Merge pull request #477 from open-element/feature/alpha18-sweep

v0.41.0-alpha.18: second audit sweep (ADR-0117, packages A–D)

Author: SisyphusZheng

.github/workflows/autoflow-ci.yml

@@ -42,9 +42,13 @@ jobs:
       - name: AutoFlow3 CI gate
         run: deno task autoflow:ci
       # Cross-browser smoke: the main gate is chromium-only. Run the core
-      # DSD/island-hydration/theme specs on Firefox against the www/dist the
-      # gate's build step already produced.
+      # DSD/island-hydration/theme specs on Firefox and WebKit against the
+      # www/dist the gate's build step already produced.
       - name: Install Playwright Firefox
         run: ./node_modules/.bin/playwright install --with-deps firefox
       - name: Firefox smoke E2E
         run: deno task test:e2e:firefox-smoke
+      - name: Install Playwright WebKit
+        run: ./node_modules/.bin/playwright install --with-deps webkit
+      - name: WebKit smoke E2E
+        run: deno task test:e2e:webkit-smoke

.gitignore

@@ -3,6 +3,8 @@ node_modules/
 
 # Deno
 .deno/
+.deno-cache/
+.deno_cache/
 vendor/*
 # Keep vendored dependency attribution tracked for license compliance
 !vendor/jsr.io/
@@ -19,6 +21,8 @@ vendor/jsr.io/@std/*/*
 # Build output
 dist/
 custom-dist/
+dist-test-*/
+www/dist/
 npm/
 packages/adapter-vite/__fixtures__/nitro-proof/.output-*/
 packages/adapter-vite/__fixtures__/nitro-proof/.wrangler/
@@ -27,10 +31,16 @@ packages/adapter-vite/__fixtures__/nitro-proof/node_modules/
 *.tsbuildinfo
 .tsbuildinfo
 www/app/data/_generated-blog-data.ts
+.openElement/
+www/.openElement/
 
 # npm (Deno project - no npm lockfiles)
 package-lock.json
 
+# npm pack tarballs
+packages/*/*.tgz
+*.tgz
+
 # Environment
 .env
 .env.local
@@ -52,6 +62,7 @@ Thumbs.db
 # Testing
 coverage/
 .coverage/
+.coverage-*/
 .coverage-check/
 __test_fixtures__/
 playwright-report/
@@ -61,6 +72,7 @@ test-results/
 .workbuddy/
 .gstack/
 .qoder/
+.codebuddy/settings.local.json
 docs/autoflow/cells/*/state.json
 
 # Vite cache
@@ -79,43 +91,18 @@ coverage-*.txt
 coverage-output.txt
 .git-commit-msg.txt
 docs/vite-build-*.txt
-node_modules/
-
-# npm pack tarballs
-packages/*/*.tgz
-*.tgz
 
 # Root-level logo source files (design originals, keep local)
 /open-logo*.svg
 /open-favicon.svg
-/brand/exports/
 
-www/dist/
-dist/
-custom-dist/
-dist-test-ssg-render/
-dist-test-ssg-package-render/
-dist-test-*/
-coverage/
-playwright-report/
-test-results/
 debug.log
 hub-index/
 hub-submission.json
-
-deliverables/
 lighthouse-result*.json
-.deno-cache/
-.deno_cache/
-www/.openElement/
-.openElement/
-.codebuddy/settings.local.json
 
