rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-file-upload/CHANGELOG.md

@@ -1,9 +1,64 @@
 # application-file-upload CHANGELOG
 
-## 1.0.0 (visual round T-2, spec 2026-09-06)
+## 1.2.7 - 2026-09-11
 
-- First ratified version of the shelf's file-upload blueprint. Five REQs (input contract with a labelled file input plus drop-zone plus keyboard alternative per WCAG 2.5.7, progress contract with per-file percent and aggregate percent and polite live-region tick, refusal contract with MIME and size and virus-scan gates and aria-describedby error binding and focus-to-retry, transport contract chunked-and-resumable with multipart POST default and tus.io elicited alternative, completion contract with assertive-slot success announcement per WCAG 4.1.3 and per-file remove and retry), seven USs 23101-23107 binding one runtime-observable AC per REQ plus two cross-cutting cases (network-interruption resumption AC-23106-1, background-tab progress AC-23107-1), three TACs 2401-2403 (upload input surface, upload transport contract, upload progress announcer), three ADRs 2401-2403 (transport branch with multipart recommendedDefault true and tus and vendor-sdk elicited, accepted MIME set and per-file size cap elicited, virus-scan integration via a capability-plus-elicit). No new global topics.
-- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
-- Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/` with a Node HTTP server realising both transport branches honestly (`?transport=multipart` default, `?transport=tus` elicited alternative) and break switches (`?break=no-input`, `?break=no-live-region`, `?break=send-refused`, `?break=no-chunks`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?transport=`, every `?seed=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
+- per-file-progressbar now emits a notObservableHere row for AC-23102-2 alongside the existing conformanceOnly server row: the AC's when/then names the aggregate announcement text emitted through the polite live region, and that half is a browser DOM observation the server-side probe pack cannot make. The AC is now represented on the shelf as (i) a conformanceOnly counting row observing the byte-weighted aggregate from the server's uploaded-bytes accounting and (ii) a notObservableHere row carrying the AC id and the browser-observable-half reason.
+- Anatomy test pin bumped to 1.2.7.
+
+## 1.2.6 - 2026-09-11
+
+- Corrects the stale chunked-transport-endpoints probe header: the AC-23104-1 row drives one declared 16 KiB file split into four sequential 4 KiB chunks against one sessionId, and the header now says so rather than "three real chunk POSTs with distinct byte payloads"; the code and evidence were already the four-equal-chunk shape.
+- Anatomy test pin bumped to 1.2.6.
+
+
+## 1.2.5 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d.
+- Probes: upload-surface-shape, per-file-progressbar, chunked-transport-endpoints, assertive-completion-slot.
+- Chunked-transport row for AC-23104-1 is conformanceOnly: the probe observes multipart chunk-count bytes server-side; the DOM half ([data-transport], [data-chunks-uploaded]) and the browser-network half (PATCH requests carrying Upload-Offset) are notObservableHere. AC-23104-3 remains a positive row on the tus branch (post-409 state read + resume PATCH from the acknowledged offset).
+- Per-file aggregate row for AC-23102-2 is conformanceOnly with limitation naming that the polite live region's rendered aggregate announcement text is browser-only; the row drives three files of 1/2/5 MiB through /upload/chunk and shows byte-weighted percent differs materially from plain per-file average at the intermediate steps (12.5% vs 33.33% after file 1; 37.5% vs 66.67% after file 2) and converges to 100% at completion.
+- Enter-press / focus surface (AC-23101-1) is conformanceOnly with limitation naming that the button-Enter-open-picker interaction is browser-only.
+- Aggregate completion is derived from request-body bytes.
+- Anatomy test pin bumped to 1.2.5.
+
+
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- Six elicits (`accepted-set`, `size-cap`, `tick-interval`, `concurrency`, `polling`, `chunked-transport`) declared on blueprint.json; REQ-006 binds one runtime clause per apply-time answer family.
+- `virusScan` declared on `blueprint.json.capabilities` and REQ-007 binds the input TAC's refusal path to the applied verifier.
+- Vendor citations on AC-23104-1, AC-23104-3 and AC-23104-4 (tus.io PATCH); AC-23104-4 names the response header (not body).
