[JUM-821][Release] Promote dev to main by web2solutions · Pull Request #346 · web2solutions/Jumentix

web2solutions · 2026-09-16T15:59:46Z

Summary

Promote the current dev branch to main.

Included since the current main:

JUM-815 architecture designer, Core service, Swagger changes
Consolidated Dependabot security updates from PR [Deps] Consolidate Dependabot security updates #345

Validation

This PR targets main, so it must run the full promotion gate: branch gate, workspace builds/tests, integration, coverage, website, database matrix, third-party review, CodeQL, SonarCloud and related required checks.

Note

Medium Risk
Touches release promotion gates, full-matrix coverage ordering, and a large Service Management UI surface (new tabs, vendor sync, offline shell); auth/security impact is limited to disabling Fastify Helmet CSP defaults.

Overview
Release promotion that lands the Service Management architecture/OpenAPI work (JUM-815–819) plus CI coverage gate fixes and dependency bumps on main.

The Service Management SPA gains two tabs: Architecture (Core vs domain services, drag-and-drop domain assignment, inter-service links, validation, export image) and OpenAPI (Swagger UI with per-service document selection). Boot wiring vendors Swagger UI, extends the PWA precache, and adds Playwright integration coverage for architecture flows and eight-tab boot. Catalog design payloads can carry merged/per-service OAS via CatalogService.oasDocumentsFromDesign.

CI (CircleCI and GitHub Actions) no longer runs coverage:check right after Jest with browser coverage disabled; it runs after the browser-engine union, then frontend coverage, then patch coverage—enforced by an updated workflow-order unit test.

Smaller changes: Fastify Helmet sets contentSecurityPolicy: false; changelog trimmed for the JUM-821 promotion; frontend/website/template lockfile and devDependency updates (Vite, happy-dom, Next, Storybook).

^{Reviewed by Cursor Bugbot for commit 390576a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Model services in designer-core, emit x-services, add Architecture and OpenAPI tabs. JUM-815 JUM-816 JUM-817 JUM-818 JUM-819 JUM-820.