 # Root-level audit artifact
 /audit-ast.json
 
-# Coverage variants
-.coverage-*/
-
 # Vite virtual assets
 assets/_virtual_*

REVIEW-REPORT.md

@@ -7,7 +7,8 @@
     "./packages/create",
     "./packages/app",
     "./www",
-    "./examples/deno-desktop-reader"
+    "./examples/deno-desktop-reader",
+    "./examples/deno-desktop-mastodon"
   ],
   "imports": {
     "@std/fs/walk": "jsr:@std/fs@^1.0.0/walk",
@@ -64,6 +65,7 @@
     "consumer:packaged": "deno task pack:dry-run && deno run --allow-read --allow-write --allow-run --allow-env --allow-net tools/consumer-packaged-starter.ts && deno run --allow-read --allow-write --allow-run --allow-env --allow-net tools/consumer-local.ts --packaged-import-map-check",
     "third-party-wc:smoke": "deno run --allow-read --allow-write --allow-run --allow-env --allow-net --allow-sys tools/third-party-wc-smoke.ts",
     "desktop-reader:smoke": "cd examples/deno-desktop-reader && deno test -A app/__tests__/",
+    "examples:check": "cd examples/deno-desktop-reader && deno task check && deno task smoke && cd ../deno-desktop-mastodon && deno task check && deno task smoke",
     "stress:dogfood": "deno run --allow-read --allow-run --allow-env tools/run-dogfood-stress.ts",
     "dogfood:evidence": "deno run --allow-read --allow-write --allow-run tools/run-dogfood-evidence.ts",
     "package-artifacts:check": "deno run --allow-read --allow-write --allow-run --allow-net --allow-env tools/check-package-artifacts.ts",
@@ -82,17 +84,18 @@
     "test:visual-baselines": "OPEN_VISUAL_REGRESSION=1 deno run -A npm:@playwright/test@1.59.1 test www/e2e/visual-baselines.spec.ts --config www/e2e/playwright.config.ts --project=chromium",
     "test:e2e:browsers": "deno run -A npm:@playwright/test@1.59.1 test --config www/e2e/playwright.config.ts",
     "test:e2e:install": "deno run -A npm:playwright@1.59.1 install chromium",
-    "test:e2e:firefox-smoke": "deno run -A npm:@playwright/test@1.59.1 test --config www/e2e/playwright.config.ts --project=firefox --grep \"DSD Layers|Layout Island Shell|Island Script Loading|Theme Toggle\"",
+    "test:e2e:firefox-smoke": "deno run -A npm:@playwright/test@1.59.1 test --config www/e2e/playwright.config.ts --project=firefox --grep \"DSD Layers|Layout Island Shell|Island Script Loading|Theme Toggle|Theme initialization|data-signal bindings|SSR/hydration mismatch degradation|router guards on browser history traversal\"",
+    "test:e2e:webkit-smoke": "deno run -A npm:@playwright/test@1.59.1 test --config www/e2e/playwright.config.ts --project=webkit --grep \"DSD Layers|Layout Island Shell|Island Script Loading|Theme Toggle|Theme initialization|data-signal bindings|SSR/hydration mismatch degradation|router guards on browser history traversal\"",
     "test:e2e:browsers:install": "deno run -A npm:playwright@1.59.1 install chromium firefox webkit",
     "nitro:proof:node": "deno run --allow-read --allow-write --allow-run --allow-env --allow-net tools/nitro-proof.ts node",
     "nitro:proof:workers": "deno run --allow-read --allow-write --allow-run --allow-env --allow-net tools/nitro-proof.ts workers",
     "test:coverage:check": "deno run --allow-read --allow-run --allow-write --allow-env --allow-net --allow-ffi --allow-sys tools/check-coverage.ts --threshold 73 --branch-threshold 82 --function-threshold 77",
-    "test:critical-paths": "deno run --allow-read --allow-run tools/check-critical-path-tests.ts",
+    "test:critical-paths": "deno run --allow-read --allow-run --allow-env tools/check-critical-path-tests.ts",
     "consumer:element-smoke": "deno run -A tools/consumer-smoke.ts --local",
     "typecheck": "deno task generate:ui-manifest && deno run --allow-read --allow-run --allow-env tools/run-package-graph-task.ts typecheck",
     "lint": "deno lint",
-    "fmt": "deno fmt --ignore=deliverables/,REVIEW-REPORT*.md,WC-FULLSTACK*.md,www/content/blog/,www/app/routes/,www/app/data/,www/design/mockups/,brand/,www/public/assets/,custom-dist/,dist-test-ssg-render/,dist-test-ssg-package-render/,packages/adapter-vite/__fixtures__/nitro-proof/.nitro/,.deno_cache/",
-    "fmt:check": "deno fmt --check --ignore=deliverables/,REVIEW-REPORT*.md,WC-FULLSTACK*.md,www/content/blog/,www/app/routes/,www/app/data/,www/design/mockups/,brand/,www/public/assets/,custom-dist/,dist-test-ssg-render/,dist-test-ssg-package-render/,packages/adapter-vite/__fixtures__/nitro-proof/.nitro/,.deno_cache/",
+    "fmt": "deno fmt",
+    "fmt:check": "deno fmt --check",
     "clean": "rm -rf packages/*/dist www/dist packages/*/*.tgz",
     "hooks:install": "git config core.hooksPath .githooks",
     "hooks:uninstall": "git config core.hooksPath",
@@ -106,8 +109,8 @@
     "autoflow:release-prepare": "deno run --allow-read --allow-write --allow-run --allow-env tools/autoflow/mod3.ts release-prepare",
     "autoflow:publish-existing": "deno run --allow-read --allow-write --allow-run --allow-env tools/autoflow/mod3.ts publish-existing",
     "autoflow:test": "deno test --allow-read --allow-write --allow-run --allow-env tools/autoflow/__tests__/",
-    "verify:configs": "deno run --allow-read tools/verify-package-configs.ts",
-    "verify:configs:fix": "deno run --allow-read --allow-write tools/verify-package-configs.ts --fix"
+    "verify:configs": "deno run --allow-read --allow-env tools/verify-package-configs.ts",
+    "verify:configs:fix": "deno run --allow-read --allow-write --allow-env tools/verify-package-configs.ts --fix"
   },
   "fmt": {
     "useTabs": false,
@@ -117,19 +120,13 @@
     "singleQuote": true,
     "proseWrap": "preserve",
     "exclude": [
-      "deliverables/",
-      "REVIEW-REPORT*.md",
-      "WC-FULLSTACK*.md",
       "www/content/blog/",
-      "www/app/routes/",
       "www/app/data/",
       "www/design/mockups/",
-      "brand/",
       "www/public/assets/",
       "custom-dist/",
       "dist-test-ssg-render/",
-      "**/.nitro/",
-      ".deno_cache/"
+      "**/.nitro/"
     ]
   },
   "lint": {
@@ -138,14 +135,11 @@
       "exclude": ["no-sloppy-imports"]
     },
     "exclude": [
-      "deliverables/",
       "www/content/blog/",
-      "www/app/routes/",
       "www/app/data/",
       "custom-dist/",
       "dist-test-ssg-render/",
-      "**/.nitro/",
-      ".deno_cache/"
+      "**/.nitro/"
     ]
   },
   "compilerOptions": {
@@ -166,7 +160,6 @@
     ".deno_cache",
     "custom-dist",
     "dist-test-ssg-render",
-    "deliverables",
     "vendor",
     "**/.nitro"
   ]