+
+### Changed
+
+- REQ-002 drops the "at least every 10 percent" clause and keeps the 2-second announcement cap owned by `TAC-2403.interfaces.announcementInterval` (user-observable); names `TAC-2403.interfaces.tickInterval` (250 ms internal poll, not user-observable); ADR-2402 references both via ownerRef.
+- REQ-002.deliveredBy retargeted to `TAC-2403.interfaces.tick`.
+- REQ-003.deliveredBy retargeted to `TAC-2401.interfaces.renderRefusal`.
+- REQ-004.deliveredBy retargeted to `TAC-2402.interfaces.uploadFile`.
+- `TAC-2402.interfaces.removeFile` declared with DELETE failure semantics; REQ-005 targets it.
+- Probe check AC-23103-1 reworked to positively assert a per-file `[data-refusal-receipt]` keyed by file id; fixture updated to emit the marker alongside `data-file-id`.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10)
+
+### Added
+
+- Failure-path acceptance criteria added on US-23101 (MIME and size cap refusal), US-23102 (byte-weighted aggregate progress, tick-cadence cap), US-23103 (per-file failure with focus on retry), US-23104 (tus prerequisite apply refusal with TUS_PREREQUISITE_MISSING, Upload-Offset semantics on retry, malformed Upload-Offset handling), US-23105 (successful removal with polite announce, failed DELETE with data-remove-outcome=failed, completion-once idempotency), US-23106 (Upload-Offset regression abort with UPLOAD_OFFSET_REGRESSION), US-23107 (prefers-reduced-motion static-text fallback), so applying projects have explicit failure-path acceptance criteria on each story.
+- Vendor citations on the tus.io resumable-upload protocol AC and the WCAG animation-from-interactions AC (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2401 (input), TAC-2402 (transport) or TAC-2403 (progress-announcer).
+- Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe removeFile carry ownerRef into TAC-2402.
+
+## 1.0.0 (2026-09-06)
+
+- Initial shipped version of the shelf's file-upload blueprint. Five REQs (input contract with a labelled file input plus drop-zone plus keyboard alternative per WCAG 2.5.7, progress contract with per-file percent and aggregate percent and polite live-region tick, refusal contract with MIME and size and virus-scan gates and aria-describedby error binding and focus-to-retry, transport contract chunked-and-resumable with multipart POST default and tus.io elicited alternative, completion contract with assertive-slot success announcement per WCAG 4.1.3 and per-file remove and retry), seven USs 23101-23107 binding one runtime-observable AC per REQ plus two cross-cutting cases (network-interruption resumption AC-23106-1, background-tab progress AC-23107-1), three TACs 2401-2403 (upload input surface, upload transport contract, upload progress announcer), three ADRs 2401-2403 (transport branch with multipart recommendedDefault true and tus and vendor-sdk elicited, accepted MIME set and per-file size cap elicited, virus-scan integration via a capability-plus-elicit). No new global topics.
+- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
+- Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/` with a Node HTTP server realising both transport branches honestly (`?transport=multipart` default, `?transport=tus` elicited alternative) and break switches (`?break=no-input`, `?break=no-live-region`, `?break=send-refused`, `?break=no-chunks`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?transport=`, every `?seed=`, every `?break=`, the manual boot line and the two-line manual boot.
 - Declares `suggestedCompanions` `logging` (every refused upload writes one request-scoped log line with the closed refusal reason and the correlation identifier) and `errorHandling` (refusals and transport-layer failures construct an internal error record through the applied error-handling factory). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
-- Seventh shipped consumer of T-0's probe-pack runner extension.
+- Seventh shipped consumer of the earlier release probe-pack runner extension.

package/blueprints/application-file-upload/README.md

@@ -52,7 +52,7 @@ Every file row on the fixture cycles through the closed state set `idle` -> `upl
 
 ## The one runtime gate
 
-`probe-packs/application-file-upload.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2401-application-file-upload-input` or whose nav model routes name an operator-configured upload path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM (and the request log for the refusal check and the tus branch), and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation.
+`probe-packs/application-file-upload.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2401-application-file-upload-input` or whose nav model routes name an operator-configured upload path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM (and the request log for the refusal check and the tus branch), and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper; no bare string concatenation.
