feat: integrate bounded external auth sessions

src/adapters/auth/external-session-adapter.js

@@ -0,0 +1,45 @@
+/**
+ * Creates the skeleton-owned side of an external session integration.
+ * Credential acquisition and storage stay inside the supplied external owner.
+ *
+ * @param {{
+ *   readState(): import("../../application/ports/auth-session-port.js").SessionState,
+ *   attachCredential(request: Request): Promise<Request>,
+ *   recoverSession(): Promise<"restored" | "no-session">,
+ *   notifyUnauthenticated(): void
+ * }} owner
+ * @returns {import("../../application/ports/auth-session-port.js").AuthSessionPort}
+ */
+export function createExternalAuthSessionAdapter(owner) {
+  return Object.freeze({
+    getState() {
+      return owner.readState();
+    },
+    async attach(request) {
+      const attached = await owner.attachCredential(request);
+      if (!(attached instanceof Request)) {
+        throw new TypeError("Auth owner returned an invalid request");
+      }
+      return attached;
+    },
+    async recover() {
+      const result = await owner.recoverSession();
+      if (result !== "restored" && result !== "no-session") {
+        throw new TypeError("Auth owner returned an invalid recovery state");
+      }
+      return result;
+    },
+    onUnauthenticated() {
+      owner.notifyUnauthenticated();
+    },
+  });
+}
+
+export function createAnonymousSessionAdapter() {
+  return createExternalAuthSessionAdapter({
+    readState: () => "unauthenticated",
+    attachCredential: async (request) => request,
+    recoverSession: async () => "no-session",
+    notifyUnauthenticated: () => {},
+  });
+}