deno.json

@@ -9,8 +9,11 @@ contract is the HTML `shadowrootmode` template attribute, not a framework
 polyfill.
 
 The supported behavior is verified in the Chromium, Firefox, and WebKit
-Playwright projects by `www/e2e/dsd-layers.spec.ts`. The default build emits no
-inline DSD fallback, so a strict CSP does not need `unsafe-inline` for DSD.
+Playwright projects by `www/e2e/dsd-layers.spec.ts`. CI runs the full E2E suite
+on Chromium and the DSD/island-hydration/theme smoke subset
+(`test:e2e:firefox-smoke`, `test:e2e:webkit-smoke`) on Firefox and WebKit. The
+default build emits no inline DSD fallback, so a strict CSP does not need
+`unsafe-inline` for DSD.
 
 Projects that intentionally support browsers outside this baseline may opt in
 to `legacyDsdPolyfill`. That fallback injects an inline script and therefore

deno.lock

@@ -33,3 +33,10 @@ static, hydrate, or CSR implementation packages.
   entries.
 - Third-party custom elements are hydrated only according to validated package
   or Custom Elements Manifest metadata.
+
+## Known limitations
+
+- Islands located outside the project root are emitted through the Vite
+  `/@fs/` absolute-path specifier convention. That branch is covered by unit
+  tests (`module-specifier.test.ts`) but has not been verified on a real
+  Windows build; the regular root-relative path is exercised on every change.

