upup v3.0.0: headless core, six framework packages, hardened server-mode

.changeset/config.json

@@ -1,12 +1,11 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@2.3.1/schema.json",
-  "changelog": false,
-  "commit": false,
-  "fixed": [],
-  "linked": [],
-  "access": "public",
-  "baseBranch": "master",
-  "updateInternalDependencies": "patch",
-  "ignore": ["docs", "@upup/landing", "@upup/playground"],
-  "packages": ["packages/*"]
+    "$schema": "https://unpkg.com/@changesets/config@2.3.1/schema.json",
+    "changelog": false,
+    "commit": false,
+    "fixed": [],
+    "linked": [],
+    "access": "public",
+    "baseBranch": "master",
+    "updateInternalDependencies": "patch",
+    "ignore": ["@upupjs/docs", "@upupjs/landing", "@upupjs/playground"]
 }

.gitattributes

@@ -0,0 +1,9 @@
+# Husky hooks are sh scripts parsed line-by-line by knip and executed by sh —
+# a CRLF checkout (Windows core.autocrlf) makes knip extract binary names with
+# a trailing \r ("lint-staged\r"), failing the gate on any Windows clone (N7).
+.husky/* text eol=lf
+
+# Drive-sandbox test fixtures are byte-exact assets: the live cloud-drive
+# integration suite uploads them and hash-checks the round-tripped bytes, so no
+# platform EOL normalization may touch them.
+scripts/drive-sandbox/fixtures/** binary

.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  # Published surface + workspace deps. `npm` ecosystem reads pnpm-lock.yaml (v9).
+  - package-ecosystem: 'npm'
+    directories:
+      - '/'
+      - '/packages/*'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+    open-pull-requests-limit: 5
+    groups:
+      production-dependencies:      # prioritise the shipped prod deps, one PR
+        applies-to: version-updates
+        dependency-type: 'production'
+        update-types: ['minor', 'patch']
+      development-dependencies:
+        applies-to: version-updates
+        dependency-type: 'development'
+        update-types: ['minor', 'patch']
+    ignore:
+      # Majors are DEFERRED (F-189: Angular 19->22, Storybook 9->10, Tailwind
+      # 3->4, TS 5->6, Vite/Rollup/ESLint/jsdom). See audit/deferred-roadmap.md.
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major']
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    groups:
+      github-actions:
+        patterns: ['*']

.github/pull_request_template.md

@@ -21,6 +21,16 @@ Fixes # (issue)
 - [ ] I have performed a self-review of my own code
 - [ ] I have made corresponding changes to the documentation
 - [ ] My changes generate no new warnings
-- [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] I have updated the `package.json` file with the new version
-- [ ] I have updated the `CHANGELOG.md` file for the new version
+- [ ] I have added tests that prove my fix is effective or that my feature works, with behavior-driven names (see `docs/testing.md`)
+- [ ] I have added a changeset (`pnpm changeset`) if this PR changes any publishable `@upupjs/*` package
+
+## Test-foundation checklist (delete rows that cannot apply)
+
+- [ ] UI change: landed in `@upupjs/react` first, ported DOM-identically, and `parity-fixtures.json` was regenerated via `UPDATE_PARITY=1` + reviewed like code (never in CI)
+- [ ] New/renamed story: name, id, args, and variants stay consistent across all six framework storybooks (or the divergence is documented where it lives)
+- [ ] Public export changed: the affected package's `public-api` pin was updated deliberately (core: also `internal-surface`)
+- [ ] Packaging/dependency change: `pnpm run smoke:packages` passes locally
+- [ ] New test suite or moved test directory: the impact map in `scripts/ci/resolve-affected-tests.mjs` still routes it (add a rule + table-driven test if not)
+- [ ] New env var: added to the relevant `local-dev/*.example` file and `scripts/validate-env.mjs` schema (`pnpm run env:check`)
+- [ ] New third-party integration: sandbox/test credentials documented in `docs/testing.md` (names, scopes, callback URLs) — never production credentials
+- [ ] No new `.only`, silent skips, unjustified sleeps, or integration-layer mocks (`pnpm run test:quality`)