 
 ## Quality bar
 

package/blueprints/application-file-upload/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-file-upload",
-  "version": "1.0.0",
+  "version": "1.2.7",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -38,6 +38,16 @@
       "kind": "req",
       "path": "requirements/application-file-upload-req-005.json"
     },
+    {
+      "id": "application-file-upload-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-file-upload-req-006.json"
+    },
+    {
+      "id": "application-file-upload-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-file-upload-req-007.json"
+    },
     {
       "id": "application-file-upload-US-23101",
       "kind": "us",
@@ -110,5 +120,51 @@
       "elicited": true,
       "standardsTraceClause": "OWASP ASVS V12 file uploads"
     }
-  ]
+  ],
+  "elicits": [
+    {
+      "id": "accepted-set",
+      "prompt": "Accepted MIME set: comma-separated IANA media types or wildcards (image/*, application/*).",
+      "kind": "string",
+      "default": "image/*"
+    },
+    {
+      "id": "size-cap",
+      "prompt": "Per-file size cap in bytes.",
+      "kind": "string",
+      "default": "10485760"
+    },
+    {
+      "id": "tick-interval",
+      "prompt": "Internal progress polling cadence in milliseconds (default 250, internal only).",
+      "kind": "string",
+      "default": "250"
+    },
+    {
+      "id": "concurrency",
+      "prompt": "Chunk upload concurrency cap (default 3).",
+      "kind": "string",
+      "default": "3"
+    },
+    {
+      "id": "polling",
+      "prompt": "Announcement cap in seconds for the polite live region (default 2).",
+      "kind": "string",
+      "default": "2"
+    },
+    {
+      "id": "chunked-transport",
+      "prompt": "Chunked-and-resumable transport branch: multipart (default) or tus.",
+      "kind": "enum",
+      "options": [
+        "multipart",
+        "tus"
+      ],
+      "default": "multipart"
+    }
+  ],
+  "capabilities": [
+    "virusScan"
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-file-upload/contributions/adrs/adr-2402-application-file-upload-accepted-set.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-2402-application-file-upload-accepted-set",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Accepted MIME set and per-file size cap are elicited per project; no shelf default beyond \"nothing accepted\"",
   "context": "A shelf blueprint cannot know what a downstream project's upload endpoint accepts. A photo-gallery product accepts a narrow image set (jpeg, png, webp) with a 20 MB per-file cap; a document workspace accepts pdf, docx, txt with a 100 MB cap; a code-review product accepts a broad set with a 5 MB cap. Picking a default that fits all projects picks one that fits none. Shipping without any elicited values leaves the input TAC in a state where every file is refused (the safe default), which is the correct floor: a project that forgets to elicit the accepted set discovers this immediately on the first upload.",
-  "decision": "The accepted MIME set and the per-file size cap are elicited per project through this ADR. The blueprint contributes the two parameters as elicits on apply; the input TAC's MIME gate refuses every file until both are elicited. The elicited MIME set is a list of IANA media types; wildcards (image/*, application/*) are permitted for projects that want them but discouraged in the guide. The per-file size cap is a positive integer in bytes. A concurrency cap and the polling interval for the announcer are secondary elicits with recommended defaults (concurrency 3, interval 250 ms).",
+  "decision": "The accepted MIME set and the per-file size cap are elicited per project through this ADR. The blueprint contributes the two parameters as elicits on apply; the input TAC's MIME gate refuses every file until both are elicited. The elicited MIME set is a list of IANA media types; wildcards (image/*, application/*) are permitted for projects that want them but discouraged in the guide. The per-file size cap is a positive integer in bytes. A concurrency cap and the announcer cadences are secondary elicits with recommended defaults owned by `TAC-2403.interfaces.tickInterval` (250 ms internal poll, not user-observable) and `TAC-2403.interfaces.announcementInterval` (2 seconds user-observable announcement cap); concurrency defaults to 3.",
   "consequences": "Projects that apply the blueprint without elicitizing discover the refusal on the first upload attempt and go through the elicit flow to unblock it; the refusal is legible (\"MIME gate has no accepted set\") rather than silently accepting everything. Projects with a mature accepted-set list paste it in once and never revisit. The pack asserts the input TAC refuses an obvious wrong-MIME file (a text/plain payload with a jpeg extension) and refuses a payload exceeding the size cap.",
   "alternativesConsidered": [
     {
@@ -21,5 +21,5 @@
     }
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/probes/assertive-completion-slot.mjs

@@ -0,0 +1,78 @@
+// assertive-completion-slot probe for application-file-upload v1.2.7.
