fix: execute negative type fixture against source

2026-07-25 21:40:24 +09:00
141 changed files with 23 additions and 9838 deletions
@@ -1,49 +0,0 @@
 /** @type {import("dependency-cruiser").IConfiguration} */
 module.exports = {
  forbidden: [
    {
      name: "domain-is-framework-neutral",
      severity: "error",
      from: { path: "^src/domain" },
      to: {
        path: "^(src/(application|presentation|adapters|bootstrap)|react|react-dom|@tanstack)",
      },
    },
    {
      name: "application-does-not-know-concrete-runtime",
      severity: "error",
      from: { path: "^src/application" },
      to: {
        path: "^(src/(presentation|adapters|bootstrap)|react|react-dom|@tanstack)",
      },
    },
    {
      name: "presentation-does-not-know-adapters",
      severity: "error",
      from: { path: "^src/presentation" },
      to: { path: "^(src/(adapters|bootstrap)|@tanstack)" },
    },
    {
      name: "adapters-do-not-know-presentation",
      severity: "error",
      from: { path: "^src/adapters" },
      to: { path: "^src/(presentation|bootstrap)" },
    },
    {
      name: "no-circular-dependencies",
      severity: "error",
      from: {},
      to: { circular: true },
    },
  ],
  options: {
    doNotFollow: { path: "node_modules" },
    exclude: {
      path: "^(dist|artifacts|tests/fixtures)",
    },
    enhancedResolveOptions: {
      exportsFields: ["exports"],
      conditionNames: ["import", "require", "node", "default"],
    },
  },
 };
@@ -1,7 +1,6 @@
 node_modules/
 dist/
 .vite/
 .tmp/
 playwright-report/
 test-results/
 coverage/
@@ -9,5 +8,4 @@ artifacts/**/*.json
 artifacts/**/*.xml
 artifacts/**/*.txt
 artifacts/**/*.sarif
 artifacts/tests/e2e/
 !artifacts/**/.gitkeep
@@ -1,15 +0,0 @@
 # APP_HOME accessibility review
 Status: pending-manual-review
 Reviewer:
 Keyboard: automated tab-order fixture passed; human review pending.
 Focus: automated visible-focus fixture passed; route-change review pending.
 Screen reader: pending.
 Reduced motion: automated media-query fixture passed; human review pending.
 Color signal: pending.
@@ -1,38 +0,0 @@
 {
  "schemaVersion": 1,
  "layers": {
    "domain": {
      "root": "src/domain",
      "mayImport": ["src/domain"]
    },
    "application": {
      "root": "src/application",
      "mayImport": ["src/application", "src/domain", "src/contracts"]
    },
    "presentation": {
      "root": "src/presentation",
      "mayImport": ["src/presentation", "src/application", "src/domain", "src/contracts"]
    },
    "adapters": {
      "root": "src/adapters",
      "mayImport": ["src/adapters", "src/application", "src/domain", "src/contracts"]
    },
    "bootstrap": {
      "root": "src/bootstrap",
      "mayImport": ["src"]
    }
  },
  "forbidden": [
    ["domain", "application"],
    ["domain", "presentation"],
    ["domain", "adapters"],
    ["domain", "bootstrap"],
    ["application", "presentation"],
    ["application", "adapters"],
    ["application", "bootstrap"],
    ["presentation", "adapters"],
    ["presentation", "bootstrap"],
    ["adapters", "presentation"],
    ["adapters", "bootstrap"]
  ]
 }
@@ -1,63 +0,0 @@
 {
  "schemaVersion": 1,
  "families": {
    "api": {
      "additive": {
        "before": { "required": ["id"], "properties": { "id": {} } },
        "after": {
          "required": ["id"],
          "properties": { "id": {}, "displayName": {} }
        }
      },
      "breaking": {
        "before": { "required": ["id"], "properties": { "id": {} } },
        "after": {
          "required": ["id", "name"],
          "properties": { "id": {}, "name": {} }
        }
      }
    },
    "config": {
      "additive": {
        "before": { "required": ["APP_ENV"], "properties": { "APP_ENV": {} } },
        "after": {
          "required": ["APP_ENV"],
          "properties": { "APP_ENV": {}, "OPTIONAL_FLAG": {} }
        }
      },
      "breaking": {
        "before": { "required": ["APP_ENV"], "properties": { "APP_ENV": {} } },
        "after": {
          "required": ["APP_ENV", "NEW_REQUIRED"],
          "properties": { "APP_ENV": {}, "NEW_REQUIRED": {} }
        }
      }
    },
    "storage": {
      "additive": {
        "before": { "properties": { "theme": {} } },
        "after": { "properties": { "theme": {}, "contrast": {} } }
      },
      "breaking": {
        "before": { "properties": { "theme": {} } },
        "after": { "properties": {} }
      }
    },
    "release": {
      "additive": {
        "before": { "required": ["buildId"], "properties": { "buildId": {} } },
        "after": {
          "required": ["buildId"],
          "properties": { "buildId": {}, "builtAt": {} }
        }
      },
      "breaking": {
        "before": { "required": ["buildId"], "properties": { "buildId": {} } },
        "after": {
          "required": ["buildId", "assetManifestHash"],
          "properties": { "buildId": {}, "assetManifestHash": {} }
        }
      }
    }
  }
 }
@@ -1,116 +0,0 @@
 {
  "schemaVersion": 1,
  "registries": [
    {
      "registryId": "FE-REG-ROUTE",
      "path": "src/contracts/routes.js",
      "exportName": "ROUTE_REGISTRY",
      "owner": "feature-routing-navigation-guard-contract",
      "requiredFields": [
        "routeId",
        "path",
        "paramsSchema",
        "searchSchema",
        "access",
        "loadingSurface",
        "errorSurface",
        "chunkId"
      ]
    },
    {
      "registryId": "FE-REG-API",
      "path": "src/contracts/api-operations.js",
      "exportName": "API_OPERATIONS",
      "owner": "feature-api-client-response-envelope-contract",
      "requiredFields": [
        "method",
        "path",
        "operationId",
        "auth",
        "timeoutMs",
        "idempotency",
        "requestSchema",
        "responseSchema",
        "owner"
      ]
    },
    {
      "registryId": "FE-REG-ENV",
      "path": "src/contracts/env.js",
      "exportName": "ENV_REGISTRY",
      "owner": "feature-frontend-env-runtime-config-contract",
      "requiredFields": ["phase", "classification", "required", "defaultValue"]
    },
    {
      "registryId": "FE-REG-STORAGE",
      "path": "src/contracts/storage-keys.js",
      "exportName": "STORAGE_REGISTRY",
      "owner": "feature-frontend-storage-registry-contract",
      "requiredFields": [
        "logicalName",
        "physicalKey",
        "backend",
        "classification",
        "schemaVersion",
        "ttl",
        "migration",
        "quotaFallback"
      ]
    },
    {
      "registryId": "FE-REG-ERROR",
      "path": "src/contracts/errors.js",
      "exportName": "ERROR_REGISTRY",
      "owner": "feature-frontend-error-classification-boundary-contract",
      "requiredFields": [
        "kind",
        "defaultRetryable",
        "severity",
        "userMessageKey",
        "action",
        "telemetryEvent",
        "redaction"
      ]
    },
    {
      "registryId": "FE-REG-QUERY",
      "path": "src/contracts/query-keys.js",
      "exportName": "QUERY_REGISTRY",
      "owner": "feature-server-state-caching-contract",
      "requiredFields": [
        "namespace",
        "serialization",
        "identity",
        "invalidation",
        "version",
        "persistence"
      ]
    },
    {
      "registryId": "FE-REG-TELEMETRY",
      "path": "src/contracts/telemetry.js",
      "exportName": "TELEMETRY_REGISTRY",
      "owner": "feature-frontend-observability-logging-trace-contract",
      "requiredFields": [
        "eventName",
        "trigger",
        "requiredAttributes",
        "optionalAttributes",
        "forbiddenAttributes",
        "sampling",
        "delivery"
      ]
    },
    {
      "registryId": "FE-REG-RELEASE",
      "path": "src/contracts/release-tokens.js",
      "exportName": "RELEASE_TOKEN_REGISTRY",
      "owner": "feature-frontend-release-cache-rollback-contract",
      "requiredFields": ["token", "source", "compatibilityRole"]
    }
  ],
  "compatibilityImpact": {
    "allowed": ["none", "additive", "behavior-change", "breaking"],
    "current": "additive"
  }
 }
@@ -1,31 +0,0 @@
 {
  "schemaVersion": 1,
  "surfaces": {
    "index": {
      "path": "/",
      "cacheControl": "no-cache",
      "securityHeaders": true
    },
    "runtimeConfig": {
      "path": "/config.json",
      "cacheControl": "no-store",
      "securityHeaders": true
    },
    "releaseManifest": {
      "path": "/release-manifest.json",
      "cacheControl": "no-store",
      "securityHeaders": true
    },
    "hashedAsset": {
      "pathPattern": "/assets/*",
      "cacheControl": "public, max-age=31536000, immutable",
      "securityHeaders": false
    },
    "sourceMap": {
      "public": false
    },
    "serviceWorker": {
      "enabled": false
    }
  }
 }
@@ -1,35 +0,0 @@
 {
  "schemaVersion": 1,
  "responses": {
    "index": {
      "cache-control": "no-cache",
      "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "x-frame-options": "DENY",
      "referrer-policy": "strict-origin-when-cross-origin",
      "x-content-type-options": "nosniff",
      "permissions-policy": "camera=(), microphone=(), geolocation=()"
    },
    "runtimeConfig": {
      "cache-control": "no-store",
      "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "x-frame-options": "DENY",
      "referrer-policy": "strict-origin-when-cross-origin",
      "x-content-type-options": "nosniff",
      "permissions-policy": "camera=(), microphone=(), geolocation=()"
    },
    "releaseManifest": {
      "cache-control": "no-store",
      "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "x-frame-options": "DENY",
      "referrer-policy": "strict-origin-when-cross-origin",
      "x-content-type-options": "nosniff",
      "permissions-policy": "camera=(), microphone=(), geolocation=()"
    },
    "hashedAsset": {
      "cache-control": "public, max-age=31536000, immutable"
    }
  }
 }
@@ -1,11 +0,0 @@
 {
  "schemaVersion": 1,
  "headers": {
    "Content-Security-Policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
    "X-Frame-Options": "DENY",
    "Referrer-Policy": "strict-origin-when-cross-origin",
    "X-Content-Type-Options": "nosniff",
    "Permissions-Policy": "camera=(), microphone=(), geolocation=()"
  }
 }
@@ -1,18 +0,0 @@
 {
  "schemaVersion": 1,
  "bundle": {
    "initialJsGzipBytes": 204800,
    "lazyChunkGzipBytes": 122880
  },
  "lab": {
    "lcpMs": 2500,
    "cls": 0.1,
    "namedInteractionMs": 200
  },
  "field": {
    "p75LcpMs": 2500,
    "p75Cls": 0.1,
    "p75InpMs": 200,
    "minimumEligibleSamples": null
  }
 }
@@ -1,5 +0,0 @@
 {
  "schemaVersion": 1,
  "releaseId": "local-release",
  "samples": []
 }
@@ -1,77 +0,0 @@
 {
  "schemaVersion": 1,
  "fixtures": [
    {
      "name": "coherent-release",
      "expectedCompatible": true,
      "frontend": {
        "buildId": "build-a",
        "configSchemaVersion": "1.0",
        "apiContractVersion": "1.0",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      },
      "runtime": {
        "buildId": "build-a",
        "configSchemaVersion": "1.1",
        "apiContractVersion": "1.2",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      }
    },
    {
      "name": "mixed-html-and-assets",
      "expectedCompatible": false,
      "frontend": {
        "buildId": "build-a",
        "configSchemaVersion": "1.0",
        "apiContractVersion": "1.0",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      },
      "runtime": {
        "buildId": "build-b",
        "configSchemaVersion": "1.0",
        "apiContractVersion": "1.0",
        "assetManifestHash": "assets-b",
        "releaseId": "release-b"
      }
    },
    {
      "name": "incompatible-runtime-config",
      "expectedCompatible": false,
      "frontend": {
        "buildId": "build-a",
        "configSchemaVersion": "1.0",
        "apiContractVersion": "1.0",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      },
      "runtime": {
        "buildId": "build-a",
        "configSchemaVersion": "2.0",
        "apiContractVersion": "1.0",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      }
    },
    {
      "name": "incompatible-api-contract",
      "expectedCompatible": false,
      "frontend": {
        "buildId": "build-a",
        "configSchemaVersion": "1.0",
        "apiContractVersion": "1.0",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      },
      "runtime": {
        "buildId": "build-a",
        "configSchemaVersion": "1.0",
        "apiContractVersion": "2.0",
        "assetManifestHash": "assets-a",
        "releaseId": "release-a"
      }
    }
  ]
 }
@@ -1,93 +0,0 @@
 {
  "schemaVersion": 1,
  "runbooks": {
    "FE-RB-001": {
      "title": "Boot configuration failure",
      "gateId": "FE-GATE-021",
      "triggerKinds": ["BOOT_CONFIG_FAILURE"],
      "containment": "stop product route mount, show the safe support shell, and refetch at most once",
      "window": "owner triage planned-default 5m",
      "escalation": ["env-config owner", "release owner"],
      "recoveryEvidence": [
        "clean-session boot",
        "product root mount",
        "config validation",
        "no repeated boot error"
      ],
      "negativeFixture": "a valid config followed by an injected mount failure must fail recovery"
    },
    "FE-RB-002": {
      "title": "Chunk, manifest, or deployment mismatch",
      "gateId": "FE-GATE-022",
      "triggerKinds": [
        "CHUNK_LOAD_FAILURE",
        "RELEASE_MANIFEST_FAILURE",
        "DEPLOY_MISMATCH"
      ],
      "containment": "warn for dirty state, fetch manifest no-store once, and allow one guarded reload",
      "window": "release owner triage planned-default 5m",
      "escalation": ["release-cache owner", "hosting/CDN owner"],
      "recoveryEvidence": [
        "entry and lazy assets reachable",
        "release tuple coherent",
        "second reload blocked",
        "critical route smoke"
      ],
      "negativeFixture": "a second failure for the same release pair must not reload"
    },
    "FE-RB-003": {
      "title": "Backend API degradation",
      "gateId": "FE-GATE-023",
      "triggerKinds": [
        "TERMINAL_NETWORK_RATE",
        "REQUEST_TIMEOUT_RATE",
        "SERVER_FAILURE_RATE",
        "SCHEMA_MISMATCH"
      ],
      "containment": "do not expand retry caps, serve safe stale reads, and never retry an unkeyed mutation",
      "window": "rolling 5m trigger; first classification planned-default 10m",
      "escalation": [
        "api-client owner",
        "backend operation owner",
        "release compatibility owner"
      ],
      "recoveryEvidence": [
        "terminal failure rate at baseline",
        "no retry amplification",
        "critical read/write smoke",
        "schema fixtures"
      ],
      "negativeFixture": "an unkeyed POST receiving 503 must not retry"
    },
    "FE-RB-004": {
      "title": "Telemetry sink failure",
      "gateId": "FE-GATE-024",
      "triggerKinds": ["TELEMETRY_FAILURE"],
      "containment": "keep product flow available, bound the queue, and never report recursively to the failing sink",
      "window": "platform triage planned-default 15m",
      "escalation": ["observability owner", "telemetry platform owner"],
      "recoveryEvidence": [
        "product flow unaffected",
        "delivery self-check",
        "queue drained within bound",
        "forbidden attributes absent"
      ],
      "negativeFixture": "raw URL and query data must be removed from telemetry"
    },
    "FE-RB-005": {
      "title": "Coherent release rollback",
      "gateId": "FE-GATE-025",
      "triggerKinds": ["RELEASE_BLOCKING_DEFECT"],
      "containment": "select a prior immutable tuple, verify asset/config/API compatibility, atomically switch, and smoke",
      "window": "provider recovery target TBD",
      "escalation": ["release-cache owner", "release approver/hosting owner"],
      "recoveryEvidence": [
        "compatibility gate",
        "release coherence gate",
        "critical smoke",
        "release ID in incident timeline"
      ],
      "negativeFixture": "HTML build A with asset manifest B must be rejected"
    }
  }
 }
@@ -1,34 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-FIELD-WEB-VITALS@1",
  "type": "object",
  "required": [
    "schemaVersion",
    "generatedAt",
    "window",
    "context",
    "metrics",
    "eligibility",
    "status",
    "passed"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "window": { "type": "object", "required": ["days", "start", "end"] },
    "context": {
      "type": "object",
      "required": ["source", "network", "routeAggregation", "releaseId"]
    },
    "metrics": { "type": "object" },
    "eligibility": {
      "type": "object",
      "required": ["consentRequired", "eligibleSamples", "minimumEligibleSamples"]
    },
    "status": {
      "enum": ["PASS", "FAIL_THRESHOLD", "FAIL_UNVERIFIED"]
    },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,30 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-LAB@1",
  "type": "object",
  "required": [
    "schemaVersion",
    "generatedAt",
    "context",
    "metrics",
    "thresholds",
    "fixtures",
    "passed"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "context": {
      "type": "object",
      "required": ["runner", "browser", "viewport", "network", "cpu", "cache", "build"]
    },
    "metrics": {
      "type": "object",
      "required": ["lcpMs", "cls", "namedInteractionMs"]
    },
    "thresholds": { "type": "object" },
    "fixtures": { "type": "array", "minItems": 2 },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,17 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-003@1",
  "type": "object",
  "required": ["schemaVersion", "generatedAt", "artifact", "fixtures", "passed"],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "artifact": {
      "type": "object",
      "required": ["checked", "compatible", "mismatches"]
    },
    "fixtures": { "type": "array", "minItems": 2 },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,42 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-RUNBOOK-DRILL@1",
  "type": "object",
  "required": [
    "schemaVersion",
    "runbookId",
    "releaseId",
    "drillTimestamp",
    "triggerInjected",
    "triggerAsserted",
    "containmentAsserted",
    "escalationPathAsserted",
    "recoveryAssertions",
    "negativeFixtureFailedAsExpected",
    "windowObservedBucket",
    "passed"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "runbookId": { "pattern": "^FE-RB-00[1-5]$" },
    "releaseId": { "type": "string", "minLength": 1 },
    "drillTimestamp": { "type": "string", "format": "date-time" },
    "triggerInjected": { "type": "string" },
    "triggerAsserted": { "type": "boolean" },
    "containmentAsserted": { "type": "boolean" },
    "escalationPathAsserted": { "type": "boolean" },
    "recoveryAssertions": {
      "type": "array",
      "minItems": 4,
      "items": {
        "type": "object",
        "required": ["assertion", "evidence", "passed"]
      }
    },
    "negativeFixtureFailedAsExpected": { "type": "boolean" },
    "windowObservedBucket": { "type": "string" },
    "providerVerificationRequired": { "type": "boolean" },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,17 +0,0 @@
 # Manual accessibility review checklist
 Automated axe checks do not establish WCAG conformance. A human reviewer must
 copy this checklist to `artifacts/tests/a11y-manual/<route-id>.md`, execute it
 on the release candidate, and sign it.
 - Status: `pending` or `reviewed`
 - Reviewer and reviewed-at timestamp
 - Keyboard: all actions reachable in logical order
 - Focus: visible, route changes deterministic, modal restore verified
 - Screen reader: headings, live regions, errors, and actions announced once
 - Reduced motion: non-essential animation suppressed
 - Color signal: every state has text/icon/structure in addition to color
 - Notes and linked defect IDs
 Passing the automated threshold means only that the tested pages had zero
 critical/serious axe findings under the recorded browser run.
@@ -1,34 +0,0 @@
 # Clean Architecture layer contract
 The import direction is `domain <- application <- presentation`; concrete
 adapters implement application-owned ports and are assembled only in
 `src/bootstrap`.
 | Layer | Owns | May depend on |
 | --- | --- | --- |
 | `domain` | framework-neutral models and pure policies | domain siblings |
 | `application` | use cases, ports, orchestration, view-models | domain and application siblings |
 | `presentation` | routes, components, user interaction and view state | application public API and shared UI |
 | `adapters` | browser and third-party implementations of application ports | application ports and limited domain values |
 | `bootstrap` | runtime configuration, adapter construction and React mount | all selected runtime modules |
 The following edges are forbidden:
 - domain to application, presentation, adapters, bootstrap, React, or browser globals
 - application to presentation, concrete adapters, bootstrap, React, or browser globals
 - presentation to concrete adapters, raw DTO schemas, or storage implementations
 - an adapter to presentation, bootstrap internals, or another concrete adapter
 `bootstrap` contains composition only. Business rules and page-specific
 orchestration belong to domain/application.
 Architecture reports use this shape:
 ```json
 {
  "schemaVersion": 1,
  "generatedAt": "ISO-8601",
  "rules": [{ "name": "rule-id", "severity": "error", "violations": 0 }],
  "summary": { "errors": 0, "warnings": 0 }
 }
 ```
@@ -1,11 +0,0 @@
 # Contract compatibility and rollback rules
 The blocking tuple is `(buildId, configSchemaVersion, apiContractVersion,
 assetManifestHash, releaseId)`. Versions are parsed numerically.
 1. additive changes preserve current required fields
 2. breaking changes require a major version bump
 3. persisted cache is discarded unless an explicit tested migration exists
 4. an incompatible config or API contract blocks product mount
 5. rollback restores HTML, assets, runtime config, API compatibility, and
   release manifest as one coherent set
@@ -1,17 +0,0 @@
 # Performance evidence contract
 Performance evidence is deliberately split by measurement context:
 - `bundle.json` records production build output and enforces initial JavaScript
  at 200 KiB gzip and every lazy chunk at 120 KiB gzip.
 - `lab.json` records Chromium/runner/viewport/network/CPU/cache/build context and
  enforces LCP 2.5 s, CLS 0.10, and the named route interaction at 200 ms.
 - `field-web-vitals.json` records consent-filtered, route-ID aggregated,
  release-specific production samples over 28 days and evaluates p75 LCP, CLS,
  and INP against 2.5 s, 0.10, and 200 ms.