## Summary Adds the Architecture tab (monolith Core plus split services, domain assignment, protocol links), per-service OpenAPI (`x-services` / `x-service` / `servers` / `x-architecture-links`), catalog storage of `design.oasDocuments`, and an OpenAPI tab that renders vendored Swagger UI from `apps/backend-template/OASdoc`. Covers JUM-815 through JUM-820 in one delivery. Expected outcome: operators model Core vs domain services in Service Management and inspect the OAS set in-app without a new npm Swagger dependency. ## Problem Statement The Service Management designer treated the model as a single implicit service. The epic requires an architecture graph, Core ownership of Users, per-service OAS, Swagger UI, tests, and bilingual docs. - Related issue(s): JUM-815, JUM-816, JUM-817, JUM-818, JUM-819, JUM-820 - Related PR(s): none - Related check run(s): pending after open ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epicservice-management-architecture-designer-core-service-swagger-360ccadacfdc - Epic milestone: as recorded on the Linear Project (open milestone covering JUM-815–820) - Primary task nature: feature - Epic-delegated agent ID: cursor (this session) - Child task issue link: https://linear.app/jumentix/issue/JUM-815 - Project Update: published after PR open (Requirement 102) - Linear Project link(s): https://linear.app/jumentix/project/epicservice-management-architecture-designer-core-service-swagger-360ccadacfdc - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-815, https://linear.app/jumentix/issue/JUM-816, https://linear.app/jumentix/issue/JUM-817, https://linear.app/jumentix/issue/JUM-818, https://linear.app/jumentix/issue/JUM-819, https://linear.app/jumentix/issue/JUM-820 - Linear Issue ID list (comma separated): JUM-815, JUM-816, JUM-817, JUM-818, JUM-819, JUM-820 - Item status at PR creation: In Review after this PR URL is attached - Target cycle (`Start date` -> `End date`): Linear Project dates - Priority group for this PR (`P0` / `P1` / `P2`): P1 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/feature/JUM-815-architecture-designer-swagger` - Target branch: `dev` - Required PR title format: `[JUM-XXXX][Nature] <concise outcome>` - [x] The leading `JUM-XXXX` matches the primary Linear Issue declared above (`JUM-815`). - [x] This task PR targets `dev`. - [x] If this PR targets `main`, it is a release promotion sourced from `dev`, references the task PRs/issues already merged into `dev`, and introduces no unreviewed changes. (N/A — targets `dev`.) - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - [ ] Every linked issue already contains this PR URL. (filled immediately after open) - [ ] Every linked issue already contains commit hash/range evidence. - [x] PR description includes mapping of task -> commit(s). - Task -> commit(s) mapping: - `JUM-815`–`JUM-820`: `3757eaa8` ## Scope of Change ### Domain / Business Rules - Architecture model: exactly one Core; Users stays on Core when present; domain assignment; link protocol vs interfaces; implicit monolith for pre-JUM-815 payloads. - Architecture issues are collected with model validation; missing Users is a warning only when architecture is explicit. ### Application / Use Cases - Architecture canvas: add/remove service, move domains, draw links, inspector, empty state. - OpenAPI tab: service selector (merged + per service) + Swagger UI. ### Adapters / Infrastructure - `ci-cd/sync-service-management-swagger-ui.js` copies Swagger UI from OASdoc (no new npm package). - Catalog `design.oasDocuments` via existing catalog create/update. ### API / Contracts (OpenAPI, DTOs, handlers, controllers) - Exported OAS stamps `x-service` on schemas/ops, `x-services`, `servers` with `x-service-id`, `x-architecture-links`. - Persist `architecture` as a compatible Contract 2 section (sixteen top-level keys). ## Detailed Technical Changes 1. `packages/designer-core` architecture module + validation; exporters/importers round-trip; no `document.` identifier in exporters (DOM-free pin). 2. Service Management UI tabs Architecture + OpenAPI; PWA shell 0.9.53; sidebar on architecture starts open so panels are reachable. 3. Tests: unit (architecture, swagger, exporters, catalog) + Playwright `architectureDesigner.browser.integration.test.ts`; docs EN/PT + website MDX. ## Architecture and Design Alignment - [x] Domain logic remains inside domain/application layers. - [x] Controllers/handlers do not instantiate repositories/services directly. - [x] Ports/adapters boundaries are respected. - [x] No new circular dependencies introduced. (`architecture.js` does not import `designerState`.) - [x] Event publishing/listening flow remains consistent. ## Security Impact - Security impact: Swagger UI is copied from the already-reviewed OASdoc vendor set. OAS is designer-generated; no new public OAS routes. - Secrets handling reviewed: [x] N/A - Input/output sanitization reviewed: [x] Yes - AuthN/AuthZ impact: [x] No - Data exposure risk (password/salt/token/PII): [x] No - Sonar security findings addressed or unaffected: [ ] No (CI pending) ## Data and Migration Impact - Data model impact: additive `architecture` section on `service-management.v1`; load path normalizes missing architecture to a monolith. - Migration required: [x] No (payload normalize, not Cana record version bump) - Rollback strategy: revert PR; old clients ignore unknown `architecture` key. ## Breaking Changes None. Implicit monolith keeps Billing-only `collectModelIssues([])` green. ## Acceptance Criteria - [x] Feature/bug behavior matches expected functional outcome. - [x] Error paths and edge cases are covered. - [x] API contract changes (if any) are documented and validated. - [x] Architecture boundaries remain enforced. - [x] No regression in existing workflows. ## Test Plan (Evidence) Executed on commit hook `ci:gate:task` for this branch (`env -u PLAYWRIGHT_BROWSERS_PATH git commit`, command produced the counts below). - [x] lint via hook preflight (`eslint . --ext .ts`) - [ ] `pnpm run lint` (repo uses Bun/eslint through `ci:gate:branch`, not pnpm) - [ ] `pnpm run deps:check-cycles` - [ ] `pnpm run arch:check-boundaries` - [ ] `pnpm run arch:check-users-legacy-imports` - [x] unit layer in task gate: `Test Suites: 230 passed, 230 total` (Jest layer-aware-unit) - [ ] `pnpm run oas:check-routes` - [x] `build:dev` preflight (`NODE_ENV=dev tsc -p tsconfig.build.json`) - [ ] `pnpm run ci:smoke` - [x] `ci:gate:task` / `ci:gate:branch` on this commit: exit 0 - Service Management integration: `Test Suites: 19 passed, 19 total` / `Tests: 105 passed, 105 total` ### Coverage - Project coverage >= 95%: [ ] No (not measured in this hook; CI reports Codecov) - Patch coverage >= 95%: [ ] No - Codecov status passing: [ ] No (pending CI) ### SonarQube Cloud - Quality Gate passing: [ ] No (pending CI) - New vulnerabilities introduced: [ ] No - New security hotspots reviewed: [ ] N/A ## Performance / Reliability Impact No measurable impact on API latency. Designer persist adds one architecture object. Swagger UI loads lazily on the OpenAPI tab. ## Observability - Logs updated: [x] No - Metrics/Tracing updated: [x] N/A ## Deployment and Rollout - Deployment notes: ship with Service Management static app; swagger vendor is generated at test/CI sync, same pattern as Cana/d3. - Feature flag needed: [x] No - Rollout strategy: merge to `dev` when required checks pass (operator requested no merge in this PR). - Rollback steps: revert the merge commit on `dev`. ## Risks and Mitigations 1. Risk: implicit architecture validation breaking empty Billing models. Mitigation: Users-missing is warning only when `architecture.services` is already present; otherwise monolith normalize. 2. Risk: Playwright browsers missing under Cursor `PLAYWRIGHT_BROWSERS_PATH`. Mitigation: local hook used host `~/Library/Caches/ms-playwright`; CI installs browsers. ## Documentation Updates - [x] README updated (if needed) — N/A - [x] Additional docs updated (DOMAIN-DESIGNER, CONTRACT-PARITY, FACTORY matrix, USING-SERVICE-MANAGER, website MDX EN/PT) - [x] Changelog updated/synced (husky `bun ci-cd/update-changelog.js`) ## Reviewer Checklist - [ ] Changes are clear and scoped. - [ ] Acceptance criteria are testable and satisfied. - [ ] Tests are sufficient for risk level. - [ ] Security and data impacts are addressed. - [ ] CI checks pass fully.  --- > [!NOTE] > **Medium Risk** > Large surface area across designer state, OAS contract extensions, and catalog design payloads; mitigated by normalization for legacy models and broad test coverage. > > **Overview** > Service Management gains **Architecture** and **OpenAPI** tabs: model Core vs domain services, assign domains, draw protocol links, and browse generated OAS in vendored Swagger UI. > > **Designer-core** adds persisted `architecture` (16th Contract 2 section), validation (one Core, Users on Core, cross-service `x-relation` warnings), and OAS 3.1 extensions (`x-services`, `x-service`, `servers[].x-service-id`, `x-architecture-links`) with merged and per-service document sets. OAS import round-trips architecture; suite JSON export includes the slice. > > **Tooling & API:** `service-management:vendor` and the test harness sync Swagger UI from `apps/backend-template/OASdoc` (no new npm dep). Catalog API exposes `CatalogService.oasDocumentsFromDesign` for `design.oasDocuments`. PWA shell bumps to 0.9.54 and precaches new modules. Playwright covers architecture + OpenAPI tabs; unit tests cover model, exporters, and swagger selector. Docs and changelog updated (EN/PT). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 5ccdb9d. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