+//
+// AC-23105-1 (server-observable half): after the fixture completes
+// the upload set, the assertive-slot in the shell reads
+// /^\d+ files uploaded successfully$/ derived from real bytes.
+// The DOM-observable per-row remove/retry controls are browser-only,
+// so this probe records ONE conformanceOnly row for AC-23105-1
+// carrying real evidence for the observed half.
+//
+// anchorAcId: application-file-upload-AC-23105-1.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorReqId = 'application-file-upload-REQ-005';
+export const accountBound = false;
+
+const COMPLETION_RE = /^\d+ files uploaded successfully$/;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const sessionId = `probe-${randomUUID()}`;
+    const files = [{ name: 'p.bin', bytes: 100 }, { name: 'q.bin', bytes: 200 }, { name: 'r.bin', bytes: 300 }];
+    const total = files.reduce((s, f) => s + f.bytes, 0);
+    await fetch(`${fixture.baseUrl}/upload/session?sessionId=${sessionId}`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ totalExpectedBytes: total, files }),
+    });
+    for (const [i, f] of files.entries()) {
+      await fetch(`${fixture.baseUrl}/upload/chunk?n=${i + 1}&sessionId=${sessionId}`, {
+        method: 'POST', body: Buffer.alloc(f.bytes, 65 + i),
+      });
+    }
+    const completionRes = await fetch(`${fixture.baseUrl}/upload/completion?sessionId=${sessionId}`);
+    const completionBody = await completionRes.text();
+    const completionParsed = JSON.parse(completionBody);
+    const completeDerived = completionParsed.complete === true && completionParsed.uploadedBytes === total
+      && COMPLETION_RE.test(completionParsed.completionText);
+
+    const shellRes = await fetch(`${fixture.baseUrl}/upload?sessionId=${sessionId}`);
+    const shellBody = await shellRes.text();
+    const slotMatch = shellBody.match(/<div[^>]+data-assertive-slot[^>]+aria-live="assertive"[^>]*>([^<]*)<\/div>/);
+    const slotText = slotMatch ? slotMatch[1].trim() : '';
+    const shellOk = shellRes.status === 200 && !!slotMatch && COMPLETION_RE.test(slotText)
+      && slotText === completionParsed.completionText;
+    const pass = completeDerived && shellOk;
+    results.push(conformanceOnlyResult({
+      anchorAcId: 'application-file-upload-AC-23105-1',
+      anchorReqId: 'application-file-upload-REQ-005',
+      verdict: pass ? 'pass' : 'fail',
+      detail: `After the fixture completes the upload set the - drove three real chunk uploads (${total} bytes) under sessionId=${sessionId}; fixture derived completionText="${completionParsed.completionText}"; shell assertive-slot text="${slotText}"`,
+      evidence: evidenceFromResponse({
+        route: `/upload?sessionId=${sessionId}`,
+        response: shellRes,
+        bodyText: shellBody,
+        extraFields: {
+          input: { sessionId, files, totalExpectedBytes: total },
+          derived: {
+            uploadedBytes: completionParsed.uploadedBytes,
+            complete: completionParsed.complete,
+            completionText: completionParsed.completionText,
+            assertiveSlotText: slotText,
+          },
+          altBodyExcerpt: completionBody.slice(0, 240),
+        },
+      }),
+      limitation: 'application-file-upload-AC-23105-1: per-row remove and retry controls need browser DOM inspection',
+    }));
+
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-file-upload/contributions/probes/chunked-transport-endpoints.mjs

@@ -0,0 +1,173 @@
+// chunked-transport-endpoints probe for application-file-upload v1.2.7.
+//
+// Row 1 (AC-23104-1): multipart transport - one declared file is
+// sent as four sequential equal-sized 4 KiB chunk POSTs against
+// one sessionId; the server's per-session byte accounting advances
+// by the actual body bytes of each chunk and the completion GET
+// reports chunksUploaded higher than one and complete=true.