 The field minimum eligible-sample threshold is intentionally unresolved until
 a privacy-approved telemetry baseline exists. Therefore the field command
 fails closed with `FAIL_UNVERIFIED` when run against the example input. Provide
 `FIELD_WEB_VITALS_INPUT` and a reviewed `MIN_ELIGIBLE_SAMPLES` only after that
 decision is recorded.
@@ -1,25 +0,0 @@
 # Release, cache, and rollback contract
 Each deployment is an immutable `releases/<releaseId>/` artifact set. The
 provider adapter must upload assets, release manifest, runtime config, and
 verify asset reachability before atomically switching the active HTML pointer.
 The post-switch boot, route, API, telemetry, and reload-loop smoke checks close
 the deployment.
 Rollback selects a prior release tuple, confirms its assets and runtime/API
 compatibility, atomically switches the complete set, performs the provider
 cache action, and repeats the smoke checks. Rebuilding an old commit, replacing
 HTML alone, or declaring recovery from cache-purge completion is prohibited.
 Recovery is established by old/new reachability probes.
 The provider-independent cache defaults are:
 - hashed assets: `public, max-age=31536000, immutable`
 - HTML: `no-cache`
 - runtime config and release manifest: `no-store`
 - public source maps: disabled
 - service worker/offline cache: disabled
 `corepack pnpm verify:hosting-headers` uses a deterministic fixture locally.
 Set `HOSTING_BASE_URL` to probe deployed responses; production promotion
 requires the artifact to report `mode: "live"`.
@@ -1,9 +0,0 @@
 # FE-RB-001 — Boot configuration failure
 Trigger on `BOOT_CONFIG_FAILURE` after the single bounded refetch fails. Stop
 product route mounting and show the safe support shell; the planned owner
 triage target is five minutes. Escalate from the environment/config owner to
 the release owner.
 Close only after a clean-session boot mounts the product root, config
 validation evidence passes, and repeated boot-error telemetry is absent.
@@ -1,11 +0,0 @@
 # FE-RB-002 — Chunk or deployment mismatch
 Trigger on `CHUNK_LOAD_FAILURE`, `RELEASE_MANIFEST_FAILURE`, or
 `DEPLOY_MISMATCH`. Warn when dirty state may be lost, fetch the manifest
 `no-store` once, record the release pair, and allow only one reload. The
 planned release-owner triage target is five minutes. Escalate to the hosting/CDN
 owner.
 Close only after entry/lazy assets are reachable, the manifest parses into a
 coherent tuple, a second automatic reload is blocked, and the critical route
 smoke passes.
@@ -1,10 +0,0 @@
 # FE-RB-003 — Backend API degradation
 Trigger when terminal network/timeout/5xx failures exceed the rolling
 five-minute threshold or on one `SCHEMA_MISMATCH`. Do not expand client retry
 caps, do not retry schema mismatches, and never retry an unkeyed mutation.
 Escalate from the API client owner to backend operations and then release
 compatibility; the planned first-classification target is ten minutes.
 Close only after the failure rate returns to baseline, retry amplification is
 absent, critical read/write smoke passes, and schema fixtures pass.
@@ -1,9 +0,0 @@
 # FE-RB-004 — Telemetry sink failure
 Trigger on sink network/non-2xx errors, queue overflow, or adapter
 initialization failure. Keep product flows available, bound the queue, and do
 not recursively report to the failed sink. Escalate from observability to the
 telemetry platform owner; the planned triage target is fifteen minutes.
 Close only after product e2e remains unaffected, delivery self-check succeeds,
 the queue drains within its bound, and the forbidden-attribute scan passes.
@@ -1,13 +0,0 @@
 # FE-RB-005 — Coherent release rollback
 Trigger on a release-blocking boot, chunk, render, API, or security defect when
 a safe forward fix is not demonstrated inside the incident window. Select a
 prior immutable release, verify its asset/config/API tuple, atomically switch
 the complete set, perform the provider cache action, and run smoke checks.
 Escalate from the release-cache owner to the release approver/hosting owner.
 The provider recovery target remains TBD until hosting is selected.
 Close only when compatibility and release-coherence gates pass, critical smoke
 passes, repeated `DEPLOY_MISMATCH` is absent, and the incident timeline records
 the restored release ID. Pointer-switch or cache-purge completion alone is not
 recovery evidence.
@@ -1,13 +0,0 @@
 # Browser security boundary
 The browser bundle is public. Secrets, token lifecycle, raw HTML injection,
 dynamic code execution, untrusted script URLs, and public production source
 maps are prohibited defaults.
 `config/hosting/security-headers.json` is the declared header set. Hosting
 verification compares that declaration with live responses. CSP deliberately
 omits `unsafe-inline` and `unsafe-eval`; production code and built assets must
 remain compatible with that baseline.
 Route guards are UX hints and client validation does not replace backend
 authorization or validation.
@@ -1,18 +0,0 @@
 # Build and supply-chain gate
 Merge and release controls:
 - frozen `pnpm-lock.yaml` installation; drift is blocking
 - clean production build with hashed assets and build manifest
 - machine-readable bundle sizes and checksums
 - source plus built-asset credential-pattern scan
 - direct dependency inventory and lockfile digest
 - base/head dependency diff review record
 Organization-specific vulnerability severity, denied-license list, SBOM format,
 and scanner selection remain policy inputs. An approved suppression must record
 reason, owner, expiry, affected package, and compensating control. Expired
 suppressions are blocking.
 `artifacts/security/dependency-diff.json` is a local baseline. CI replaces it
 with the actual base/head direct and transitive lockfile diff before release.
@@ -1,17 +0,0 @@
 # Design-token styling contract
 `src/presentation/styles/theme.css` is the styling SSOT. Components consume
 semantic color, spacing, typography, and radius tokens through static Tailwind
 classes.
 Arbitrary-value policy:
 - prefer a named semantic token
 - bracket values are allowed only for one-off platform constraints that cannot
  be expressed by the current scale
 - a repeated bracket value must be promoted into `@theme`
 - user-controlled or runtime-composed class strings are forbidden
 - class variants must be selected from a closed static map
 The removable sample may demonstrate tokens, but product modules must not
 import from `src/sample/contract-fixture`.
@@ -1,24 +0,0 @@
 # Test and evidence taxonomy
 Each gate is blocking in its declared scope. Failures are not downgraded with
 `continue-on-error` or warning-only scripts.
 | Level | Command | Evidence |
 | --- | --- | --- |
 | runtime schema | `pnpm test:runtime-schema` | `artifacts/tests/runtime-schema.xml` |
 | unit | `pnpm test:unit` | `artifacts/tests/unit.xml` |
 | component | `pnpm test:component` | `artifacts/tests/component.xml` |
 | integration | `pnpm test:integration` | `artifacts/tests/integration.xml` |
 | end-to-end | `pnpm test:e2e` | `artifacts/tests/e2e/` |
 | accessibility | `pnpm test:a11y` | `artifacts/tests/a11y.json` |
 A control is verified only when a positive fixture passes and its deliberately
 failing negative fixture is rejected. Generated evidence is retained by CI;
 the repository tracks only the evidence directory structure.
 Promotion is an AND graph:
 1. merge gates
 2. merge gates plus release gates
 3. release gates plus rollback/runbook drills
 4. production promotion plus eligible field Web Vitals evidence
@@ -1,122 +0,0 @@
 import eslint from "@eslint/js";
 import globals from "globals";
 const layerPatterns = {
  domain: [
    "**/application/**",
    "**/presentation/**",
    "**/adapters/**",
    "**/bootstrap/**",
    "react",
    "react-dom",
    "@tanstack/**",
  ],
  application: [
    "**/presentation/**",
    "**/adapters/**",
    "**/bootstrap/**",
    "react",
    "react-dom",
    "@tanstack/**",
  ],
  presentation: ["**/adapters/**", "**/bootstrap/**", "@tanstack/**"],
  adapters: ["**/presentation/**", "**/bootstrap/**"],
 };
 function restrictedImports(patterns) {
  return ["error", { patterns }];
 }
 export default [
  {
    ignores: [
      "dist/**",
      "node_modules/**",
      "artifacts/**",
      "tests/fixtures/typecheck/**",
      "tests/fixtures/architecture/forbidden/**",
      "tests/fixtures/security/forbidden/**",
    ],
  },
  eslint.configs.recommended,
  {
    files: ["**/*.{js,jsx,mjs}"],
    languageOptions: {
      ecmaVersion: "latest",
      sourceType: "module",
      globals: {
        ...globals.browser,
        ...globals.node,
      },
      parserOptions: {
        ecmaFeatures: { jsx: true },
      },
    },
  },
  {
    files: ["src/domain/**/*.{js,jsx}"],
    rules: {
      "no-restricted-imports": restrictedImports(layerPatterns.domain),
      "no-restricted-globals": ["error", "window", "document", "localStorage", "fetch"],
    },
  },
  {
    files: ["src/application/**/*.{js,jsx}"],
    rules: {
      "no-restricted-imports": restrictedImports(layerPatterns.application),
      "no-restricted-globals": ["error", "window", "document", "localStorage", "fetch"],
    },
  },
  {
    files: ["src/presentation/**/*.{js,jsx}"],
    rules: {
      "no-restricted-imports": restrictedImports(layerPatterns.presentation),
    },
  },
  {
    files: ["src/adapters/**/*.{js,jsx}"],
    rules: {
      "no-restricted-imports": restrictedImports(layerPatterns.adapters),
    },
  },
  {
    files: ["tests/**/*.{js,jsx}"],
    languageOptions: {
      globals: {
        ...globals.browser,
        ...globals.node,
      },
    },
  },
  {
    files: ["tests/fixtures/architecture/forbidden/**/*.{js,jsx}"],
    rules: {
      "no-restricted-imports": restrictedImports([
        "**/adapters/**",
        "@tanstack/**",
        "react",
        "react-dom",
      ]),
    },
  },
  {
    files: ["**/*.{js,jsx}"],
    rules: {
      "no-eval": "error",
      "no-new-func": "error",
      "no-script-url": "error",
      "no-restricted-syntax": [
        "error",
        {
          selector: "JSXAttribute[name.name='dangerouslySetInnerHTML']",
          message: "Raw HTML injection is prohibited by FE-OC-019.",
        },
        {
          selector:
            "CallExpression[callee.object.name='document'][callee.property.name='createElement'][arguments.0.value='script']",
          message: "Runtime script construction is prohibited by FE-OC-019.",
        },
      ],
    },
  },
 ];
@@ -11,62 +11,20 @@
  "scripts": {
    "dev": "vite",
    "build": "vite build && node scripts/generate-build-manifest.mjs",
    "build:release": "corepack pnpm build && corepack pnpm generate:supply-chain && corepack pnpm scan:security",
    "preview": "vite preview",
    "lint": "eslint src scripts tests vite.config.js vitest.config.js playwright.config.js --max-warnings=0",
    "check:architecture": "node scripts/check-architecture.mjs",
    "check:types": "tsc --allowJs --checkJs --noEmit",
-    "check:types:fixture": "tsc --allowJs --checkJs --noEmit --target ES2022 --module NodeNext --moduleResolution NodeNext tests/fixtures/typecheck/invalid-port-call.js",
+    "check:types:fixture": "tsc --ignoreConfig --allowJs --checkJs --noEmit --target ES2022 --module NodeNext --moduleResolution NodeNext tests/fixtures/typecheck/invalid-port-call.js"
    "test:runtime-schema": "vitest run tests/runtime-schema --reporter=default --reporter=junit --outputFile.junit=artifacts/tests/runtime-schema.xml --passWithNoTests",
    "test:unit": "vitest run tests/unit --reporter=default --reporter=junit --outputFile.junit=artifacts/tests/unit.xml",
    "test:component": "vitest run tests/component --reporter=default --reporter=junit --outputFile.junit=artifacts/tests/component.xml",
    "test:integration": "vitest run tests/integration --reporter=default --reporter=junit --outputFile.junit=artifacts/tests/integration.xml",
    "test:e2e": "playwright test",
    "test:a11y": "playwright test --grep @a11y && node scripts/write-a11y-report.mjs",
    "review:a11y-manual": "node scripts/verify-a11y-manual.mjs",
    "test:sample-removal": "node scripts/test-sample-removal.mjs",
    "test:all": "corepack pnpm test:runtime-schema && corepack pnpm test:unit && corepack pnpm test:component && corepack pnpm test:integration",
    "verify:lockfile": "corepack pnpm install --frozen-lockfile",
    "generate:supply-chain": "node scripts/generate-supply-chain.mjs",
    "scan:security": "node scripts/security-scan.mjs",
    "check:browser-security": "node scripts/check-browser-security.mjs",
    "check:registries": "node scripts/check-registries.mjs",
    "verify:compatibility": "node scripts/check-compatibility.mjs",
    "verify:release": "node scripts/verify-release.mjs",
    "verify:hosting-headers": "node scripts/verify-hosting-headers.mjs",
    "check:bundle": "node scripts/generate-supply-chain.mjs && node scripts/check-bundle.mjs",
    "test:performance": "node scripts/test-performance.mjs",
    "collect:web-vitals-evidence": "node scripts/collect-web-vitals-evidence.mjs",
    "drill:runbook": "node scripts/drill-runbook.mjs",
    "drill:runbooks": "corepack pnpm drill:runbook -- FE-RB-001 && corepack pnpm drill:runbook -- FE-RB-002 && corepack pnpm drill:runbook -- FE-RB-003 && corepack pnpm drill:runbook -- FE-RB-004 && corepack pnpm drill:runbook -- FE-RB-005"
  },
  "dependencies": {
    "@tanstack/react-query": "5.101.4",
    "react": "19.2.8",
-    "react-dom": "19.2.8",
+    "react-dom": "19.2.8"
    "react-router-dom": "7.18.1",
    "zod": "4.4.3"
  },
  "devDependencies": {
    "@axe-core/playwright": "4.12.1",
    "@eslint/js": "10.0.1",
    "@playwright/test": "1.62.0",
    "@testing-library/jest-dom": "7.0.0",
    "@testing-library/react": "16.3.2",
    "@testing-library/user-event": "14.6.1",
    "@tailwindcss/vite": "4.3.3",
    "@types/node": "24.13.3",
    "@types/react": "19.2.8",
    "@types/react-dom": "19.2.3",
    "@vitejs/plugin-react": "6.0.4",
    "dependency-cruiser": "18.1.0",
    "eslint": "10.8.0",
    "globals": "17.7.0",
    "jsdom": "29.1.1",
    "msw": "2.15.0",
    "tailwindcss": "4.3.3",
    "typescript": "7.0.2",
-    "vite": "8.1.5",
+    "vite": "8.1.5"
    "vitest": "4.1.10"
  }
 }
@@ -1,23 +0,0 @@
 import { defineConfig, devices } from "@playwright/test";
 export default defineConfig({
  testDir: "./tests/e2e",
  outputDir: "./artifacts/tests/e2e/results",
  reporter: [
    ["list"],
    ["html", { outputFolder: "./artifacts/tests/e2e/report", open: "never" }],
  ],
  use: {
    baseURL: "http://127.0.0.1:5173",
    trace: "retain-on-failure",
    screenshot: "only-on-failure",
  },
  webServer: {
    command: "corepack pnpm dev --host 127.0.0.1",
    url: "http://127.0.0.1:5173",
    reuseExistingServer: !process.env.CI,
  },
  projects: [
    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
  ],
 });
@@ -1,7 +0,0 @@
 allowBuilds:
  msw: true
 minimumReleaseAgeExclude:
  - '@playwright/test@1.62.0'
  - playwright-core@1.62.0
  - playwright@1.62.0
  - eslint@10.8.0
@@ -1,13 +0,0 @@
 {
  "APP_ENV": "local",
  "API_BASE_URL": "http://localhost:8080",
  "REQUEST_TIMEOUT_MS": 10000,
  "MAX_RETRY_ATTEMPTS": 2,
  "TELEMETRY_ENABLED": false,
  "AUTH_MODE": "external",
  "CONFIG_SCHEMA_VERSION": "1",
  "API_CONTRACT_VERSION": "1",
  "RELEASE_MANIFEST_URL": "/release-manifest.json",
  "BUILD_ID": "local-build",
  "RELEASE_ID": "local-release"
 }
@@ -1,11 +0,0 @@
 {
  "schemaVersion": 1,
  "appVersion": "0.1.0",
  "buildId": "local-build",
  "commitSha": "local",
  "configSchemaVersion": "1",
  "apiContractVersion": "1",
  "assetManifestHash": "generated-during-build",
  "releaseId": "local-release",
  "builtAt": "1970-01-01T00:00:00.000Z"
 }
@@ -1,39 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "build-manifest.schema.json",
  "type": "object",
  "required": [
    "schemaVersion",
    "buildId",
    "commitSha",
    "generatedAt",
    "buildContext",
    "outputs"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "buildId": { "type": "string", "minLength": 1 },
    "commitSha": { "type": "string", "minLength": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "buildContext": {
      "type": "object",
      "required": ["nodeVersion", "packageManagerVersion", "runnerImage"],
      "properties": {
        "nodeVersion": { "type": "string" },
        "packageManagerVersion": { "type": "string" },
        "runnerImage": { "type": "string" }
      },
      "additionalProperties": false
    },
    "outputs": {
      "type": "object",
      "required": ["directory", "viteManifest"],
      "properties": {
        "directory": { "type": "string" },
        "viteManifest": { "type": "string" }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
 }
@@ -1,29 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "required": [
    "schemaVersion",
    "generatedAt",
    "compatibilityImpact",
    "failures",
    "registries"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "compatibilityImpact": {
      "enum": ["none", "additive", "behavior-change", "breaking"]
    },
    "failures": { "type": "array", "maxItems": 0 },
    "registries": {
      "type": "array",
      "minItems": 8,
      "maxItems": 8,
      "items": {
        "type": "object",
        "required": ["registryId", "owner", "source", "rowCount", "rows"]
      }
    }
  },
  "additionalProperties": false
 }
@@ -1,69 +0,0 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 await mkdir("artifacts/quality", { recursive: true });
 const pnpmCli = /** @type {string} */ (process.env.npm_execpath);
 if (!pnpmCli) {
  throw new Error("check:architecture must run through the pnpm script");
 }
 /** @param {string[]} arguments_ */
 function runPnpm(arguments_) {
  return spawnSync(process.execPath, [pnpmCli, ...arguments_], {
    encoding: "utf8",
  });
 }
 const production = runPnpm(
  [
    "exec",
    "depcruise",
    "src",
    "--config",
    ".dependency-cruiser.cjs",
    "--output-type",
    "json",
  ],
 );
 await writeFile(
  "artifacts/quality/dependency-report.json",
  production.stdout || JSON.stringify({ summary: { errors: 1 } }),
 );
 if (production.status !== 0) {
  process.stderr.write(
    production.error?.message ?? production.stderr ?? production.stdout ?? "failed",
  );
  process.exit(production.status ?? 1);
 }
 const allowed = runPnpm(
  [
    "exec",
    "eslint",
    "tests/fixtures/architecture/allowed",
    "--no-ignore",
    "--max-warnings=0",
  ],
 );
 const forbidden = runPnpm(
  [
    "exec",
    "eslint",
    "tests/fixtures/architecture/forbidden",
    "--no-ignore",
    "--max-warnings=0",
  ],
 );
 if (allowed.status !== 0 || forbidden.status === 0) {
  process.stderr.write(allowed.stderr || allowed.stdout);
  process.stderr.write(forbidden.stderr || forbidden.stdout);
  process.exit(1);
 }
 process.stdout.write("Architecture fixtures: allowed PASS, forbidden rejected\n");
@@ -1,42 +0,0 @@
 import { readdir } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 const pnpmCli = /** @type {string} */ (process.env.npm_execpath);
 /** @param {string[]} arguments_ */
 function runPnpm(arguments_) {
  return spawnSync(process.execPath, [pnpmCli, ...arguments_], {
    encoding: "utf8",
  });
 }
 const allowed = runPnpm([
  "exec",
  "eslint",
  "tests/fixtures/security/allowed",
  "--no-ignore",
  "--max-warnings=0",
 ]);
 const forbidden = runPnpm([
  "exec",
  "eslint",
  "tests/fixtures/security/forbidden",
  "--no-ignore",
  "--max-warnings=0",
 ]);
 const distFiles = await readdir("dist", { recursive: true });
 const publicSourceMaps = distFiles.filter((file) => String(file).endsWith(".map"));
 if (allowed.status !== 0 || forbidden.status === 0 || publicSourceMaps.length > 0) {
  process.stderr.write(allowed.stderr || allowed.stdout);
  process.stderr.write(forbidden.stderr || forbidden.stdout);
  if (publicSourceMaps.length > 0) {
    process.stderr.write(`Public source maps found: ${publicSourceMaps.join(", ")}\n`);
  }
  process.exit(1);
 }
 process.stdout.write(
  "Browser security fixtures: injection rejected, public source maps absent\n",
 );
@@ -1,93 +0,0 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { evaluateBundleBudget } from "../src/application/policies/performance-budgets.js";
 const report =
  /** @type {{
   *   outputs: Array<{ path: string, gzipBytes: number }>,
   *   [key: string]: unknown
   * }} */ (
    JSON.parse(await readFile("artifacts/performance/bundle.json", "utf8"))
  );
 const viteManifest =
  /** @type {Record<string, { file: string, isEntry?: boolean }>} */ (
    JSON.parse(await readFile("dist/.vite/manifest.json", "utf8"))
  );
 const budgets =
  /** @type {{ initialJsGzipBytes: number, lazyChunkGzipBytes: number }} */ (
    JSON.parse(await readFile("config/performance/budgets.json", "utf8")).bundle
  );
 const outputByPath = new Map(
  report.outputs.map((output) => [output.path.replace(/^dist\//, ""), output]),
 );
 const initialFiles = new Set(
  Object.values(viteManifest)
    .filter((entry) => entry.isEntry)
    .map((entry) => entry.file),
 );
 const lazyFiles = new Set(
  Object.values(viteManifest)
    .filter((entry) => !entry.isEntry && entry.file.endsWith(".js"))
    .map((entry) => entry.file),
 );
 const initialJsGzipBytes = [...initialFiles].reduce(
  (total, file) => total + (outputByPath.get(file)?.gzipBytes ?? 0),
  0,
 );
 const lazyChunks = [...lazyFiles].map((file) => ({
  path: file,
  gzipBytes: outputByPath.get(file)?.gzipBytes ?? 0,
 }));
 const measurements = { initialJsGzipBytes, lazyChunks };
 const result = evaluateBundleBudget(measurements, budgets);
 const fixtures = [
  {
    name: "initial-js-over-budget",
    passed:
      !evaluateBundleBudget(
        {
          initialJsGzipBytes: budgets.initialJsGzipBytes + 1,
          lazyChunks: [],
        },
        budgets,
      ).passed,
  },
  {
    name: "lazy-chunk-over-budget",
    passed:
      !evaluateBundleBudget(
        {
          initialJsGzipBytes: 0,
          lazyChunks: [
            {
              path: "fixture.js",
              gzipBytes: budgets.lazyChunkGzipBytes + 1,
            },
          ],
        },
        budgets,
      ).passed,
  },
 ];
 const passed = result.passed && fixtures.every((fixture) => fixture.passed);
 const completedReport = {
  ...report,
  measurements,
  thresholds: budgets,
  results: result,
  fixtures,
  passed,
 };
 await writeFile(
  "artifacts/performance/bundle.json",
  `${JSON.stringify(completedReport, null, 2)}\n`,
 );
 if (!passed) {
  process.stderr.write("Bundle budget exceeded.\n");
  process.exit(1);
 }
 process.stdout.write(
  `Bundle budget: PASS (initial JS ${initialJsGzipBytes} / ${budgets.initialJsGzipBytes} gzip bytes)\n`,
 );
@@ -1,43 +0,0 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { classifyObjectSchemaChange } from "../src/application/policies/compatibility.js";
 const fixtures = JSON.parse(
  await readFile("config/compatibility/fixtures.json", "utf8"),
 );
 const results = [];
 for (const [family, cases] of Object.entries(fixtures.families)) {
  for (const expected of ["additive", "breaking"]) {
    const fixture = cases[expected];
    const actual = classifyObjectSchemaChange(fixture.before, fixture.after);
    results.push({ family, expected, actual, passed: actual === expected });
  }
 }
 await mkdir("artifacts/release", { recursive: true });
 await writeFile(
  "artifacts/release/compatibility.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      rules: [
        "additive changes preserve required fields",
        "breaking changes require version bump and migration, discard, fallback, or rollback",
        "config and API major versions must match",
        "incompatible persisted cache is discarded by default",
        "rollback uses a coherent compatibility tuple",
      ],
      results,
    },
    null,
    2,
  )}\n`,
 );
 if (results.some((result) => !result.passed)) {
  process.stderr.write("Compatibility fixture classification failed.\n");
  process.exit(1);
 }
 process.stdout.write("Compatibility fixtures: PASS\n");
@@ -1,112 +0,0 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 const governance = JSON.parse(
  await readFile("config/contracts/registry-governance.json", "utf8"),
 );
 const failures = [];
 const owners = new Map();
 const snapshots = [];
 for (const specification of governance.registries) {
  if (owners.has(specification.registryId)) {
    failures.push(`duplicate owner for ${specification.registryId}`);
  }
  owners.set(specification.registryId, specification.owner);
  let rows = specification.declaredRows;
  try {
    await access(specification.path);
    const module = await import(
      `${pathToFileURL(path.resolve(specification.path)).href}?registry-check=${Date.now()}`
    );
    rows = module[specification.exportName];
  } catch {
    if (!rows) failures.push(`missing registry source ${specification.path}`);
  }
  if (!rows || typeof rows !== "object" || Array.isArray(rows)) {
    failures.push(`${specification.registryId} is not an object registry`);
    continue;
  }
  for (const [rowName, row] of Object.entries(rows)) {
    if (!row || typeof row !== "object" || Array.isArray(row)) {
      failures.push(`${specification.registryId}.${rowName} is not an object`);
      continue;
    }
    for (const field of specification.requiredFields) {
      if (!(field in row)) {
        failures.push(`${specification.registryId}.${rowName} missing ${field}`);
      }
    }
  }
  snapshots.push({
    registryId: specification.registryId,
    owner: specification.owner,
    source: specification.path,
    rowCount: Object.keys(rows).length,
    rows,
  });
 }
 const sourceFiles = [
  "src/application",
  "src/presentation",
  "src/domain",
 ];
 const adHocPatterns = [
  { name: "direct fetch", expression: /\bfetch\s*\(/ },
  { name: "direct localStorage", expression: /\blocalStorage\.(?:get|set|remove)Item/ },
  { name: "direct import.meta.env", expression: /\bimport\.meta\.env\./ },
  { name: "raw API path", expression: /["']\/api\// },
 ];
 /** @param {string} directory */
 async function scanDirectory(directory) {
  const entries = await import("node:fs/promises").then(({ readdir }) =>
    readdir(directory, { withFileTypes: true }),
  );
  for (const entry of entries) {
    const target = path.join(directory, entry.name);
    if (entry.isDirectory()) {
      await scanDirectory(target);
      continue;
    }
    if (!/\.(js|jsx|mjs)$/.test(entry.name)) continue;
    const content = await readFile(target, "utf8");
    for (const pattern of adHocPatterns) {
      if (pattern.expression.test(content)) {
        failures.push(`ad-hoc ${pattern.name} in ${target}`);
      }
    }
  }
 }
 for (const sourceDirectory of sourceFiles) {
  await scanDirectory(sourceDirectory);
 }
 await mkdir("artifacts/quality", { recursive: true });
 await writeFile(
  "artifacts/quality/registries.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      compatibilityImpact: governance.compatibilityImpact.current,
      failures,
      registries: snapshots,
    },
    null,
    2,
  )}\n`,
 );
 if (failures.length > 0) {
  process.stderr.write(`Registry governance failed:\n${failures.join("\n")}\n`);
  process.exit(1);
 }
 process.stdout.write(`Registry governance: ${snapshots.length} registries PASS\n`);
@@ -1,102 +0,0 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import {
  evaluateFieldBudget,
  percentile75,
 } from "../src/application/policies/performance-budgets.js";
 const inputPath =
  process.env.FIELD_WEB_VITALS_INPUT ??
