feat(js): add app-http contracts and migrate helpdesk runtime layer

bin/js-contract-check.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd -- "${script_dir}/.." && pwd)"
+cd "${repo_root}"
+
+if ! command -v rg >/dev/null 2>&1; then
+  echo "[ERROR] rg is required for js-contract-check." >&2
+  exit 2
+fi
+
+failures=0
+
+ok() {
+  echo "[OK]  $*"
+}
+
+fail() {
+  echo "[FAIL] $*" >&2
+  failures=$((failures + 1))
+}
+
+alert_hits="$(rg -n "window\\.alert\\s*\\(" web/js modules/helpdesk/web/js -g '*.js' || true)"
+if [[ -n "${alert_hits}" ]]; then
+  fail "window.alert usage detected:"
+  echo "${alert_hits}" >&2
+else
+  ok "No window.alert usage in web/js and modules/helpdesk/web/js"
+fi
+
+fetch_hits="$(rg -n "\\bfetch\\s*\\(" modules/helpdesk/web/js -g '*.js' || true)"
+if [[ -n "${fetch_hits}" ]]; then
+  fail "Direct fetch(...) usage detected in helpdesk JS:"
+  echo "${fetch_hits}" >&2
+else
+  ok "Helpdesk JS uses centralized app-http (no direct fetch)"
+fi
+
+runtime_files=(
+  "modules/helpdesk/web/js/helpdesk-detail.js"
+  "modules/helpdesk/web/js/helpdesk-domain-detail.js"
+  "modules/helpdesk/web/js/helpdesk-ticket.js"
+  "modules/helpdesk/web/js/helpdesk-team.js"
+  "modules/helpdesk/web/js/helpdesk-risk-radar.js"
+  "modules/helpdesk/web/js/helpdesk-settings.js"
+  "modules/helpdesk/web/js/handover-domain-select.js"
+  "modules/helpdesk/web/js/handover-schema-editor.js"
+  "web/js/components/app-lookup-field.js"
+)
+
+for file in "${runtime_files[@]}"; do
+  if [[ ! -f "${file}" ]]; then
+    fail "Missing runtime file: ${file}"
+    continue
+  fi
+
+  if rg -q "DOMContentLoaded|document\\.readyState" "${file}"; then
+    fail "${file}: lifecycle auto-init pattern found"
+  fi
+
+  if rg -q "const container = document\\.querySelector" "${file}"; then
+    fail "${file}: top-level container auto-init pattern found"
+  fi
+
+done
+ok "Runtime files are free of sideeffect auto-init patterns"
+
+import_violations=0
+while IFS= read -r line; do
+  file="${line%%:*}"
+  import_path="$(printf '%s' "${line}" | sed -E "s/.*['\"]([^'\"]+)['\"].*/\1/")"
+
+  if [[ "${import_path}" == /js/* ]]; then
+    continue
+  fi
+
+  if [[ "${import_path}" == ./* || "${import_path}" == ../* ]]; then
+    if printf '%s' "${import_path}" | rg -q "(^|/)js/(core|components|pages)/"; then
+      echo "${file}: relative core import forbidden -> ${import_path}" >&2
+      import_violations=$((import_violations + 1))
+    fi
+    continue
+  fi
+
+  echo "${file}: invalid import path -> ${import_path}" >&2
+  import_violations=$((import_violations + 1))
+done < <(rg -n "^\\s*import\\s+(?:[^'\\\"]+\\s+from\\s+)?['\\\"][^'\\\"]+['\\\"]" modules/helpdesk/web/js -g '*.js')
+
+if [[ "${import_violations}" -gt 0 ]]; then
+  fail "Helpdesk import policy violations: ${import_violations}"
+else
+  ok "Helpdesk import policy valid (core imports absolute /js/...; local imports relative)"
+fi
+
+if [[ "${failures}" -gt 0 ]]; then
+  echo "[FAIL] JS contract check failed with ${failures} issue(s)." >&2
+  exit 1
+fi
+
+echo "[OK] JS contract check passed."

bin/qa-required.sh

@@ -44,6 +44,9 @@ run_step "QG-008 Docs drift contract" \
 run_step "CSS contract check" \
   bin/css-contract-check.sh
 
+run_step "JS contract check" \
+  bin/js-contract-check.sh
+
 run_step "QG-009 Codex skills sync" \
   bin/codex-skills-sync.sh --check