docs/current/BROWSER_BASELINE.md

@@ -13,30 +13,25 @@
       },
       "declarations": {
         ".": {
-          "sha256": "805e7850e04b743205883bba909dda297677412c0e967cec5c9ca42b89ac9905",
+          "sha256": "35290be84ac939a8c58a47ce1f55dab5150a59ff33ff4a8934f5ec15a61cfa16",
           "publicDeclarations": [
-            "export type { OpenElementComponentConstructor } from './open-element.ts';",
             "export type { ElementDefinition } from './types.ts';",
             "export type {",
-            "export type { OpenElementRenderer } from './internal/protocol/framework.ts';",
             "export type { VNode } from './internal/protocol/vnode.ts';",
             "export type * from './internal/protocol/framework.ts';",
             "export type * from './internal/protocol/manifest.ts';",
             "export type * from './internal/protocol/render.ts';",
             "export type * from './internal/protocol/style-sheet.ts';",
             "export type * from './internal/protocol/vnode.ts';",
             "export type { Context } from './internal/core/index.ts';",
-            "export type { PropValidationError, RenderError } from './internal/core/index.ts';",
-            "export type { ErrorCode, ErrorPhase, ErrorSeverity } from './internal/protocol/errors.ts';",
-            "export type { SignalLike } from './internal/protocol/signal.ts';",
+            "export type { RenderError } from './internal/core/index.ts';",
             "export type { Signal } from './internal/protocol/signal.ts';",
-            "export type { SafeHtml, UnsafeHtml } from './internal/protocol/framework.ts';",
             "export type { IslandOptions } from './internal/protocol/island.ts';",
-            "export type { StyleSheetLike, StyleSheetRule } from './internal/protocol/style-sheet.ts';",
+            "export type { StyleSheetLike } from './internal/protocol/style-sheet.ts';",
             "export type { Action, ActionContext, Loader, LoaderContext } from './internal/protocol/data.ts';",
             "export type { HydrationStrategy, LocalePath } from './internal/protocol/framework.ts';",
             "export type {",
-            "export type {",
+            "export type { OpenElementRouteKind, OpenElementRouteNode } from './internal/protocol/app-model.ts';",
             "export type {"
           ]
         },
@@ -83,7 +78,7 @@
       },
       "declarations": {
         ".": {
-          "sha256": "9143060e4b44f2c44df0656656a314772ced1321c00829339651e3f0710d0fd7",
+          "sha256": "95cc58ef49406811e4e9fd7a6897f03e237772b1657cb65d5b686c8b0536d067",
           "publicDeclarations": [
             "export type {",
             "export type { Action, ActionContext, Loader, LoaderContext } from '@openelement/element';",
@@ -128,7 +123,7 @@
           ]
         },
         "./spa": {
-          "sha256": "d685b61816bdb46948fd5a28533191a49753f2e49afe3d75b1d34e1a210fe3ea",
+          "sha256": "79038615bb4d54805c3fac24440e620011b7ff3927302132cc1139484a965dfd",
           "publicDeclarations": [
             "export interface SpaAppOptions {",
             "export interface SpaAppInstance {",
@@ -157,30 +152,29 @@
       },
       "declarations": {
         ".": {
-          "sha256": "a735a6ab7a856ba04dc13e83215b652780c5a2c3957e548744fc027b23c900fa",
+          "sha256": "9e3b2833c05034e7678307f7282fbef55490da1d1c9dc0b575f12fc4f86773cd",
           "publicDeclarations": [
             "export interface OpenPipelineConfig {",
             "export function openPipeline(config: OpenPipelineConfig = {}): Plugin[] {",
             "export type { FrameworkOptions };",
             "export type { ArtifactInfo, BuildManifest } from './build-manifest.ts';",
-            "export type { SpeculationRulesOptions } from './internal/protocol/ssg.ts';",