.github/workflows/e2e.yml

@@ -0,0 +1,213 @@
+name: E2E
+
+permissions:
+    contents: read
+
+on:
+    pull_request:
+        branches: [master, dev]
+    workflow_dispatch:
+
+# Actions pinned to full commit SHAs (F-792); pnpm via pnpm/action-setup +
+# setup-node cache:pnpm (F-787) — same mechanism as main.yml / publish.yml.
+
+# Affected-test routing: Resolve-Affected classifies the PR's changed files
+# via scripts/ci/resolve-affected-tests.mjs (the impact map lives IN CODE and
+# is unit-tested by `pnpm run test:scripts`). Heavy jobs skip only when the
+# resolver proves them unaffected; an unmatched path fails open to every
+# suite, and the E2E-Status rollup fails on any skip the resolver did NOT
+# sanction — so branch protection semantics are preserved. main.yml is
+# deliberately unrouted (static + unit gates always run).
+
+jobs:
+    Resolve-Affected:
+        name: Resolve affected suites
+        runs-on: ubuntu-latest
+        outputs:
+            e2e: ${{ steps.resolve.outputs.e2e }}
+            minio: ${{ steps.resolve.outputs.minio }}
+            smoke: ${{ steps.resolve.outputs.smoke }}
+        steps:
+            - name: Checkout the repository (full history for merge-base diff)
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+              with:
+                  fetch-depth: 0
+
+            - name: Setup Node.js
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+              with:
+                  node-version-file: '.nvmrc'
+
+            - name: Resolve affected suites (zero-dep script, no install)
+              id: resolve
+              run: |
+                  if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+                    node scripts/ci/resolve-affected-tests.mjs --all
+                  else
+                    node scripts/ci/resolve-affected-tests.mjs \
+                      --base "${{ github.event.pull_request.base.sha }}" \
+                      --head "${{ github.event.pull_request.head.sha }}"
+                  fi
+
+    E2E:
+        name: Cross-framework E2E (Playwright + MinIO)
+        runs-on: ubuntu-latest
+        needs: [Resolve-Affected]
+        if: needs.Resolve-Affected.outputs.e2e == 'true' || needs.Resolve-Affected.outputs.minio == 'true'
+        steps:
+            - name: Checkout the repository
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+            - name: Setup pnpm
+              uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.4.0
+
+            - name: Setup Node.js
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+              with:
+                  node-version-file: '.nvmrc'
+                  cache: pnpm
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Install Playwright Chromium
+              run: pnpm --filter @upupjs/e2e-test exec playwright install --with-deps chromium
+
+            - name: Provision MinIO env (defaults; smoke is OAuth-free)
+              run: cp local-dev/.env.minio.example local-dev/.env.minio
+
+            - name: Guard against fixture/baseline regen in CI (F-205)
+              run: if [ -n "$UPDATE_PARITY" ] || [ -n "$UPDATE_A11Y_BASELINE" ]; then echo "regen env forbidden in CI"; exit 1; fi
+
+            - name: Run e2e gate (deep React + cross-framework smoke)
+              run: pnpm run e2e
+              env:
+                  MINIO_ROOT_USER: upupadmin
+                  MINIO_ROOT_PASSWORD: upupadmin123
+                  UPUP_UPLOAD_TOKEN_SECRET: upup-e2e-upload-token-secret-dev-only
+                  UPUP_E2E_BUCKET: upup-e2e
+                  UPUP_E2E_REGION: us-east-1
+                  UPUP_E2E_ENDPOINT: http://localhost:9100
+
+            # The strongest adversarial verification in the repo (forged-token 403s,
+            # oversized-PUT rejection, multipart size-envelope abort, sha256 byte
+            # round-trips) lives in @upupjs/server tests/integration and is gated on
+            # UPUP_E2E_MINIO=1 (provided by the env file via the dotenv wrapper).
+            # Without these steps it silently skips everywhere except a dev laptop.
+            # Runs after the e2e gate because that step builds the workspace
+            # (server's vitest resolves @upupjs/core via dist). MinIO must be booted
+            # HERE: the cf global-teardown stops the compose stack its own setup
+            # started, so nothing from the e2e gate survives into this step
+            # (proven by an ECONNREFUSED :9100 on this step's first CI execution).
+            - name: Boot MinIO for the integration suites
+              if: needs.Resolve-Affected.outputs.minio == 'true'
+              run: |
+                  pnpm run e2e:minio:up
+                  for i in $(seq 1 45); do
+                    if curl -sf http://localhost:9100/minio/health/live > /dev/null; then