## Summary Consolidates the open Dependabot dependency/security PRs into one signed update targeting `dev`. Covered updates: - `@fastify/helmet` 13.1.1 - `@types/bcryptjs` 3.0.0 - `@types/supertest` 7.2.1 - `jest` 30.5.1 - `next` 16.3.3 - Storybook Next stack 10.6.0 - frontend `happy-dom` 20.8.9 and `vite` 8.0.16 - frontend template lock updates for `baseline-browser-mapping`, `js-yaml`, `postcss-selector-parser`, `nanoid`, `immutable`, `postcss`, `browserslist`, `brace-expansion`, and `vite` - root override for `qs` 6.16.0 plus explicit temporary accepted risk for the remaining `qs@6.15.3` nested through `express@4.22.2` in Sails/LoopBack, which Bun cannot override at that nested edge yet ## Notes - `@fastify/helmet` 13 tightened its CSP option type; `FastifyServer` now uses `contentSecurityPolicy: false` to preserve the previous no-default-CSP behavior. - `apps/frontend/template` npm audit is clean. - The first-party OSV audit is clean after the temporary accepted-risk entries for the upstream `qs` nested edge. ## Local validation - `npm audit --prefix apps/frontend/template --audit-level=low` - `rtk proxy bun run deps:audit` - `rtk proxy bun run deps:check-overrides` - `rtk proxy bun run test-map:check` - `rtk proxy bun run pr:governance:check` - `rtk proxy bun run ci:check-provider` - `rtk proxy bun run --filter @jumentix/frontend test` - `rtk proxy bun run --filter @jumentix/website test:unit` - `rtk proxy bun test packages/security-scanner/test/scanner.test.ts` - `rtk proxy bun test apps/backend-template/test/unit/ci-cd/check-bun-version.test.ts apps/backend-template/test/unit/ci-cd/check-dependency-override-integrity.test.ts` - `rtk proxy bun run build:dev` - pre-push branch-aware quality gate, including layer-aware unit/integration suites  --- > [!NOTE] > **Low Risk** > Mostly version bumps and lockfile churn; the only runtime tweak is equivalent Helmet CSP disabling on the Fastify adapter. > > **Overview** > Consolidates Dependabot-driven dependency bumps across backend, frontend, and website workspaces, with one small Fastify adapter tweak for a major `@fastify/helmet` API change. > > **Fastify:** `FastifyServer` now passes `contentSecurityPolicy: false` to helmet instead of `{ useDefaults: false }`, matching `@fastify/helmet` 13’s stricter options while keeping the prior “no default CSP” behavior. > > **Frontend:** `@jumentix/frontend` bumps `happy-dom` / `@happy-dom/global-registrator` to **20.8.9** and `vite` to **^8.0.16**. The CoreUI **template** app aligns `postcss` and `vite` and refreshes `package-lock.json` (Vite 8 / Rolldown transitive updates). > > **Website:** `next` **16.3.3** and the Storybook Next stack **10.6.0** (addons + core `storybook`). > > Other updates described in the PR (root `jest`, `@types/*`, `qs` overrides, accepted-risk entries) are part of the same consolidation but may live outside the files shown in this diff slice. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit bc12ad6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

cursor · 2026-09-16T16:00:00Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.