src/adapters/http/client.js

@@ -0,0 +1,407 @@
+import { systemClock } from "../../application/ports/clock-port.js";
+import { getApiOperation } from "../../contracts/api-operations.js";
+import {
+  createFailure as failure,
+  kindForStatus as statusKind,
+} from "../../contracts/errors.js";
+import { retryDelay, shouldRetry } from "./retry-policy.js";
+import {
+  validateEnvelope,
+  validateOperationPayload,
+  validateOperationRequest,
+} from "./schema-registry.js";
+
+const noAuthSession =
+  /** @type {import("../../application/ports/auth-session-port.js").AuthSessionPort} */ ({
+  getState: () => /** @type {"unauthenticated"} */ ("unauthenticated"),
+  attach: async (request) => request,
+  recover: async () => /** @type {"no-session"} */ ("no-session"),
+  onUnauthenticated: () => {},
+});
+
+/**
+ * @typedef {{
+ *   kind: string,
+ *   code: string,
+ *   retryable: boolean,
+ *   operationId: string,
+ *   attemptCount: number,
+ *   httpStatus?: number,
+ *   requestId?: string,
+ *   traceId?: string,
+ *   retryAfterMs?: number,
+ *   userMessageKey: string,
+ *   action: string
+ * }} HttpFailure
+ */
+
+/**
+ * @typedef {{ ok: true, value: unknown, meta: Record<string, string> } |
+ * { ok: false, error: HttpFailure }} HttpResult
+ */
+
+/**
+ * @param {{
+ *   baseUrl: string,
+ *   fetcher?: typeof fetch,
+ *   authSession?: import("../../application/ports/auth-session-port.js").AuthSessionPort,
+ *   clock?: import("../../application/ports/clock-port.js").ClockPort,
+ *   random?: () => number,
+ *   validatePayload?: (schemaId: string, value: unknown) =>
+ *     { success: true, data: unknown } | { success: false },
+ *   idempotencyKeyFactory?: () => string
+ * }} dependencies
+ */
+export function createHttpClient(dependencies) {
+  const fetcher = dependencies.fetcher ?? fetch;
+  const authSession = dependencies.authSession ?? noAuthSession;
+  const clock = dependencies.clock ?? systemClock;
+  const random = dependencies.random ?? Math.random;
+  const validatePayload =
+    dependencies.validatePayload ?? validateOperationPayload;
+  const idempotencyKeyFactory =
+    dependencies.idempotencyKeyFactory ?? (() => crypto.randomUUID());
+
+  /**
+   * @param {string} operationId
+   * @param {{
+   *   body?: unknown,
+   *   routeId?: string,
+   *   signal?: AbortSignal,
+   *   idempotencyKey?: string
+   * }} [input]
+   */
+  async function execute(operationId, input = {}) {
+    const operation = getApiOperation(operationId);
+    const logicalIdempotencyKey =
+      operation.idempotency === "keyed"
+        ? input.idempotencyKey ?? idempotencyKeyFactory()
+        : undefined;
+    let retryCount = 0;
+    let recoveryUsed = false;
+
+    while (true) {
+      const attempt = retryCount;
+      /** @type {HttpResult} */
+      const outcome = await performAttempt({
+        operation,
+        input,
+        attempt,
+        idempotencyKey: logicalIdempotencyKey,
+      });
+
+      if (outcome.ok) return outcome;
+
+      if (outcome.error.httpStatus === 401 && !recoveryUsed) {
+        recoveryUsed = true;
+        const recovered = await recoverSession(authSession, operation, outcome.error);
+        if (!recovered.ok) return recovered;
+        if (operation.idempotency === "none") {
+          return {
+            ok: false,
+            error: {
+              ...outcome.error,
+              retryable: false,
+              action: "retry",
+            },
+          };
+        }
+        continue;
+      }
+
+      if (outcome.error.httpStatus === 401 && recoveryUsed) {
+        authSession.onUnauthenticated();
+        return outcome;
+      }
+
+      if (!shouldRetry(operation, outcome.error, retryCount)) {
+        return outcome;
+      }
+
+      const delay = retryDelay(outcome.error, retryCount, random, clock.now());
+      retryCount += 1;
+
+      try {
+        await clock.sleep(delay, input.signal);
+      } catch {
+        return {
+          ok: false,
+          error: failure("REQUEST_ABORTED", operationId, retryCount, {
+            code: "REQUEST_ABORTED",
+          }),
+        };
+      }
+    }
+  }
+
+  /**
+   * @param {{
+   *   operation: ReturnType<typeof getApiOperation>,
+   *   input: { body?: unknown, routeId?: string, signal?: AbortSignal },
+   *   attempt: number,
+   *   idempotencyKey?: string
+   * }} context
+   * @returns {Promise<HttpResult>}
+   */
+  async function performAttempt(context) {
+    const { operation, input, attempt, idempotencyKey } = context;
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      controller.abort("timeout");
+    }, operation.timeoutMs);
+    const onExternalAbort = () => controller.abort(input.signal?.reason);
+    input.signal?.addEventListener("abort", onExternalAbort, { once: true });
+
+    const headers = new Headers({ Accept: "application/json" });
+    if (input.body !== undefined) headers.set("Content-Type", "application/json");
+    if (idempotencyKey) headers.set("Idempotency-Key", idempotencyKey);
+
+    if (input.body !== undefined) {
+      const requestValidation = validateOperationRequest(
+        operation.requestSchema,
+        input.body,
+      );
+      if (!requestValidation.success) {
+        return {
+          ok: false,
+          error: failure("VALIDATION_REJECTED", operation.operationId, attempt, {
+            code: "REQUEST_SCHEMA_INVALID",
+          }),
+        };
+      }
+    }
+
+    let request = new Request(new URL(operation.path, dependencies.baseUrl), {
+      method: operation.method,
+      headers,
+      body: input.body === undefined ? undefined : JSON.stringify(input.body),
+      signal: controller.signal,
+    });
+
+    try {
+      if (operation.auth === "external-session") {
+        try {
+          request = await authSession.attach(request);
+        } catch {
+          return {
+            ok: false,
+            error: failure("AUTH_INTEGRATION_FAILURE", operation.operationId, attempt, {
+              code: "AUTH_ATTACH_FAILED",
+            }),
+          };
+        }
+      }
+
+      const response = await fetcher(request);
+      return await parseResponse(response, operation, attempt, validatePayload);
+    } catch {
+      if (timedOut) {
+        return {
+          ok: false,
+          error: failure("REQUEST_TIMEOUT", operation.operationId, attempt, {
+            code: "REQUEST_TIMEOUT",
+          }),
+        };
+      }
+      if (controller.signal.aborted || input.signal?.aborted) {
+        const externalReason = input.signal?.reason;
+        if (externalReason === "timeout") {
+          return {
+            ok: false,
+            error: failure("REQUEST_TIMEOUT", operation.operationId, attempt, {
+              code: "REQUEST_TIMEOUT",
+            }),
+          };
+        }
+        if (
+          externalReason !== undefined &&
+          !["navigation", "user", "superseded"].includes(String(externalReason))
+        ) {
+          return {
+            ok: false,
+            error: failure("UNKNOWN_FAILURE", operation.operationId, attempt, {
+              code: "EXTERNAL_ABORT_UNRESOLVED",
+            }),
+          };
+        }
+        return {
+          ok: false,
+          error: failure("REQUEST_ABORTED", operation.operationId, attempt, {
+            code: "REQUEST_ABORTED",
+          }),
+        };
+      }
+      return {
+        ok: false,
+        error: failure("NETWORK_UNREACHABLE", operation.operationId, attempt, {
+          code: "NETWORK_UNREACHABLE",
+        }),
+      };
+    } finally {
+      clearTimeout(timeout);
+      input.signal?.removeEventListener("abort", onExternalAbort);
+    }
+  }
+
+  return Object.freeze({ execute });
+}
+
+/**
+ * @param {Response} response
+ * @param {import("../../contracts/api-operations.js").ApiOperation} operation
+ * @param {number} attempt
+ * @param {(schemaId: string, value: unknown) =>
+ *   { success: true, data: unknown } | { success: false }} validatePayload
+ * @returns {Promise<HttpResult>}
+ */
+async function parseResponse(response, operation, attempt, validatePayload) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    return {
+      ok: false,
+      error: failure("CONTENT_TYPE_MISMATCH", operation.operationId, attempt, {
+        code: "CONTENT_TYPE_MISMATCH",
+        httpStatus: response.status,
+      }),
+    };
+  }
+
+  let envelope;
+  try {
+    envelope = await response.json();
+  } catch {
+    return {
+      ok: false,
+      error: failure("MALFORMED_JSON", operation.operationId, attempt, {
+        code: "MALFORMED_JSON",
+        httpStatus: response.status,
+      }),
+    };
+  }
+
+  const envelopeValidation = validateEnvelope(envelope);
+  if (!envelopeValidation.success) {
+    return {
+      ok: false,
+      error: failure(
+        response.ok ? "ENVELOPE_MISMATCH" : statusKind(response.status),
+        operation.operationId,
+        attempt,
+        {
+        code: response.ok ? "ENVELOPE_MISMATCH" : "HTTP_FAILURE",
+        httpStatus: response.status,
+        },
+      ),
+    };
+  }
+
+  const envelopeRecord =
+    /** @type {Record<string, unknown>} */ (envelopeValidation.data);
+  if (response.ok && envelopeRecord.success === true && "data" in envelopeRecord) {
+    const payload = validatePayload(operation.responseSchema, envelopeRecord.data);
+    if (!payload.success) {
+      return {
+        ok: false,
+        error: failure("SCHEMA_MISMATCH", operation.operationId, attempt, {
+          code: "SCHEMA_MISMATCH",
+          httpStatus: response.status,
+        }),
+      };
+    }
+
+    return {
+      ok: true,
+      value: structuredClone(payload.data),
+      meta: safeMeta(envelopeRecord.meta),
+    };
+  }
+
+  const kind = statusKind(response.status);
+  const retryAfter = response.headers.get("retry-after");
+  return {
+    ok: false,
+    error: failure(kind, operation.operationId, attempt, {
+      code: safeBackendCode(envelope),
+      httpStatus: response.status,
+      requestId: safeMeta(envelopeRecord.meta).requestId,
+      traceId: safeMeta(envelopeRecord.meta).traceId,
+      retryAfterMs:
+        response.status === 429 && retryAfter
+          ? parseRetryAfterHeader(retryAfter)
+          : undefined,
+    }),
+  };
+}
+
+/**
+ * @param {import("../../application/ports/auth-session-port.js").AuthSessionPort} authSession
+ * @param {import("../../contracts/api-operations.js").ApiOperation} operation
+ * @param {HttpFailure} originalFailure
+ * @returns {Promise<{ok: true} | {ok: false, error: HttpFailure}>}
+ */
+async function recoverSession(authSession, operation, originalFailure) {
+  try {
+    const result = await authSession.recover();
+    if (result === "restored") return { ok: true };
+    if (result === "no-session") {
+      authSession.onUnauthenticated();
+      return {
+        ok: false,
+        error: failure("AUTH_REQUIRED", operation.operationId, originalFailure.attemptCount, {
+          code: "AUTH_REQUIRED",
+          httpStatus: 401,
+        }),
+      };
+    }
+  } catch {
+    // Normalized below.
+  }
+
+  return {
+    ok: false,
+    error: failure(
+      "AUTH_INTEGRATION_FAILURE",
+      operation.operationId,
+      originalFailure.attemptCount,
+      { code: "AUTH_RECOVERY_FAILED" },
+    ),
+  };
+}
+
+/**
+ * @param {string} kind
+ * @param {string} operationId
+ * @param {number} attempt
+ * @param {FailureDetails} [details]
+ * @returns {HttpFailure}
+ */
+/** @param {unknown} envelope */
+function safeBackendCode(envelope) {
+  if (!envelope || typeof envelope !== "object") return "HTTP_FAILURE";
+  const error = /** @type {Record<string, unknown>} */ (envelope).error;
+  if (!error || typeof error !== "object") return "HTTP_FAILURE";
+  const code = /** @type {Record<string, unknown>} */ (error).code;
+  return typeof code === "string" ? code : "HTTP_FAILURE";
+}
+
+/** @param {unknown} meta @returns {Record<string, string>} */
+function safeMeta(meta) {
+  if (!meta || typeof meta !== "object") return {};
+  const metaRecord = /** @type {Record<string, unknown>} */ (meta);
+  return {
+    ...(typeof metaRecord.requestId === "string"
+      ? { requestId: metaRecord.requestId }
+      : {}),
+    ...(typeof metaRecord.traceId === "string" ? { traceId: metaRecord.traceId } : {}),
+  };
+}
+
+/** @param {string} value */
+function parseRetryAfterHeader(value) {
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1_000;
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? Math.max(0, timestamp - Date.now()) : undefined;
+}