+            "export type { SpeculationRulesOptions, SsgBehaviorOptions } from './internal/protocol/ssg.ts';",
             "export type { HeadExtrasResult } from './head-injection.ts';",
             "export type { OpenMdxPluginOptions } from './plugin-mdx.ts';"
           ]
         },
         "./app-vite": {
-          "sha256": "57646b30b6aef837c2929b4e0ac5cf19247cac2261ab2049fad306309f2ae64b",
+          "sha256": "fbc9bbfd9964bfab9465a1f572ee12ee430b99fa0c216aa2937a8e7a2cfc5ad2",
           "publicDeclarations": [
             "export interface OpenElementOptions extends FrameworkOptions {",
             "export function openElement(options: OpenElementOptions = {}): Plugin[] {"
           ]
         },
         "./build-context": {
-          "sha256": "e44780f20cb07559848863fd0217f8b0e1989a3bd5a083e2420c0d997e1fd9cc",
+          "sha256": "a77770942f8fd2e1ea5acf4b5e66545e9cf54373a2c312193f317dbe274c3bcf",
           "publicDeclarations": [
             "export type Phase = 1 | 2 | 3;",
             "export class Phase1Meta {",
-            "export class Phase2Meta {",
             "export class Phase3Meta {",
             "export class OpenElementBuildContext {"
           ]
@@ -194,8 +188,11 @@
           "publicDeclarations": []
         },
         "./cli/build-ssg": {
-          "sha256": "de3c257dc6d26fac3f4fbf235edb566524fb19722528e7fa52bc5f2f5271ef58",
-          "publicDeclarations": []
+          "sha256": "784788fc8e914583533c814a51d023fca062f9aa2ff5039a14748779065a98e6",
+          "publicDeclarations": [
+            "export interface SsgEntryDescriptorInputs {",
+            "export function buildSsgEntryDescriptor("
+          ]
         },
         "./generated-data-resolver": {
           "sha256": "d18395cfa3eca7cd72f2e5481b24a0e76d49284d717a9c08274c085adf80788c",
@@ -234,14 +231,14 @@
           ]
         },
         "./plugin": {
-          "sha256": "d6606aed4c4bea1c6929d7136ba0f7f454af058cef6b3d30248a5c2c99dcd214",
+          "sha256": "d4e9230cc30f41f3eeece30437abb4ff8e95057803c47f520c1cc36e2eda0f56",
           "publicDeclarations": [
             "export function optionalPackageStubsPlugin(): Plugin {",
             "export function createOpenPlugin("
           ]
         },
         "./plugin-mdx": {
-          "sha256": "5acc04ce17016f446a66384f859e24ef914743a71fa02c0cb10cdfa3adcc84eb",
+          "sha256": "d935ba8f764d12bb95cacbe38e1d88ddb3c647560af5d293f0cccb84ecd85601",
           "publicDeclarations": [
             "export interface OpenMdxPluginOptions {",
             "export function mdxPlugin(options: OpenMdxPluginOptions = {}): Plugin {"
@@ -282,7 +279,7 @@
       },
       "declarations": {
         ".": {
-          "sha256": "44a7cacc806416be1c35dbf0b0a4db120bae09489b321e1fd59b33e0fc40a2d3",
+          "sha256": "600c64d12cb8272d2689aca138d46167d7441cae1a5e1445cf11a16e89e2638e",
           "publicDeclarations": []
         },
         "./open-badge": {
@@ -293,7 +290,7 @@
           ]
         },
         "./open-button": {
-          "sha256": "57411b37ffc3d08f48c04f97df841a111ab32a2081d648fae1e1141dfe1cd360",
+          "sha256": "9a4694535c3527b29a81d981218fc26d919ef819556eb13529fff4131fae07ad",
           "publicDeclarations": [
             "export const tagName = 'open-button';",
             "export class OpenButton extends OpenElement {"
@@ -321,7 +318,7 @@
           ]
         },
         "./open-dialog": {
-          "sha256": "fd25902bfe740877bb87e125779afb5012e0327891b038a7b92ae49472cb21b5",
+          "sha256": "e0a4bf78c47d08c0281c539bb8e2193bcfc100e07f0fc65bd795eedf520c5ab0",
           "publicDeclarations": [
             "export const tagName = 'open-dialog';",
             "export class OpenDialog extends OpenElement {"