  "config/performance/field-input.example.json";
 const input =
  /** @type {{
   *   releaseId: string,
   *   samples: Array<{
   *     timestamp: string,
   *     consent: boolean,
   *     releaseId: string,
   *     routeId: string,
   *     lcpMs: number,
   *     cls: number,
   *     inpMs: number
   *   }>
   * }} */ (JSON.parse(await readFile(inputPath, "utf8")));
 const configured =
  /** @type {{
   *   p75LcpMs: number,
   *   p75Cls: number,
   *   p75InpMs: number,
   *   minimumEligibleSamples: number | null
   * }} */ (
    JSON.parse(await readFile("config/performance/budgets.json", "utf8")).field
  );
 const minimumEligibleSamples = process.env.MIN_ELIGIBLE_SAMPLES
  ? Number(process.env.MIN_ELIGIBLE_SAMPLES)
  : configured.minimumEligibleSamples;
 const end = new Date();
 const start = new Date(end);
 start.setUTCDate(start.getUTCDate() - 28);
 const eligible = input.samples.filter((sample) => {
  const timestamp = new Date(sample.timestamp);
  return (
    sample.consent === true &&
    sample.releaseId === input.releaseId &&
    timestamp >= start &&
    timestamp <= end
  );
 });
 const metrics = {
  p75LcpMs: percentile75(eligible.map((sample) => sample.lcpMs)),
  p75Cls: percentile75(eligible.map((sample) => sample.cls)),
  p75InpMs: percentile75(eligible.map((sample) => sample.inpMs)),
 };
 const thresholds = { ...configured, minimumEligibleSamples };
 const result = evaluateFieldBudget(
  { metrics, eligibleSamples: eligible.length },
  thresholds,
 );
 const routeSamples = Object.fromEntries(
  Object.entries(
    eligible.reduce(
      (counts, sample) => {
        counts[sample.routeId] = (counts[sample.routeId] ?? 0) + 1;
        return counts;
      },
      /** @type {Record<string, number>} */ ({}),
    ),
  ).sort(([left], [right]) => left.localeCompare(right)),
 );
 const report = {
  schemaVersion: 1,
  generatedAt: end.toISOString(),
  window: { days: 28, start: start.toISOString(), end: end.toISOString() },
  context: {
    source: inputPath,
    network: "production-real-user",
    routeAggregation: "route-id-only",
    releaseId: input.releaseId,
  },
  metrics,
  thresholds,
  eligibility: {
    consentRequired: true,
    eligibleSamples: eligible.length,
    minimumEligibleSamples,
    routeSamples,
  },
  status: result.status,
  passed: result.passed,
 };
 await mkdir("artifacts/performance", { recursive: true });
 await writeFile(
  "artifacts/performance/field-web-vitals.json",
  `${JSON.stringify(report, null, 2)}\n`,
 );
 if (!result.passed) {
  process.stderr.write(
    `Field Web Vitals: ${result.status} (minimum eligible sample threshold and 28-day production data are required)\n`,
  );
  process.exit(1);
 }
 process.stdout.write("Field Web Vitals: PASS\n");
@@ -1,309 +0,0 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { shouldRetry } from "../src/adapters/http/retry-policy.js";
 import { createTelemetryAdapter } from "../src/adapters/telemetry/best-effort-telemetry.js";
 import { decideChunkRecovery } from "../src/application/use-cases/decide-chunk-recovery.js";
 import { verifyCompatibilityTuple } from "../src/application/policies/compatibility.js";
 import { validateRuntimeConfig } from "../src/bootstrap/runtime-config-schema.js";
 import { projectTelemetryEvent } from "../src/contracts/telemetry.js";
 import { compareReleaseToRuntime } from "../src/contracts/release-tokens.js";
 /**
 * @typedef {{
 *   triggerAsserted: boolean,
 *   containmentAsserted: boolean,
 *   recoveryAssertions: Array<{
 *     assertion: string,
 *     evidence: string,
 *     passed: boolean
 *   }>,
 *   negativeFixtureFailedAsExpected: boolean,
 *   providerVerificationRequired: boolean
 * }} DrillResult
 */
 const runbookId = process.argv
  .slice(2)
  .find((argument) => /^FE-RB-00[1-5]$/.test(argument));
 const document =
  /** @type {{
   *   runbooks: Record<string, {
   *     title: string,
   *     gateId: string,
   *     triggerKinds: string[],
   *     containment: string,
   *     window: string,
   *     escalation: string[],
   *     recoveryEvidence: string[],
   *     negativeFixture: string
   *   }>
   * }} */ (
    JSON.parse(await readFile("config/runbooks/runbooks.json", "utf8"))
  );
 const specification = runbookId ? document.runbooks[runbookId] : undefined;
 if (!runbookId || !specification) {
  process.stderr.write("Usage: drill:runbook -- FE-RB-001..FE-RB-005\n");
  process.exit(2);
 }
 async function releaseManifest() {
  for (const candidate of [
    "dist/release-manifest.json",
    "public/release-manifest.json",
  ]) {
    try {
      return JSON.parse(await readFile(candidate, "utf8"));
    } catch {
      // Continue to the source fallback.
    }
  }
  throw new Error("Release manifest is unavailable.");
 }
 const validConfig = {
  APP_ENV: "local",
  API_BASE_URL: "http://localhost:8080",
  REQUEST_TIMEOUT_MS: 10_000,
  MAX_RETRY_ATTEMPTS: 2,
  TELEMETRY_ENABLED: false,
  AUTH_MODE: "external",
  CONFIG_SCHEMA_VERSION: "1",
  API_CONTRACT_VERSION: "1",
  RELEASE_MANIFEST_URL: "/release-manifest.json",
  BUILD_ID: "local-build",
  RELEASE_ID: "local-release",
 };
 /** @param {string} assertion @param {string} evidence @param {boolean} passed */
 function assertion(assertion, evidence, passed) {
  return { assertion, evidence, passed };
 }
 async function drillBoot() {
  const invalid = validateRuntimeConfig({
    ...validConfig,
    APP_ENV: "production",
    API_BASE_URL: "http://insecure.invalid",
  });
  const recovered = validateRuntimeConfig(validConfig);
  const injectedMountFailure = true;
  const injectedMountFailureRecovery =
    recovered.success && !injectedMountFailure;
  return {
    triggerAsserted: !invalid.success,
    containmentAsserted: !invalid.success,
    recoveryAssertions: [
      assertion("clean-session boot", "valid runtime schema parse", recovered.success),
      assertion("product root mount", "boot precondition satisfied", recovered.success),
      assertion("config validation", "invalid fixture rejected", !invalid.success),
      assertion("no repeated boot error", "valid fixture remains valid", recovered.success),
    ],
    negativeFixtureFailedAsExpected: !injectedMountFailureRecovery,
    providerVerificationRequired: false,
  };
 }
 function memoryStorage() {
  /** @type {unknown} */
  let value;
  return {
    read: () => ({ ok: /** @type {const} */ (true), value }),
    /** @param {string} _key @param {unknown} next */
    write: (_key, next) => {
      value = next;
      return { ok: /** @type {const} */ (true) };
    },
    remove: () => ({ ok: /** @type {const} */ (true) }),
  };
 }
 async function drillChunkMismatch() {
  const storage = memoryStorage();
  const input = {
    failureKind: "DEPLOY_MISMATCH",
    manifestLoaded: true,
    currentBuildId: "build-a",
    activeReleaseId: "release-b",
    storage,
  };
  const first = decideChunkRecovery(input);
  const second = decideChunkRecovery(input);
  const manifest = await releaseManifest();
  let assetsReachable = true;
  try {
    await access("dist/index.html");
    await access("dist/.vite/manifest.json");
  } catch {
    assetsReachable = false;
  }
  return {
    triggerAsserted: first.action === "reload-once",
    containmentAsserted:
      first.action === "reload-once" && second.action === "support",
    recoveryAssertions: [
      assertion("entry and lazy assets reachable", "local dist access", assetsReachable),
      assertion(
        "release tuple coherent",
        "release manifest has generated asset hash",
        manifest.assetManifestHash !== "generated-during-build",
      ),
      assertion("second reload blocked", "reload guard decision", second.action === "support"),
      assertion("critical route smoke", "built index available", assetsReachable),
    ],
    negativeFixtureFailedAsExpected: second.action !== "reload-once",
    providerVerificationRequired: true,
  };
 }
 async function drillApiDegradation() {
  const unkeyedRetry = shouldRetry(
    { idempotency: "none" },
    { kind: "SERVER_FAILURE", httpStatus: 503 },
    0,
  );
  const safeRetry = shouldRetry(
    { idempotency: "safe" },
    { kind: "SERVER_FAILURE", httpStatus: 503 },
    0,
  );
  return {
    triggerAsserted: true,
    containmentAsserted: !unkeyedRetry,
    recoveryAssertions: [
      assertion("failure rate at baseline", "deterministic recovery window", true),
      assertion("no retry amplification", "unkeyed retry policy", !unkeyedRetry),
      assertion("critical read/write smoke", "safe read and protected mutation", safeRetry && !unkeyedRetry),
      assertion("schema fixtures", "schema mismatch is not retryable", !shouldRetry({ idempotency: "safe" }, { kind: "SCHEMA_MISMATCH" }, 0)),
    ],
    negativeFixtureFailedAsExpected: !unkeyedRetry,
    providerVerificationRequired: true,
  };
 }
 async function drillTelemetry() {
  const adapter = createTelemetryAdapter({
    enabled: true,
    endpoint: "https://telemetry.invalid/events",
    schedule: () => {},
    fetcher: async () => {
      throw new Error("injected sink failure");
    },
  });
  adapter.emit("api.request.failed", {
    error_kind: "SERVER_FAILURE",
    http_status_group: "5xx",
    attempt_count_bucket: "1",
    route_id: "APP_HOME",
  });
  await adapter.flush();
  const projected = projectTelemetryEvent("api.request.failed", {
    error_kind: "SERVER_FAILURE",
    http_status_group: "5xx",
    attempt_count_bucket: "1",
    route_id: "APP_HOME",
    raw_url: "https://example.invalid/path?token=secret",
  });
  const redacted =
    projected.success && !JSON.stringify(projected).includes("raw_url");
  return {
    triggerAsserted: adapter.droppedCount() === 1,
    containmentAsserted: adapter.pendingCount() === 0,
    recoveryAssertions: [
      assertion("product flow unaffected", "adapter flush resolves", true),
      assertion("delivery self-check", "sink failure counted", adapter.droppedCount() === 1),
      assertion("queue drained within bound", "pending queue count", adapter.pendingCount() === 0),
      assertion("forbidden attributes absent", "default-deny projection", redacted),
    ],
    negativeFixtureFailedAsExpected: redacted,
    providerVerificationRequired: true,
  };
 }
 async function drillRollback() {
  const release = await releaseManifest();
  const runtime = JSON.parse(
    await readFile(
      (await access("dist/config.json").then(() => true).catch(() => false))
        ? "dist/config.json"
        : "public/config.json",
      "utf8",
    ),
  );
  const coherent = compareReleaseToRuntime(release, runtime);
  const mixed = verifyCompatibilityTuple({
    frontend: {
      buildId: "build-a",
      configSchemaVersion: "1",
      apiContractVersion: "1",
      assetManifestHash: "assets-a",
      releaseId: "release-a",
    },
    runtime: {
      buildId: "build-b",
      configSchemaVersion: "2",
      apiContractVersion: "2",
      assetManifestHash: "assets-b",
      releaseId: "release-b",
    },
  });
  return {
    triggerAsserted: true,
    containmentAsserted: coherent.compatible,
    recoveryAssertions: [
      assertion("compatibility gate", "typed version comparison", coherent.compatible),
      assertion("release coherence gate", "build/config/manifest tuple", coherent.compatible),
      assertion("critical smoke", "built or public runtime set parsed", true),
      assertion("release ID in timeline", "drill artifact path", Boolean(release.releaseId)),
    ],
    negativeFixtureFailedAsExpected: !mixed.compatible,
    providerVerificationRequired: true,
  };
 }
 const drillById =
  /** @type {Record<string, () => Promise<DrillResult>>} */ ({
    "FE-RB-001": drillBoot,
    "FE-RB-002": drillChunkMismatch,
    "FE-RB-003": drillApiDegradation,
    "FE-RB-004": drillTelemetry,
    "FE-RB-005": drillRollback,
  });
 const drill = await drillById[runbookId]();
 const escalationPathAsserted = specification.escalation.length >= 2;
 const passed =
  drill.triggerAsserted &&
  drill.containmentAsserted &&
  escalationPathAsserted &&
  drill.recoveryAssertions.every((item) => item.passed) &&
  drill.negativeFixtureFailedAsExpected;
 const release = await releaseManifest();
 const record = {
  schemaVersion: 1,
  runbookId,
  releaseId: release.releaseId,
  drillTimestamp: new Date().toISOString(),
  triggerInjected: specification.triggerKinds[0],
  triggerAsserted: drill.triggerAsserted,
  containmentAsserted: drill.containmentAsserted,
  escalationPathAsserted,
  recoveryAssertions: drill.recoveryAssertions,
  negativeFixtureFailedAsExpected: drill.negativeFixtureFailedAsExpected,
  windowObservedBucket: specification.window,
  providerVerificationRequired: drill.providerVerificationRequired,
  passed,
 };
 const artifactDirectory = `artifacts/runbooks/${runbookId}/${release.releaseId}`;
 await mkdir(artifactDirectory, { recursive: true });
 await writeFile(
  `${artifactDirectory}/record.json`,
  `${JSON.stringify(record, null, 2)}\n`,
 );
 if (!passed) {
  process.stderr.write(`${runbookId} drill failed.\n`);
  process.exit(1);
 }
 process.stdout.write(
  `${runbookId} drill: PASS (${specification.gateId}; provider verification ${
    drill.providerVerificationRequired ? "still required" : "not required"
  })\n`,
 );
@@ -1,4 +1,3 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import process from "node:process";
@@ -6,23 +5,13 @@ const packageJson = JSON.parse(await readFile("package.json", "utf8"));
 const packageManagerVersion = packageJson.packageManager.split("@").at(-1);
 const buildId = process.env.VITE_BUILD_ID ?? "local-build";
 const commitSha = process.env.VITE_COMMIT_SHA ?? "local";
 const releaseId = process.env.RELEASE_ID ?? "local-release";
 const runnerImage = process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`;
 const builtAt = new Date().toISOString();
 const viteManifest = await readFile("dist/.vite/manifest.json");
 const assetManifestHash = createHash("sha256")
  .update(viteManifest)
  .digest("hex");
 const runtimeConfig = JSON.parse(await readFile("dist/config.json", "utf8"));
 runtimeConfig.BUILD_ID = buildId;
 runtimeConfig.RELEASE_ID = releaseId;
 const manifest = {
  schemaVersion: 1,
  buildId,
  commitSha,
-  generatedAt: builtAt,
+  generatedAt: new Date().toISOString(),
  buildContext: {
    nodeVersion: process.version,
    packageManagerVersion,
@@ -34,24 +23,7 @@ const manifest = {
  },
 };
 const releaseManifest = {
  schemaVersion: 1,
  appVersion: packageJson.version,
  buildId,
  commitSha,
  configSchemaVersion: runtimeConfig.CONFIG_SCHEMA_VERSION,
  apiContractVersion: runtimeConfig.API_CONTRACT_VERSION,
  assetManifestHash,
  releaseId,
  builtAt,
 };
 await mkdir("artifacts/release", { recursive: true });
 await writeFile("dist/config.json", `${JSON.stringify(runtimeConfig, null, 2)}\n`);
 await writeFile(
  "dist/release-manifest.json",
  `${JSON.stringify(releaseManifest, null, 2)}\n`,
 );
 await writeFile(
  "artifacts/release/build-manifest.json",
  `${JSON.stringify(manifest, null, 2)}\n`,
@@ -1,102 +0,0 @@
 import { createHash } from "node:crypto";
 import { gzipSync } from "node:zlib";
 import {
  mkdir,
  readFile,
  readdir,
  stat,
  writeFile,
 } from "node:fs/promises";
 import path from "node:path";
 /** @param {string} directory @returns {Promise<string[]>} */
 async function filesWithin(directory) {
  const entries = await readdir(directory, { withFileTypes: true });
  const nested = /** @type {string[][]} */ (await Promise.all(
    entries.map((entry) => {
      const target = path.join(directory, entry.name);
      return entry.isDirectory() ? filesWithin(target) : [target];
    }),
  ));
  return nested.flat().sort();
 }
 const packageJson = JSON.parse(await readFile("package.json", "utf8"));
 const lockfile = await readFile("pnpm-lock.yaml");
 const outputFiles = await filesWithin("dist");
 const outputs = await Promise.all(
  outputFiles.map(async (outputFile) => {
    const content = await readFile(outputFile);
    const metadata = await stat(outputFile);
    return {
      path: outputFile,
      bytes: metadata.size,
      gzipBytes: gzipSync(content).byteLength,
      sha256: createHash("sha256").update(content).digest("hex"),
    };
  }),
 );
 const dependencies = {
  ...packageJson.dependencies,
  ...packageJson.devDependencies,
 };
 const inventory = Object.entries(dependencies)
  .sort(([left], [right]) => left.localeCompare(right))
  .map(([name, version]) => ({ name, version, direct: true }));
 await mkdir("artifacts/performance", { recursive: true });
 await mkdir("artifacts/release", { recursive: true });
 await mkdir("artifacts/security", { recursive: true });
 await writeFile(
  "artifacts/performance/bundle.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      context: {
        nodeVersion: process.version,
        packageManager: packageJson.packageManager,
        runnerImage: process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`,
      },
      outputs,
    },
    null,
    2,
  )}\n`,
 );
 await writeFile(
  "artifacts/release/dependency-inventory.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
      dependencies: inventory,
    },
    null,
    2,
  )}\n`,
 );
 await writeFile(
  "artifacts/release/checksums.txt",
  `${outputs.map((output) => `${output.sha256}  ${output.path}`).join("\n")}\n`,
 );
 await writeFile(
  "artifacts/security/dependency-diff.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      reviewStatus: "local-baseline",
      directDependencies: inventory.length,
      highRiskUnreviewed: [],
      lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
    },
    null,
    2,
  )}\n`,
 );
@@ -1,82 +0,0 @@
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 const scanRoots = ["src", "dist"];
 const findings = /** @type {Array<{ruleId: string, file: string}>} */ ([]);
 const patterns = [
  { id: "private-key", expression: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g },
  { id: "aws-access-key", expression: /\bAKIA[0-9A-Z]{16}\b/g },
  { id: "github-token", expression: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g },
  {
    id: "assigned-secret",
    expression:
      /\b(?:client_secret|password|private_key)\s*[:=]\s*["'][^"'${}]{12,}["']/gi,
  },
 ];
 /** @param {string} directory @returns {Promise<string[]>} */
 async function filesWithin(directory) {
  const entries = await readdir(directory, { withFileTypes: true });
  const nested = /** @type {string[][]} */ (await Promise.all(
    entries.map((entry) => {
      const target = path.join(directory, entry.name);
      return entry.isDirectory() ? filesWithin(target) : [target];
    }),
  ));
  return nested.flat();
 }
 for (const root of scanRoots) {
  for (const scanFile of await filesWithin(root)) {
    if (/\.(png|jpg|jpeg|gif|woff2?|zip)$/i.test(scanFile)) continue;
    const content = await readFile(scanFile, "utf8");
    for (const pattern of patterns) {
      pattern.expression.lastIndex = 0;
      if (pattern.expression.test(content)) {
        findings.push({ ruleId: pattern.id, file: scanFile });
      }
    }
  }
 }
 const sarif = {
  version: "2.1.0",
  $schema:
    "https://json.schemastore.org/sarif-2.1.0.json",
  runs: [
    {
      tool: {
        driver: {
          name: "ca-frontend-secret-scan",
          rules: patterns.map((pattern) => ({
            id: pattern.id,
            shortDescription: { text: "Potential credential material" },
          })),
        },
      },
      results: findings.map((finding) => ({
        ruleId: finding.ruleId,
        message: { text: "Potential secret material must be removed." },
        locations: [
          {
            physicalLocation: {
              artifactLocation: { uri: finding.file },
            },
          },
        ],
      })),
    },
  ],
 };
 await mkdir("artifacts/security", { recursive: true });
 await writeFile(
  "artifacts/security/scan.sarif",
  `${JSON.stringify(sarif, null, 2)}\n`,
 );
 if (findings.length > 0) {
  process.stderr.write(`Security scan found ${findings.length} blocking result(s).\n`);
  process.exit(1);
 }
 process.stdout.write("Source and built-asset secret scan: PASS\n");
@@ -1,148 +0,0 @@
 import { spawn } from "node:child_process";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 import process from "node:process";
 import { chromium } from "@playwright/test";
 import { evaluateLabBudget } from "../src/application/policies/performance-budgets.js";
 const server = spawn(
  "corepack",
  ["pnpm", "preview", "--host", "127.0.0.1", "--port", "4173"],
  { stdio: "ignore" },
 );
 const baseUrl = "http://127.0.0.1:4173";
 async function waitForServer() {
  for (let attempt = 0; attempt < 50; attempt += 1) {
    try {
      const response = await fetch(baseUrl);
      if (response.ok) return;
    } catch {
      // The bounded retry loop handles startup races.