src/adapters/http/retry-policy.js

@@ -0,0 +1,79 @@
+const retryKinds = new Set([
+  "NETWORK_UNREACHABLE",
+  "REQUEST_TIMEOUT",
+  "RATE_LIMITED",
+  "SERVER_FAILURE",
+]);
+
+/**
+ * @param {number} retryIndex
+ * @param {() => number} [random]
+ * @param {number} [baseDelayMs]
+ * @param {number} [maxDelayMs]
+ */
+export function calculateBackoff(
+  retryIndex,
+  random = Math.random,
+  baseDelayMs = 250,
+  maxDelayMs = 2_000,
+) {
+  return Math.min(maxDelayMs, baseDelayMs * 2 ** retryIndex) * random();
+}
+
+/** @param {string | null | undefined} value @param {number} [now] */
+export function parseRetryAfter(value, now = Date.now()) {
+  if (!value) return null;
+
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) {
+    return seconds < 0 ? null : seconds * 1_000;
+  }
+
+  const timestamp = Date.parse(value);
+  if (!Number.isFinite(timestamp)) return null;
+  return Math.max(0, timestamp - now);
+}
+
+/**
+ * @param {{ idempotency: "safe" | "keyed" | "none" }} operation
+ * @param {{ kind: string, retryAfterMs?: number, httpStatus?: number }} failure
+ * @param {number} retryCount
+ * @param {number} [maxRetries]
+ */
+export function shouldRetry(operation, failure, retryCount, maxRetries = 2) {
+  if (retryCount >= maxRetries) return false;
+  if (!retryKinds.has(failure.kind)) return false;
+  if (
+    failure.kind === "SERVER_FAILURE" &&
+    failure.httpStatus !== undefined &&
+    ![502, 503, 504].includes(failure.httpStatus)
+  ) {
+    return false;
+  }
+  if (
+    failure.kind === "RATE_LIMITED" &&
+    typeof failure.retryAfterMs === "number" &&
+    failure.retryAfterMs > 30_000
+  ) {
+    return false;
+  }
+  return operation.idempotency === "safe" || operation.idempotency === "keyed";
+}
+
+/**
+ * @param {{ kind: string, retryAfterMs?: number, retryAfter?: string }} failure
+ * @param {number} retryIndex
+ * @param {() => number} [random]
+ * @param {number} [now]
+ */
+export function retryDelay(failure, retryIndex, random = Math.random, now = Date.now()) {
+  const localBackoff = calculateBackoff(retryIndex, random);
+  if (failure.kind !== "RATE_LIMITED") return localBackoff;
+
+  const retryAfterMs =
+    typeof failure.retryAfterMs === "number"
+      ? failure.retryAfterMs
+      : parseRetryAfter(failure.retryAfter, now);
+
+  return retryAfterMs === null ? localBackoff : Math.max(localBackoff, retryAfterMs);
+}