+// Row 2 (AC-23104-3): tus transport - Upload-Offset writes bytes
+// durably; a mismatched offset returns 409 WITHOUT advancing the
+// stored offset; the probe then re-reads the state and issues a
+// RESUME PATCH from the last acknowledged offset, closing the
+// gap (post-409 state check + resume PATCH from the AC).
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult, notObservableHereResult } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorReqId = 'application-file-upload-REQ-004';
+export const accountBound = false;
+
+export default async function runProbe() {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js');
+ const fixture = await startFixture({ startServer, port: 0 });
+ try {
+ const results = [];
+
+ // Row 1 (AC-23104-1 server-observable half): ONE file forced into
+ // multiple chunks on the ?transport=multipart branch. AC-23104-1
+ // requires a file large enough to force chunking with a completed
+ // chunk count higher than 1. The probe declares one file of
+ // sixteen KiB and posts four sequential 4 KiB chunks against the
+ // same sessionId; the fixture's per-session byte accounting
+ // advances by the actual body bytes of each chunk and the final
+ // response reports the file as complete. AC-23104-1 has three
+ // halves: multipart chunk-count in the DOM (browser), tus PATCH
+ // with Upload-Offset on the browser network log (browser), and
+ // the underlying server-side byte accounting for one file forced
+ // into multiple chunks (server-observable). The probe positively
+ // observes the third half and records the row as conformanceOnly
+ // with a limitation naming the two browser halves not observed
+ // here.
+ const sessionId = `session-${randomUUID()}`;
+ const oneFileBytes = 16 * 1024;
+ const chunkBytes = 4 * 1024;
+ const chunkCount = oneFileBytes / chunkBytes;
+ const files = [{ name: 'one-large-file.bin', bytes: oneFileBytes }];
+ await fetch(`${fixture.baseUrl}/upload/session?sessionId=${sessionId}`, {
+ method: 'POST', headers: { 'content-type': 'application/json' },
+ body: JSON.stringify({ totalExpectedBytes: oneFileBytes, files }),
+ });
+ const chunkResults = [];
+ let lastChunkRes, lastChunkBody = '';
+ for (let i = 0; i < chunkCount; i += 1) {
+ const payload = Buffer.alloc(chunkBytes, 65 + i);
+ const r = await fetch(`${fixture.baseUrl}/upload/chunk?n=${i + 1}&sessionId=${sessionId}`, { method: 'POST', body: payload });
+ const b = await r.text();
+ const parsed = JSON.parse(b);
+ chunkResults.push({ chunk: i + 1, bytesReceived: parsed.bytesReceived, uploadedBytes: parsed.uploadedBytes, chunksUploaded: parsed.chunksUploaded, complete: parsed.complete });
+ lastChunkRes = r; lastChunkBody = b;
+ }
+ const finalRes = await fetch(`${fixture.baseUrl}/upload/chunk?sessionId=${sessionId}`);
+ const finalBody = await finalRes.text();
+ const finalParsed = JSON.parse(finalBody);
+ const allChunksAcceptedFor4KiB = chunkResults.every((c) => c.bytesReceived === chunkBytes);
+ const chunksHigherThanOne = finalParsed.chunksUploaded > 1;
+ const bytesAdvanced = finalParsed.uploadedBytes === oneFileBytes;
+ const completeAtEnd = finalParsed.complete === true;
+ const chunkOk = allChunksAcceptedFor4KiB && chunksHigherThanOne && bytesAdvanced && completeAtEnd;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-file-upload-AC-23104-1',
+ verdict: chunkOk ? 'pass' : 'fail',
+ detail: `On the ?transport=multipart branch the fixture returns 200 - one file (${oneFileBytes} B) forced into ${chunkCount} chunks of ${chunkBytes} B; chunksUploaded=${finalParsed.chunksUploaded} (>1: ${chunksHigherThanOne}); uploadedBytes=${finalParsed.uploadedBytes}/${oneFileBytes} (complete=${completeAtEnd})`,