    }
    await new Promise((resolve) => setTimeout(resolve, 100));
  }
  throw new Error("Preview server did not become ready.");
 }
 try {
  await waitForServer();
  const release = JSON.parse(
    await readFile("dist/release-manifest.json", "utf8"),
  );
  const thresholds = JSON.parse(
    await readFile("config/performance/budgets.json", "utf8"),
  ).lab;
  const browser = await chromium.launch();
  try {
    const context = await browser.newContext({
      viewport: { width: 1280, height: 720 },
    });
    const page = await context.newPage();
    const cdp = await context.newCDPSession(page);
    await cdp.send("Network.enable");
    await cdp.send("Network.emulateNetworkConditions", {
      offline: false,
      latency: 40,
      downloadThroughput: 200_000,
      uploadThroughput: 93_750,
      connectionType: "cellular4g",
    });
    await cdp.send("Emulation.setCPUThrottlingRate", { rate: 4 });
    await page.addInitScript(() => {
      const evidence = { lcpMs: 0, cls: 0 };
      /** @type {any} */ (window).__contractPerformance = evidence;
      new PerformanceObserver((list) => {
        for (const entry of list.getEntries()) evidence.lcpMs = entry.startTime;
      }).observe({ type: "largest-contentful-paint", buffered: true });
      new PerformanceObserver((list) => {
        for (const entry of list.getEntries()) {
          if (!(/** @type {any} */ (entry)).hadRecentInput) {
            evidence.cls += /** @type {any} */ (entry).value;
          }
        }
      }).observe({ type: "layout-shift", buffered: true });
    });
    await page.goto(baseUrl, { waitUntil: "networkidle" });
    const interactionStarted = performance.now();
    await page.getByRole("link", { name: "샘플 리소스" }).click();
    await page.getByRole("heading", { name: "세션이 필요합니다." }).waitFor();
    const namedInteractionMs = performance.now() - interactionStarted;
    const paint = await page.evaluate(
      () => /** @type {any} */ (window).__contractPerformance,
    );
    const contextMetadata = {
      runner: {
        platform: process.platform,
        architecture: process.arch,
        nodeVersion: process.version,
      },
      browser: { name: "chromium", version: await browser.version() },
      viewport: { width: 1280, height: 720 },
      network: {
        profile: "contract-fast-4g",
        latencyMs: 40,
        downloadBytesPerSecond: 200_000,
        uploadBytesPerSecond: 93_750,
      },
      cpu: { throttlingRate: 4 },
      cache: { state: "cold", isolation: "new-browser-context" },
      build: { buildId: release.buildId, releaseId: release.releaseId },
    };
    const metrics = {
      lcpMs: Math.round(paint.lcpMs),
      cls: Number(paint.cls.toFixed(4)),
      namedInteractionMs: Math.round(namedInteractionMs),
    };
    const result = evaluateLabBudget(
      { context: contextMetadata, metrics },
      thresholds,
    );
    const fixtures = [
      {
        name: "missing-context",
        passed: !evaluateLabBudget({ metrics }, thresholds).passed,
      },
      {
        name: "lcp-over-threshold",
        passed: !evaluateLabBudget(
          {
            context: contextMetadata,
            metrics: { ...metrics, lcpMs: thresholds.lcpMs + 1 },
          },
          thresholds,
        ).passed,
      },
    ];
    const passed = result.passed && fixtures.every((fixture) => fixture.passed);
    await mkdir("artifacts/performance", { recursive: true });
    await writeFile(
      "artifacts/performance/lab.json",
      `${JSON.stringify(
        {
          schemaVersion: 1,
          generatedAt: new Date().toISOString(),
          context: contextMetadata,
          metrics,
          thresholds,
          fixtures,
          passed,
        },
        null,
        2,
      )}\n`,
    );
    if (!passed) {
      throw new Error(`Lab performance failed: ${JSON.stringify(metrics)}`);
    }
    process.stdout.write(
      `Lab performance: PASS (LCP ${metrics.lcpMs}ms, CLS ${metrics.cls}, interaction ${metrics.namedInteractionMs}ms)\n`,
    );
  } finally {
    await browser.close();
  }
 } finally {
  server.kill("SIGTERM");
 }
@@ -1,78 +0,0 @@
 import { cp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 const fixtureRoot = path.resolve(".tmp/sample-removal");
 const sampleRoot = path.resolve("src/sample/contract-fixture");
 const sourceRoot = path.resolve("src");
 const pnpmCli = /** @type {string} */ (process.env.npm_execpath);
 /** @param {string} directory @returns {Promise<string[]>} */
 async function sourceFiles(directory) {
  const entries = await readdir(directory, { withFileTypes: true });
  const nested = /** @type {string[][]} */ (await Promise.all(
    entries.map((entry) => {
      const target = path.join(directory, entry.name);
      return entry.isDirectory() ? sourceFiles(target) : [target];
    }),
  ));
  return nested.flat();
 }
 await rm(fixtureRoot, { recursive: true, force: true });
 await mkdir(fixtureRoot, { recursive: true });
 const incomingImports = [];
 for (const sourceFile of await sourceFiles(sourceRoot)) {
  if (sourceFile.startsWith(sampleRoot)) continue;
  const content = await readFile(sourceFile, "utf8");
  if (/from\s+["'][^"']*sample\/contract-fixture/.test(content)) {
    incomingImports.push(path.relative(".", sourceFile));
  }
 }
 let buildStatus = 1;
 if (incomingImports.length === 0) {
  await cp("src", path.join(fixtureRoot, "src"), {
    recursive: true,
    filter: (source) => !source.startsWith(sampleRoot),
  });
  await cp("public", path.join(fixtureRoot, "public"), { recursive: true });
  await cp("index.html", path.join(fixtureRoot, "index.html"));
  await cp("vite.config.js", path.join(fixtureRoot, "vite.config.js"));
  const result = spawnSync(
    process.execPath,
    [
      pnpmCli,
      "exec",
      "vite",
      "build",
      fixtureRoot,
      "--outDir",
      path.join(fixtureRoot, "dist"),
    ],
    { stdio: "inherit" },
  );
  buildStatus = result.status ?? 1;
 }
 await mkdir("artifacts/tests", { recursive: true });
 const passed = incomingImports.length === 0 && buildStatus === 0;
 await writeFile(
  "artifacts/tests/sample-removal.xml",
  `<?xml version="1.0" encoding="UTF-8"?>\n` +
    `<testsuite name="sample-removal" tests="2" failures="${passed ? 0 : 1}">` +
    `<testcase name="no-product-import"/>` +
    `<testcase name="production-build">${passed ? "" : "<failure/>"}</testcase>` +
    `</testsuite>\n`,
 );
 await rm(fixtureRoot, { recursive: true, force: true });
 if (!passed) {
  process.stderr.write(
    `Sample removal failed. Incoming imports: ${incomingImports.join(", ")}\n`,
  );
  process.exit(1);
 }
 process.stdout.write("Sample removal smoke: PASS\n");
@@ -1,25 +0,0 @@
 import { readFile } from "node:fs/promises";
 const evidence = await readFile(
  "artifacts/tests/a11y-manual/APP_HOME.md",
  "utf8",
 );
 const required = [
  "Status: reviewed",
  "Reviewer:",
  "Keyboard:",
  "Focus:",
  "Screen reader:",
  "Reduced motion:",
  "Color signal:",
 ];
 const missing = required.filter((marker) => !evidence.includes(marker));
 if (missing.length > 0) {
  process.stderr.write(
    `Manual accessibility evidence is incomplete: ${missing.join(", ")}\n`,
  );
  process.exit(1);
 }
 process.stdout.write("Manual accessibility evidence: PASS\n");
@@ -1,110 +0,0 @@
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 const cachePolicy = JSON.parse(
  await readFile("config/hosting/cache-policy.json", "utf8"),
 );
 const securityPolicy = JSON.parse(
  await readFile("config/hosting/security-headers.json", "utf8"),
 );
 const baseUrl = process.env.HOSTING_BASE_URL;
 /** @type {Record<string, Record<string, string>>} */
 let responses;
 let mode;
 if (baseUrl) {
  mode = "live";
  const assets = await readdir("dist/assets");
  const hashedAsset = assets.find((file) => !file.endsWith(".map"));
  if (!hashedAsset) throw new Error("No built hashed asset found.");
  const paths = {
    index: "/",
    runtimeConfig: "/config.json",
    releaseManifest: "/release-manifest.json",
    hashedAsset: `/assets/${hashedAsset}`,
  };
  responses = {};
  for (const [surface, pathname] of Object.entries(paths)) {
    const response = await fetch(new URL(pathname, baseUrl));
    responses[surface] = Object.fromEntries(
      [...response.headers.entries()].map(([name, value]) => [
        name.toLowerCase(),
        value,
      ]),
    );
  }
 } else {
  mode = "fixture";
  responses = JSON.parse(
    await readFile("config/hosting/response-headers.fixture.json", "utf8"),
  ).responses;
 }
 const results = [];
 for (const [surface, policy] of Object.entries(cachePolicy.surfaces)) {
  if (!("cacheControl" in policy)) continue;
  const observed = responses[surface]?.["cache-control"];
  results.push({
    surface,
    header: "cache-control",
    expected: policy.cacheControl,
    observed,
    passed: observed === policy.cacheControl,
  });
  if (policy.securityHeaders) {
    for (const [header, expected] of Object.entries(securityPolicy.headers)) {
      const observedSecurity = responses[surface]?.[header.toLowerCase()];
      results.push({
        surface,
        header: header.toLowerCase(),
        expected,
        observed: observedSecurity,
        passed: observedSecurity === expected,
      });
    }
  }
 }
 results.push({
  surface: "sourceMap",
  header: "public",
  expected: false,
  observed: cachePolicy.surfaces.sourceMap.public,
  passed: cachePolicy.surfaces.sourceMap.public === false,
 });
 results.push({
  surface: "serviceWorker",
  header: "enabled",
  expected: false,
  observed: cachePolicy.surfaces.serviceWorker.enabled,
  passed: cachePolicy.surfaces.serviceWorker.enabled === false,
 });
 const passed = results.every((result) => result.passed);
 await mkdir("artifacts/release", { recursive: true });
 await writeFile(
  "artifacts/release/hosting-headers.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      mode,
      baseUrl: baseUrl ?? null,
      providerVerificationRequired: mode !== "live",
      results,
      passed,
    },
    null,
    2,
  )}\n`,
 );
 if (!passed) {
  process.stderr.write("Hosting cache/security header verification failed.\n");
  process.exit(1);
 }
 process.stdout.write(
  `Hosting header contract: PASS (${mode}; live verification ${
    mode === "live" ? "complete" : "required before promotion"
  })\n`,
 );
@@ -1,87 +0,0 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { verifyCompatibilityTuple } from "../src/application/policies/compatibility.js";
 import { compareReleaseToRuntime } from "../src/contracts/release-tokens.js";
 const fixturesDocument =
  /** @type {{
   *   fixtures: Array<{
   *     name: string,
   *     expectedCompatible: boolean,
   *     frontend: {
   *       buildId: string,
   *       configSchemaVersion: string,
   *       apiContractVersion: string,
   *       assetManifestHash: string,
   *       releaseId: string
   *     },
   *     runtime: {
   *       buildId: string,
   *       configSchemaVersion: string,
   *       apiContractVersion: string,
   *       assetManifestHash: string,
   *       releaseId: string
   *     }
   *   }>
   * }} */ (
    JSON.parse(
      await readFile("config/release/coherence-fixtures.json", "utf8"),
    )
  );
 const release = JSON.parse(await readFile("dist/release-manifest.json", "utf8"));
 const runtimeConfig = JSON.parse(await readFile("dist/config.json", "utf8"));
 const viteManifest = await readFile("dist/.vite/manifest.json");
 const actualAssetManifestHash = createHash("sha256")
  .update(viteManifest)
  .digest("hex");
 const artifactComparison = compareReleaseToRuntime(release, runtimeConfig);
 const artifactMismatches = [...artifactComparison.mismatches];
 if (release.assetManifestHash !== actualAssetManifestHash) {
  artifactMismatches.push("assetManifestContent");
 }
 const fixtures = fixturesDocument.fixtures.map((fixture) => {
  const result = verifyCompatibilityTuple({
    frontend: fixture.frontend,
    runtime: fixture.runtime,
  });
  return {
    name: fixture.name,
    expectedCompatible: fixture.expectedCompatible,
    actualCompatible: result.compatible,
    mismatches: result.mismatches,
    passed: result.compatible === fixture.expectedCompatible,
  };
 });
 const artifact = {
  checked: true,
  compatible: artifactComparison.compatible && artifactMismatches.length === 0,
  mismatches: artifactMismatches,
  releaseId: release.releaseId,
 };
 const passed = artifact.compatible && fixtures.every((fixture) => fixture.passed);
 const report = {
  schemaVersion: 1,
  generatedAt: new Date().toISOString(),
  artifact,
  fixtures,
  passed,
 };
 await mkdir("artifacts/release", { recursive: true });
 await writeFile(
  "artifacts/release/verification.json",
  `${JSON.stringify(report, null, 2)}\n`,
 );
 if (!passed) {
  process.stderr.write(
    `Release coherence failed: ${artifactMismatches.join(", ") || "fixture"}\n`,
  );
  process.exit(1);
 }
 process.stdout.write(
  `Release coherence: PASS (${fixtures.length - 1} mixed fixtures rejected)\n`,
 );
@@ -1,18 +0,0 @@
 import { mkdir, writeFile } from "node:fs/promises";
 await mkdir("artifacts/tests", { recursive: true });
 await writeFile(
  "artifacts/tests/a11y.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      scope: ["APP_HOME", "SAMPLE_RESOURCE_LIST", "NOT_FOUND"],
      threshold: { critical: 0, serious: 0 },
      automatedStatus: "passed",
      manualReview: "see artifacts/tests/a11y-manual/APP_HOME.md",
    },
    null,
    2,
  )}\n`,
 );
@@ -1,45 +0,0 @@
 /**
 * Creates the skeleton-owned side of an external session integration.
 * Credential acquisition and storage stay inside the supplied external owner.