src/adapters/http/schema-registry.js

@@ -0,0 +1,115 @@
+import { z } from "zod";
+
+const metaSchema = z
+  .object({
+    requestId: z.string().min(1),
+    traceId: z.string().min(1),
+    correlationId: z.string().min(1).optional(),
+  })
+  .passthrough();
+
+export const successEnvelopeSchema = z
+  .object({
+    success: z.literal(true),
+    data: z.unknown(),
+    meta: metaSchema,
+  })
+  .strict();
+
+export const failureEnvelopeSchema = z
+  .object({
+    success: z.literal(false),
+    error: z
+      .object({
+        code: z.string().min(1),
+        category: z.string().min(1).optional(),
+        message: z.string().optional(),
+        retryable: z.boolean().optional(),
+        details: z.unknown().optional(),
+      })
+      .strict(),
+    meta: metaSchema,
+  })
+  .strict();
+
+export const responseEnvelopeSchema = z.discriminatedUnion("success", [
+  successEnvelopeSchema,
+  failureEnvelopeSchema,
+]);
+
+const sampleResourceSchema = z
+  .object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    createdAt: z.string().optional(),
+  })
+  .passthrough();
+
+const payloadSchemas =
+  /** @type {Readonly<Record<string, z.ZodType>>} */ (Object.freeze({
+  SampleResourceListPayload: z.array(sampleResourceSchema),
+  SampleResourcePayload: sampleResourceSchema,
+}));
+
+const requestSchemas =
+  /** @type {Readonly<Record<string, z.ZodType>>} */ (Object.freeze({
+  SampleResourceListQuery: z
+    .object({
+      cursor: z.string().optional(),
+      limit: z.int().min(1).max(100).default(20),
+    })
+    .strict(),
+  CreateSampleResourceCommand: z
+    .object({
+      name: z.string().trim().min(1).max(120),
+    })
+    .strict(),
+}));
+
+/** @param {unknown} value */
+export function validateEnvelope(value) {
+  return projectResult(responseEnvelopeSchema.safeParse(value));
+}
+
+/** @param {string} schemaId @param {unknown} value */
+export function validateOperationPayload(schemaId, value) {
+  const schema = payloadSchemas[schemaId];
+  if (!schema) return missingSchema(schemaId);
+  return projectResult(schema.safeParse(value));
+}
+
+/** @param {string} schemaId @param {unknown} value */
+export function validateOperationRequest(schemaId, value) {
+  const schema = requestSchemas[schemaId];
+  if (!schema) return missingSchema(schemaId);
+  return projectResult(schema.safeParse(value));
+}
+
+/** @param {string} schemaId */
+function missingSchema(schemaId) {
+  return {
+    success: /** @type {false} */ (false),
+    issues: [{ path: "", code: "SCHEMA_NOT_REGISTERED", schemaId }],
+  };
+}
+
+/**
+ * @param {{ success: true, data: unknown } |
+ * { success: false, error: { issues: Array<{ path: PropertyKey[], code: string }> } }} result
+ */
+function projectResult(result) {
+  if (result.success) {
+    return {
+      success: /** @type {true} */ (true),
+      data: structuredClone(result.data),
+    };
+  }
+
+  return {
+    success: /** @type {false} */ (false),
+    issues: result.error.issues.map((issue) => ({
+      path: issue.path.join("."),
+      code: issue.code,
+    })),
+  };
+}

src/application/ports/resource-ports.js

@@ -22,7 +22,7 @@
 /**
  * @template Value
  * @typedef {{ ok: true, value: Value, meta?: Record<string, unknown> } |
- *   { ok: false, error: unknown }} Result
+ *   { ok: false, error: import("../../contracts/errors.js").ApiFailure }} Result
  */
 
 export {};

src/contracts/api-operations.js

@@ -0,0 +1,51 @@
+/**
+ * @typedef {{
+ *   method: string,
+ *   path: string,
+ *   operationId: string,
+ *   auth: "none" | "external-session",
+ *   timeoutMs: number,
+ *   idempotency: "safe" | "keyed" | "none",
+ *   requestSchema: string,
+ *   responseSchema: string,
+ *   owner: string
+ * }} ApiOperation
+ */
+
+/** @param {ApiOperation} definition */
+const operation = (definition) => Object.freeze(definition);
+
+export const API_OPERATIONS = Object.freeze({
+  LIST_SAMPLE_RESOURCES: operation({
+    method: "GET",
+    path: "/api/sample/resources",
+    operationId: "LIST_SAMPLE_RESOURCES",
+    auth: "external-session",
+    timeoutMs: 10_000,
+    idempotency: "safe",
+    requestSchema: "SampleResourceListQuery",
+    responseSchema: "SampleResourceListPayload",
+    owner: "feature-sample-feature-slice-contract-fixture",
+  }),
+  CREATE_SAMPLE_RESOURCE: operation({
+    method: "POST",
+    path: "/api/sample/resources",
+    operationId: "CREATE_SAMPLE_RESOURCE",
+    auth: "external-session",
+    timeoutMs: 10_000,
+    idempotency: "keyed",
+    requestSchema: "CreateSampleResourceCommand",
+    responseSchema: "SampleResourcePayload",
+    owner: "feature-sample-feature-slice-contract-fixture",
+  }),
+});
+
+/** @param {string} operationId */
+export function getApiOperation(operationId) {
+  const registry = /** @type {Record<string, ApiOperation>} */ (API_OPERATIONS);
+  const selected = registry[operationId];
+  if (!selected) {
+    throw new Error(`Unregistered API operation: ${operationId}`);
+  }
+  return selected;
+}

