "actions": { "source": { "organizeImports": "on" } } },
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true
+      "preset": "recommended"
     }
   },
   "formatter": {

package/config/lighthouse-thresholds.base.json

@@ -0,0 +1,9 @@
+{
+  "_comment": "Mechanism-neutral Lighthouse score-floor thresholds for mandrel-platform consumers (refs #157). Runner-agnostic: both an LHCI `lighthouserc` (via lighthouse.base.json, which spreads this file's `categories` into its `ci.assert.assertions`) and a bespoke puppeteer + baseline-drift script (reading `categories` directly against each category's `lighthouse-result.categories.<key>.score`) can consume the same floors. Consumer-tunable: override any entry locally in either mechanism.",
+  "categories": {
+    "performance": 0.9,
+    "accessibility": 0.9,
+    "best-practices": 0.9,
+    "seo": 0.9
+  }
+}

package/config/lighthouse.base.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Shared Lighthouse CI base for mandrel-platform consumers. Lighthouse's `lighthouserc.json` has no whole-file `extends`, so this ships the shared `ci` block (collect settings + category assertions on the recommended preset). Consumers deep-merge it and add repo-specific `ci.collect.url` / `ci.collect.staticDistDir` and any per-repo assertion overrides (see README). Category score floors stay consumer-tunable.",
+  "_comment": "Shared Lighthouse CI base for mandrel-platform LHCI (@lhci/cli) consumers. Lighthouse's `lighthouserc.json` has no whole-file `extends`, so this ships the shared `ci` block (collect settings + category assertions on the recommended preset). Consumers deep-merge it and add repo-specific `ci.collect.url` / `ci.collect.staticDistDir` and any per-repo assertion overrides (see README). The `categories:*` minScore floors below are sourced from the mechanism-neutral `mandrel-platform/lighthouse-thresholds.base.json` (refs #157) — keep the two files' scores in sync when a floor changes. Consumers who run Lighthouse via a bespoke puppeteer + baseline-drift script instead of @lhci/cli should extend `lighthouse-thresholds.base.json` directly rather than this file (see README). Category score floors stay consumer-tunable.",
   "ci": {
     "collect": {
       "numberOfRuns": 3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel-platform",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Shared CI/deploy workflows, composite toolchain action, npm config package, Renovate preset, and operator runbook templates.",
   "license": "MIT",
   "repository": {
@@ -24,6 +24,7 @@
     "./dependency-cruiser.base.json": "./config/dependency-cruiser.base.json",
     "./size-limit.base.json": "./config/size-limit.base.json",
     "./lighthouse.base.json": "./config/lighthouse.base.json",
+    "./lighthouse-thresholds.base.json": "./config/lighthouse-thresholds.base.json",
     "./pnpm-workspace.supply-chain.yaml": "./config/pnpm-workspace.supply-chain.yaml",
     "./edge-security": "./config/edge-security/index.mjs",
     "./edge-security/*": "./config/edge-security/*",
@@ -40,7 +41,7 @@
     "provenance": true
   },
   "dependencies": {
-    "mandrel": "^1.78.0"
+    "mandrel": "^1.81.0"
   },
   "scripts": {
     "typecheck": "node --input-type=module --eval 'process.exit(0)'",

package/scripts/check-coverage-threshold.mjs

@@ -127,10 +127,19 @@ export function meetsThreshold(pct, threshold) {
 }
 
 /**
- * Recursively find every `coverage-summary.json` under `coverage/` directories
- * below `root`. `node_modules` and dotted dirs (e.g. `.git`, `.agents`) are
- * pruned so the scan stays fast and never reads a vendored framework tree.
- * `roots` (from `--coverage-dir`) overrides the auto-scan when provided.
+ * Recursively find every `coverage-summary.json` under `root`, regardless of
+ * the name of the directory that directly contains it. `node_modules` and
+ * dotted dirs (e.g. `.git`, `.agents`) are pruned so the scan stays fast and
+ * never reads a vendored framework tree. `roots` (from `--coverage-dir`)
+ * overrides the auto-scan when provided.
+ *
+ * A directory literally named `coverage` (the common single-workspace shape)
+ * is still discovered, but so is a per-workspace fan-out layout where the
+ * top-level `coverage/` dir nests differently-named subdirectories per
+ * package (e.g. `coverage/web/coverage-summary.json`,
+ * `coverage/shared/coverage-summary.json`) — the match condition is "this
+ * directory contains a coverage-summary.json file", not "this directory is
+ * named coverage".
  */
 export function findCoverageSummaries(root, roots = []) {
   if (roots.length > 0) {
@@ -151,17 +160,13 @@ export function findCoverageSummaries(root, roots = []) {
     } catch {
       return;
     }
+    const file = join(dir, "coverage-summary.json");
+    if (existsSync(file)) found.push(file);
     for (const entry of entries) {
       const name = entry.name;
       if (!entry.isDirectory()) continue;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join(dir, name);
-      if (name === "coverage") {
-        const file = join(full, "coverage-summary.json");
-        if (existsSync(file)) found.push(file);
-        // A coverage dir may still nest sub-package coverage; keep walking.
-      }
-      walk(full);
+      walk(join(dir, name));
     }
   };
   walk(resolve(root));

package/scripts/check-coverage-threshold.test.mjs

@@ -243,6 +243,42 @@ test("findCoverageSummaries auto-scans **/coverage/, pruning node_modules + dott
   }
 });
 
+test("findCoverageSummaries discovers a per-workspace fan-out layout (coverage/<workspace>/coverage-summary.json)", () => {
+  const root = mkdtempSync(join(tmpdir(), "cov-gate-"));
+  try {
+    // domio's shape: top-level coverage/ dir nests per-workspace subdirs that
+    // are NOT themselves named "coverage".
+    mkdirSync(join(root, "coverage", "web"), { recursive: true });
+    writeFileSync(
+      join(root, "coverage", "web", "coverage-summary.json"),
+      JSON.stringify(summary({ lines: 77 }))
+    );
+    mkdirSync(join(root, "coverage", "shared"), { recursive: true });
+    writeFileSync(
+      join(root, "coverage", "shared", "coverage-summary.json"),
+      JSON.stringify(summary({ lines: 93 }))
+    );
+    // Decoys that must still be pruned.
+    mkdirSync(join(root, "node_modules", "dep", "coverage"), { recursive: true });
+    writeFileSync(
+      join(root, "node_modules", "dep", "coverage", "coverage-summary.json"),
+      JSON.stringify(summary({ lines: 1 }))
+    );
+    mkdirSync(join(root, ".agents", "coverage"), { recursive: true });
+    writeFileSync(
+      join(root, ".agents", "coverage", "coverage-summary.json"),
+      JSON.stringify(summary({ lines: 2 }))
+    );
+
+    const files = findCoverageSummaries(root).sort();
+    assert.equal(files.length, 2);
+    assert.ok(files.some((f) => /coverage[/\\]shared[/\\]coverage-summary\.json$/.test(f)));
+    assert.ok(files.some((f) => /coverage[/\\]web[/\\]coverage-summary\.json$/.test(f)));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("findCoverageSummaries honours explicit --coverage-dir roots", () => {
   const root = mkdtempSync(join(tmpdir(), "cov-gate-"));
   try {