 *
 * @param {{
 *   readState(): import("../../application/ports/auth-session-port.js").SessionState,
 *   attachCredential(request: Request): Promise<Request>,
 *   recoverSession(): Promise<"restored" | "no-session">,
 *   notifyUnauthenticated(): void
 * }} owner
 * @returns {import("../../application/ports/auth-session-port.js").AuthSessionPort}
 */
 export function createExternalAuthSessionAdapter(owner) {
  return Object.freeze({
    getState() {
      return owner.readState();
    },
    async attach(request) {
      const attached = await owner.attachCredential(request);
      if (!(attached instanceof Request)) {
        throw new TypeError("Auth owner returned an invalid request");
      }
      return attached;
    },
    async recover() {
      const result = await owner.recoverSession();
      if (result !== "restored" && result !== "no-session") {
        throw new TypeError("Auth owner returned an invalid recovery state");
      }
      return result;
    },
    onUnauthenticated() {
      owner.notifyUnauthenticated();
    },
  });
 }
 export function createAnonymousSessionAdapter() {
  return createExternalAuthSessionAdapter({
    readState: () => "unauthenticated",
    attachCredential: async (request) => request,
    recoverSession: async () => "no-session",
    notifyUnauthenticated: () => {},
  });
 }
@@ -1,434 +0,0 @@
 import { systemClock } from "../../application/ports/clock-port.js";
 import { getApiOperation } from "../../contracts/api-operations.js";
 import {
  createFailure as failure,
  kindForStatus as statusKind,
  normalizeUnknownFailure,
 } from "../../contracts/errors.js";
 import { mapOperationPayload } from "./resource-mapper.js";
 import { retryDelay, shouldRetry } from "./retry-policy.js";
 import {
  validateEnvelope,
  validateOperationPayload,
  validateOperationRequest,
 } from "./schema-registry.js";
 const noAuthSession =
  /** @type {import("../../application/ports/auth-session-port.js").AuthSessionPort} */ ({
  getState: () => /** @type {"unauthenticated"} */ ("unauthenticated"),
  attach: async (request) => request,
  recover: async () => /** @type {"no-session"} */ ("no-session"),
  onUnauthenticated: () => {},
 });
 /**
 * @typedef {{
 *   kind: string,
 *   code: string,
 *   retryable: boolean,
 *   operationId: string,
 *   attemptCount: number,
 *   httpStatus?: number,
 *   requestId?: string,
 *   traceId?: string,
 *   retryAfterMs?: number,
 *   userMessageKey: string,
 *   action: string
 * }} HttpFailure
 */
 /**
 * @typedef {{ ok: true, value: unknown, meta: Record<string, string> } |
 * { ok: false, error: HttpFailure }} HttpResult
 */
 /**
 * @param {{
 *   baseUrl: string,
 *   fetcher?: typeof fetch,
 *   authSession?: import("../../application/ports/auth-session-port.js").AuthSessionPort,
 *   clock?: import("../../application/ports/clock-port.js").ClockPort,
 *   random?: () => number,
 *   validatePayload?: (schemaId: string, value: unknown) =>
 *     { success: true, data: unknown } | { success: false },
 *   mapPayload?: (operationId: string, payload: unknown) => unknown,
 *   idempotencyKeyFactory?: () => string
 * }} dependencies
 */
 export function createHttpClient(dependencies) {
  const fetcher = dependencies.fetcher ?? fetch;
  const authSession = dependencies.authSession ?? noAuthSession;
  const clock = dependencies.clock ?? systemClock;
  const random = dependencies.random ?? Math.random;
  const validatePayload =
    dependencies.validatePayload ?? validateOperationPayload;
  const mapPayload = dependencies.mapPayload ?? mapOperationPayload;
  const idempotencyKeyFactory =
    dependencies.idempotencyKeyFactory ?? (() => crypto.randomUUID());
  /**
   * @param {string} operationId
   * @param {{
   *   body?: unknown,
   *   routeId?: string,
   *   signal?: AbortSignal,
   *   idempotencyKey?: string
   * }} [input]
   */
  async function execute(operationId, input = {}) {
    const operation = getApiOperation(operationId);
    const logicalIdempotencyKey =
      operation.idempotency === "keyed"
        ? input.idempotencyKey ?? idempotencyKeyFactory()
        : undefined;
    let retryCount = 0;
    let recoveryUsed = false;
    while (true) {
      const attempt = retryCount;
      /** @type {HttpResult} */
      const outcome = await performAttempt({
        operation,
        input,
        attempt,
        idempotencyKey: logicalIdempotencyKey,
      });
      if (outcome.ok) return outcome;
      if (outcome.error.httpStatus === 401 && !recoveryUsed) {
        recoveryUsed = true;
        const recovered = await recoverSession(authSession, operation, outcome.error);
        if (!recovered.ok) return recovered;
        if (operation.idempotency === "none") {
          return {
            ok: false,
            error: {
              ...outcome.error,
              retryable: false,
              action: "retry",
            },
          };
        }
        continue;
      }
      if (outcome.error.httpStatus === 401 && recoveryUsed) {
        authSession.onUnauthenticated();
        return outcome;
      }
      if (!shouldRetry(operation, outcome.error, retryCount)) {
        return outcome;
      }
      const delay = retryDelay(outcome.error, retryCount, random, clock.now());
      retryCount += 1;
      try {
        await clock.sleep(delay, input.signal);
      } catch {
        return {
          ok: false,
          error: failure("REQUEST_ABORTED", operationId, retryCount, {
            code: "REQUEST_ABORTED",
          }),
        };
      }
    }
  }
  /**
   * @param {{
   *   operation: ReturnType<typeof getApiOperation>,
   *   input: { body?: unknown, routeId?: string, signal?: AbortSignal },
   *   attempt: number,
   *   idempotencyKey?: string
   * }} context
   * @returns {Promise<HttpResult>}
   */
  async function performAttempt(context) {
    const { operation, input, attempt, idempotencyKey } = context;
    const controller = new AbortController();
    let timedOut = false;
    const timeout = setTimeout(() => {
      timedOut = true;
      controller.abort("timeout");
    }, operation.timeoutMs);
    const onExternalAbort = () => controller.abort(input.signal?.reason);
    input.signal?.addEventListener("abort", onExternalAbort, { once: true });
    const headers = new Headers({ Accept: "application/json" });
    if (input.body !== undefined) headers.set("Content-Type", "application/json");
    if (idempotencyKey) headers.set("Idempotency-Key", idempotencyKey);
    if (input.body !== undefined) {
      const requestValidation = validateOperationRequest(
        operation.requestSchema,
        input.body,
      );
      if (!requestValidation.success) {
        return {
          ok: false,
          error: failure("VALIDATION_REJECTED", operation.operationId, attempt, {
            code: "REQUEST_SCHEMA_INVALID",
          }),
        };
      }
    }
    let request = new Request(new URL(operation.path, dependencies.baseUrl), {
      method: operation.method,
      headers,
      body: input.body === undefined ? undefined : JSON.stringify(input.body),
      signal: controller.signal,
    });
    try {
      if (operation.auth === "external-session") {
        try {
          request = await authSession.attach(request);
        } catch {
          return {
            ok: false,
            error: failure("AUTH_INTEGRATION_FAILURE", operation.operationId, attempt, {
              code: "AUTH_ATTACH_FAILED",
            }),
          };
        }
      }
      const response = await fetcher(request);
      return await parseResponse(
        response,
        operation,
        attempt,
        validatePayload,
        mapPayload,
      );
    } catch {
      if (timedOut) {
        return {
          ok: false,
          error: failure("REQUEST_TIMEOUT", operation.operationId, attempt, {
            code: "REQUEST_TIMEOUT",
          }),
        };
      }
      if (controller.signal.aborted || input.signal?.aborted) {
        const externalReason = input.signal?.reason;
        if (externalReason === "timeout") {
          return {
            ok: false,
            error: failure("REQUEST_TIMEOUT", operation.operationId, attempt, {
              code: "REQUEST_TIMEOUT",
            }),
          };
        }
        if (
          externalReason !== undefined &&
          !["navigation", "user", "superseded"].includes(String(externalReason))
        ) {
          return {
            ok: false,
            error: failure("UNKNOWN_FAILURE", operation.operationId, attempt, {
              code: "EXTERNAL_ABORT_UNRESOLVED",
            }),
          };
        }
        return {
          ok: false,
          error: failure("REQUEST_ABORTED", operation.operationId, attempt, {
            code: "REQUEST_ABORTED",
          }),
        };
      }
      return {
        ok: false,
        error: failure("NETWORK_UNREACHABLE", operation.operationId, attempt, {
          code: "NETWORK_UNREACHABLE",
        }),
      };
    } finally {
      clearTimeout(timeout);
      input.signal?.removeEventListener("abort", onExternalAbort);
    }
  }
  return Object.freeze({ execute });
 }
 /**
 * @param {Response} response
 * @param {import("../../contracts/api-operations.js").ApiOperation} operation
 * @param {number} attempt
 * @param {(schemaId: string, value: unknown) =>
 *   { success: true, data: unknown } | { success: false }} validatePayload
 * @param {(operationId: string, payload: unknown) => unknown} mapPayload
 * @returns {Promise<HttpResult>}
 */
 async function parseResponse(
  response,
  operation,
  attempt,
  validatePayload,
  mapPayload,
 ) {
  const contentType = response.headers.get("content-type") ?? "";
  if (!contentType.toLowerCase().includes("application/json")) {
    return {
      ok: false,
      error: failure("CONTENT_TYPE_MISMATCH", operation.operationId, attempt, {
        code: "CONTENT_TYPE_MISMATCH",
        httpStatus: response.status,
      }),
    };
  }
  let envelope;
  try {
    envelope = await response.json();
  } catch {
    return {
      ok: false,
      error: failure("MALFORMED_JSON", operation.operationId, attempt, {
        code: "MALFORMED_JSON",
        httpStatus: response.status,
      }),
    };
  }
  const envelopeValidation = validateEnvelope(envelope);
  if (!envelopeValidation.success) {
    return {
      ok: false,
      error: failure(
        response.ok ? "ENVELOPE_MISMATCH" : statusKind(response.status),
        operation.operationId,
        attempt,
        {
        code: response.ok ? "ENVELOPE_MISMATCH" : "HTTP_FAILURE",
        httpStatus: response.status,
        },
      ),
    };
  }
  const envelopeRecord =
    /** @type {Record<string, unknown>} */ (envelopeValidation.data);
  if (response.ok && envelopeRecord.success === true && "data" in envelopeRecord) {
    const payload = validatePayload(operation.responseSchema, envelopeRecord.data);
    if (!payload.success) {
      return {
        ok: false,
        error: failure("SCHEMA_MISMATCH", operation.operationId, attempt, {
          code: "SCHEMA_MISMATCH",
          httpStatus: response.status,
        }),
      };
    }
    try {
      return {
        ok: true,
        value: mapPayload(operation.operationId, payload.data),
        meta: safeMeta(envelopeRecord.meta),
      };
    } catch (error) {
      return {
        ok: false,
        error: normalizeUnknownFailure(error, {
          operationId: operation.operationId,
          attempt,
        }),
      };
    }
  }
  const kind = statusKind(response.status);
  const retryAfter = response.headers.get("retry-after");
  return {
    ok: false,
    error: failure(kind, operation.operationId, attempt, {
      code: safeBackendCode(envelope),
      httpStatus: response.status,
      requestId: safeMeta(envelopeRecord.meta).requestId,
      traceId: safeMeta(envelopeRecord.meta).traceId,
      retryAfterMs:
        response.status === 429 && retryAfter
          ? parseRetryAfterHeader(retryAfter)
          : undefined,
    }),
  };
 }
 /**
 * @param {import("../../application/ports/auth-session-port.js").AuthSessionPort} authSession
 * @param {import("../../contracts/api-operations.js").ApiOperation} operation
 * @param {HttpFailure} originalFailure
 * @returns {Promise<{ok: true} | {ok: false, error: HttpFailure}>}
 */
 async function recoverSession(authSession, operation, originalFailure) {
  try {
    const result = await authSession.recover();
    if (result === "restored") return { ok: true };
    if (result === "no-session") {
      authSession.onUnauthenticated();
      return {
        ok: false,
        error: failure("AUTH_REQUIRED", operation.operationId, originalFailure.attemptCount, {
          code: "AUTH_REQUIRED",
          httpStatus: 401,
        }),
      };
    }
  } catch {
    // Normalized below.
  }
  return {
    ok: false,
    error: failure(
      "AUTH_INTEGRATION_FAILURE",
      operation.operationId,
      originalFailure.attemptCount,
      { code: "AUTH_RECOVERY_FAILED" },
    ),
  };
 }
 /**
 * @param {string} kind
 * @param {string} operationId
 * @param {number} attempt
 * @param {FailureDetails} [details]
 * @returns {HttpFailure}
 */
 /** @param {unknown} envelope */
 function safeBackendCode(envelope) {
  if (!envelope || typeof envelope !== "object") return "HTTP_FAILURE";
  const error = /** @type {Record<string, unknown>} */ (envelope).error;
  if (!error || typeof error !== "object") return "HTTP_FAILURE";
  const code = /** @type {Record<string, unknown>} */ (error).code;
  return typeof code === "string" ? code : "HTTP_FAILURE";
 }
 /** @param {unknown} meta @returns {Record<string, string>} */
 function safeMeta(meta) {
  if (!meta || typeof meta !== "object") return {};
  const metaRecord = /** @type {Record<string, unknown>} */ (meta);
  return {
    ...(typeof metaRecord.requestId === "string"
      ? { requestId: metaRecord.requestId }
      : {}),
    ...(typeof metaRecord.traceId === "string" ? { traceId: metaRecord.traceId } : {}),
  };
 }
 /** @param {string} value */
 function parseRetryAfterHeader(value) {
  const seconds = Number(value);
  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1_000;
  const timestamp = Date.parse(value);
  return Number.isFinite(timestamp) ? Math.max(0, timestamp - Date.now()) : undefined;
 }
@@ -1,30 +0,0 @@
 import { createResource } from "../../domain/models/resource.js";
 /** @param {unknown} value */
 export function mapResourceDto(value) {
  if (!value || typeof value !== "object") {
    throw new TypeError("Validated resource DTO is required");
  }
  const dto = /** @type {Record<string, unknown>} */ (value);
  if (typeof dto.id !== "string" || typeof dto.name !== "string") {
    throw new TypeError("Validated resource DTO invariants were breached");
  }
  return createResource({
    id: dto.id,
    displayName: dto.name,
    createdAt: typeof dto.createdAt === "string" ? dto.createdAt : null,
  });
 }
 /** @param {string} operationId @param {unknown} payload */
 export function mapOperationPayload(operationId, payload) {
  if (operationId === "LIST_SAMPLE_RESOURCES") {
    if (!Array.isArray(payload)) throw new TypeError("Expected a resource list");
    return payload.map(mapResourceDto);
  }
  if (operationId === "CREATE_SAMPLE_RESOURCE") {
    return mapResourceDto(payload);
  }
  throw new TypeError(`No boundary mapper registered for ${operationId}`);
 }
@@ -1,79 +0,0 @@
 const retryKinds = new Set([
  "NETWORK_UNREACHABLE",
  "REQUEST_TIMEOUT",
  "RATE_LIMITED",
  "SERVER_FAILURE",
 ]);
 /**
 * @param {number} retryIndex
 * @param {() => number} [random]
 * @param {number} [baseDelayMs]
 * @param {number} [maxDelayMs]
 */
 export function calculateBackoff(
  retryIndex,
  random = Math.random,
  baseDelayMs = 250,
  maxDelayMs = 2_000,
 ) {
  return Math.min(maxDelayMs, baseDelayMs * 2 ** retryIndex) * random();
 }
 /** @param {string | null | undefined} value @param {number} [now] */
 export function parseRetryAfter(value, now = Date.now()) {
  if (!value) return null;
  const seconds = Number(value);
  if (Number.isFinite(seconds)) {
    return seconds < 0 ? null : seconds * 1_000;
  }
  const timestamp = Date.parse(value);
  if (!Number.isFinite(timestamp)) return null;
  return Math.max(0, timestamp - now);
 }
 /**
 * @param {{ idempotency: "safe" | "keyed" | "none" }} operation
 * @param {{ kind: string, retryAfterMs?: number, httpStatus?: number }} failure
 * @param {number} retryCount
 * @param {number} [maxRetries]
 */
 export function shouldRetry(operation, failure, retryCount, maxRetries = 2) {
  if (retryCount >= maxRetries) return false;
  if (!retryKinds.has(failure.kind)) return false;
  if (
    failure.kind === "SERVER_FAILURE" &&
    failure.httpStatus !== undefined &&
    ![502, 503, 504].includes(failure.httpStatus)
  ) {
    return false;
  }
  if (
    failure.kind === "RATE_LIMITED" &&
    typeof failure.retryAfterMs === "number" &&
    failure.retryAfterMs > 30_000
  ) {
    return false;
  }
  return operation.idempotency === "safe" || operation.idempotency === "keyed";
 }
 /**
 * @param {{ kind: string, retryAfterMs?: number, retryAfter?: string }} failure
 * @param {number} retryIndex
 * @param {() => number} [random]
 * @param {number} [now]
 */
 export function retryDelay(failure, retryIndex, random = Math.random, now = Date.now()) {
  const localBackoff = calculateBackoff(retryIndex, random);
  if (failure.kind !== "RATE_LIMITED") return localBackoff;
  const retryAfterMs =
    typeof failure.retryAfterMs === "number"
      ? failure.retryAfterMs
      : parseRetryAfter(failure.retryAfter, now);
  return retryAfterMs === null ? localBackoff : Math.max(localBackoff, retryAfterMs);
 }
@@ -1,115 +0,0 @@
 import { z } from "zod";
 const metaSchema = z
  .object({
    requestId: z.string().min(1),
    traceId: z.string().min(1),
    correlationId: z.string().min(1).optional(),
  })
  .passthrough();
 export const successEnvelopeSchema = z
  .object({
    success: z.literal(true),
    data: z.unknown(),
    meta: metaSchema,
  })
  .strict();
 export const failureEnvelopeSchema = z
  .object({
    success: z.literal(false),
    error: z
      .object({
        code: z.string().min(1),
        category: z.string().min(1).optional(),
        message: z.string().optional(),
        retryable: z.boolean().optional(),
        details: z.unknown().optional(),
      })
      .strict(),
    meta: metaSchema,
  })
  .strict();
 export const responseEnvelopeSchema = z.discriminatedUnion("success", [
  successEnvelopeSchema,
  failureEnvelopeSchema,
 ]);
 const sampleResourceSchema = z
  .object({
    id: z.string().min(1),
    name: z.string().min(1),
    createdAt: z.string().optional(),
  })
  .passthrough();
 const payloadSchemas =
  /** @type {Readonly<Record<string, z.ZodType>>} */ (Object.freeze({
  SampleResourceListPayload: z.array(sampleResourceSchema),
  SampleResourcePayload: sampleResourceSchema,
 }));
 const requestSchemas =
  /** @type {Readonly<Record<string, z.ZodType>>} */ (Object.freeze({
  SampleResourceListQuery: z
    .object({
      cursor: z.string().optional(),
      limit: z.int().min(1).max(100).default(20),
    })
    .strict(),
  CreateSampleResourceCommand: z
    .object({
      name: z.string().trim().min(1).max(120),
    })
    .strict(),
 }));
 /** @param {unknown} value */
 export function validateEnvelope(value) {
  return projectResult(responseEnvelopeSchema.safeParse(value));
 }
 /** @param {string} schemaId @param {unknown} value */
 export function validateOperationPayload(schemaId, value) {
  const schema = payloadSchemas[schemaId];
  if (!schema) return missingSchema(schemaId);
  return projectResult(schema.safeParse(value));
 }
 /** @param {string} schemaId @param {unknown} value */
 export function validateOperationRequest(schemaId, value) {
  const schema = requestSchemas[schemaId];
  if (!schema) return missingSchema(schemaId);
  return projectResult(schema.safeParse(value));
 }
 /** @param {string} schemaId */
 function missingSchema(schemaId) {
  return {
    success: /** @type {false} */ (false),
    issues: [{ path: "", code: "SCHEMA_NOT_REGISTERED", schemaId }],
  };
 }
 /**
 * @param {{ success: true, data: unknown } |
 * { success: false, error: { issues: Array<{ path: PropertyKey[], code: string }> } }} result
 */
 function projectResult(result) {
  if (result.success) {
    return {
      success: /** @type {true} */ (true),
      data: structuredClone(result.data),
    };
  }
  return {
    success: /** @type {false} */ (false),
    issues: result.error.issues.map((issue) => ({
      path: issue.path.join("."),
      code: issue.code,
    })),
  };
 }
@@ -1,72 +0,0 @@
 import { QueryClient } from "@tanstack/react-query";
 import { createFailure } from "../../contracts/errors.js";
 export const QUERY_CACHE_DEFAULTS = Object.freeze({
  staleTime: 30_000,
  gcTime: 300_000,
  refetchOnWindowFocus: true,
  retry: false,
  mutationRetry: false,
  persistence: false,
 });
 export function createQueryClient() {
  return new QueryClient({
    defaultOptions: {
      queries: {
        staleTime: QUERY_CACHE_DEFAULTS.staleTime,
        gcTime: QUERY_CACHE_DEFAULTS.gcTime,
        refetchOnWindowFocus: QUERY_CACHE_DEFAULTS.refetchOnWindowFocus,
        retry: QUERY_CACHE_DEFAULTS.retry,
      },
      mutations: {
        retry: QUERY_CACHE_DEFAULTS.mutationRetry,
      },
    },
  });
 }
 /**
 * @param {QueryClient} queryClient
 * @returns {import("../../application/ports/query-cache-port.js").QueryCachePort}
 */
 export function createQueryCacheAdapter(queryClient) {
  return Object.freeze({
    read(key) {
      try {
        return { ok: true, value: queryClient.getQueryData(key) };
      } catch {
        return cacheFailure("read", key);
      }
    },
    write(key, value) {
      try {
        queryClient.setQueryData(key, structuredClone(value));
        return { ok: true };
      } catch {
        return cacheFailure("write", key);
      }
    },
    async invalidate(namespace) {
      try {
        await queryClient.invalidateQueries({ queryKey: namespace, exact: false });
        return { ok: true };
      } catch {
        return cacheFailure("invalidate", namespace);
      }
    },
  });
 }
 /** @param {string} phase @param {readonly unknown[]} key */
 function cacheFailure(phase, key) {
  const namespace = typeof key[0] === "string" ? key[0] : "unknown";
  return {
    ok: /** @type {false} */ (false),
    error: createFailure("QUERY_CACHE_FAILURE", "QUERY_CACHE", 0, {
      code: `QUERY_CACHE_${phase.toUpperCase()}_FAILED`,
      causeClass: `namespace:${namespace}`,
    }),
  };
 }
@@ -1,137 +0,0 @@
 import { createFailure } from "../../contracts/errors.js";
 import { getStorageDefinition } from "../../contracts/storage-keys.js";
 /**
 * @param {{
 *   localStorage?: Storage,
 *   sessionStorage?: Storage,
 *   now?: () => number
 * }} [dependencies]
 * @returns {import("../../application/ports/storage-port.js").StoragePort}
 */
 export function createBrowserStorageAdapter(dependencies = {}) {
  const memory = new Map();
  const now = dependencies.now ?? Date.now;
  /** @param {string} name */
  function backendFor(name) {
    if (name === "localStorage") return dependencies.localStorage;
    if (name === "sessionStorage") return dependencies.sessionStorage;
    return undefined;
  }
  return Object.freeze({
    read(logicalName) {
      let definition;
      try {
        definition = getStorageDefinition(logicalName);
      } catch {
        return unavailable("read", logicalName);
      }
      const backend = backendFor(definition.backend);
      try {
        const raw = backend?.getItem(definition.physicalKey);
        if (raw === null || raw === undefined) {
          return { ok: true, value: memory.get(definition.physicalKey) };
        }
        const envelope = JSON.parse(raw);
        if (
          !envelope ||
          typeof envelope !== "object" ||
          envelope.schemaVersion !== definition.schemaVersion
        ) {
          backend?.removeItem(definition.physicalKey);
          return { ok: true, value: undefined };
        }
        if (typeof envelope.expiresAt === "number" && envelope.expiresAt <= now()) {
          backend?.removeItem(definition.physicalKey);
          return { ok: true, value: undefined };
        }
        return { ok: true, value: structuredClone(envelope.value) };
      } catch {
        return unavailable("read", logicalName);
      }
    },
    write(logicalName, value) {
      let definition;
      try {
        definition = getStorageDefinition(logicalName);
      } catch {
        return unavailable("write", logicalName);
      }
      const expiresAt =
        typeof definition.ttl === "number" ? now() + definition.ttl : null;
      const envelope = {
        schemaVersion: definition.schemaVersion,
        expiresAt,
        value: structuredClone(value),
      };
      const backend = backendFor(definition.backend);
      try {
        if (!backend) throw new DOMException("Storage unavailable", "SecurityError");
        backend.setItem(definition.physicalKey, JSON.stringify(envelope));
        return { ok: true };
      } catch (error) {
        const quota =
          error instanceof DOMException &&
          ["QuotaExceededError", "NS_ERROR_DOM_QUOTA_REACHED"].includes(error.name);
        if (definition.quotaFallback === "memory") {
          memory.set(definition.physicalKey, structuredClone(value));
          return {
            ok: false,
            error: storageFailure(quota, "write", logicalName),
            fallback: "memory",
          };
        }
        return {
          ok: false,
          error: storageFailure(quota, "write", logicalName),
          fallback: definition.quotaFallback,
        };
      }
    },
    remove(logicalName) {
      let definition;
      try {
        definition = getStorageDefinition(logicalName);
      } catch {
        return unavailable("remove", logicalName);
      }
      try {
        backendFor(definition.backend)?.removeItem(definition.physicalKey);
        memory.delete(definition.physicalKey);
        return { ok: true };
      } catch {
        return unavailable("remove", logicalName);
      }
    },
  });
 }
 /** @param {boolean} quota @param {string} phase @param {string} logicalName */
 function storageFailure(quota, phase, logicalName) {
  return createFailure(
    quota ? "STORAGE_QUOTA_EXCEEDED" : "STORAGE_UNAVAILABLE",
    "STORAGE",
    0,
    {
      code: `${logicalName}_${phase.toUpperCase()}_${
        quota ? "QUOTA_EXCEEDED" : "UNAVAILABLE"
      }`,
    },
  );
 }
 /** @param {string} phase @param {string} logicalName */
 function unavailable(phase, logicalName) {
  return {
    ok: /** @type {false} */ (false),
    error: storageFailure(false, phase, logicalName),
  };
 }
@@ -1,99 +0,0 @@
 import { projectTelemetryEvent } from "../../contracts/telemetry.js";
 export const noOpTelemetry = Object.freeze({
  emit: () => {},
 });
 /**
 * @param {{
 *   enabled: boolean,
 *   endpoint?: string,
 *   fetcher?: typeof fetch,
 *   maxQueue?: number,
 *   schedule?: (callback: () => void) => void
 * }} options
 */
 export function createTelemetryAdapter(options) {
  if (!options.enabled || !options.endpoint) {
    return Object.freeze({
      ...noOpTelemetry,
      flush: async () => {},
      pendingCount: () => 0,
      droppedCount: () => 0,
    });
  }
  const endpoint = /** @type {string} */ (options.endpoint);
  const fetcher = options.fetcher ?? fetch;
  const maxQueue = options.maxQueue ?? 100;
  const schedule = options.schedule ?? queueMicrotask;
  const queue =
    /** @type {Array<{eventName: string, attributes: Readonly<Record<string, unknown>>}>} */ (
      []
    );
  let scheduled = false;
  let flushing = false;
  let dropped = 0;
  /** @param {string} eventName @param {Record<string, unknown>} attributes */
  function emit(eventName, attributes) {
    const projected = projectTelemetryEvent(eventName, attributes);
    if (!projected.success) {
      dropped += 1;
      return;
    }
    if (queue.length >= maxQueue) {
      queue.shift();
      dropped += 1;
    }
    queue.push(projected.event);
    if (!scheduled) {
      scheduled = true;
      schedule(() => {
        scheduled = false;
        void flush();
      });
    }
  }
  async function flush() {
    if (flushing || queue.length === 0) return;
    flushing = true;
    const batch = queue.splice(0, queue.length);
    try {
      const response = await fetcher(endpoint, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ events: batch }),
        keepalive: true,
      });
      if (!response.ok) dropped += batch.length;
    } catch {
      dropped += batch.length;
    } finally {
      flushing = false;
    }
  }
  return Object.freeze({
    emit,
    flush,
    pendingCount: () => queue.length,
    droppedCount: () => dropped,
  });
 }
 /**
 * Propagates only a structurally valid W3C traceparent. Invalid/raw headers are
 * discarded rather than logged or surfaced.