src/contracts/errors.js

@@ -0,0 +1,240 @@
+const DROP_SENSITIVE = Object.freeze([
+  "cause",
+  "body",
+  "headers",
+  "authorization",
+  "url",
+  "query",
+  "stack",
+  "storageValue",
+]);
+
+/**
+ * @typedef {{
+ *   kind: string,
+ *   defaultRetryable: boolean,
+ *   severity: string,
+ *   userMessageKey: string,
+ *   action: string,
+ *   telemetryEvent: string,
+ *   redaction: readonly string[]
+ * }} ErrorDefinition
+ */
+
+/**
+ * @param {string} kind
+ * @param {boolean} defaultRetryable
+ * @param {string} severity
+ * @param {string} action
+ * @param {string} [telemetryEvent]
+ * @returns {Readonly<ErrorDefinition>}
+ */
+const row = (
+  kind,
+  defaultRetryable,
+  severity,
+  action,
+  telemetryEvent = "api.request.failed",
+) =>
+  Object.freeze({
+    kind,
+    defaultRetryable,
+    severity,
+    userMessageKey: `error.${kind.toLowerCase()}`,
+    action,
+    telemetryEvent,
+    redaction: DROP_SENSITIVE,
+  });
+
+export const ERROR_REGISTRY = Object.freeze({
+  NETWORK_UNREACHABLE: row("NETWORK_UNREACHABLE", true, "warning", "retry"),
+  REQUEST_TIMEOUT: row("REQUEST_TIMEOUT", true, "warning", "retry"),
+  REQUEST_ABORTED: row("REQUEST_ABORTED", false, "info", "none"),
+  CONTENT_TYPE_MISMATCH: row(
+    "CONTENT_TYPE_MISMATCH",
+    false,
+    "error",
+    "contact-support",
+  ),
+  MALFORMED_JSON: row("MALFORMED_JSON", false, "error", "contact-support"),
+  ENVELOPE_MISMATCH: row("ENVELOPE_MISMATCH", false, "error", "contact-support"),
+  SCHEMA_MISMATCH: row("SCHEMA_MISMATCH", false, "error", "contact-support"),
+  AUTH_REQUIRED: row("AUTH_REQUIRED", false, "info", "reauth"),
+  AUTH_INTEGRATION_FAILURE: row(
+    "AUTH_INTEGRATION_FAILURE",
+    false,
+    "error",
+    "contact-support",
+  ),
+  FORBIDDEN: row("FORBIDDEN", false, "warning", "navigate"),
+  NOT_FOUND: row("NOT_FOUND", false, "info", "navigate"),
+  CONFLICT: row("CONFLICT", false, "warning", "retry"),
+  VALIDATION_REJECTED: row("VALIDATION_REJECTED", false, "info", "none"),
+  UNKNOWN_CLIENT_FAILURE: row(
+    "UNKNOWN_CLIENT_FAILURE",
+    false,
+    "warning",
+    "contact-support",
+  ),
+  RATE_LIMITED: row("RATE_LIMITED", true, "warning", "retry"),
+  SERVER_FAILURE: row("SERVER_FAILURE", true, "error", "retry"),
+  CHUNK_LOAD_FAILURE: row(
+    "CHUNK_LOAD_FAILURE",
+    false,
+    "error",
+    "reload-once",
+    "release.mismatch.detected",
+  ),
+  BOOT_CONFIG_FAILURE: row(
+    "BOOT_CONFIG_FAILURE",
+    false,
+    "error",
+    "contact-support",
+    "app.boot.failed",
+  ),
+  RELEASE_MANIFEST_FAILURE: row(
+    "RELEASE_MANIFEST_FAILURE",
+    false,
+    "error",
+    "contact-support",
+    "app.boot.failed",
+  ),
+  DEPLOY_MISMATCH: row(
+    "DEPLOY_MISMATCH",
+    false,
+    "error",
+    "reload-once",
+    "release.mismatch.detected",
+  ),
+  STORAGE_UNAVAILABLE: row(
+    "STORAGE_UNAVAILABLE",
+    false,
+    "warning",
+    "none",
+    "storage.operation.failed",
+  ),
+  STORAGE_QUOTA_EXCEEDED: row(
+    "STORAGE_QUOTA_EXCEEDED",
+    false,
+    "warning",
+    "none",
+    "storage.operation.failed",
+  ),
+  RENDER_FAILURE: row(
+    "RENDER_FAILURE",
+    false,
+    "error",
+    "reload-once",
+    "ui.render.failed",
+  ),
+  TELEMETRY_FAILURE: row(
+    "TELEMETRY_FAILURE",
+    false,
+    "info",
+    "none",
+    "telemetry.delivery.dropped",
+  ),
+  QUERY_CACHE_FAILURE: row(
+    "QUERY_CACHE_FAILURE",
+    false,
+    "error",
+    "retry",
+    "query.cache.failed",
+  ),
+  UNKNOWN_FAILURE: row("UNKNOWN_FAILURE", false, "error", "contact-support"),
+});
+
+/**
+ * @typedef {{
+ *   kind: string,
+ *   code: string,
+ *   httpStatus?: number,
+ *   retryable: boolean,
+ *   operationId: string,
+ *   attemptCount: number,
+ *   requestId?: string,
+ *   traceId?: string,
+ *   retryAfterMs?: number,
+ *   userMessageKey: string,
+ *   action: string,
+ *   causeClass?: string
+ * }} ApiFailure
+ */
+
+/**
+ * @param {string} kind
+ * @param {string} operationId
+ * @param {number} attempt
+ * @param {{
+ *   code?: string,
+ *   httpStatus?: number,
+ *   requestId?: string,
+ *   traceId?: string,
+ *   retryAfterMs?: number,
+ *   causeClass?: string
+ * }} [details]
+ * @returns {ApiFailure}
+ */
+export function createFailure(kind, operationId, attempt, details = {}) {
+  const registry =
+    /** @type {Readonly<Record<string, Readonly<ErrorDefinition>>>} */ (
+      ERROR_REGISTRY
+    );
+  const definition =
+    registry[kind] ?? ERROR_REGISTRY.UNKNOWN_FAILURE;
+  return Object.freeze({
+    kind: definition.kind,
+    code: typeof details.code === "string" ? details.code : definition.kind,
+    retryable: definition.defaultRetryable,
+    operationId,
+    attemptCount: Math.max(1, attempt + 1),
+    ...(Number.isInteger(details.httpStatus)
+      ? { httpStatus: details.httpStatus }
+      : {}),
+    ...(typeof details.requestId === "string" ? { requestId: details.requestId } : {}),
+    ...(typeof details.traceId === "string" ? { traceId: details.traceId } : {}),
+    ...(typeof details.retryAfterMs === "number"
+      ? { retryAfterMs: details.retryAfterMs }
+      : {}),
+    ...(typeof details.causeClass === "string"
+      ? { causeClass: details.causeClass }
+      : {}),
+    userMessageKey: definition.userMessageKey,
+    action: definition.action,
+  });
+}
+
+/** @param {number} status */
+export function kindForStatus(status) {
+  if (status === 401) return "AUTH_REQUIRED";
+  if (status === 403) return "FORBIDDEN";
+  if (status === 404) return "NOT_FOUND";
+  if (status === 409) return "CONFLICT";
+  if (status === 422) return "VALIDATION_REJECTED";
+  if (status === 429) return "RATE_LIMITED";
+  if (status >= 500) return "SERVER_FAILURE";
+  if (status >= 400) return "UNKNOWN_CLIENT_FAILURE";
+  return "ENVELOPE_MISMATCH";
+}
+
+/**
+ * Total catch-all that intentionally discards the thrown value.
+ *
+ * @param {unknown} value
+ * @param {{ operationId?: string, attempt?: number }} [context]
+ */
+export function normalizeUnknownFailure(value, context = {}) {
+  const causeClass =
+    value instanceof Error
+      ? value.name
+      : value === null
+        ? "null"
+        : typeof value;
+
+  return createFailure(
+    "UNKNOWN_FAILURE",
+    context.operationId ?? "UNKNOWN_OPERATION",
+    context.attempt ?? 0,
+    { code: "UNKNOWN_FAILURE", causeClass },
+  );
+}