+ evidence: evidenceFromResponse({
+ route: `/upload/chunk (sessionId=${sessionId})`,
+ response: lastChunkRes,
+ bodyText: lastChunkBody,
+ extraFields: {
+ input: { sessionId, files, totalExpectedBytes: oneFileBytes, chunkBytes, chunkCount },
+ derived: { chunkResults, finalParsed, allChunksAcceptedFor4KiB, chunksHigherThanOne, bytesAdvanced, completeAtEnd },
+ },
+ }),
+ limitation: 'application-file-upload-AC-23104-1: [data-transport] and [data-chunks-uploaded] DOM values, and the browser-network PATCH log carrying Upload-Offset on the tus branch, are not observable on a server-driven probe pack; this row observes the server-side byte accounting of one file forced into multiple chunks only',
+ }));
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23104-1',
+ detail: 'On the ?transport=multipart branch the fixture returns 200 - the DOM half ([data-transport], [data-chunks-uploaded]) is browser-only',
+ reason: 'AC-23104-1 requires observing [data-transport="multipart"] and [data-chunks-uploaded] on the rendered DOM; a server-side probe pack cannot observe DOM',
+ evidence: { requires: 'browser DOM observation', ac: 'application-file-upload-AC-23104-1', half: 'dom' },
+ }));
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23104-1',
+ detail: 'On the ?transport=multipart branch the fixture returns 200 - the tus network half (PATCH with Upload-Offset on the browser network log) is browser-only',
+ reason: 'AC-23104-1 requires observing at least one PATCH on the browser network log whose request headers include a numeric Upload-Offset; a server-side probe pack cannot observe the browser network log',
+ evidence: { requires: 'browser network log observation', ac: 'application-file-upload-AC-23104-1', half: 'browser-network' },
+ }));
+
+ // Row 2 (AC-23104-3): tus offset write; a 409 mismatch does not
+ // advance stored offset; the resume PATCH from the last
+ // acknowledged offset succeeds.
+ const uploadId = `upload-${randomUUID()}`;
+ const patch1 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': '0' }, body: Buffer.alloc(4096, 65),
+ });
+ const patch1Offset = patch1.headers.get('upload-offset');
+ const get1 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const get1Body = await get1.text();
+ const get1Parsed = JSON.parse(get1Body);
+ const patch2 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': '4096' }, body: Buffer.alloc(8192, 66),
+ });
+ const patch2Offset = patch2.headers.get('upload-offset');
+ const get2 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const get2Body = await get2.text();
+ const get2Parsed = JSON.parse(get2Body);
+ // Bad PATCH: declared offset 99999 while stored is 12288.
+ const patchBad = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': '99999' }, body: Buffer.alloc(10, 67),
+ });
+ const patchBadBody = await patchBad.text();
+ // AC-23104-3 post-failure state check: stored offset must NOT
+ // have moved, and the client re-reads Upload-Offset before
+ // resuming (post-409 state check plus resume PATCH).
+ const postFail = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const postFailBody = await postFail.text();
+ const postFailParsed = JSON.parse(postFailBody);
+ const storedUnchanged = postFailParsed.storedBytes === 12288;
+ // Resume PATCH from the last acknowledged offset (12288) with a
+ // real payload; on success the stored bytes advance again.
