# TASK METADATA

- **Target Files:** `src/core/`, `src/features/`, `src/shared/`,
  `src/tests/arch/`, `server/` (legacy), `ui/` (legacy). Note: `sdk/` and
  `spire_ffi/` must remain independent top-level root modules.
- **Core Objective:** Execute a multi-phase, non-overlapping architectural
  transition to a Datastar-driven Hypermedia paradigm and Vertical Feature
  Slicing.
- **Dependencies:** `docs/HYPERMEDIA_ARCHITECTURE_BLUEPRINT.md`, `AGENTS.md`.
- **Additional Important Notes:** The code does not need to maintain
  backwards-compatible bridges for legacy vanilla scripts during intermediate
  phases; optimize for a clean, uncompromised vertical slice architecture in
  `src/`.

---

## Architectural Considerations & Risks

- **Risks:**
  - Moving from a separated `server/` and `ui/` structure to co-located
    `src/features/` will require extensive routing and import refactoring.
  - Dropping legacy imperative DOM scripts in favor of Datastar requires strict
    adherence to `data-ignore` for WebAuthn micro-scripts so the DOM diffing
    engine doesn't wipe critical ceremony state.
  - Converting SSE streams to the typed adapter (`core/sse_adapter.ts`) might
    break existing real-time UI components if payload formats are mismatched.
- **Alternatives:**
  - Instead of moving to `src/`, we could restructure within `server/`. However,
    adopting `src/features/` enforces a clean break from the legacy horizontally
    sliced architecture and clearly demarcates the new vertical hypermedia
    standard.

## Proposed Implementation

### Phase 1: Core Foundation, Tooling & Safety Guards

Establish the authoritative infrastructure, transport toolkit, and invariant
guards inside `src/core/`.

1. Create `src/core/` directory.
2. Migrate and adapt foundational integrations from `server/` (strictly
   read-only reference):
   - `db.ts`: PostgreSQL connection pool and queries.
   - `valkey.ts`: Valkey connection and Pub/Sub broker.
   - `spire_ffi.ts`: Rust SPIFFE/mTLS FFI bindings.
3. Implement `auth_guards.ts` (enforcing max 16KB payload cap, rate limiting,
   and CSRF/Origin checks).
4. Implement `content_negotiation.ts` to route between Datastar HTML, CLI/JSON
   clients, and shell strings.
5. Implement `sse_adapter.ts` for typed Datastar SSE streaming helper logic.
6. Implement `error_fragments.tsx` for standardized error toast and field-error
   JSX morph fragments.
7. Setup `src/main.ts` with `serveStatic` for `/public/datastar-v1.x.js`.
8. Add `deno task lint:arch` in `scripts/lint_arch.ts` (blocking
   `document.getElementById` and unescaped HTML) and integrate into `deno.json`.

### Phase 2: Base Vertical Slices & Shared UI

Migrate domain-agnostic presentation atoms and standard CRUD-style feature
slices.

1. Create `src/shared/ui/` with distinctive fragment names (`LayoutFragment`,
   `NavbarFragment`, `ToastFragment`, `DrawerShellFragment`,
   `PillGroupFragment`, `AccordionFragment`).
2. Create `src/features/auth/` and migrate `/login`, `/register`, and
   `/recovery`. Extract WebAuthn ceremony scripts into `webauthn.ts` with
   explicit `data-ignore` attributes.
3. Create `src/features/admin/` and migrate admin routes, SQL queries, and
   fragments (`AdminUserTableFragment`, `AdminAppCardFragment`,
   `RoleModalFragment`).
4. Add pure JSX unit tests: `auth.test.ts` and `admin.test.ts`.

### Phase 3: Real-Time Slices & Script Elimination

Migrate complex, interactive features and eliminate legacy imperative scripts in
favor of targeted SSE and Datastar morphs.

1. Create `src/features/events/`:
   - Migrate event routing, queries, and JSX fragments
     (`EventCockpitDeckFragment`, `WorkshopPassDrawerFragment`,
     `GuestDrawerAttendeesFragment`).
   - Implement `stream.ts` using `src/core/sse_adapter.ts` for live seat
     counters bound to Valkey Pub/Sub.
2. Create `src/features/sessions/`:
   - Migrate routing, queries, and fragments (`SessionTableFragment`,
     `SessionHandoffCardFragment`, `DirectPassDrawerFragment`).
   - Eliminate legacy `SessionsScript.tsx` completely, replacing interactive
     flows with Datastar reactive attributes (`data-on-click`, `data-patch`).
3. Add pure JSX unit tests: `events.test.ts` and `sessions.test.ts`.

### Phase 4: Persistent Architectural Test Suite

Implement the invariant test harness defined in the blueprint to prevent
regression.

1. Create `src/tests/arch/`.
2. Implement `transport_efficiency.test.ts` (asserts routine mutations return
   `text/html` in <2ms).
3. Implement `sse_lifecycle.test.ts` (asserts connection limits, draining, and
   memory stability for 100+ concurrent live listeners).
4. Implement `proxy_buffering.test.ts` (asserts `X-Accel-Buffering: no` is
   emitted).
5. Implement `error_fragment.test.ts` (asserts 4xx/5xx responses yield valid JSX
   morph fragments for `#status-banner`).
6. Implement `content_negotiation.test.ts` (asserts proper dual-mode REST vs
   Datastar handling) and `xss_fuzzing.test.ts` (fuzzes fragment rendering).

### Phase 5: Legacy Deprecation & Final Cleanup

Execute cleanup only after Phase 4 architectural tests and existing test suites
pass 100%.

1. Safely delete legacy `server/` and `ui/` directories.
2. Perform dead-code cleanup and dependency verification.
3. Verify all gates: `deno fmt`, `deno task lint`, `deno task check`, and
   `deno test -A --no-check`.