tests/integration/auth-recovery.test.js

@@ -0,0 +1,103 @@
+import { HttpResponse, http } from "msw";
+import { setupServer } from "msw/node";
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+import { createExternalAuthSessionAdapter } from "../../src/adapters/auth/external-session-adapter.js";
+import { createHttpClient } from "../../src/adapters/http/client.js";
+
+let responseStatuses = [];
+const server = setupServer(
+  http.get("https://api.test/api/sample/resources", () => {
+    const status = responseStatuses.shift() ?? 200;
+    if (status === 401) {
+      return HttpResponse.json(
+        {
+          success: false,
+          error: { code: "UNAUTHENTICATED" },
+          meta: { requestId: "request-1", traceId: "trace-1" },
+        },
+        { status },
+      );
+    }
+    return HttpResponse.json({
+      success: true,
+      data: [{ id: "resource-1", name: "Example" }],
+      meta: { requestId: "request-2", traceId: "trace-1" },
+    });
+  }),
+);
+
+beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
+afterEach(() => {
+  responseStatuses = [];
+  server.resetHandlers();
+});
+afterAll(() => server.close());
+
+const clock = { now: () => 0, sleep: async () => {} };
+
+describe("bounded 401 session recovery", () => {
+  it("calls recovery once and replays a safe request once", async () => {
+    responseStatuses = [401, 200];
+    const recoverSession = vi.fn(async () => "restored");
+    const authSession = createExternalAuthSessionAdapter({
+      readState: () => "authenticated",
+      attachCredential: async (request) => request,
+      recoverSession,
+      notifyUnauthenticated: vi.fn(),
+    });
+    const client = createHttpClient({
+      baseUrl: "https://api.test",
+      authSession,
+      clock,
+    });
+
+    await expect(client.execute("LIST_SAMPLE_RESOURCES")).resolves.toMatchObject({
+      ok: true,
+    });
+    expect(recoverSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("stops after a second 401 and notifies unauthenticated once", async () => {
+    responseStatuses = [401, 401];
+    const notifyUnauthenticated = vi.fn();
+    const authSession = createExternalAuthSessionAdapter({
+      readState: () => "authenticated",
+      attachCredential: async (request) => request,
+      recoverSession: async () => "restored",
+      notifyUnauthenticated,
+    });
+    const client = createHttpClient({
+      baseUrl: "https://api.test",
+      authSession,
+      clock,
+    });
+
+    await expect(client.execute("LIST_SAMPLE_RESOURCES")).resolves.toMatchObject({
+      ok: false,
+      error: { kind: "AUTH_REQUIRED" },
+    });
+    expect(notifyUnauthenticated).toHaveBeenCalledTimes(1);
+  });
+
+  it("normalizes attach and invalid recovery failures", async () => {
+    const attachFailure = createExternalAuthSessionAdapter({
+      readState: () => "authenticated",
+      attachCredential: async () => {
+        throw new Error("credential detail");
+      },
+      recoverSession: async () => "restored",
+      notifyUnauthenticated: vi.fn(),
+    });
+    const client = createHttpClient({
+      baseUrl: "https://api.test",
+      authSession: attachFailure,
+      clock,
+    });
+
+    await expect(client.execute("LIST_SAMPLE_RESOURCES")).resolves.toMatchObject({
+      ok: false,
+      error: { kind: "AUTH_INTEGRATION_FAILURE" },
+    });
+  });
+});

