Verification: Frontend Implementation for Item Image Upload

This matrix maps every requirement to the verification method that confirms it is correctly implemented. Requirements are linked to requirements.md for full text. Status reflects the state at the time of writing; update to Pass or Fail as verification is completed.

Traceability Matrix

Requirement	Description (brief)	Verification Method	Phase	Status
REQ-FE-001	`createImageUploadUrl` method on api-proxy client	Unit test (mocked fetch)	3.1	Pending
REQ-FE-002	Type exports from api-proxy package	Build (typecheck)	3.1	Pending
REQ-FE-003	api-proxy package published to GitHub Packages	Manual (verify on GitHub Packages)	3.1	Pending
REQ-FE-010	`/image-upload` BFF proxy route	Unit test (mocked api-proxy)	3.5	Pending
REQ-FE-011	`/check-url` reachability endpoint	Unit test (mocked fetch)	3.5	Pending
REQ-FE-012	SSRF protection on `/check-url`	Unit test (private IPs, localhost, managed host)	3.5	Pending
REQ-FE-013	`/fetch-url` proxy with stream passthrough	Unit test (mocked fetch, stream)	3.5	Pending
REQ-FE-014	Rate limiting on BFF routes	Unit test (counter logic)	3.5	Pending
REQ-FE-015	JWT required on all BFF routes	Unit test (missing/invalid token)	3.5	Pending
REQ-FE-016	`/cdn-cookies` signing via Secrets Manager	Unit test (mocked Secrets Manager)	3.5	Pending
REQ-FE-017	Correct cookie attributes on CDN cookie response	Unit test (Set-Cookie header inspection)	3.5	Pending
REQ-FE-018	Cookie TTL driven by config parameter	Unit test (TTL parameter)	3.5	Pending
REQ-FE-019	Tenant resolved from session, not client payload	Unit test (not from client)	3.5	Pending
REQ-FE-020	File bytes never pass through BFF	Code review	3.5	Pending
REQ-FE-021	10-second timeout on outbound BFF requests	Unit test (timeout config)	3.5	Pending
REQ-FE-022	BFF routes follow FD-02 structure	Code review (files in `src/server/`)	3.5	Pending
REQ-FE-023	`server-only` import guard on BFF modules	Build (client import would fail)	3.5	Pending
REQ-FE-024	Content-Type validation on BFF fetch routes	Unit test (non-image Content-Type → 422)	3.5	Pending
REQ-FE-025	Secret cache TTL and eviction	Unit test (expired cache re-fetches)	3.5	Pending
REQ-FE-026	`Max-Age` on CDN cookies	Unit test (Set-Cookie header inspection)	3.5	Pending
REQ-FE-027	GET fallback body discarded	Code review + Unit test	3.5	Pending
REQ-FE-028	BFF uses `RequestContext` for header injection	Unit test (context forwarded to proxy)	3.5	Pending
REQ-FE-030	Lifecycle types exported from design system	Build (import in test)	3.2	Pending
REQ-FE-031	`useDraft` hook exposes full API surface	Unit test (all methods)	3.2	Pending
REQ-FE-032	Draft resets when `initialValue` changes	Unit test	3.2	Pending
REQ-FE-033	`contextErrors` merges with field errors	Unit test	3.2	Pending
REQ-FE-040	Indeterminate progress indicator component	Unit test + Storybook	3.3	Pending
REQ-FE-041	`UploadError` state rendering	Unit test + Storybook	3.3	Pending
REQ-FE-042	`EditLifecycleCallbacks` type shape	Build (type check)	3.3	Pending
REQ-FE-043	`ImageCellEditor` factory hook integration	Unit test	3.3	Pending
REQ-FE-044	`ImageFormField` accepts `EditableComponentProps`	Unit test + Storybook	3.3	Pending
REQ-FE-045	`ItemGridLookups` expanded with image fields	Build (type check)	3.3	Pending
REQ-FE-046	No TanStack Query import in design system	Build (would fail if imported) + Code review	3.3	Pending
REQ-FE-047	Storybook default MSW handlers cover all stories	Storybook (all stories render)	3.3	Pending
REQ-FE-060	`QueryClientProvider` wraps the SPA tree	Build + Unit test (provider wrapping)	3.6	Pending
REQ-FE-061	TanStack provider hooks for image upload	Unit test (mocked fetch)	3.6	Pending
REQ-FE-062	`useCdnCookies` refresh interval configuration	Unit test (refetchInterval config)	3.6	Pending
REQ-FE-063	`src/api/` layer present in SPA	Code review (FD-02)	3.6	Pending
REQ-FE-064	Hook directories follow FD-02 convention	Code review (FD-02)	3.6	Pending
REQ-FE-065	Upload orchestration runs three-step flow	Unit test (3-step flow)	3.6	Pending
REQ-FE-066	Reachability check falls back to BFF on CORS failure	Unit test (CORS failure → BFF)	3.6	Pending
REQ-FE-067	CDN cookie lifecycle (refresh, tenant switch, 403 recovery)	Unit test	3.6	Pending
REQ-FE-068	Grid thumbnails display from CDN	Integration test + Manual	3.6	Pending
REQ-FE-069	Hover preview over grid thumbnail	Integration test + Manual	3.6	Pending
REQ-FE-070	Cell editor opens in modal	Integration test + Manual	3.6	Pending
REQ-FE-071	Add Item form includes image field	Integration test + Manual	3.6	Pending
REQ-FE-072	Edit Item flow supports image replacement	Integration test + Manual	3.6	Pending
REQ-FE-073	Single upload enforced per cell editor session	Unit test	3.6	Pending
REQ-FE-074	Output image format is JPEG	Unit test	3.6	Pending
REQ-FE-075	Copyright watermark text displayed	Storybook + Manual	3.6	Pending
REQ-FE-076	Upload uses presigned POST (not PUT)	Unit test (form fields, not PUT)	3.6	Pending
REQ-FE-077	Indeterminate progress shown during upload	Manual (visual)	3.6	Pending
REQ-FE-079	`crossOrigin` on canvas image editing	Unit test + Storybook	3.3	Pending
REQ-FE-078	CDN 403 recovery hook	Unit test (refresh triggered, retry, max retries)	3.6	Pending
REQ-FE-080	CDN host derived from env vars	Unit test (naming convention)	3.6	Pending
REQ-FE-081	Cookie TTL shared constant	Unit test (refetchInterval matches TTL/2)	3.6	Pending
REQ-FE-NF-001	No layout reflow on image load	Manual (visual check)	3.6	Pending
REQ-FE-NF-002	Failed uploads are retryable	Unit test + Manual	3.6	Pending
REQ-FE-NF-003	Graceful degradation for HEIC on unsupported browsers	Unit test (unsupported browser)	3.3	Pending
REQ-FE-NF-004	CDN cookie mocks present in test setup	Code review (mock setup)	3.5	Pending
REQ-FE-NF-005	All deliverables follow FD-02 directory structure	Code review	All phases	Pending