+                      echo "MinIO healthy on :9100"; exit 0
+                    fi
+                    sleep 2
+                  done
+                  echo "MinIO failed to become healthy on :9100" >&2
+                  exit 1
+
+            - name: Server trust-model + byte-integrity suites (real MinIO)
+              if: needs.Resolve-Affected.outputs.minio == 'true'
+              run: pnpm run e2e:minio:test
+
+            # Visual layer: the suites freeze named product states as PNGs
+            # (apps/e2e-test/visual/product-state-screenshots.ts). Uploaded on
+            # success AND failure — they are review evidence now and the
+            # snapvisor.io (Argos-style) diff input once its uploader is wired
+            # into this job. An empty upload warns: e2e ran but captured
+            # nothing, which means the capture layer itself broke.
+            - name: Upload visual product-state screenshots
+              if: always()
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: e2e-visual-screenshots
+                  path: apps/e2e-test/screenshots/
+                  if-no-files-found: warn
+                  retention-days: 14
+
+            - name: Upload Playwright traces and reports
+              if: failure()
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: e2e-playwright-artifacts
+                  path: |
+                      apps/e2e-test/playwright-report/
+                      apps/e2e-test/test-results/
+                  retention-days: 14
+
+    Smoke-Packages:
+        name: Package smoke (real tarball consumer)
+        runs-on: ubuntu-latest
+        needs: [Resolve-Affected]
+        if: needs.Resolve-Affected.outputs.smoke == 'true'
+        steps:
+            - name: Checkout the repository
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+            - name: Setup pnpm
+              uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.4.0
+
+            - name: Setup Node.js
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+              with:
+                  node-version-file: '.nvmrc'
+                  cache: pnpm
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Package smoke (packs all 9, isolated consumer, vite build, dist-shape asserts)
+              run: pnpm run smoke:packages # self-builds via build:package; no browser, no MinIO
+
+    # Rollup aggregator for this workflow (F-780): main.yml's Status-Check spans
+    # only main.yml jobs, so E2E + Smoke-Packages were aggregated by nothing.
+    # Branch protection must require BOTH this job AND main.yml's Status Check.
+    # Routing-aware: a job may be SKIPPED only when Resolve-Affected proved it
+    # unaffected; any other non-success (including a skip caused by a failed
+    # resolver) fails the rollup, so routing can never hide required coverage.
+    E2E-Status:
+        name: E2E Status Check
+        runs-on: ubuntu-latest
+        needs: [Resolve-Affected, E2E, Smoke-Packages]
+        if: always()
+        steps:
+            - name: Check status (respecting resolver-sanctioned skips)
+              env:
+                  RESOLVE_RESULT: ${{ needs.Resolve-Affected.result }}
+                  E2E_RESULT: ${{ needs.E2E.result }}
+                  E2E_WANTED: ${{ needs.Resolve-Affected.outputs.e2e == 'true' || needs.Resolve-Affected.outputs.minio == 'true' }}
+                  SMOKE_RESULT: ${{ needs.Smoke-Packages.result }}
+                  SMOKE_WANTED: ${{ needs.Resolve-Affected.outputs.smoke }}
+              run: |
+                  fail=0
+                  if [ "$RESOLVE_RESULT" != "success" ]; then
+                    echo "Resolve-Affected did not succeed ($RESOLVE_RESULT) — cannot trust any skip"
+                    fail=1
+                  fi
+                  check() {
+                    name="$1"; result="$2"; wanted="$3"
+                    if [ "$wanted" = "true" ]; then
+                      if [ "$result" != "success" ]; then
+                        echo "$name is required for this change set but finished '$result'"
+                        fail=1
+                      fi
+                    else
+                      if [ "$result" != "skipped" ] && [ "$result" != "success" ]; then
+                        echo "$name was not required but finished '$result'"
+                        fail=1
+                      fi
+                    fi
+                  }
+                  check "E2E" "$E2E_RESULT" "$E2E_WANTED"
+                  check "Smoke-Packages" "$SMOKE_RESULT" "$SMOKE_WANTED"
+                  if [ "$fail" -ne 0 ]; then
+                    echo "E2E status check failed"
+                    exit 1
+                  fi
+                  echo "All required E2E jobs passed (unaffected suites legitimately skipped)"