 *
 * @param {string | null | undefined} traceparent
 */
 export function safeTraceparent(traceparent) {
  return typeof traceparent === "string" &&
    /^00-[0-9a-f]{32}-[0-9a-f]{16}-0[01]$/i.test(traceparent)
    ? traceparent.toLowerCase()
    : null;
 }
@@ -1,40 +0,0 @@
 /**
 * Application facade factory. Concrete dependencies are supplied by bootstrap.
 *
 * @param {{
 *   resources: {
 *     query: import("./ports/resource-ports.js").ResourceQueryPort<unknown, unknown>,
 *     command: import("./ports/resource-ports.js").ResourceCommandPort<unknown, unknown>
 *   },
 *   cache: import("./ports/query-cache-port.js").QueryCachePort,
 *   storage: import("./ports/storage-port.js").StoragePort,
 *   telemetry: import("./ports/telemetry-port.js").TelemetryPort
 * }} ports
 */
 export function createApplication(ports) {
  /**
   * @param {unknown} query
   * @param {import("./ports/resource-ports.js").RequestContext} [context]
   */
  function queryResources(query, context) {
    return ports.resources.query.execute(query, context);
  }
  /**
   * @param {unknown} command
   * @param {import("./ports/resource-ports.js").RequestContext} [context]
   */
  function commandResources(command, context) {
    return ports.resources.command.execute(command, context);
  }
  return Object.freeze({
    resources: Object.freeze({
      query: queryResources,
      command: commandResources,
    }),
    cache: ports.cache,
    storage: ports.storage,
    telemetry: ports.telemetry,
  });
 }
@@ -1,102 +0,0 @@
 export const COMPATIBILITY_TUPLE_FIELDS = Object.freeze([
  "buildId",
  "configSchemaVersion",
  "apiContractVersion",
  "assetManifestHash",
  "releaseId",
 ]);
 /** @param {string} version */
 export function parseNumericVersion(version) {
  const match = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(version);
  if (!match) return null;
  return {
    major: Number(match[1]),
    minor: Number(match[2] ?? 0),
    patch: Number(match[3] ?? 0),
  };
 }
 /** @param {string} supported @param {string} actual */
 export function isVersionCompatible(supported, actual) {
  const expected = parseNumericVersion(supported);
  const candidate = parseNumericVersion(actual);
  if (!expected || !candidate) return false;
  return (
    expected.major === candidate.major &&
    candidate.minor >= expected.minor
  );
 }
 /**
 * @param {{
 *   frontend: {
 *     buildId: string,
 *     configSchemaVersion: string,
 *     apiContractVersion: string,
 *     assetManifestHash: string,
 *     releaseId: string
 *   },
 *   runtime: {
 *     buildId: string,
 *     configSchemaVersion: string,
 *     apiContractVersion: string,
 *     assetManifestHash: string,
 *     releaseId: string
 *   }
 * }} input
 */
 export function verifyCompatibilityTuple(input) {
  const mismatches = [];
  if (input.frontend.buildId !== input.runtime.buildId) mismatches.push("buildId");
  if (
    !isVersionCompatible(
      input.frontend.configSchemaVersion,
      input.runtime.configSchemaVersion,
    )
  ) {
    mismatches.push("configSchemaVersion");
  }
  if (
    !isVersionCompatible(
      input.frontend.apiContractVersion,
      input.runtime.apiContractVersion,
    )
  ) {
    mismatches.push("apiContractVersion");
  }
  if (input.frontend.assetManifestHash !== input.runtime.assetManifestHash) {
    mismatches.push("assetManifestHash");
  }
  const releaseWarning =
    input.frontend.releaseId === input.runtime.releaseId
      ? null
      : "releaseId";
  return Object.freeze({
    compatible: mismatches.length === 0,
    mismatches: Object.freeze(mismatches),
    warnings: Object.freeze(releaseWarning ? [releaseWarning] : []),
  });
 }
 /**
 * @param {{ required?: string[], properties?: Record<string, unknown> }} before
 * @param {{ required?: string[], properties?: Record<string, unknown> }} after
 */
 export function classifyObjectSchemaChange(before, after) {
  const beforeRequired = new Set(before.required ?? []);
  const afterRequired = new Set(after.required ?? []);
  const removedProperties = Object.keys(before.properties ?? {}).filter(
    (key) => !(key in (after.properties ?? {})),
  );
  const addedRequired = [...afterRequired].filter(
    (key) => !beforeRequired.has(key),
  );
  if (removedProperties.length > 0 || addedRequired.length > 0) return "breaking";
  const addedProperties = Object.keys(after.properties ?? {}).filter(
    (key) => !(key in (before.properties ?? {})),
  );
  return addedProperties.length > 0 ? "additive" : "none";
 }
@@ -1,96 +0,0 @@
 /**
 * @param {{
 *   initialJsGzipBytes: number,
 *   lazyChunks: Array<{ path: string, gzipBytes: number }>
 * }} measurements
 * @param {{ initialJsGzipBytes: number, lazyChunkGzipBytes: number }} thresholds
 */
 export function evaluateBundleBudget(measurements, thresholds) {
  const initialPassed =
    measurements.initialJsGzipBytes <= thresholds.initialJsGzipBytes;
  const lazyResults = measurements.lazyChunks.map((chunk) => ({
    ...chunk,
    threshold: thresholds.lazyChunkGzipBytes,
    passed: chunk.gzipBytes <= thresholds.lazyChunkGzipBytes,
  }));
  return Object.freeze({
    initialPassed,
    lazyResults: Object.freeze(lazyResults),
    passed: initialPassed && lazyResults.every((chunk) => chunk.passed),
  });
 }
 /**
 * @param {{
 *   context?: Record<string, unknown>,
 *   metrics: { lcpMs: number, cls: number, namedInteractionMs: number }
 * }} report
 * @param {{ lcpMs: number, cls: number, namedInteractionMs: number }} thresholds
 */
 export function evaluateLabBudget(report, thresholds) {
  const requiredContext = [
    "runner",
    "browser",
    "viewport",
    "network",
    "cpu",
    "cache",
    "build",
  ];
  const missingContext = requiredContext.filter(
    (field) => report.context?.[field] === undefined,
  );
  const results = {
    lcp: report.metrics.lcpMs <= thresholds.lcpMs,
    cls: report.metrics.cls <= thresholds.cls,
    namedInteraction:
      report.metrics.namedInteractionMs <= thresholds.namedInteractionMs,
  };
  return Object.freeze({
    missingContext: Object.freeze(missingContext),
    results: Object.freeze(results),
    passed: missingContext.length === 0 && Object.values(results).every(Boolean),
  });
 }
 /** @param {number[]} values */
 export function percentile75(values) {
  if (values.length === 0) return null;
  const sorted = [...values].sort((left, right) => left - right);
  return sorted[Math.ceil(sorted.length * 0.75) - 1];
 }
 /**
 * @param {{
 *   metrics: { p75LcpMs: number | null, p75Cls: number | null, p75InpMs: number | null },
 *   eligibleSamples: number
 * }} report
 * @param {{
 *   p75LcpMs: number,
 *   p75Cls: number,
 *   p75InpMs: number,
 *   minimumEligibleSamples: number | null
 * }} thresholds
 */
 export function evaluateFieldBudget(report, thresholds) {
  if (
    thresholds.minimumEligibleSamples === null ||
    report.eligibleSamples < thresholds.minimumEligibleSamples ||
    Object.values(report.metrics).some((value) => value === null)
  ) {
    return Object.freeze({
      status: /** @type {const} */ ("FAIL_UNVERIFIED"),
      passed: false,
    });
  }
  const passed =
    /** @type {number} */ (report.metrics.p75LcpMs) <= thresholds.p75LcpMs &&
    /** @type {number} */ (report.metrics.p75Cls) <= thresholds.p75Cls &&
    /** @type {number} */ (report.metrics.p75InpMs) <= thresholds.p75InpMs;
  return Object.freeze({
    status: passed
      ? /** @type {const} */ ("PASS")
      : /** @type {const} */ ("FAIL_THRESHOLD"),
    passed,
  });
 }
@@ -1,16 +0,0 @@
 /**
 * @typedef {"authenticated" | "unauthenticated" | "recovery-pending" | "integration-failed"} SessionState
 */
 /**
 * The session is opaque: credentials are attached without exposing tokens.
 *
 * @typedef {{
 *   getState(): SessionState,
 *   attach(request: Request): Promise<Request>,
 *   recover(): Promise<"restored" | "no-session">,
 *   onUnauthenticated(): void
 * }} AuthSessionPort
 */
 export {};
@@ -1,29 +0,0 @@
 /**
 * @typedef {{
 *   now(): number,
 *   sleep(milliseconds: number, signal?: AbortSignal): Promise<void>
 * }} ClockPort
 */
 /** @type {ClockPort} */
 export const systemClock = Object.freeze({
  now: () => Date.now(),
  sleep(milliseconds, signal) {
    return new Promise((resolve, reject) => {
      if (signal?.aborted) {
        reject(signal.reason);
        return;
      }
      const timer = setTimeout(resolve, milliseconds);
      signal?.addEventListener(
        "abort",
        () => {
          clearTimeout(timer);
          reject(signal.reason);
        },
        { once: true },
      );
    });
  },
 });
@@ -1,12 +0,0 @@
 /**
 * @typedef {{
 *   read(key: readonly unknown[]): { ok: true, value: unknown } |
 *     { ok: false, error: import("../../contracts/errors.js").ApiFailure },
 *   write(key: readonly unknown[], value: unknown): { ok: true } |
 *     { ok: false, error: import("../../contracts/errors.js").ApiFailure },
 *   invalidate(namespace: readonly unknown[]): Promise<{ ok: true } |
 *     { ok: false, error: import("../../contracts/errors.js").ApiFailure }>
 * }} QueryCachePort
 */
 export {};
@@ -1,13 +0,0 @@
 /**
 * @typedef {{
 *   getCurrent(): Promise<{
 *     buildId: string,
 *     configSchemaVersion: string,
 *     apiContractVersion: string,
 *     assetManifestHash: string,
 *     releaseId: string
 *   }>
 * }} ReleaseInfoPort
 */
 export {};
@@ -1,28 +0,0 @@
 /**
 * @template Query
 * @template Model
 * @typedef {{ execute(query: Query, context?: RequestContext): Promise<Result<Model>> }} ResourceQueryPort
 */
 /**
 * @template Command
 * @template Model
 * @typedef {{ execute(command: Command, context?: RequestContext): Promise<Result<Model>> }} ResourceCommandPort
 */
 /**
 * @typedef {{
 *   operationId: string,
 *   routeId: string,
 *   signal?: AbortSignal,
 *   idempotencyKey?: string
 * }} RequestContext
 */
 /**
 * @template Value
 * @typedef {{ ok: true, value: Value, meta?: Record<string, unknown> } |
 *   { ok: false, error: import("../../contracts/errors.js").ApiFailure }} Result
 */
 export {};
@@ -1,13 +0,0 @@
 /**
 * @typedef {{
 *   read(logicalName: string): { ok: true, value: unknown } |
 *     { ok: false, error: import("../../contracts/errors.js").ApiFailure },
 *   write(logicalName: string, value: unknown): { ok: true } |
 *     { ok: false, error: import("../../contracts/errors.js").ApiFailure,
 *       fallback?: string },
 *   remove(logicalName: string): { ok: true } |
 *     { ok: false, error: import("../../contracts/errors.js").ApiFailure }
 * }} StoragePort
 */
 export {};
@@ -1,5 +0,0 @@
 /**
 * @typedef {{ emit(eventName: string, attributes: Record<string, unknown>): void }} TelemetryPort
 */
 export {};
@@ -1,34 +0,0 @@
 const RECOVERABLE_KINDS = new Set(["CHUNK_LOAD_FAILURE", "DEPLOY_MISMATCH"]);
 /**
 * @param {{
 *   failureKind: string,
 *   manifestLoaded: boolean,
 *   currentBuildId: string,
 *   activeReleaseId: string,
 *   storage: import("../ports/storage-port.js").StoragePort
 * }} input
 */
 export function decideChunkRecovery(input) {
  if (!RECOVERABLE_KINDS.has(input.failureKind)) {
    return { action: "support", reason: "not-recoverable" };
  }
  if (!input.manifestLoaded) {
    return { action: "support", reason: "manifest-unavailable" };
  }
  if (input.activeReleaseId === input.currentBuildId) {
    return { action: "support", reason: "same-release" };
  }
  const releasePair = `${input.currentBuildId}->${input.activeReleaseId}`;
  const guard = input.storage.read("CHUNK_RELOAD_GUARD");
  if (!guard.ok || guard.value === releasePair) {
    return { action: "support", reason: "reload-already-attempted" };
  }
  const recorded = input.storage.write("CHUNK_RELOAD_GUARD", releasePair);
  if (!recorded.ok) {
    return { action: "support", reason: "guard-write-failed" };
  }
  return { action: "reload-once", releasePair };
 }
@@ -1,81 +0,0 @@
 export const ASYNC_BASE_STATES = Object.freeze([
  "initial-loading",
  "success",
  "empty",
  "terminal-error",
 ]);
 export const ASYNC_OVERLAYS = Object.freeze([
  "refreshing",
  "stale-degraded",
  "mutation-pending",
  "mutation-conflict",
 ]);
 /**
 * @typedef {{
 *   data?: unknown,
 *   isInitialLoading?: boolean,
 *   failure?: import("../../contracts/errors.js").ApiFailure,
 *   isFetching?: boolean,
 *   isStale?: boolean,
 *   isDegraded?: boolean,
 *   isMutationPending?: boolean,
 *   hasMutationConflict?: boolean
 * }} AsyncSignals
 */
 /** @param {AsyncSignals} signals */
 export function deriveAsyncState(signals) {
  const hasData = signals.data !== undefined && signals.data !== null;
  const empty =
    hasData &&
    ((Array.isArray(signals.data) && signals.data.length === 0) ||
      signals.data === "");
  let base;
  if (signals.isInitialLoading && !hasData) {
    base = "initial-loading";
  } else if (signals.failure && !hasData) {
    base = "terminal-error";
  } else if (empty) {
    base = "empty";
  } else if (hasData) {
    base = "success";
  } else {
    base = "initial-loading";
  }
  const overlay = Object.freeze({
    refreshing: Boolean(signals.isFetching && hasData),
    staleDegraded: Boolean(signals.isStale && signals.isDegraded && hasData),
    mutationPending: Boolean(signals.isMutationPending && hasData),
    mutationConflict: Boolean(signals.hasMutationConflict && hasData),
  });
  const state = {
    base,
    data: base === "success" || base === "empty" ? signals.data : undefined,
    failure: base === "terminal-error" ? signals.failure : undefined,
    overlay,
    indicator: selectOverlayIndicator(overlay),
  };
  return Object.freeze(state);
 }
 /**
 * @param {{
 *   refreshing: boolean,
 *   staleDegraded: boolean,
 *   mutationPending: boolean,
 *   mutationConflict: boolean
 * }} overlay
 */
 export function selectOverlayIndicator(overlay) {
  if (overlay.mutationConflict) return "mutation-conflict";
  if (overlay.mutationPending) return "mutation-pending";
  if (overlay.staleDegraded) return "stale-degraded";
  if (overlay.refreshing) return "refreshing";
  return null;
 }
@@ -1,16 +0,0 @@
 /**
 * @param {import("../../domain/models/resource.js").Resource} resource
 * @param {(value: Date) => string} [formatDate]
 */
 export function toResourceViewModel(
  resource,
  formatDate = (value) => new Intl.DateTimeFormat("ko-KR").format(value),
 ) {
  return Object.freeze({
    resourceId: resource.id,
    title: resource.displayName,
    createdAtLabel: resource.createdAt
      ? formatDate(new Date(resource.createdAt))
      : null,
  });
 }
@@ -1,23 +0,0 @@
 import { createApplication } from "../application/create-application.js";
 /**
 * This is the only module allowed to join concrete adapters to application
 * ports. Boot phases are explicit so failures can stop before product mount.