+ const resumeBytes = 1024;
+ const patchResume = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': String(postFailParsed.storedBytes) }, body: Buffer.alloc(resumeBytes, 68),
+ });
+ const patchResumeOffset = patchResume.headers.get('upload-offset');
+ const getResume = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const getResumeBody = await getResume.text();
+ const getResumeParsed = JSON.parse(getResumeBody);
+ const resumeOk = patchResume.status === 204
+ && patchResumeOffset === String(12288 + resumeBytes)
+ && getResumeParsed.storedBytes === 12288 + resumeBytes;
+ const tusOk = patch1.status === 204 && patch1Offset === '4096' && get1Parsed.storedBytes === 4096
+ && patch2.status === 204 && patch2Offset === '12288' && get2Parsed.storedBytes === 12288
+ && patchBad.status === 409 && storedUnchanged
+ && resumeOk;
+ results.push({
+ anchorAcId: 'application-file-upload-AC-23104-3',
+ verdict: tusOk ? 'pass' : 'fail',
+ detail: `Upload-Offset on the tus branch matches the byte - tus writes byte-derived: PATCH#1 stored=${get1Parsed.storedBytes}, PATCH#2 stored=${get2Parsed.storedBytes}, mismatch PATCH -> ${patchBad.status} (stored unchanged=${storedUnchanged}), resume PATCH -> ${patchResume.status} stored=${getResumeParsed.storedBytes}`,
+ evidence: evidenceFromResponse({
+ route: `/upload/tus (uploadId=${uploadId})`,
+ response: getResume,
+ bodyText: getResumeBody,
+ extraFields: {
+ input: { uploadId, patches: [
+ { offset: 0, bytes: 4096 },
+ { offset: 4096, bytes: 8192 },
+ { offset: 99999, bytes: 10, expectMismatch: true },
+ { offset: 12288, bytes: resumeBytes, resume: true },
+ ] },
+ derived: {
+ patch1Offset, patch2Offset, stored1: get1Parsed.storedBytes, stored2: get2Parsed.storedBytes,
+ mismatchStatus: patchBad.status, storedUnchanged, postFailBody: postFailBody.slice(0, 240),
+ resumeStatus: patchResume.status, resumeStoredBytes: getResumeParsed.storedBytes, resumeOffsetHeader: patchResumeOffset,
+ },
+ },
+ }),
+ });
+
+ return { results };
+ } finally {
+ await fixture.close();
+ }
+}

package/blueprints/application-file-upload/contributions/probes/per-file-progressbar.mjs

@@ -0,0 +1,124 @@
+// per-file-progressbar probe for application-file-upload v1.2.7.
+//
+// Row 1 (AC-23102-1, browser-only): rendered live-region text and
+// per-file DOM values are notObservableHere.
+// Row 2 (AC-23102-2, byte-weighted aggregate discrimination):
+// three files of 1 MiB, 2 MiB and 5 MiB upload one at a time. The
+// probe records the fixture's uploadedBytes / totalExpectedBytes
+// after EACH file completes and compares the byte-weighted aggregate
+// against the plain average of per-file percents at the same point.
+// Discrimination is unambiguous after files 1 and 2 (byte-weighted
+// 12.5% vs plain-average 33.3% after file 1; 37.5% vs 66.7% after
+// file 2); after file 3 both collapse to 100% (the AC's aggregate
+// meets its terminal condition). Row is conformanceOnly with a
+// limitation naming that only the server-side aggregate byte
+// accounting is asserted here; the AC's rendered aggregate value
+// on the polite live region is a browser-observable half.
+// Row 3 (AC-23102-2, browser-only half): the emitted announcement
+// text on the polite live region is a browser DOM observation and
+// is recorded as notObservableHere against the same AC so the
+// browser half is represented on the shelf alongside the server
+// counting evidence.
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse, notObservableHereResult, conformanceOnlyResult } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorReqId = 'application-file-upload-REQ-002';
+export const accountBound = false;
+
+const MIB = 1024 * 1024;
+
+export default async function runProbe() {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js');
+ const fixture = await startFixture({ startServer, port: 0 });
+ try {
+ const results = [];
+
+ // Row 1: notObservableHere for the live-region + per-file DOM value.
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23102-1',
+ detail: 'The upload region ships a [data-live-region="polite"] wrapper with - rendered live-region text and per-file DOM values are browser-only',
+ reason: 'AC-23102-1 requires observing the rendered aria-live text and the per-file DOM progressbar value change; a server-side probe pack cannot observe DOM mutation',
+ evidence: { requires: 'browser DOM observation', ac: 'application-file-upload-AC-23102-1' },
+ }));
+
+ const sessionId = `session-${randomUUID()}`;
+ const files = [
+ { name: 'a.bin', bytes: 1 * MIB },
+ { name: 'b.bin', bytes: 2 * MIB },
+ { name: 'c.bin', bytes: 5 * MIB },
+ ];
+ const totalExpectedBytes = files.reduce((s, f) => s + f.bytes, 0);
+ await fetch(`${fixture.baseUrl}/upload/session?sessionId=${sessionId}`, {
+ method: 'POST',
+ headers: { 'content-type': 'application/json' },
+ body: JSON.stringify({ totalExpectedBytes, files }),
+ });
+
+ const perStep = [];
+ let lastRes, lastBody = '';
+ const fileBytesPerFile = files.map((f) => 0);
+ for (const [i, f] of files.entries()) {
+ const payload = Buffer.alloc(f.bytes, 65 + i);
+ const chunkRes = await fetch(`${fixture.baseUrl}/upload/chunk?n=${i + 1}&sessionId=${sessionId}`, {
+ method: 'POST', body: payload,
+ });
+ const chunkBody = await chunkRes.text();
+ const parsed = JSON.parse(chunkBody);
+ fileBytesPerFile[i] = parsed.bytesReceived;
+ // Byte-weighted percent = server's uploadedBytes / totalExpectedBytes.