tests/integration/http-client.test.js

@@ -0,0 +1,102 @@
+import { HttpResponse, http } from "msw";
+import { setupServer } from "msw/node";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+
+import { createHttpClient } from "../../src/adapters/http/client.js";
+
+let attempts = 0;
+const server = setupServer(
+  http.get("https://api.test/api/sample/resources", () => {
+    attempts += 1;
+    if (attempts < 3) {
+      return HttpResponse.json(
+        { success: false, error: { code: "TEMPORARY" } },
+        { status: 503 },
+      );
+    }
+    return HttpResponse.json({
+      success: true,
+      data: [{ id: "resource-1", name: "Example" }],
+      meta: { requestId: "request-1", traceId: "trace-1" },
+    });
+  }),
+);
+
+beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
+afterEach(() => {
+  attempts = 0;
+  server.resetHandlers();
+});
+afterAll(() => server.close());
+
+const clock = {
+  now: () => 0,
+  sleep: async () => {},
+};
+
+describe("shared HTTP client", () => {
+  it("retries a safe request at most twice and returns validated data", async () => {
+    const client = createHttpClient({
+      baseUrl: "https://api.test",
+      clock,
+      random: () => 0,
+    });
+
+    await expect(
+      client.execute("LIST_SAMPLE_RESOURCES", { routeId: "SAMPLE_RESOURCE_LIST" }),
+    ).resolves.toMatchObject({
+      ok: true,
+      value: [{ id: "resource-1" }],
+      meta: { requestId: "request-1" },
+    });
+    expect(attempts).toBe(3);
+  });
+
+  it("rejects a non-JSON response without exposing its body", async () => {
+    server.use(
+      http.get(
+        "https://api.test/api/sample/resources",
+        () => new HttpResponse("<secret>raw body</secret>", { status: 502 }),
+      ),
+    );
+    const client = createHttpClient({ baseUrl: "https://api.test", clock });
+    const result = await client.execute("LIST_SAMPLE_RESOURCES");
+
+    expect(result).toMatchObject({
+      ok: false,
+      error: { kind: "CONTENT_TYPE_MISMATCH" },
+    });
+    expect(JSON.stringify(result)).not.toContain("raw body");
+  });
+
+  it("classifies malformed JSON and invalid payloads at the boundary", async () => {
+    server.use(
+      http.get(
+        "https://api.test/api/sample/resources",
+        () =>
+          new HttpResponse("{", {
+            headers: { "Content-Type": "application/json" },
+          }),
+      ),
+    );
+    const client = createHttpClient({ baseUrl: "https://api.test", clock });
+    await expect(client.execute("LIST_SAMPLE_RESOURCES")).resolves.toMatchObject({
+      ok: false,
+      error: { kind: "MALFORMED_JSON" },
+    });
+
+    server.use(
+      http.get("https://api.test/api/sample/resources", () =>
+        HttpResponse.json({
+          success: true,
+          data: [{ id: "resource-1", name: 42 }],
+          meta: { requestId: "request-1", traceId: "trace-1" },
+        }),
+      ),
+    );
+    await expect(client.execute("LIST_SAMPLE_RESOURCES")).resolves.toMatchObject({
+      ok: false,
+      error: { kind: "SCHEMA_MISMATCH" },
+    });
+  });
+});

tests/runtime-schema/http-schema.test.js

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  validateEnvelope,
+  validateOperationPayload,
+  validateOperationRequest,
+} from "../../src/adapters/http/schema-registry.js";
+
+describe("HTTP runtime schema boundary", () => {
+  it("rejects an invalid top-level envelope", () => {
+    expect(validateEnvelope({ success: true }).success).toBe(false);
+  });
+
+  it("rejects an invalid operation payload with safe issue metadata", () => {
+    const result = validateOperationPayload("SampleResourceListPayload", [
+      { id: "resource-1", name: 42 },
+    ]);
+
+    expect(result).toMatchObject({
+      success: false,
+      issues: [{ path: "0.name" }],
+    });
+    expect(JSON.stringify(result)).not.toContain("resource-1");
+  });
+
+  it("returns a deep-cloned additive-tolerant payload", () => {
+    const source = [{ id: "resource-1", name: "Example", additive: "accepted" }];
+    const result = validateOperationPayload("SampleResourceListPayload", source);
+
+    expect(result).toMatchObject({
+      success: true,
+      data: [{ id: "resource-1", additive: "accepted" }],
+    });
+    expect(result.data).not.toBe(source);
+  });
+
+  it("validates outbound commands before transport", () => {
+    expect(
+      validateOperationRequest("CreateSampleResourceCommand", { name: "" }).success,
+    ).toBe(false);
+    expect(
+      validateOperationRequest("CreateSampleResourceCommand", { name: "Example" })
+        .success,
+    ).toBe(true);
+  });
+
+  it("fails closed for an unregistered schema", () => {
+    expect(validateOperationPayload("UnknownPayload", {})).toMatchObject({
+      success: false,
+      issues: [{ code: "SCHEMA_NOT_REGISTERED" }],
+    });
+  });
+});