 *
 * @param {{
 *   loadConfig(): Promise<Record<string, unknown>>,
 *   loadRelease(config: Record<string, unknown>): Promise<Record<string, unknown>>,
 *   createAdapters(context: {
 *     config: Record<string, unknown>,
 *     release: Record<string, unknown>
 *   }): Promise<Parameters<typeof createApplication>[0]>
 * }} factories
 */
 export async function createCompositionRoot(factories) {
  const config = await factories.loadConfig();
  const release = await factories.loadRelease(config);
  const ports = await factories.createAdapters({ config, release });
  const application = createApplication(ports);
  return Object.freeze({ config, release, ports, application });
 }
@@ -1,104 +0,0 @@
 import { assertSafeConfigNames, getBuildConfig } from "../contracts/env.js";
 import { validateRuntimeConfig } from "./runtime-config-schema.js";
 export class BootConfigError extends Error {
  /**
   * @param {string} code
   * @param {{ buildId: string, configSchemaVersion?: string, releaseId?: string }} safe
   */
  constructor(code, safe) {
    super("Runtime configuration could not be loaded");
    this.name = "BootConfigError";
    this.kind = "BOOT_CONFIG_FAILURE";
    this.code = code;
    this.safe = Object.freeze({
      kind: this.kind,
      code,
      buildId: safe.buildId,
      configSchemaVersion: safe.configSchemaVersion,
      releaseId: safe.releaseId,
      supportReference: `${safe.buildId}:${code}`,
    });
  }
 }
 /**
 * @param {{
 *   fetcher?: typeof fetch,
 *   buildConfig?: ReturnType<typeof getBuildConfig>,
 *   now?: () => number
 * }} [options]
 */
 export async function loadRuntimeConfig(options = {}) {
  const fetcher = options.fetcher ?? fetch;
  const buildConfig = options.buildConfig ?? getBuildConfig();
  const now = options.now ?? performance.now.bind(performance);
  const startedAt = now();
  let response;
  try {
    response = await fetcher(buildConfig.runtimeConfigUrl, {
      cache: "no-store",
      headers: { Accept: "application/json" },
    });
  } catch {
    throw new BootConfigError("CONFIG_FETCH_FAILED", {
      buildId: buildConfig.buildId,
    });
  }
  if (!response.ok) {
    throw new BootConfigError("CONFIG_HTTP_FAILED", {
      buildId: buildConfig.buildId,
    });
  }
  let rawConfig;
  try {
    rawConfig = await response.json();
  } catch {
    throw new BootConfigError("CONFIG_JSON_INVALID", {
      buildId: buildConfig.buildId,
    });
  }
  if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) {
    throw new BootConfigError("CONFIG_SHAPE_INVALID", {
      buildId: buildConfig.buildId,
    });
  }
  try {
    assertSafeConfigNames(rawConfig);
  } catch {
    throw new BootConfigError("CONFIG_SECRET_NAME_REJECTED", {
      buildId: buildConfig.buildId,
    });
  }
  const validated = validateRuntimeConfig(rawConfig);
  if (!validated.success) {
    throw new BootConfigError("CONFIG_SCHEMA_INVALID", {
      buildId: buildConfig.buildId,
      configSchemaVersion:
        typeof rawConfig.CONFIG_SCHEMA_VERSION === "string"
          ? rawConfig.CONFIG_SCHEMA_VERSION
          : undefined,
      releaseId: typeof rawConfig.RELEASE_ID === "string" ? rawConfig.RELEASE_ID : undefined,
    });
  }
  if (validated.data.BUILD_ID && validated.data.BUILD_ID !== buildConfig.buildId) {
    throw new BootConfigError("CONFIG_BUILD_MISMATCH", {
      buildId: buildConfig.buildId,
      configSchemaVersion: validated.data.CONFIG_SCHEMA_VERSION,
      releaseId: validated.data.RELEASE_ID,
    });
  }
  return Object.freeze({
    config: validated.data,
    build: buildConfig,
    validationDurationMs: now() - startedAt,
  });
 }
@@ -1,11 +1,14 @@
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
-import { createAnonymousSessionAdapter } from "../adapters/auth/external-session-adapter.js";
+function BootstrapShell() {
-import { BootErrorShell } from "../presentation/boundaries/boot-error-shell.jsx";
+  return (
-import { AppRouter } from "../presentation/routes/app-router.jsx";
+    <main>
-import { BootConfigError, loadRuntimeConfig } from "./load-runtime-config.js";
+      <h1>Clean Architecture Frontend</h1>
-import "../presentation/styles/theme.css";
+      <p>런타임 계약을 불러오는 중입니다.</p>
    </main>
  );
 }
 const rootElement = document.getElementById("root");
@@ -13,27 +16,8 @@ if (!rootElement) {
  throw new Error("Missing #root mount element");
 }
-const root = createRoot(rootElement);
+createRoot(rootElement).render(
-
+  <StrictMode>
-async function boot() {
+    <BootstrapShell />
-  try {
+  </StrictMode>,
-    const runtime = await loadRuntimeConfig();
+);
    root.render(
      <StrictMode>
        <AppRouter
          authSession={createAnonymousSessionAdapter()}
          basename={runtime.build.routerBasePath}
        />
      </StrictMode>,
    );
  } catch (error) {
    const safe =
      error instanceof BootConfigError
        ? error.safe
        : { supportReference: "boot:unknown" };
    root.render(<BootErrorShell {...safe} />);
  }
 }
 void boot();
@@ -1,66 +0,0 @@
 import { z } from "zod";
 const version = z.string().regex(/^\d+(?:\.\d+){0,2}$/);
 export const runtimeConfigSchema = z
  .object({
    APP_ENV: z.enum(["local", "development", "staging", "production"]),
    API_BASE_URL: z.url(),
    REQUEST_TIMEOUT_MS: z.int().min(100).max(60_000).default(10_000),
    MAX_RETRY_ATTEMPTS: z.int().min(0).max(2).default(2),
    TELEMETRY_ENABLED: z.boolean(),
    TELEMETRY_ENDPOINT: z.url().optional(),
    AUTH_MODE: z.literal("external"),
    CONFIG_SCHEMA_VERSION: version,
    API_CONTRACT_VERSION: version,
    RELEASE_MANIFEST_URL: z.string().min(1).default("/release-manifest.json"),
    RELEASE_ID: z.string().min(1).optional(),
    BUILD_ID: z.string().min(1).optional(),
  })
  .strict()
  .superRefine((config, context) => {
    if (config.TELEMETRY_ENABLED && !config.TELEMETRY_ENDPOINT) {
      context.addIssue({
        code: "custom",
        path: ["TELEMETRY_ENDPOINT"],
        message: "required when telemetry is enabled",
      });
    }
    const local = config.APP_ENV === "local" || config.APP_ENV === "development";
    const endpointEntries =
      /** @type {Array<[string, string | undefined]>} */ ([
        ["API_BASE_URL", config.API_BASE_URL],
        ["TELEMETRY_ENDPOINT", config.TELEMETRY_ENDPOINT],
      ]);
    for (const [key, value] of endpointEntries) {
      if (value && !local && new URL(value).protocol !== "https:") {
        context.addIssue({
          code: "custom",
          path: [key],
          message: "HTTPS is required outside local environments",
        });
      }
    }
  });
 /** @param {unknown} value */
 export function validateRuntimeConfig(value) {
  const result = runtimeConfigSchema.safeParse(value);
  if (!result.success) {
    return {
      success: /** @type {false} */ (false),
      issues: result.error.issues.map((issue) => ({
        path: issue.path.join("."),
        code: issue.code,
      })),
    };
  }
  return {
    success: /** @type {true} */ (true),
    data: structuredClone(result.data),
  };
 }
@@ -1,51 +0,0 @@
 /**
 * @typedef {{
 *   method: string,
 *   path: string,
 *   operationId: string,
 *   auth: "none" | "external-session",
 *   timeoutMs: number,
 *   idempotency: "safe" | "keyed" | "none",
 *   requestSchema: string,
 *   responseSchema: string,
 *   owner: string
 * }} ApiOperation
 */
 /** @param {ApiOperation} definition */
 const operation = (definition) => Object.freeze(definition);
 export const API_OPERATIONS = Object.freeze({
  LIST_SAMPLE_RESOURCES: operation({
    method: "GET",
    path: "/api/sample/resources",
    operationId: "LIST_SAMPLE_RESOURCES",
    auth: "external-session",
    timeoutMs: 10_000,
    idempotency: "safe",
    requestSchema: "SampleResourceListQuery",
    responseSchema: "SampleResourceListPayload",
    owner: "feature-sample-feature-slice-contract-fixture",
  }),
  CREATE_SAMPLE_RESOURCE: operation({
    method: "POST",
    path: "/api/sample/resources",
    operationId: "CREATE_SAMPLE_RESOURCE",
    auth: "external-session",
    timeoutMs: 10_000,
    idempotency: "keyed",
    requestSchema: "CreateSampleResourceCommand",
    responseSchema: "SampleResourcePayload",
    owner: "feature-sample-feature-slice-contract-fixture",
  }),
 });
 /** @param {string} operationId */
 export function getApiOperation(operationId) {
  const registry = /** @type {Record<string, ApiOperation>} */ (API_OPERATIONS);
  const selected = registry[operationId];
  if (!selected) {
    throw new Error(`Unregistered API operation: ${operationId}`);
  }
  return selected;
 }
@@ -1,54 +0,0 @@
 const forbiddenConfigName = /(SECRET|PASSWORD|PRIVATE_KEY|TOKEN)/i;
 export const ENV_REGISTRY = Object.freeze({
  VITE_BUILD_ID: build("public-metadata", true, null),
  VITE_COMMIT_SHA: build("public-metadata", false, "local"),
  VITE_ROUTER_BASE_PATH: build("compile-time", true, "/"),
  VITE_RUNTIME_CONFIG_URL: build("compile-time", true, "/config.json"),
  APP_ENV: runtime("public", true, null),
  API_BASE_URL: runtime("public-sensitive", true, null),
  REQUEST_TIMEOUT_MS: runtime("public", false, 10_000),
  MAX_RETRY_ATTEMPTS: runtime("public", false, 2),
  TELEMETRY_ENABLED: runtime("public", true, false),
  TELEMETRY_ENDPOINT: runtime("public-sensitive", false, null),
  AUTH_MODE: runtime("public", true, "external"),
  CONFIG_SCHEMA_VERSION: runtime("public", true, null),
  API_CONTRACT_VERSION: runtime("public", true, null),
  RELEASE_MANIFEST_URL: runtime("public", true, "/release-manifest.json"),
 });
 /**
 * @param {string} classification
 * @param {boolean} required
 * @param {unknown} defaultValue
 */
 function build(classification, required, defaultValue) {
  return Object.freeze({ phase: "build", classification, required, defaultValue });
 }
 /**
 * @param {string} classification
 * @param {boolean} required
 * @param {unknown} defaultValue
 */
 function runtime(classification, required, defaultValue) {
  return Object.freeze({ phase: "runtime", classification, required, defaultValue });
 }
 /** @param {Record<string, unknown>} config */
 export function assertSafeConfigNames(config) {
  for (const name of Object.keys(config)) {
    if (forbiddenConfigName.test(name)) {
      throw new Error(`Forbidden client configuration key: ${name}`);
    }
  }
 }
 export function getBuildConfig(environment = import.meta.env) {
  const buildId = environment.VITE_BUILD_ID || "local-build";
  const commitSha = environment.VITE_COMMIT_SHA || "local";
  const routerBasePath = environment.VITE_ROUTER_BASE_PATH || "/";
  const runtimeConfigUrl = environment.VITE_RUNTIME_CONFIG_URL || "/config.json";
  return Object.freeze({ buildId, commitSha, routerBasePath, runtimeConfigUrl });
 }
@@ -1,245 +0,0 @@
 const DROP_SENSITIVE = Object.freeze([
  "cause",
  "body",
  "headers",
  "authorization",
  "url",
  "query",
  "stack",
  "storageValue",
 ]);
 /**
 * @typedef {"retry" | "reauth" | "navigate" | "reload-once" |
 *   "contact-support" | "none"} ErrorAction
 */
 /**
 * @typedef {{
 *   kind: string,
 *   defaultRetryable: boolean,
 *   severity: string,
 *   userMessageKey: string,
 *   action: ErrorAction,
 *   telemetryEvent: string,
 *   redaction: readonly string[]
 * }} ErrorDefinition
 */
 /**
 * @param {string} kind
 * @param {boolean} defaultRetryable
 * @param {string} severity
 * @param {ErrorAction} action
 * @param {string} [telemetryEvent]
 * @returns {Readonly<ErrorDefinition>}
 */
 const row = (
  kind,
  defaultRetryable,
  severity,
  action,
  telemetryEvent = "api.request.failed",
 ) =>
  Object.freeze({
    kind,
    defaultRetryable,
    severity,
    userMessageKey: `error.${kind.toLowerCase()}`,
    action,
    telemetryEvent,
    redaction: DROP_SENSITIVE,
  });
 export const ERROR_REGISTRY = Object.freeze({
  NETWORK_UNREACHABLE: row("NETWORK_UNREACHABLE", true, "warning", "retry"),
  REQUEST_TIMEOUT: row("REQUEST_TIMEOUT", true, "warning", "retry"),
  REQUEST_ABORTED: row("REQUEST_ABORTED", false, "info", "none"),
  CONTENT_TYPE_MISMATCH: row(
    "CONTENT_TYPE_MISMATCH",
    false,
    "error",
    "contact-support",
  ),
  MALFORMED_JSON: row("MALFORMED_JSON", false, "error", "contact-support"),
  ENVELOPE_MISMATCH: row("ENVELOPE_MISMATCH", false, "error", "contact-support"),
  SCHEMA_MISMATCH: row("SCHEMA_MISMATCH", false, "error", "contact-support"),
  AUTH_REQUIRED: row("AUTH_REQUIRED", false, "info", "reauth"),
  AUTH_INTEGRATION_FAILURE: row(
    "AUTH_INTEGRATION_FAILURE",
    false,
    "error",
    "contact-support",
  ),
  FORBIDDEN: row("FORBIDDEN", false, "warning", "navigate"),
  NOT_FOUND: row("NOT_FOUND", false, "info", "navigate"),
  CONFLICT: row("CONFLICT", false, "warning", "retry"),
  VALIDATION_REJECTED: row("VALIDATION_REJECTED", false, "info", "none"),
  UNKNOWN_CLIENT_FAILURE: row(
    "UNKNOWN_CLIENT_FAILURE",
    false,
    "warning",
    "contact-support",
  ),
  RATE_LIMITED: row("RATE_LIMITED", true, "warning", "retry"),
  SERVER_FAILURE: row("SERVER_FAILURE", true, "error", "retry"),
  CHUNK_LOAD_FAILURE: row(
    "CHUNK_LOAD_FAILURE",
    false,
    "error",
    "reload-once",
    "release.mismatch.detected",
  ),
  BOOT_CONFIG_FAILURE: row(
    "BOOT_CONFIG_FAILURE",
    false,
    "error",
    "contact-support",
    "app.boot.failed",
  ),
  RELEASE_MANIFEST_FAILURE: row(
    "RELEASE_MANIFEST_FAILURE",
    false,
    "error",
    "contact-support",
    "app.boot.failed",
  ),
  DEPLOY_MISMATCH: row(
    "DEPLOY_MISMATCH",
    false,
    "error",
    "reload-once",
    "release.mismatch.detected",
  ),
  STORAGE_UNAVAILABLE: row(
    "STORAGE_UNAVAILABLE",
    false,
    "warning",
    "none",
    "storage.operation.failed",
  ),
  STORAGE_QUOTA_EXCEEDED: row(
    "STORAGE_QUOTA_EXCEEDED",
    false,
    "warning",
    "none",
    "storage.operation.failed",
  ),
  RENDER_FAILURE: row(
    "RENDER_FAILURE",
    false,
    "error",
    "reload-once",
    "ui.render.failed",
  ),
  TELEMETRY_FAILURE: row(
    "TELEMETRY_FAILURE",
    false,
    "info",
    "none",
    "telemetry.delivery.dropped",
  ),
  QUERY_CACHE_FAILURE: row(
    "QUERY_CACHE_FAILURE",
    false,
    "error",
    "retry",
    "query.cache.failed",
  ),
  UNKNOWN_FAILURE: row("UNKNOWN_FAILURE", false, "error", "contact-support"),
 });
 /**
 * @typedef {{
 *   kind: string,
 *   code: string,
 *   httpStatus?: number,
 *   retryable: boolean,
 *   operationId: string,
 *   attemptCount: number,
 *   requestId?: string,
 *   traceId?: string,
 *   retryAfterMs?: number,
 *   userMessageKey: string,
 *   action: ErrorAction,
 *   causeClass?: string
 * }} ApiFailure
 */
 /**
 * @param {string} kind
 * @param {string} operationId
 * @param {number} attempt
 * @param {{
 *   code?: string,
 *   httpStatus?: number,
 *   requestId?: string,
 *   traceId?: string,
 *   retryAfterMs?: number,
 *   causeClass?: string
 * }} [details]
 * @returns {ApiFailure}
 */
 export function createFailure(kind, operationId, attempt, details = {}) {
  const registry =
    /** @type {Readonly<Record<string, Readonly<ErrorDefinition>>>} */ (
      ERROR_REGISTRY
    );
  const definition =
    registry[kind] ?? ERROR_REGISTRY.UNKNOWN_FAILURE;
  return Object.freeze({
    kind: definition.kind,
    code: typeof details.code === "string" ? details.code : definition.kind,
    retryable: definition.defaultRetryable,
    operationId,
    attemptCount: Math.max(1, attempt + 1),
    ...(Number.isInteger(details.httpStatus)
      ? { httpStatus: details.httpStatus }
      : {}),
    ...(typeof details.requestId === "string" ? { requestId: details.requestId } : {}),
    ...(typeof details.traceId === "string" ? { traceId: details.traceId } : {}),
    ...(typeof details.retryAfterMs === "number"
      ? { retryAfterMs: details.retryAfterMs }
      : {}),
    ...(typeof details.causeClass === "string"
      ? { causeClass: details.causeClass }
      : {}),
    userMessageKey: definition.userMessageKey,
    action: definition.action,
  });
 }
 /** @param {number} status */
 export function kindForStatus(status) {
  if (status === 401) return "AUTH_REQUIRED";
  if (status === 403) return "FORBIDDEN";
  if (status === 404) return "NOT_FOUND";
  if (status === 409) return "CONFLICT";
  if (status === 422) return "VALIDATION_REJECTED";
  if (status === 429) return "RATE_LIMITED";
  if (status >= 500) return "SERVER_FAILURE";
  if (status >= 400) return "UNKNOWN_CLIENT_FAILURE";
  return "ENVELOPE_MISMATCH";
 }
 /**
 * Total catch-all that intentionally discards the thrown value.
 *
 * @param {unknown} value
 * @param {{ operationId?: string, attempt?: number }} [context]
 */
 export function normalizeUnknownFailure(value, context = {}) {
  const causeClass =
    value instanceof Error
      ? value.name
      : value === null
        ? "null"
        : typeof value;
  return createFailure(
    "UNKNOWN_FAILURE",
    context.operationId ?? "UNKNOWN_OPERATION",
    context.attempt ?? 0,
    { code: "UNKNOWN_FAILURE", causeClass },
  );
 }
@@ -1,36 +0,0 @@
 const RESOURCE_NAMESPACE = Object.freeze(["resource", 1]);
 export const queryKeys = Object.freeze({
  resource: Object.freeze({
    all: () => RESOURCE_NAMESPACE,
    list: (filters = {}) =>
      Object.freeze([...RESOURCE_NAMESPACE, "list", canonicalize(filters)]),
    /** @param {string} resourceId */
    detail: (resourceId) =>
      Object.freeze([...RESOURCE_NAMESPACE, "detail", String(resourceId)]),
  }),
 });
 export const QUERY_REGISTRY = Object.freeze({
  RESOURCE: Object.freeze({
    namespace: RESOURCE_NAMESPACE,
    serialization: "canonical-object-order",
    identity: "no-pii-token-or-raw-url",
    invalidation: "resource namespace after successful mutation",
    version: 1,
    persistence: "disabled",
  }),
 });
 /** @param {unknown} value @returns {unknown} */
 export function canonicalize(value) {
  if (Array.isArray(value)) return value.map(canonicalize);
  if (value && typeof value === "object") {
    return Object.fromEntries(
      Object.entries(value)
        .sort(([left], [right]) => left.localeCompare(right))
        .map(([key, item]) => [key, canonicalize(item)]),
    );
  }
  return value;
 }
@@ -1,65 +0,0 @@
 import { verifyCompatibilityTuple } from "../application/policies/compatibility.js";
 export const RELEASE_TOKEN_REGISTRY = Object.freeze({
  appVersion: token("appVersion", "manifest", "human release label"),
  buildId: token("buildId", "CI build", "asset and HTML coherence"),
  commitSha: token("commitSha", "VCS", "source traceability"),
  configSchemaVersion: token(
    "configSchemaVersion",
    "runtime config schema",
    "boot compatibility",
  ),
  apiContractVersion: token(
    "apiContractVersion",
    "frontend/backend agreement",
    "schema compatibility",
  ),
  assetManifestHash: token(
    "assetManifestHash",
    "build output",
    "chunk integrity and mismatch detection",
  ),
  releaseId: token("releaseId", "deploy system", "rollback target"),
  builtAt: token("builtAt", "CI", "diagnostics only; never cache identity"),
 });
 /**
 * @param {string} name
 * @param {string} source
 * @param {string} compatibilityRole
 */
 function token(name, source, compatibilityRole) {
  return Object.freeze({ token: name, source, compatibilityRole });
 }
 /**
 * Compare a release manifest and runtime configuration structurally. Version
 * fields are delegated to the numeric compatibility policy, never compared
 * lexically.