+ const byteWeightedPercent = (parsed.uploadedBytes / totalExpectedBytes) * 100;
+ // Plain average of per-file percents at this same point.
+ const perFilePercents = files.map((ff, idx) => (fileBytesPerFile[idx] / ff.bytes) * 100);
+ const plainAveragePercent = perFilePercents.reduce((a, b) => a + b, 0) / perFilePercents.length;
+ perStep.push({
+ afterFileIndex: i,
+ uploadedBytes: parsed.uploadedBytes,
+ byteWeightedPercent: Number(byteWeightedPercent.toFixed(2)),
+ perFilePercents: perFilePercents.map((p) => Number(p.toFixed(2))),
+ plainAveragePercent: Number(plainAveragePercent.toFixed(2)),
+ discriminates: Math.abs(byteWeightedPercent - plainAveragePercent) > 0.5,
+ });
+ lastRes = chunkRes; lastBody = chunkBody;
+ }
+ // Discrimination proven if the intermediate steps distinguish byte-weighted
+ // from plain-average by more than 0.5 percentage points.
+ const intermediateDiscriminates = perStep[0].discriminates && perStep[1].discriminates;
+ const finalConverges = Math.abs(perStep[2].byteWeightedPercent - 100) < 0.5;
+ const runOk = intermediateDiscriminates && finalConverges;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-file-upload-AC-23102-2',
+ verdict: runOk ? 'pass' : 'fail',
+ detail: `Aggregate progress is the byte-weighted sum of per-file - after file 1 byteWeighted=${perStep[0].byteWeightedPercent}% vs plainAverage=${perStep[0].plainAveragePercent}%; after file 2 ${perStep[1].byteWeightedPercent}% vs ${perStep[1].plainAveragePercent}%; after file 3 ${perStep[2].byteWeightedPercent}% vs ${perStep[2].plainAveragePercent}% (converge at completion)`,
+ evidence: evidenceFromResponse({
+ route: `/upload/chunk (sessionId=${sessionId})`,
+ response: lastRes,
+ bodyText: lastBody,
+ extraFields: {
+ input: { sessionId, filesDeclared: files, totalExpectedBytes },
+ derived: { perStep, intermediateDiscriminates, finalConverges },
+ },
+ }),
+ limitation: 'application-file-upload-AC-23102-2: the polite live region\'s rendered aggregate announcement text is not observable on a server-driven probe pack; the byte-weighted aggregate is asserted from the server\'s uploaded-bytes accounting only',
+ }));
+
+ // Row 3: notObservableHere for AC-23102-2's browser-observable
+ // half - the emitted aggregate announcement text on the polite
+ // live region. The AC's `when` and `then` explicitly concern the
+ // announcer's emitted value in the DOM, which a server-driven
+ // probe pack cannot observe; the row represents that half on the
+ // shelf so it is not carried by the server row's limitation alone.
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23102-2',
+ detail: 'Aggregate progress is the byte-weighted sum of per-file - the announcer\'s emitted aggregate text on the polite live region is a browser DOM observation',
+ reason: 'AC-23102-2 requires observing the aggregate progress text emitted through the polite live region; a server-side probe pack cannot observe DOM mutation or aria-live announcements',
+ evidence: { requires: 'browser DOM observation of the polite live region', ac: 'application-file-upload-AC-23102-2' },
+ }));
+
+ return { results };
+ } finally {
+ await fixture.close();
+ }
+}