build(node): coordinate Node 22.22.2 floor with jsdom 30

[seonghobae]

Canonical #779 Node/jsdom compatibility slice

This Draft advances issue #779 and remains deliberately downstream of canonical dependency-security owner #783. The PR targets protected develop so required protected-base workflows execute on its exact head; predecessor/base evidence never transfers.

Exact current identity

• Head: c07e51639dbb7b44f57ff0aabc26ad793e691add.
• Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Historical dependency-root ancestor carried in this branch: fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 dae5d3c8d055381d57c0971d8e40456711499476.
• Current canonical fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 has advanced separately to 99e6be9f0933df605c03c04e959b47c5c2405ca6; this Draft must be reconstructed/revalidated after fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 integrates rather than pretending that later root evidence is already ancestry.

Compatibility contract

The branch requires:

• root Node support >=22.22.2 <23 with an explicit rejection regression for Node 22.22.1;
• repository-canonical npm 10.9.8;
• jsdom ^30.0.1;
• persistent node-minimum-compatibility execution on exact Node 22.22.2 with npm 10.9.8 bootstrapped before dependency consumption;
• lint, strict typecheck, measured tests, production build, Storybook, and Tauri check/test at the supported floor; and
• canonical developer documentation aligned to the raised floor.

Dependency-root least-privilege carry-forward

Fresh exact logs showed this descendant still had the pre-repair lock-validation checkout credential behavior even after #783's owning lane identified and repaired it.

The descendant was repaired without competing with #783:

1. ce45742e6c0c44e08a015d16ea012b4d6b2beac7 adds the branch-specific regression requiring persist-credentials: false inside the frozen lock-validation job while retaining the Node 22.22.2-floor contract.
2. Current head c07e51639dbb7b44f57ff0aabc26ad793e691add adds the credential-free checkout option to this descendant's inherited ci.yml.

Exact-head CI run 32097740686, job 95592252535, proves the checkout now executes with persist-credentials: false and verifies npm 10.9.8 before reaching the already-known lock mismatch. The security repair therefore changed the intended authority boundary without masking the next RED condition.

Current real RED boundary

The root package-lock.json is still the pre-jsdom-30 graph. Exact-head frozen npm ci fails because the manifest requires entries absent from the lock, including:

• jsdom@30.0.1;
• @asamuzakjp/css-color@6.0.7;
• @asamuzakjp/dom-selector@8.3.2;
• undici@8.10.0; and
• whatwg-url@17.1.0.

This is not bypassed or hand-edited. The lock must be regenerated on the correct post-#783 ancestry with the approved npm 10.9.8 generator and then revalidated through frozen consumption. The closed Dependabot #760 graph is reference evidence only; its checks/reviews/generator provenance do not transfer.

Accordingly, exact-head ci, node-minimum-compatibility, and build-baseline are currently terminal-failure/non-passing at the stale-lock boundary. Other queued or incomplete workflows are also non-passing until terminal.

Merge gate

Keep Draft and unmerged until #783 reaches protected develop, this branch is deliberately reconstructed on the resulting live base, the lock is generated by the approved toolchain, and one unchanged exact head has every applicable repository/central CI, security, SAST, SBOM/supply-chain, coverage/docstring, build/package/release and review gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.

Never hand-edit generated dependency provenance, weaken a gate, reuse predecessor evidence, self-approve, or treat queued/pending/skipped/cancelled/failed/model-only evidence as success.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 08cf1fb9-ab46-4176-8583-193740fd56db

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please continue the existing canonical owner branch fix/node-22-22-2-jsdom-30-779 at exact head 8596bd1c4459d039ae87dfc165ba132ed2c7cca4; do not create another PR/branch and do not touch #783's dependency-security ownership.

Validated RED: run 32021377546 job 95361595934 fails at npm ci --ignore-scripts --no-audit --no-fund because the committed lock lacks the jsdom 30 workspace graph (jsdom@30.0.1, @asamuzakjp/css-color@6.0.7, @asamuzakjp/dom-selector@8.3.2, undici@8.10.0, whatwg-url@17.1.0).

A generator-produced repair already exists and is still downloadable: run 32018726491 / job 95353636943 generated package-lock.json with exact Node 22.22.2 + repository-canonical npm 10.9.8 using npm install --package-lock-only --ignore-scripts --no-audit --no-fund, then uploaded artifact node-minimum-package-lock-candidate, artifact ID 9284543105, ZIP digest sha256:4010a4693a5e6306cf86eae8036e7558c1b4bed7bf9d52b4748f4f743edee4d6. Artifact file SHA-256 after extraction is 6e4a3cd452d11c1d5b80eb0dea9d2890353ad0e422202788c11c08d375c8b4e0. 6f5d1e40c13eb7a07d651798ff7fa1fe64bcd1b6..8596bd1c4459d039ae87dfc165ba132ed2c7cca4 changes only .github/workflows/node-minimum-compatibility.yml, so package manifests and the stale lock input are unchanged since generation.

Use that exact artifact as the provenance-preserving lock repair (do not hand-edit generated dependency graph), commit it to the existing branch, then verify current-head ci npm-lock-validation and node-minimum-compatibility first, followed by all applicable repository gates. Keep the PR Draft and dependency-ordered behind #783; do not claim predecessor evidence or merge readiness.