feat: add secure portable local and hosted transfer archives

.github/workflows/apply-portable-transfer-domain.yml

@@ -0,0 +1,99 @@
+name: Apply portable transfer domain integration
+
+on:
+  push:
+    branches:
+      - architecture/portable-transfer
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: apply-portable-transfer-domain
+  cancel-in-progress: false
+
+jobs:
+  integrate-and-verify:
+    if: github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: architecture/portable-transfer
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Validate and apply domain migration
+        run: |
+          python -m py_compile scripts/apply-portable-transfer-domain.py
+          python scripts/apply-portable-transfer-domain.py
+          git diff --check
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Run frontend tests
+        id: frontend_tests
+        working-directory: frontend
+        shell: bash
+        run: |
+          set +e
+          npm test > ../portable-transfer-test.log 2>&1
+          status=$?
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Write compact failure summary
+        if: steps.frontend_tests.outputs.status != '0'
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          lines = Path('portable-transfer-test.log').read_text(errors='replace').splitlines()
+          indexes = [i for i, line in enumerate(lines) if line.startswith('not ok ')]
+          output = []
+          for index in indexes[:3]:
+              output.extend(lines[index:index + 28])
+              output.append('---')
+          Path('portable-transfer-failure-summary.txt').write_text('\n'.join(output) or 'Tests failed without a TAP not-ok block.')
+          PY
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -f portable-transfer-failure-summary.txt
+          git commit -m "test: capture portable transfer assertion"
+          git push origin HEAD:architecture/portable-transfer
+
+      - name: Fail when frontend tests fail
+        if: steps.frontend_tests.outputs.status != '0'
+        run: exit 1
+
+      - name: Audit and build frontend
+        working-directory: frontend
+        run: |
+          npm audit --omit=dev --audit-level=high
+          npm run build
+
+      - name: Remove temporary integration files
+        run: |
+          rm scripts/apply-portable-transfer-domain.py
+          rm .github/workflows/apply-portable-transfer-domain.yml
+          rm portable-transfer-test.log
+          rm -f portable-transfer-failure-summary.txt
+          rm -rf scripts/__pycache__
+
+      - name: Commit verified core
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "feat: add portable transfer archive and import engine"
+          git push origin HEAD:architecture/portable-transfer

frontend/lib/application/browserTransferApplication.mjs

@@ -0,0 +1,31 @@
+import { createBrowserCampaignRepository } from "../infrastructure/adapters.mjs";
+import {
+  createBrowserApprovalRepository,
+  createBrowserAssetRepository,
+  createBrowserBlobStorage,
+  createBrowserExportRepository,
+  createBrowserSourceArtifactRepository,
+  createBrowserTransferReportRepository,
+} from "../infrastructure/transferAdapters.mjs";
+import { createTransferApplication } from "../transfer/transferApplication.mjs";
+
+export function createBrowserTransferApplication({
+  getStorage,
+  campaignKey = "signalflow_recovery_library",
+  clock,
+  idService,
+  signer = null,
+} = {}) {
+  return createTransferApplication({
+    campaignRepository: createBrowserCampaignRepository({ getStorage, key: campaignKey }),
+    assetRepository: createBrowserAssetRepository({ getStorage }),
+    sourceArtifactRepository: createBrowserSourceArtifactRepository({ getStorage }),
+    approvalRepository: createBrowserApprovalRepository({ getStorage }),
+    exportRepository: createBrowserExportRepository({ getStorage }),
+    blobStorage: createBrowserBlobStorage({ getStorage }),
+    transferReportRepository: createBrowserTransferReportRepository({ getStorage }),
+    clock,
+    idService,
+    signer,
+  });
+}

frontend/lib/domain/contracts.mjs

@@ -17,6 +17,7 @@ export const DOMAIN_KINDS = Object.freeze({
   CONNECTION: "Connection",
   USAGE_EVENT: "UsageEvent",
   AUDIT_EVENT: "AuditEvent",
+  TRANSFER_REPORT: "TransferReport",
 });
 
 export const DOMAIN_CONTRACTS = Object.freeze({
@@ -36,6 +37,7 @@ export const DOMAIN_CONTRACTS = Object.freeze({
   Connection: { idField: "connectionId", owner: "workspace", required: ["connectionId", "provider", "status"] },
   UsageEvent: { idField: "usageEventId", owner: "workspace", required: ["usageEventId", "eventType"] },
   AuditEvent: { idField: "auditEventId", owner: "workspace", required: ["auditEventId", "eventType"] },
+  TransferReport: { idField: "transferReportId", owner: "workspace", required: ["transferReportId", "archiveId", "status"] },
 });
 
 const FORBIDDEN_FIELD = /(api[_-]?key|access[_-]?token|refresh[_-]?token|oauth[_-]?token|client[_-]?secret|password|authorization|cookie|database|dbclient|request|response)/i;

frontend/lib/domain/ports.mjs

@@ -1,7 +1,12 @@
 export const PORT_CONTRACTS = Object.freeze({
   campaignRepository: ["list", "get", "upsert", "remove"],
   assetRepository: ["list", "get", "upsert", "remove"],
+  sourceArtifactRepository: ["list", "get", "upsert", "remove"],
+  approvalRepository: ["list", "get", "upsert", "remove"],
+  exportRepository: ["list", "get", "upsert", "remove"],
   blobStorage: ["put", "get", "remove"],
+  transferReportRepository: ["list", "get", "upsert", "remove"],
+  archiveSigner: ["sign", "verify", "describe"],
   jobQueue: ["enqueue", "get", "cancel"],
   providerAdapter: ["test", "generate"],
   connectorAdapter: ["status", "publish"],