chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/contracts/rest-profiles.ts

@@ -1,3 +1,8 @@
+import {
+  createReadOnlyRegistry,
+  type ReadOnlyRegistry,
+} from "./read-only-registry.ts";
+
 export type FetchCredentialsMode = "omit" | "same-origin" | "include";
 
 export type RestProviderProfile = Readonly<{
@@ -8,13 +13,42 @@ export type RestProviderProfile = Readonly<{
   referrerPolicy: "no-referrer";
 }>;
 
+/**
+ * VD-23. The complete closed set of headers a credential owner may contribute.
+ * Transport-owned headers (`accept`, `content-type`, `idempotency-key`) and
+ * every forbidden request header are deliberately absent.
+ */
+export const CREDENTIAL_HEADER_NAMES = Object.freeze([
+  "authorization",
+  "x-csrf-token",
+  "x-tenant-context",
+] as const);
+
+export type CredentialHeaderName = (typeof CREDENTIAL_HEADER_NAMES)[number];
+
 export type RestAuthProfile = Readonly<{
   authProfileId: string;
   transport: "ANONYMOUS" | "BEARER_HEADER" | "SAME_ORIGIN_COOKIE";
   credentials: FetchCredentialsMode;
-  allowedCredentialHeaders: readonly ("authorization" | "x-csrf-token")[];
+  allowedCredentialHeaders: readonly CredentialHeaderName[];
+  /**
+   * Proof headers the transport must observe before dispatch. A missing entry
+   * fails closed with zero `fetch()` calls rather than sending an anonymous
+   * request under an authenticated profile.
+   */
+  requiredCredentialHeaders: readonly CredentialHeaderName[];
 }>;
 
+/**
+ * LIVE-02. A read facade over a private store, never a `Map`. The executor
+ * resolves a profile on every request, so a post-installation `clear()` would
+ * otherwise turn every authenticated call into `UNKNOWN_AUTH_PROFILE`.
+ */
+export type InstalledRestAuthProfiles = ReadOnlyRegistry<
+  string,
+  RestAuthProfile
+>;
+
 export type RestCsrfProfile = Readonly<{
   csrfProfileId: string;
   mode: "NONE" | "HEADER";
@@ -27,15 +61,131 @@ export const REST_AUTH_PROFILES = Object.freeze({
     transport: "BEARER_HEADER",
     credentials: "omit",
     allowedCredentialHeaders: Object.freeze(["authorization"] as const),
+    requiredCredentialHeaders: Object.freeze(["authorization"] as const),
   }),
   ANONYMOUS: Object.freeze({
     authProfileId: "ANONYMOUS",
     transport: "ANONYMOUS",
     credentials: "omit",
     allowedCredentialHeaders: Object.freeze([]),
+    requiredCredentialHeaders: Object.freeze([]),
   }),
 } satisfies Readonly<Record<string, RestAuthProfile>>);
 
+function isCredentialHeaderName(value: unknown): value is CredentialHeaderName {
+  return (
+    typeof value === "string" &&
+    (CREDENTIAL_HEADER_NAMES as readonly string[]).includes(value)
+  );
+}
+
+function exactHeaderSet(
+  names: unknown,
+  label: string,
+): readonly CredentialHeaderName[] {
+  if (!Array.isArray(names)) {
+    throw new TypeError(`REST auth profile ${label} must be an array.`);
+  }
+  const seen = new Set<string>();
+  for (const name of names) {
+    if (!isCredentialHeaderName(name) || seen.has(name)) {
+      throw new TypeError(`REST auth profile ${label} is not an exact set.`);
+    }
+    seen.add(name);
+  }
+  return Object.freeze([...(names as readonly CredentialHeaderName[])]);
+}
+
+/**
+ * §7.7 / VD-23. Installs the composition-owned auth profile registry once.
+ *
+ * The registry — not a credential collaborator — owns Fetch `credentials` and
+ * the exact allowed/required credential-header sets. An incoherent profile is a
+ * composition failure, never a runtime downgrade.
+ */
+export function installRestAuthProfileRegistry(
+  profiles: Readonly<Record<string, RestAuthProfile>> = REST_AUTH_PROFILES,
+): InstalledRestAuthProfiles {
+  const installed = new Map<string, RestAuthProfile>();
+  for (const [key, candidate] of Object.entries(profiles)) {
+    if (!candidate || typeof candidate !== "object") {
+      throw new TypeError(`REST auth profile ${key} is not an object.`);
+    }
+    const authProfileId = candidate.authProfileId;
+    if (
+      typeof authProfileId !== "string" ||
+      authProfileId.length === 0 ||
+      authProfileId !== key
+    ) {
+      throw new TypeError(`REST auth profile ${key} has a mismatched identity.`);
+    }
+    const allowed = exactHeaderSet(
+      candidate.allowedCredentialHeaders,
+      "allowedCredentialHeaders",
+    );
+    const required = exactHeaderSet(
+      candidate.requiredCredentialHeaders,
+      "requiredCredentialHeaders",
+    );
+    if (!required.every((name) => allowed.includes(name))) {
+      throw new TypeError(
+        `REST auth profile ${key} requires a header it does not allow.`,
+      );
+    }
+    const credentials = candidate.credentials;
+    if (!["omit", "same-origin", "include"].includes(credentials)) {
+      throw new TypeError(`REST auth profile ${key} has invalid credentials.`);
+    }
+    switch (candidate.transport) {
+      case "ANONYMOUS":
+        if (
+          credentials !== "omit" ||
+          allowed.length > 0 ||
+          required.length > 0
+        ) {
+          throw new TypeError(
+            `Anonymous REST auth profile ${key} cannot carry credentials.`,
+          );
+        }
+        break;
+      case "BEARER_HEADER":
+        if (credentials !== "omit" || !required.includes("authorization")) {
+          throw new TypeError(
+            `Bearer REST auth profile ${key} must require authorization with omitted credentials.`,
+          );
+        }
+        break;
+      case "SAME_ORIGIN_COOKIE":
+        if (credentials === "omit" || allowed.includes("authorization")) {
+          throw new TypeError(
+            `Cookie REST auth profile ${key} must send ambient credentials without a bearer header.`,
+          );
+        }
+        break;
+      default:
+        throw new TypeError(`REST auth profile ${key} has unknown transport.`);
+    }
+    installed.set(
+      authProfileId,
+      Object.freeze({
+        authProfileId,
+        transport: candidate.transport,
+        credentials,
+        allowedCredentialHeaders: allowed,
+        requiredCredentialHeaders: required,
+      }),
+    );
+  }
+  if (installed.size === 0) {
+    throw new TypeError("REST auth profile registry cannot be empty.");
+  }
+  return createReadOnlyRegistry(installed);
+}
+
+/** The single installed registry every composition root shares. */
+export const INSTALLED_REST_AUTH_PROFILES: InstalledRestAuthProfiles =
+  installRestAuthProfileRegistry();
+
 export const REST_CSRF_PROFILES = Object.freeze({
   NO_CSRF_BEARER: Object.freeze({
     csrfProfileId: "NO_CSRF_BEARER",