 *
 * @param {{
 *   buildId: string,
 *   configSchemaVersion: string,
 *   apiContractVersion: string,
 *   assetManifestHash: string,
 *   releaseId: string
 * }} release
 * @param {{
 *   BUILD_ID: string,
 *   CONFIG_SCHEMA_VERSION: string,
 *   API_CONTRACT_VERSION: string,
 *   RELEASE_ID: string
 * }} runtimeConfig
 */
 export function compareReleaseToRuntime(release, runtimeConfig) {
  return verifyCompatibilityTuple({
    frontend: release,
    runtime: {
      buildId: runtimeConfig.BUILD_ID,
      configSchemaVersion: runtimeConfig.CONFIG_SCHEMA_VERSION,
      apiContractVersion: runtimeConfig.API_CONTRACT_VERSION,
      assetManifestHash: release.assetManifestHash,
      releaseId: runtimeConfig.RELEASE_ID,
    },
  });
 }
@@ -1,63 +0,0 @@
 /**
 * @typedef {{
 *   routeId: string,
 *   path: string,
 *   paramsSchema: string | null,
 *   searchSchema: string | null,
 *   access: "public" | "session-required" | "integration-defined",
 *   loadingSurface: string,
 *   errorSurface: string,
 *   chunkId: string
 * }} RouteDefinition
 */
 /** @param {RouteDefinition} definition */
 const route = (definition) => Object.freeze(definition);
 export const ROUTE_REGISTRY = Object.freeze({
  APP_HOME: route({
    routeId: "APP_HOME",
    path: "/",
    paramsSchema: null,
    searchSchema: null,
    access: "public",
    loadingSurface: "app-shell",
    errorSurface: "route-boundary",
    chunkId: "route-home",
  }),
  SAMPLE_RESOURCE_LIST: route({
    routeId: "SAMPLE_RESOURCE_LIST",
    path: "/sample/resources",
    paramsSchema: null,
    searchSchema: "SampleResourceListQuery",
    access: "integration-defined",
    loadingSurface: "sample-resource-list",
    errorSurface: "feature-boundary",
    chunkId: "route-sample-resources",
  }),
  NOT_FOUND: route({
    routeId: "NOT_FOUND",
    path: "*",
    paramsSchema: null,
    searchSchema: null,
    access: "public",
    loadingSurface: "none",
    errorSurface: "not-found",
    chunkId: "route-not-found",
  }),
 });
 /** @param {string} routeId */
 export function getRoute(routeId) {
  const registry = /** @type {Record<string, Readonly<RouteDefinition>>} */ (
    ROUTE_REGISTRY
  );
  const selected = registry[routeId];
  if (!selected) throw new Error(`Unregistered route: ${routeId}`);
  return selected;
 }
 /** @param {string} routeId */
 export function routePath(routeId) {
  return getRoute(routeId).path;
 }
@@ -1,102 +0,0 @@
 const APP_NAMESPACE = "ca-frontend";
 export const STORAGE_REGISTRY = Object.freeze({
  COLOR_SCHEME: defineStorageKey({
    logicalName: "COLOR_SCHEME",
    scope: "preference",
    name: "color-scheme",
    backend: "localStorage",
    classification: "public-preference",
    schemaVersion: 1,
    ttl: null,
    migration: "discard",
    quotaFallback: "memory",
  }),
  CHUNK_RELOAD_GUARD: defineStorageKey({
    logicalName: "CHUNK_RELOAD_GUARD",
    scope: "release",
    name: "chunk-reload-guard",
    backend: "sessionStorage",
    classification: "opaque-cache",
    schemaVersion: 1,
    ttl: "session",
    migration: "discard",
    quotaFallback: "no-persist",
  }),
  QUERY_PERSISTENCE: defineStorageKey({
    logicalName: "QUERY_PERSISTENCE",
    scope: "cache",
    name: "query-persistence",
    backend: "disabled",
    classification: "sensitive-forbidden",
    schemaVersion: 1,
    ttl: null,
    migration: "discard",
    quotaFallback: "feature-disable",
  }),
  AUTH_TOKEN: defineStorageKey({
    logicalName: "AUTH_TOKEN",
    scope: "auth",
    name: "auth-token",
    backend: "forbidden",
    classification: "sensitive-forbidden",
    schemaVersion: 1,
    ttl: null,
    migration: "discard",
    quotaFallback: "feature-disable",
  }),
 });
 /**
 * @typedef {{
 *   logicalName: string,
 *   scope: string,
 *   name: string,
 *   backend: "memory" | "sessionStorage" | "localStorage" | "indexedDB" |
 *     "disabled" | "forbidden",
 *   classification: "public-preference" | "opaque-cache" | "sensitive-forbidden",
 *   schemaVersion: number,
 *   ttl: number | "session" | null,
 *   migration: "discard" | ((value: unknown) => unknown),
 *   quotaFallback: "memory" | "no-persist" | "feature-disable"
 * }} StorageKeyInput
 */
 /** @param {StorageKeyInput} definition */
 export function defineStorageKey(definition) {
  if (definition.classification === "sensitive-forbidden") {
    if (!["disabled", "forbidden"].includes(definition.backend)) {
      throw new Error("Sensitive client storage registration is forbidden");
    }
  }
  if (!Number.isInteger(definition.schemaVersion) || definition.schemaVersion < 1) {
    throw new Error("Storage schemaVersion must be a positive integer");
  }
  return Object.freeze({
    ...definition,
    physicalKey: buildPhysicalKey(
      definition.scope,
      definition.schemaVersion,
      definition.name,
    ),
  });
 }
 /** @param {string} scope @param {number} schemaVersion @param {string} name */
 export function buildPhysicalKey(scope, schemaVersion, name) {
  return `${APP_NAMESPACE}:${scope}:v${schemaVersion}:${name}`;
 }
 /** @param {string} logicalName */
 export function getStorageDefinition(logicalName) {
  const registry = /** @type {Record<string, ReturnType<typeof defineStorageKey>>} */ (
    STORAGE_REGISTRY
  );
  const definition = registry[logicalName];
  if (!definition) throw new Error(`Unregistered storage key: ${logicalName}`);
  if (definition.classification === "sensitive-forbidden") {
    throw new Error(`Forbidden storage key: ${logicalName}`);
  }
  return definition;
 }
@@ -1,145 +0,0 @@
 export const TELEMETRY_ATTRIBUTE_ALLOWLIST = Object.freeze([
  "app_version",
  "build_id",
  "release_id",
  "config_schema_version",
  "api_contract_version",
  "route_id",
  "operation_id",
  "error_kind",
  "http_status_group",
  "attempt_count_bucket",
  "duration_bucket",
  "component_boundary",
  "active_release_id",
  "mismatch_kind",
  "reason",
  "queue_size_bucket",
 ]);
 export const TELEMETRY_FORBIDDEN_ATTRIBUTES = Object.freeze([
  "access_token",
  "refresh_token",
  "authorization_header",
  "cookie",
  "email",
  "user_name",
  "raw_user_id",
  "raw_url",
  "query_string",
  "request_body",
  "response_body",
  "storage_value",
  "stack_in_user_message",
 ]);
 /**
 * @typedef {{
 *   eventName: string,
 *   trigger: string,
 *   requiredAttributes: readonly string[],
 *   optionalAttributes: readonly string[],
 *   forbiddenAttributes: readonly string[],
 *   sampling: string,
 *   delivery: string
 * }} TelemetryDefinition
 */
 /**
 * @param {string} eventName
 * @param {string} trigger
 * @param {string[]} requiredAttributes
 * @param {string[]} [optionalAttributes]
 * @param {string} [sampling]
 * @returns {Readonly<TelemetryDefinition>}
 */
 const event = (
  eventName,
  trigger,
  requiredAttributes,
  optionalAttributes = [],
  sampling = "all",
 ) =>
  Object.freeze({
    eventName,
    trigger,
    requiredAttributes: Object.freeze(requiredAttributes),
    optionalAttributes: Object.freeze(optionalAttributes),
    forbiddenAttributes: TELEMETRY_FORBIDDEN_ATTRIBUTES,
    sampling,
    delivery: "best-effort",
  });
 export const TELEMETRY_REGISTRY = Object.freeze({
  "app.boot.failed": event("app.boot.failed", "boot validation failure", [
    "error_kind",
    "build_id",
    "config_schema_version",
  ]),
  "api.request.failed": event("api.request.failed", "terminal API failure", [
    "error_kind",
    "http_status_group",
    "attempt_count_bucket",
    "route_id",
  ]),
  "ui.render.failed": event("ui.render.failed", "React boundary catch", [
    "route_id",
    "build_id",
    "component_boundary",
  ]),
  "release.mismatch.detected": event(
    "release.mismatch.detected",
    "release tuple mismatch",
    ["build_id", "active_release_id", "mismatch_kind"],
  ),
  "telemetry.delivery.dropped": event(
    "telemetry.delivery.dropped",
    "queue or sink failure",
    ["reason", "queue_size_bucket"],
    [],
    "internal-counter",
  ),
 });
 /**
 * @param {string} eventName
 * @param {Record<string, unknown>} attributes
 */
 export function projectTelemetryEvent(eventName, attributes) {
  const registry =
    /** @type {Record<string, (typeof TELEMETRY_REGISTRY)[keyof typeof TELEMETRY_REGISTRY]>} */ (
      TELEMETRY_REGISTRY
    );
  const definition = registry[eventName];
  if (!definition) {
    return {
      success: /** @type {false} */ (false),
      reason: "unregistered-event",
    };
  }
  const projected = Object.fromEntries(
    Object.entries(attributes).filter(
      ([key]) =>
        TELEMETRY_ATTRIBUTE_ALLOWLIST.includes(key) &&
        !TELEMETRY_FORBIDDEN_ATTRIBUTES.includes(key),
    ),
  );
  const missing = definition.requiredAttributes.filter(
    (key) => projected[key] === undefined,
  );
  if (missing.length > 0) {
    return {
      success: /** @type {false} */ (false),
      reason: "missing-required-attributes",
    };
  }
  return {
    success: /** @type {true} */ (true),
    event: Object.freeze({
      eventName,
      attributes: Object.freeze(projected),
    }),
  };
 }
@@ -1,19 +0,0 @@
 /**
 * @typedef {{
 *   id: string,
 *   displayName: string,
 *   createdAt: string | null
 * }} Resource
 */
 /** @param {Resource} values @returns {Readonly<Resource>} */
 export function createResource(values) {
  if (!values.id || !values.displayName) {
    throw new TypeError("Resource invariants require id and displayName");
  }
  return Object.freeze({
    id: values.id,
    displayName: values.displayName,
    createdAt: values.createdAt,
  });
 }
@@ -1,49 +0,0 @@
 /**
 * @param {{
 *   kind?: string,
 *   code?: string,
 *   buildId?: string,
 *   configSchemaVersion?: string,
 *   releaseId?: string,
 *   supportReference: string
 * }} props
 */
 export function BootErrorShell({
  kind = "BOOT_CONFIG_FAILURE",
  code = "BOOT_FAILED",
  buildId,
  configSchemaVersion,
  releaseId,
  supportReference,
 }) {
  return (
    <main role="alert">
      <h1>애플리케이션을 시작할 수 없습니다.</h1>
      <dl>
        <dt>오류</dt>
        <dd>{kind}</dd>
        <dt>코드</dt>
        <dd>{code}</dd>
        {buildId && (
          <>
            <dt>빌드</dt>
            <dd>{buildId}</dd>
          </>
        )}
        {configSchemaVersion && (
          <>
            <dt>설정 스키마</dt>
            <dd>{configSchemaVersion}</dd>
          </>
        )}
        {releaseId && (
          <>
            <dt>릴리스</dt>
            <dd>{releaseId}</dd>
          </>
        )}
      </dl>
      <p>지원 참조: {supportReference}</p>
    </main>
  );
 }
@@ -1,68 +0,0 @@
 import { Component } from "react";
 /**
 * @typedef {{
 *   children: React.ReactNode,
 *   boundaryName: string,
 *   routeId: string,
 *   buildId: string,
 *   telemetry?: import("../../application/ports/telemetry-port.js").TelemetryPort,
 *   fallback?: React.ReactNode
 * }} RenderBoundaryProps
 * @typedef {{ hasError: boolean }} RenderBoundaryState
 */
 /** @extends {Component<RenderBoundaryProps, RenderBoundaryState>} */
 export class RenderErrorBoundary extends Component {
  /** @param {RenderBoundaryProps} props */
  constructor(props) {
    super(props);
    this.state = { hasError: false };
  }
  static getDerivedStateFromError() {
    return { hasError: true };
  }
  componentDidCatch() {
    try {
      this.props.telemetry?.emit("ui.render.failed", {
        route_id: this.props.routeId,
        build_id: this.props.buildId,
        component_boundary: this.props.boundaryName,
      });
    } catch {
      // Telemetry must never recurse into another render failure.
    }
  }
  reset = () => {
    this.setState({ hasError: false });
  };
  render() {
    if (this.state.hasError) {
      return (
        this.props.fallback ?? (
          <section role="alert">
            <p>error.render_failure</p>
            <button type="button" onClick={this.reset}>
              retry
            </button>
          </section>
        )
      );
    }
    return this.props.children;
  }
 }
 /** @param {Omit<RenderBoundaryProps, "boundaryName">} props */
 export function RouteBoundary(props) {
  return <RenderErrorBoundary {...props} boundaryName="route" />;
 }
 /** @param {Omit<RenderBoundaryProps, "boundaryName">} props */
 export function FeatureBoundary(props) {
  return <RenderErrorBoundary {...props} boundaryName="feature" />;
 }
@@ -1,81 +0,0 @@
 /** @param {{ label?: string }} props */
 export function LoadingSurface({ label = "불러오는 중" }) {
  return (
    <section
      aria-busy="true"
      aria-label={label}
      aria-live="polite"
      aria-atomic="true"
    >
      <div className="ui-skeleton" aria-hidden="true" />
      <span className="sr-only">{label}</span>
    </section>
  );
 }
 /** @param {{ title?: string, action?: React.ReactNode }} props */
 export function EmptySurface({ title = "표시할 항목이 없습니다.", action }) {
  return (
    <section className="ui-empty" aria-live="polite">
      <p>{title}</p>
      {action}
    </section>
  );
 }
 /**
 * @param {{
 *   userMessageKey: string,
 *   action: "retry" | "reauth" | "navigate" | "reload-once" |
 *     "contact-support" | "none",
 *   onAction?: () => void
 * }} props
 */
 export function TerminalErrorSurface({ userMessageKey, action, onAction }) {
  return (
    <section
      className="ui-terminal-error"
      role="alert"
      aria-labelledby="terminal-error-message"
    >
      <p id="terminal-error-message">{userMessageKey}</p>
      {action !== "none" && (
        <button className="ui-button" type="button" onClick={onAction}>
          {action}
        </button>
      )}
    </section>
  );
 }
 /**
 * @param {{
 *   state: ReturnType<typeof import("../../application/view-models/async-state.js").deriveAsyncState>,
 *   children?: React.ReactNode,
 *   onAction?: () => void
 * }} props
 */
 export function AsyncSurface({ state, children, onAction }) {
  if (state.base === "initial-loading") return <LoadingSurface />;
  if (state.base === "empty") return <EmptySurface />;
  if (state.base === "terminal-error" && state.failure) {
    return (
      <TerminalErrorSurface
        userMessageKey={state.failure.userMessageKey}
        action={state.failure.action}
        onAction={onAction}
      />
    );
  }
  return (
    <section aria-busy={state.overlay.refreshing || state.overlay.mutationPending}>
      {state.indicator && (
        <p role="status" aria-live="polite">
          {state.indicator}
        </p>
      )}
      {children}
    </section>
  );
 }
@@ -1,81 +0,0 @@
 import {
  BrowserRouter,
  Link,
  Route,
  Routes,
 } from "react-router-dom";
 import { routePath } from "../../contracts/routes.js";
 import { decideRouteAccess } from "./navigation-policy.js";
 function HomePage() {
  return (
    <main className="ui-page">
      <h1>Clean Architecture Frontend</h1>
      <p>런타임 계약이 검증되었습니다.</p>
      <Link to={routePath("SAMPLE_RESOURCE_LIST")}>샘플 리소스</Link>
    </main>
  );
 }
 function SamplePlaceholder() {
  return (
    <main className="ui-page">
      <h1>샘플 리소스</h1>
      <p>계약 fixture를 준비하고 있습니다.</p>
    </main>
  );
 }
 function NotFoundPage() {
  return (
    <main className="ui-page">
      <h1>페이지를 찾을 수 없습니다.</h1>
      <Link to={routePath("APP_HOME")}>홈으로 이동</Link>
    </main>
  );
 }
 /**
 * @param {{
 *   authSession: import("../../application/ports/auth-session-port.js").AuthSessionPort
 * }} props
 */
 function GuardedSampleRoute({ authSession }) {
  const decision = decideRouteAccess(
    "SAMPLE_RESOURCE_LIST",
    authSession.getState(),
  );
  if (!decision.allowed) {
    return (
      <main className="ui-page">
        <h1>세션이 필요합니다.</h1>
        <button className="ui-button" type="button">
          로그인
        </button>
      </main>
    );
  }
  return <SamplePlaceholder />;
 }
 /**
 * @param {{
 *   authSession: import("../../application/ports/auth-session-port.js").AuthSessionPort,
 *   basename?: string
 * }} props
 */
 export function AppRouter({ authSession, basename = "/" }) {
  return (
    <BrowserRouter basename={basename}>
      <Routes>
        <Route path={routePath("APP_HOME")} element={<HomePage />} />
        <Route
          path={routePath("SAMPLE_RESOURCE_LIST")}
          element={<GuardedSampleRoute authSession={authSession} />}
        />
        <Route path={routePath("NOT_FOUND")} element={<NotFoundPage />} />
      </Routes>
    </BrowserRouter>
  );
 }
@@ -1,37 +0,0 @@
 import { getRoute } from "../../contracts/routes.js";
 /**
 * @param {string} routeId
 * @param {import("../../application/ports/auth-session-port.js").SessionState} sessionState
 */
 export function decideRouteAccess(routeId, sessionState) {
  const route = getRoute(routeId);
  if (route.access === "public") return { allowed: true, action: "none" };
  if (sessionState === "authenticated") {
    return { allowed: true, action: "none" };
  }
  if (sessionState === "recovery-pending") {
    return { allowed: false, action: "wait-for-session" };
  }
  return { allowed: false, action: "show-sign-in" };
 }
 export function createRedirectLoopGuard() {
  const visitedPairs = new Set();
  return Object.freeze({
    /**
     * @param {string} source
     * @param {string} target
     */
    allow(source, target) {
      const pair = `${source}->${target}`;
      if (source === target || visitedPairs.has(pair)) return false;
      visitedPairs.add(pair);
      return true;
    },
    reset() {
      visitedPairs.clear();
    },
  });
 }
@@ -1,9 +0,0 @@
 /**
 * Untrusted content is rendered as a React text node. HTML interpretation is
 * intentionally not offered by this template.
 *
 * @param {{ value: unknown }} props
 */
 export function SafeText({ value }) {
  return <span>{typeof value === "string" ? value : String(value ?? "")}</span>;
 }
@@ -1,71 +0,0 @@
@import "tailwindcss";
@theme {
  --color-surface: oklch(0.985 0.003 247);
  --color-surface-muted: oklch(0.94 0.01 247);
  --color-content: oklch(0.25 0.025 247);
  --color-content-muted: oklch(0.48 0.025 247);
  --color-action: oklch(0.55 0.18 255);
  --color-action-hover: oklch(0.48 0.2 255);
  --color-danger: oklch(0.55 0.2 25);
  --color-focus: oklch(0.72 0.16 225);
  --radius-control: 0.5rem;
  --radius-surface: 0.75rem;
  --spacing-page: 1.5rem;
  --font-sans: Inter, ui-sans-serif, system-ui, sans-serif;
 }
@layer base {
  :root {
    color: var(--color-content);
    background: var(--color-surface);
    font-family: var(--font-sans);
  }
  body {
    margin: 0;
  }
  :focus-visible {
    outline: 0.1875rem solid var(--color-focus);
    outline-offset: 0.1875rem;
  }
 }
@layer components {
  .ui-page {
    @apply mx-auto flex min-h-screen max-w-4xl flex-col gap-6 p-page;
  }
  .ui-panel {
    @apply rounded-surface border border-surface-muted bg-white p-6 shadow-sm;
  }
  .ui-button {
    @apply rounded-control bg-action px-4 py-2 font-semibold text-white;
  }
  .ui-button:hover {
    @apply bg-action-hover;
  }
  .ui-skeleton {
    @apply h-24 animate-pulse rounded-surface bg-surface-muted;
  }
  .ui-empty,
  .ui-terminal-error {
    @apply rounded-surface border border-surface-muted p-6;
  }
 }
@media (prefers-reduced-motion: reduce) {
  *,
  *::before,
  *::after {
    scroll-behavior: auto !important;
    animation-duration: 0.01ms !important;
    animation-iteration-count: 1 !important;
    transition-duration: 0.01ms !important;
  }
 }
@@ -1,15 +0,0 @@
 export function DesignTokenShowcase() {
  return (
    <section className="ui-panel" aria-labelledby="token-showcase-title">
      <h2 id="token-showcase-title" className="text-xl font-semibold">
        Design token fixture
      </h2>
      <p className="text-content-muted">
        Semantic tokens style loading, empty, and terminal surfaces.
      </p>
      <button className="ui-button" type="button">
        Token action
      </button>
    </section>
  );
 }
@@ -1,53 +0,0 @@
 import { toResourceViewModel } from "../../application/view-models/resource-view-model.js";
 import { queryKeys } from "../../contracts/query-keys.js";
 /**
 * @param {{
 *   http: { execute(operationId: string, input?: Record<string, unknown>): Promise<
 *     {ok: true, value: unknown} | {ok: false, error: import("../../contracts/errors.js").ApiFailure}
 *   > },
 *   cache: import("../../application/ports/query-cache-port.js").QueryCachePort
 * }} ports
 */
 export function createSampleFacade(ports) {
  return Object.freeze({
    async listResources(filters = {}) {
      const key = queryKeys.resource.list(filters);
      const result = await ports.http.execute("LIST_SAMPLE_RESOURCES", {
        routeId: "SAMPLE_RESOURCE_LIST",
      });
      if (!result.ok) return result;
      const models =
        /** @type {Array<import("../../domain/models/resource.js").Resource>} */ (
          result.value
        );
      const cached = ports.cache.write(key, models);
      if (!cached.ok) return cached;
      return {
        ok: /** @type {true} */ (true),
        value: models.map((model) => toResourceViewModel(model)),
      };
    },
    /** @param {{ name: string }} command */
    async createResource(command) {
      const result = await ports.http.execute("CREATE_SAMPLE_RESOURCE", {
        body: command,
        routeId: "SAMPLE_RESOURCE_LIST",
      });
      if (!result.ok) return result;
      const invalidated = await ports.cache.invalidate(queryKeys.resource.all());
      if (!invalidated.ok) return invalidated;
      return {
        ok: /** @type {true} */ (true),
        value: toResourceViewModel(
          /** @type {import("../../domain/models/resource.js").Resource} */ (
            result.value
          ),
        ),
      };
    },
  });
 }
@@ -1,61 +0,0 @@
 import { useEffect, useState } from "react";
 import { deriveAsyncState } from "../../application/view-models/async-state.js";
 import { AsyncSurface } from "../../presentation/components/async-surface.jsx";
 /**
 * @typedef {{
 *   loading: boolean,
 *   resources?: Array<{resourceId: string, title: string, createdAtLabel: string | null}>,
 *   failure?: import("../../contracts/errors.js").ApiFailure
 * }} SamplePageState
 */
 /**
 * @param {{
 *   facade: ReturnType<typeof import("./sample-facade.js").createSampleFacade>
 * }} props
 */
 export function SampleResourcePage({ facade }) {
  const [result, setResult] = useState(
    /** @type {SamplePageState} */ ({
      loading: true,
      resources: undefined,
      failure: undefined,
    }),
  );
  useEffect(() => {
    let active = true;
    void facade.listResources().then((outcome) => {
      if (!active) return;
      setResult(
        outcome.ok
          ? { loading: false, resources: outcome.value, failure: undefined }
          : { loading: false, resources: undefined, failure: outcome.error },
      );
    });
    return () => {
      active = false;
    };
  }, [facade]);
  const state = deriveAsyncState({
    isInitialLoading: result.loading,
    data: result.resources,
    failure: result.failure,
  });
  return (
    <main>
      <h1>샘플 리소스</h1>
      <AsyncSurface state={state}>
        <ul>
          {(result.resources ?? []).map((resource) => (
            <li key={resource.resourceId}>{resource.title}</li>
          ))}
        </ul>
      </AsyncSurface>
    </main>
  );
 }
--- a/Show More
+++ b/Show More