tests/unit/auth-session-adapter.test.js

@@ -0,0 +1,44 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  createAnonymousSessionAdapter,
+  createExternalAuthSessionAdapter,
+} from "../../src/adapters/auth/external-session-adapter.js";
+
+describe("external AuthSessionPort adapter", () => {
+  it("attaches opaque credentials without exposing a token-shaped session", async () => {
+    const adapter = createExternalAuthSessionAdapter({
+      readState: () => "authenticated",
+      attachCredential: async (request) => {
+        const headers = new Headers(request.headers);
+        headers.set("X-Session-Attached", "true");
+        return new Request(request, { headers });
+      },
+      recoverSession: async () => "restored",
+      notifyUnauthenticated: vi.fn(),
+    });
+
+    const request = await adapter.attach(new Request("https://api.test/resource"));
+    expect(request.headers.get("X-Session-Attached")).toBe("true");
+    expect(adapter.getState()).toBe("authenticated");
+    expect(adapter).not.toHaveProperty("accessToken");
+    expect(adapter).not.toHaveProperty("refreshToken");
+  });
+
+  it("fails invalid recovery states closed", async () => {
+    const adapter = createExternalAuthSessionAdapter({
+      readState: () => "authenticated",
+      attachCredential: async (request) => request,
+      recoverSession: async () => "unexpected",
+      notifyUnauthenticated: vi.fn(),
+    });
+
+    await expect(adapter.recover()).rejects.toThrow("invalid recovery state");
+  });
+
+  it("provides a safe anonymous adapter", async () => {
+    const adapter = createAnonymousSessionAdapter();
+    expect(adapter.getState()).toBe("unauthenticated");
+    await expect(adapter.recover()).resolves.toBe("no-session");
+  });
+});

tests/unit/error-classification.test.js

@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  ERROR_REGISTRY,
+  createFailure,
+  kindForStatus,
+  normalizeUnknownFailure,
+} from "../../src/contracts/errors.js";
+
+describe("frontend failure classification", () => {
+  it("defines all 26 stable error kinds with the seven contract fields", () => {
+    expect(Object.keys(ERROR_REGISTRY)).toHaveLength(26);
+    for (const definition of Object.values(ERROR_REGISTRY)) {
+      expect(definition).toEqual(
+        expect.objectContaining({
+          kind: expect.any(String),
+          defaultRetryable: expect.any(Boolean),
+          severity: expect.any(String),
+          userMessageKey: expect.any(String),
+          action: expect.any(String),
+          telemetryEvent: expect.any(String),
+          redaction: expect.any(Array),
+        }),
+      );
+    }
+  });
+
+  it.each([
+    [401, "AUTH_REQUIRED"],
+    [403, "FORBIDDEN"],
+    [404, "NOT_FOUND"],
+    [409, "CONFLICT"],
+    [422, "VALIDATION_REJECTED"],
+    [418, "UNKNOWN_CLIENT_FAILURE"],
+    [429, "RATE_LIMITED"],
+    [503, "SERVER_FAILURE"],
+  ])("maps HTTP %i to %s", (status, kind) => {
+    expect(kindForStatus(status)).toBe(kind);
+  });
+
+  it("projects only allowlisted safe fields", () => {
+    const result = createFailure("SERVER_FAILURE", "LIST_SAMPLE_RESOURCES", 0, {
+      code: "TEMPORARY",
+      httpStatus: 503,
+      requestId: "request-1",
+      stack: "must not leak",
+      body: "must not leak",
+      authorization: "Bearer secret",
+    });
+
+    expect(result).toMatchObject({
+      kind: "SERVER_FAILURE",
+      code: "TEMPORARY",
+      httpStatus: 503,
+      requestId: "request-1",
+    });
+    expect(JSON.stringify(result)).not.toMatch(/stack|body|Bearer|secret/);
+  });
+
+  it("normalizes any thrown value without leaking it", () => {
+    const secret = { token: "sensitive", nested: { rawBody: "private" } };
+    const result = normalizeUnknownFailure(secret);
+
+    expect(result).toMatchObject({
+      kind: "UNKNOWN_FAILURE",
+      causeClass: "object",
+    });
+    expect(JSON.stringify(result)).not.toMatch(/sensitive|private|token|rawBody/);
+  });
+});

tests/unit/retry-policy.test.js

@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  calculateBackoff,
+  parseRetryAfter,
+  retryDelay,
+  shouldRetry,
+} from "../../src/adapters/http/retry-policy.js";
+
+describe("HTTP retry policy", () => {
+  it("uses capped exponential full jitter", () => {
+    expect(calculateBackoff(0, () => 0.5)).toBe(125);
+    expect(calculateBackoff(8, () => 1)).toBe(2_000);
+  });
+
+  it("parses retry-after and chooses the longer bounded delay", () => {
+    expect(parseRetryAfter("2", 0)).toBe(2_000);
+    expect(retryDelay({ kind: "RATE_LIMITED", retryAfterMs: 500 }, 0, () => 0)).toBe(
+      500,
+    );
+  });
+
+  it("allows at most two retries for safe or keyed requests", () => {
+    const failure = { kind: "SERVER_FAILURE" };
+    expect(shouldRetry({ idempotency: "safe" }, failure, 0)).toBe(true);
+    expect(shouldRetry({ idempotency: "keyed" }, failure, 1)).toBe(true);
+    expect(shouldRetry({ idempotency: "safe" }, failure, 2)).toBe(false);
+    expect(shouldRetry({ idempotency: "none" }, failure, 0)).toBe(false);
+    expect(
+      shouldRetry(
+        { idempotency: "safe" },
+        { kind: "SERVER_FAILURE", httpStatus: 500 },
+        0,
+      ),
+    ).toBe(false);
+  });
+
+  it("does not automatically wait beyond 30 seconds", () => {
+    expect(
+      shouldRetry(
+        { idempotency: "safe" },
+        { kind: "RATE_LIMITED", retryAfterMs: 31_000 },
+        0,
+      ),
+    ).toBe(false);
+  });
+});